On Mon, Sep 30, 2019 at 3:32 PM Stephen Smalley <sds@xxxxxxxxxxxxx> wrote: > On 9/30/19 6:48 AM, Ondrej Mosnacek wrote: > > dev_rw_infiniband_dev() and mount_rw_pid_files() are not defined in > > refpolicy. Fall back to dev_rw_generic_files() and > > mount_rw_runtime_files() if they are not defined. > > > > Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx> > > --- > > policy/test_policy.if | 14 ++++++++++++++ > > 1 file changed, 14 insertions(+) > > > > diff --git a/policy/test_policy.if b/policy/test_policy.if > > index 40e7499..e31345e 100644 > > --- a/policy/test_policy.if > > +++ b/policy/test_policy.if > > @@ -71,3 +71,17 @@ interface(`userdom_search_generic_user_home_dirs', ` > > userdom_search_user_home_content($1) > > ') > > ') > > + > > +# Workarounds for refpolicy: > > + > > +ifdef(`dev_rw_infiniband_dev', `', ` dnl > > +interface(`dev_rw_infiniband_dev', ` > > + dev_rw_generic_files($1) > > +') > > +') > > dev_rw_infiniband_dev allows access to character and block devices > labeled infiniband_device_t. dev_rw_generic_files() allows access to > _regular_ files labeled device_t. dev_rw_generic_chr_files() and > dev_rw_generic_blk_files() would be the equivalent interfaces. > Alternatively, we could wrap the calls in the test_ib*.te files with > ifdefs as we do for e.g. corenet_ib_pkey and other interfaces. > Regardless, I don't think the infiniband tests will presently work on a > system with only refpolicy. Fair enough, I'll switch to dev_rw_generic_chr_files()+dev_rw_generic_blk_files(). I think it is better to have the workaround in the common interface, as it will be a bit easier to remove/change it in the future. > > > + > > +ifdef(`mount_rw_pid_files', `', ` dnl > > +interface(`mount_rw_pid_files', ` > > + mount_rw_runtime_files($1) > > +') > > +') > > > -- Ondrej Mosnacek <omosnace at redhat dot com> Software Engineer, Security Technologies Red Hat, Inc.
