On 05/03/2015 06:50 AM, Dominick Grift wrote:
On Sat, May 02, 2015 at 05:02:59PM +0200, Dominick Grift wrote:Today i hit an bug in secilc, when compiled by policy with some modules excluded.<snip> I suspect the issue is something like the following: There are currently no rules associated with the pam_auth_config_object_type type attribute thus it will be removed from the policy by secilc However this may or may not change. I do have macros with rules assoc. with pam_auth_config_object_type, they are currently just not called by anything In my policy, the pam_auth_config_object_type type attribute currently only acts as a bridge to auth_object_type type attribute Example: pam_config_t (and many other types) is/are assoc. with auth_pam_config_object_type, auth_pam_config_object_type is associated with auth_object_type, and there are rules assoc. with auth_object_type (for example: auth_admin_subject_type auth_object_type (all_file_objects (all_file_perms_except))) The question remains, how does me exluding the xserver.cil affects all this. I actually commented out the only call to the auth.cil module ( (call auth_pam_config_object_type (xserver_pam_config_t)) ) from the xserver module and it turns out to not affect it. So it is not that macro call. It may instead be another ordering issue...
There doesn't seem to be ordering issues related to typeattributeset statements. See attached test policy if you're interested.
E.g. excluding the xserver.cil module may mess up the ordering of the modules to process in such a way that this rule vanishes Because that is what this issue boils down to: rules vanishing for no reason I made a screencast that tries to explain the issue: https://www.youtube.com/watch?v=XRp5z9aqLDo
I think that it would be more helpful to me if I could see the policy. Is it available anywhere? If not, could you send me at least the auth.cil and xserver.cil modules?
-- James Carter <jwcart2@xxxxxxxxxxxxx> National Security Agency
Attachment:
test.cil
Description: application/vnd.ms-artgalry
_______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
