On Sat, May 02, 2015 at 05:02:59PM +0200, Dominick Grift wrote: > Today i hit an bug in secilc, when compiled by policy with some modules excluded. <snip> I suspect the issue is something like the following: There are currently no rules associated with the pam_auth_config_object_type type attribute thus it will be removed from the policy by secilc However this may or may not change. I do have macros with rules assoc. with pam_auth_config_object_type, they are currently just not called by anything In my policy, the pam_auth_config_object_type type attribute currently only acts as a bridge to auth_object_type type attribute Example: pam_config_t (and many other types) is/are assoc. with auth_pam_config_object_type, auth_pam_config_object_type is associated with auth_object_type, and there are rules assoc. with auth_object_type (for example: auth_admin_subject_type auth_object_type (all_file_objects (all_file_perms_except))) The question remains, how does me exluding the xserver.cil affects all this. I actually commented out the only call to the auth.cil module ( (call auth_pam_config_object_type (xserver_pam_config_t)) ) from the xserver module and it turns out to not affect it. So it is not that macro call. It may instead be another ordering issue... E.g. excluding the xserver.cil module may mess up the ordering of the modules to process in such a way that this rule vanishes Because that is what this issue boils down to: rules vanishing for no reason I made a screencast that tries to explain the issue: https://www.youtube.com/watch?v=XRp5z9aqLDo -- 02DFF788 4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788 http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788 Dominick Grift
Attachment:
pgpGlTC7NAMlr.pgp
Description: PGP signature
_______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
