On Tue, Nov 26, 2019 at 01:27:42PM -0500, Stephen Smalley wrote: > On 11/25/19 9:10 AM, Dominick Grift wrote: > > On Mon, Nov 25, 2019 at 08:24:21AM -0500, Stephen Smalley wrote: > > > On 11/23/19 9:42 AM, Dominick Grift wrote: > > > > In 2008 support for UserPrefix was removed from Reference policy. > > > > The code to support this functionality in libsepol and libsemanage however remained albeit slightly modified. > > > > I am not sure why it was not fully removed. > > > > > > > > DefaultRole replaces UserPrefix functionality but the code in libsepol and libsemanage was only slighty adjusted to accomodate my use-case. > > > > This was done in 88e334f1923396d5ace56b8439c731dcde0d1f3b (2016). > > > > I do not use semanage and I do not mind using the old UserPrefix statement, but there is some confusion. > > > > For example there was a report recently about how semanage does not document UserPrefix. > > > > The documentation was likely removed from view because UserPrefix is no longer supported as such. > > > > > > > > I want to make the situation better and this proposal is the next phase. > > > > This proposal causes some disruption as Reference policy based policy often calls the gen_user() macro with the "user" prefix. > > > > > > > > Example: gen_user(user_u, user, user_r, s0, s0) > > > > > > > > This will no longer be valid, and the userprefix parameter in gen_user() can be left empty (or needs a valid role if RBACSEP DefaultRole is leveraged). > > > > > > > > Example: gen_user(user_u,, user_r, s0, s0) > > > > > > > > UserPrefix will now default to object_r. This should not affect common policy implementations. > > > > > > > > The next phases will be: > > > > > > > > Renaming the UserPrefix statement to UserRBACSEPRole, and renaming references to (user)?prefix to (user)?rbacseprole. > > > > Adjusting semanage to expose UserRBACSEPRole. > > > > Removing legacy UserPrefix (ROLE/USER_TEMPLATE) references from libsemanage. > > > > > > > > After this the UserPrefix to UserRBACSEPRole transition should be completed. > > > > > > > > This should get us by until someone decides to rewrite libsemanage to take advantage of CIL, simplify the code, and to make the code more robust. > > > > > > I guess my only question with regard to this phase and the next ones is with > > > regard to backward compatibility. Even if no one is using this facility, we > > > have to make sure we do not break existing installs upon upgrade. > > > > Maybe we can duplicate the code instead. That way we would not have to touch the existing, but dead userprefix code. > > That should address any compatibility issues. > > At a minimum, we must avoid breaking existing installs upon upgrade, and we > must avoid breaking compilation of existing policy modules (both refpolicy > and CIL). > > A simple test would be ensuring that if you upgrade the userspace and run > semodule -B with your previously installed policy (including its existing > userprefix statements), there are no errors and you get the same > file_contexts.homedirs as you had before. > > That should be relatively easy to ensure for targeted policy. Might be more > complicated with your policy, the CLIP policy, or perhaps others. I am thinking that we might be able to add something to cil_resolve_userprefix() that would just not process any entries referencing the "prefix" keyword as in "user ... prefix ...;" instead of "user ... rbacseprole ...;", and instead emits a warning: "Not processing deprecated userprefix: userprefix. Use userrbacseprole instead." That would then just not add those entries to users_extra, and instead rely on "fallback_rbacseprole=object_r" in genhomedircon.c, if the "migration" code in libsemanage does not catch it first. > > > > > > > > > > > > > > Dominick Grift (3): > > > > libsemanage: fall back to valid "object_r" role instead of "user" > > > > prefix string > > > > semanage: do not default prefix to "user" > > > > cil: qualify roles from symtable when resolving userprefix > > > > > > > > libsemanage/src/genhomedircon.c | 2 +- > > > > libsemanage/src/user_record.c | 4 ++-- > > > > libsepol/cil/src/cil.c | 7 +++++-- > > > > libsepol/cil/src/cil_internal.h | 1 + > > > > libsepol/cil/src/cil_resolve_ast.c | 10 ++++------ > > > > python/semanage/semanage | 2 +- > > > > 6 files changed, 14 insertions(+), 12 deletions(-) > > > > > > > > > > -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Dominick Grift
Attachment:
signature.asc
Description: PGP signature
