Re: [PATCH refpolicy] kernel: remove some unused initial SID contexts

On Sun, Nov 2, 2025 at 8:07 PM Russell Coker <[email protected]> wrote:
>
> On Sunday, 2 November 2025 12:28:21 AEDT Russell Coker wrote:
> > The above is what apparently used to be the policy so it looks like node_t
> > is being changed to sysctl_t.
>
> allow sshd_t sysctl_t:tcp_socket node_bind;
>
> I also tried rebooting a VM running that policy (previously I had loaded it on
> a running system) and got the same result with TCP as an additional issue.
>
> Also I tried kernel 6.12.48+deb13-amd64 (the latest kernel for Debian/Trixie
> the latest stable release).

My apologies, please revert. Due to differences between Fedora selinux
policy and refpolicy, I did NOT test loading of the patched refpolicy
itself but instead manually patched the base module (i.e. semodule -cE
base, edit base.cil to remove the CIL sidcontext statements for the
"UNKNOWN*" sids, then semodule -i base.cil) and tested that behavior,
which worked correctly. Looking at the generated base module from the
patched refpolicy, it is removed not only the sidcontext statements
but also the sid declarations and omitting them from the sidorder
statement, thereby perturbing the SID assignments. Not yet sure where
this is happening in refpolicy build.