Re: using an interface defined in another loaded module

Lukas,

I experimented a bit using the files below from SELinux cookbook (sources below). The  mysysadm policy uses interface from mylogging

When compiling mysysadm.te with JUST mylogging.if in the same directory I get the following eeror

Compiling targeted mysysadm module
/usr/bin/checkmodule:  loading policy configuration from tmp/mysysadm.tmp
mysysadm.te:5:ERROR 'syntax error' at token 'logging_exec_syslog' on line 3340:
logging_exec_syslog(sysadm_t)

/usr/bin/checkmodule:  error(s) encountered while parsing configuration
make: *** [tmp/mysysadm.mod] Error 1

When compiling mysysadm.te with mylogging.if and mylogging.te in the same directory. mysysadm policy compiles successfully. I was under the impression that having just .if file will allow another policy to compile apparently that is not the case.

Makefile
----------
# installation paths
SHAREDIR := /usr/share/selinux

AWK ?= gawk
NAME ?= $(strip $(shell $(AWK) -F= '/^SELINUXTYPE/{ print $$2 }' /etc/selinux/config))

ifeq ($(MLSENABLED),)
	MLSENABLED := 1
endif

ifeq ($(MLSENABLED),1)
	NTYPE = mcs
endif

ifeq ($(NAME),mls)
	NTYPE = mls
endif

TYPE ?= $(NTYPE)

HEADERDIR := $(SHAREDIR)/devel/include
include $(HEADERDIR)/Makefile

mylogging.if
------------
interface(`logging_exec_syslog',`
	gen_require(`
		type syslogd_exec_t;
	');
	can_exec($1, syslogd_exec_t)
')

mylogging.te
--------------
policy_module(mylogging, 0.2)
gen_require(`
	type syslogd_t;
')
bind_write_config(syslogd_t)

mysysadm.te
---------------
policy_module(mysysadm, 0.1)
gen_require(`
	type sysadm_t;
')
logging_exec_syslog(sysadm_t)
_______________________________________________
selinux mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]