Re: using an interface defined in another loaded module

Lukas Vrabec <[email protected]> Thu, 7 Nov 2019 22:05:19 +0100
Newsgroups	gmane.linux.redhat.fedora.selinux
Organization	Red Hat, Inc.
Message-ID	<[email protected]>
On 11/5/19 8:36 PM, zer0 0ne wrote:
> Lukas,
> 
> I experimented a bit using the files below from SELinux cookbook (sources below). The  mysysadm policy uses interface from mylogging
> 
> When compiling mysysadm.te with JUST mylogging.if in the same directory I get the following eeror
> 
> Compiling targeted mysysadm module
> /usr/bin/checkmodule:  loading policy configuration from tmp/mysysadm.tmp
> mysysadm.te:5:ERROR 'syntax error' at token 'logging_exec_syslog' on line 3340:
> logging_exec_syslog(sysadm_t)
> 
> /usr/bin/checkmodule:  error(s) encountered while parsing configuration
> make: *** [tmp/mysysadm.mod] Error 1
> 
> When compiling mysysadm.te with mylogging.if and mylogging.te in the same directory. mysysadm policy compiles successfully. I was under the impression that having just .if file will allow another policy to compile apparently that is not the case.
> 
> Makefile
> ----------
> # installation paths
> SHAREDIR := /usr/share/selinux
> 
> AWK ?= gawk
> NAME ?= $(strip $(shell $(AWK) -F= '/^SELINUXTYPE/{ print $$2 }' /etc/selinux/config))
> 
> ifeq ($(MLSENABLED),)
> 	MLSENABLED := 1
> endif
> 
> ifeq ($(MLSENABLED),1)
> 	NTYPE = mcs
> endif
> 
> ifeq ($(NAME),mls)
> 	NTYPE = mls
> endif
> 
> TYPE ?= $(NTYPE)
> 
> HEADERDIR := $(SHAREDIR)/devel/include
> include $(HEADERDIR)/Makefile
> 
> mylogging.if
> ------------
> interface(`logging_exec_syslog',`
> 	gen_require(`
> 		type syslogd_exec_t;
> 	');
> 	can_exec($1, syslogd_exec_t)
> ')
> 
> mylogging.te
> --------------
> policy_module(mylogging, 0.2)
> gen_require(`
> 	type syslogd_t;
> ')
> bind_write_config(syslogd_t)
> 
> mysysadm.te
> ---------------
> policy_module(mysysadm, 0.1)
> gen_require(`
> 	type sysadm_t;
> ')
> logging_exec_syslog(sysadm_t)
>


Did you load mylogging.pp before?
 _______________________________________________
> selinux mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
> 


-- 
Lukas Vrabec
SELinux Evangelist,
Senior Software Engineer, Security Technologies
Red Hat, Inc.

_______________________________________________
selinux mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
signature.asc (application/pgp-signature, 488 B)