On 10/19/2013 12:23 PM, Richard Haines wrote:
Thanks for the update. I added the fix used by Dominick and tested the various
fixes that are now okay. However (sorry) but one new bug has been introduced
and some others are still present:
1) New bug - I've been using tunables to select the different levels of
support between Tresys and NSA compilers. Since this update, mapping
inside tunables does not work (but only when using classpermissionset).
The "tunable-mapping-error.cil" module demos this error.
I have noticed a problem with constraints in tunables not showing up as well.
2) classmapping only takes the first entry whether in a boolean or not. The
"map-perm-error.cil" module demos this error. The Tresys compiler has
a different problem - see text in "map-perm-error.cil".
I did know about this. We are going to be making some changes to classmappings
and classpermissionsets, so this will be taken care of soon.
3) Fails to resolve neverallow "*". The "neverallow-STAR.cil" module demos
this error.
The "*" is currently seen to be an expression in CIL rather than as the name of
a set that includes all types. We are making some changes to expression and list
handling, so this could change. We have also been taking a look at using "all"
instead of "*" (since we use names instead of symbols elsewhere in CIL).
At any rate, currently you would have to define a typeattributeset and use that
in the neverallow.
Thanks for your help.
--
James Carter <jwcart2@xxxxxxxxxxxxx>
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
