Re: using an interface defined in another loaded module

Could anyone please give me some insight on this?

Thanks a lot!

Best Regards,
János Szigetvári

SZIGETVÁRI János <[email protected]> ezt írta (időpont: 2019. márc.
31., V, 13:47):

> Dear Members,
>
> My new topic is slightly related to my last message.
> Since then I managed to sort things out, and my new policy seems to work
> fine, at least far as I was able to test it.
>
> My current situation is the following:
> I had a policy that I created for the main application "A" a while ago.
> Now I am creating a policy for a submodule of application "A", called "B"
> for the sake of illustrating it.
> "B" is a separate helper application that communicates with "A", but "A"
> can perfectly work without "B" being in use.
>
> In this situation it makes sense to create a separate policy for "A" and
> "B".
>
> Now, if submodule "B" is in use, then I would need to make use some
> interfaces, defined in the SELinux policy of "B", within the policy
> belonging to "A".
> Now how should I do this? I tried googling around for a few hours, but
> practically found no examples of this on the web.
>
> The policy module of "B" is built and loaded first, and when I'm compiling
> the now extended policy of "A", I get the following:
>
> Compiling targeted syslog_ng module
> /usr/bin/checkmodule:  loading policy configuration from tmp/A.tmp
> A.te:5:ERROR 'syntax error' at token 'transition_to_B_t' on line 3212:
> transition_to_B_t(A_t)
>
> /usr/bin/checkmodule:  error(s) encountered while parsing configuration
> make: *** [tmp/A.mod] Error 1
>
> How do I need to reference the interface defined in another module, that
> is already loaded, when trying to use it?
>
> Currently this is the interface file of policy module "B":
>
> =================================================================================
> ########################################
> ## <summary>
> ##      Allow the specified program domain
> ##      to manage to the B socket.
> ## </summary>
> ## <param name="domain">
> ##      <summary>
> ##      The type of the process for which
> ##      to allow managing the socket
> ##      </summary>
> ## </param>
> #
> interface(`B_sock_manage', `
>   gen_require(`
>     type B_t, B_sock_t;
>   ')
>   manage_sock_files_pattern($1, B_sock_t, B_sock_t)
> ')
>
>
> ########################################
> ## <summary>
> ##      Allow the specified program domain
> ##      to transition to B_t through the entry point.
> ## </summary>
> ## <param name="domain">
> ##      <summary>
> ##      The type of the process for which to allow transitioning to B_t
> ##      </summary>
> ## </param>
> #
> interface(`transition_to_B_t',`
>         gen_require(`
>                 type B_t, B_exec_t;
>         ')
>
>         domtrans_pattern($1, B_exec_t, B_t)
> ')
>
>
> ########################################
> ## <summary>
> ##      Allow the specified program domain
> ##      to read B_exec_t files.
> ## </summary>
> ## <param name="domain">
> ##      <summary>
> ##      The type of the process for which to allow read access
> ##      to B_exec_t
> ##      </summary>
> ## </param>
> #
> interface(`read_B_exec_t',`
>         gen_require(`
>                 type B_exec_t;
>         ')
>
>         allow $1 B_exec_t:lnk_file { read };
>         allow $1 B_exec_t:file { read };
> ')
>
> =================================================================================
>
>
> And this is the way I am trying to access it from the policy module of "A":
>
> =================================================================================
> transition_to_B_t(A_t)
> B_sock_manage(A_t)
> filetrans_pattern(A_t, A_var_run_t, B_sock_t, sock_file, "B.sock")
> read_B_exec_t(A_t)
>
> =================================================================================
>
> I would be thankful for any suggestions for this!
> Thanks for your help in advance!
>
> Best Regards,
> János Szigetvári
>
> --
> Janos SZIGETVARI
> RHCE, License no. 150-053-692
> <https://www.redhat.com/rhtapps/verify/?certId=150-053-692>
>
> LinkedIn: linkedin.com/in/janosszigetvari
> E-mail: [email protected], [email protected]
> Phone: +36209440412 (Hungary)
>
> __@__˚V˚
> Make the switch to open (source) applications, protocols, formats now:
> - windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice
> - msn -> jabber protocol (Pidgin, Google Talk)
> - mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp
>

_______________________________________________
selinux mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]