Re: [PATCH v2] python/sepolicy: add missing socket template attributes

On Mon, Aug 17, 2026 at 11:05 AM James Carter <[email protected]> wrote:
>
> On Fri, Aug 14, 2026 at 10:29 AM Stephen Smalley
> <[email protected]> wrote:
> >
> > generate_fc() unconditionally reads template.fc_sock_file for any
> > path that stat()s as a socket, but only var_run, var_lib and rw
> > define it, so selecting a socket under /tmp, /etc, /var/cache,
> > /var/spool, /var/log or a systemd unit directory in the GUI raises
> >
> >   AttributeError: module 'sepolicy.templates.tmp' has no
> >   attribute 'fc_sock_file'
> >
> > The tmp template has no fc_* attributes at all, so any explicitly
> > added file or directory under /tmp fails the same way on fc_file /
> > fc_dir.  generate_te() and generate_if() likewise read
> > te_stream_rules / if_stream_rules for a socket path, which var_log
> > and unit_file lack.
> >
> > Add fc_sock_file to every template that already has fc_file (using
> > the -s file class), give tmp a full fc_file / fc_sock_file / fc_dir
> > set for TEMPLATETYPE_tmp_t, and add empty stream-rule strings to
> > var_log and unit_file so a stray socket there no longer takes the
> > whole generator down.
> >
> > Fixes: https://github.com/SELinuxProject/selinux/issues/379
> > Signed-off-by: Stephen Smalley <[email protected]>
>
> Oops, Ack'd the wrong patch.
>
> Acked-by: James Carter <[email protected]>

Thanks, merged.