On 9/30/19 6:48 AM, Ondrej Mosnacek wrote:
dev_rw_infiniband_dev() and mount_rw_pid_files() are not defined in
refpolicy. Fall back to dev_rw_generic_files() and
mount_rw_runtime_files() if they are not defined.
Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
---
policy/test_policy.if | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/policy/test_policy.if b/policy/test_policy.if
index 40e7499..e31345e 100644
--- a/policy/test_policy.if
+++ b/policy/test_policy.if
@@ -71,3 +71,17 @@ interface(`userdom_search_generic_user_home_dirs', `
userdom_search_user_home_content($1)
')
')
+
+# Workarounds for refpolicy:
+
+ifdef(`dev_rw_infiniband_dev', `', ` dnl
+interface(`dev_rw_infiniband_dev', `
+ dev_rw_generic_files($1)
+')
+')
dev_rw_infiniband_dev allows access to character and block devices
labeled infiniband_device_t. dev_rw_generic_files() allows access to
_regular_ files labeled device_t. dev_rw_generic_chr_files() and
dev_rw_generic_blk_files() would be the equivalent interfaces.
Alternatively, we could wrap the calls in the test_ib*.te files with
ifdefs as we do for e.g. corenet_ib_pkey and other interfaces.
Regardless, I don't think the infiniband tests will presently work on a
system with only refpolicy.
+
+ifdef(`mount_rw_pid_files', `', ` dnl
+interface(`mount_rw_pid_files', `
+ mount_rw_runtime_files($1)
+')
+')
