Re: [PATCH] policycoreutils: Using vendor defined directories for configuration files

Johannes Segitz <[email protected]> Wed, 29 Jul 2026 11:33:54 +0200

Newsgroups	org.kernel.vger.selinux
Message-ID	<[email protected]>

On Tue, Jul 28, 2026 at 11:00:25AM -0400, Stephen Smalley wrote:
> On Tue, Jul 28, 2026 at 5:27 AM Johannes Segitz <[email protected]> wrote:
> > +       error = econf_getKeys(key_file, SECTIONPROCS, &key_number, &keys);
> > +       if (error != ECONF_SUCCESS) {
> > +               printf("\nCannot read group %s: %s\n",
> > +                      SECTIONPROCS,
> > +                      econf_errString( error ));
> 
> Do you want to print this message even for ECONF_NOKEY?
> Previously we ignored missing sections silently.

I think it would be benefitial, but I don't feel strongly about this. If
you prefer ECONF_NOKEY can also be excluded

> >  static void load_checks(char *pc[], int *npc, char *fc[], int *nfc)
> >  {
> > +#ifdef VENDORDIR
> > +       load_checks_with_vendor_settings(pc, npc, fc, nfc);
> > +       return;
> > +#endif
> >         FILE *fp = fopen(CONF, "r");
> >         char buf[255], *bufp;
> >         int buf_len, section = -1;
> 
> This code doesn't pass make check-format; can fix on merge if desired.

Depending on the decision on ECONF_NOKEY I'll do it if I need to resend a
v2

> > diff --git a/policycoreutils/sestatus/sestatus.conf.5 b/policycoreutils/sestatus/sestatus.conf.5
> > index acfedf6f..01f8051d 100644
> > --- a/policycoreutils/sestatus/sestatus.conf.5
> > +++ b/policycoreutils/sestatus/sestatus.conf.5
> > @@ -8,7 +8,7 @@ The \fIsestatus.conf\fR file is used by the \fBsestatus\fR(8) command with the \
> >  .sp
> >  The fully qualified path name of the configuration file is:
> >  .RS
> > -\fI/etc/sestatus.conf\fR
> > +\fI/etc/sestatus.conf\fR or \fI<vendordir>/sestatus.conf\fR if it is not available
> 
> This says "or" but econf_readDirs() will merge the two - should say layered.

I talked to Stefan and he intentionally used or here because of
https://github.com/uapi-group/specifications/blob/main/specs/configuration_files_specification.md#masking

Johannes
-- 
GPG Key                EE16 6BCE AD56 E034 BFB3  3ADD 7BF7 29D5 E7C8 1FA0
Subkey fingerprint:    250F 43F5 F7CE 6F1E 9C59  4F95 BC27 DD9D 2CC4 FD66
SUSE Software Solutions Germany GmbH, Frankenstr. 146, 90461 Nürnberg, Germany
www.suse.com, Geschäftsführer: Jochen Jaser, Andrew McDonald, Abhinav Puri, (HRB 36809, AG Nürnberg)

signature.asc (application/pgp-signature, 870 B)