On 11/1/19 7:38 AM, zer0__0ne@outlook.com wrote:

Hi Janos,

I am working on a similar SELinux policy issue. I have two policy modules A and B. B needs to use the interfaces provided by. Does this mean policy module A.pp has to be installed on the system first and A.if has to be available in some path /usr/share/selinux/devel/include/ under for B to make use of it?

Yes. If you want to compile and load B policy, you need to have A interfaces stored in /usr/share/selinux/devel/include/.

Thanks, Lukas.

Thanks zer0 0ne _______________________________________________ selinux mailing list -- selinux@lists.fedoraproject.org To unsubscribe send an email to selinux-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.or...

On 11/2/19 8:53 AM, zer0__0ne@outlook.com wrote:

Hi Lukas

Thanks for the reply. I am following 'SELinux Cookbook' following is an excerpt from the book

"The location of the interface definitions Whenever an SELinux policy module is built, the build system sources all interface files it finds at the following locations: • /usr /share/selinux/mcs/include/* or /usr/share/selinux/devel/include/* (depending on the Linux distribution) • The current working directory The first location is where the interface files of all the SELinux modules provided by the Linux distribution are stored. The files are Inside sub dIrectories named after particular categories (the reference policy calls these layers, but this is only used to make some structure amongst the definitions, nothing else) such as contrib/, system/, and roles/.

For local development of SELinux policies, this location is usually not writable. If we develop our own policy modules, then this would mean that none of the locally managed SELinux policy files can use interfaces of the other local interface files. The Makefile file, therefore, also sources all interface files it finds in the current working directory. "

According to the above If I am developing two policies a and b (b uses a's interface) a.pp from sources a.if, a.te, a.fc b.pp from sources b.if, b.te, b.fc, a.if

When I run make to compile b.pp make fails with error at b.te pointing to domtrans macro of a.if . However if I copy all of a's sources along with a.if then I am able to compile b.pp Is this expected?

Hi,

Let's describe it on the following example:

You have 2 policies:

A: a.te, a.fc, a.if B: b.te, b.fc, b.if

You successfully compile SELinux sources to SELinux module A.pp using: # /usr/share/selinux/devel/Makefile a.pp

Because A policy uses only system interfaces (/usr/share/selinux/devel/include).

But B policy uses also macro defined in a.if + system interfaces defined in (/usr/share/selinux/devel/include), during compilation all macros needs to be extracted and these macros are searched in /usr/share/selinux/devel/include and current directory. As you mentioned from SELinux cookbook.

So yes, if you're compiling B policy, you needs to have a.if interface file in one directory with B policy sources.

Is this clear or I missing something in your question?

Thanks, Lukas.

If only a.if file is required to how does the a.if file types get's resolved when trying to compile b.pp or it doesn't get resolved? Is there an online example where one policy uses the interface file of another policy?

zer0 0ne _______________________________________________ selinux mailing list -- selinux@lists.fedoraproject.org To unsubscribe send an email to selinux-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.or...

On 11/4/19 11:02 PM, zer0 0ne wrote:

Thanks for the explanation Lukas. I have one follow up question about the example you described,

"So yes, if you're compiling B policy, you needs to have a.if interface file in one directory with B policy sources."

...

If I have a.if in the B policy sources, is that sufficient or do I need to have a.te also in B policy sources? When I experimented with just a.if B policy compilation failed and was successful when I copied the a.te into B policy sources directory. Is this expected or is it an issue with policies I have written.

You could have only a.if in B policy sources, *but* A policy (a.pp) has to be loaded to the kernel before you installing B policy module.

Lukas.

---

selinux mailing list -- selinux@lists.fedoraproject.org To unsubscribe send an email to selinux-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.or...

On 11/5/19 8:36 PM, zer0 0ne wrote:

Lukas,

I experimented a bit using the files below from SELinux cookbook (sources below). The mysysadm policy uses interface from mylogging

When compiling mysysadm.te with JUST mylogging.if in the same directory I get the following eeror

Compiling targeted mysysadm module /usr/bin/checkmodule: loading policy configuration from tmp/mysysadm.tmp mysysadm.te:5:ERROR 'syntax error' at token 'logging_exec_syslog' on line 3340: logging_exec_syslog(sysadm_t)

/usr/bin/checkmodule: error(s) encountered while parsing configuration make: *** [tmp/mysysadm.mod] Error 1

When compiling mysysadm.te with mylogging.if and mylogging.te in the same directory. mysysadm policy compiles successfully. I was under the impression that having just .if file will allow another policy to compile apparently that is not the case.

Makefile

# installation paths SHAREDIR := /usr/share/selinux

AWK ?= gawk NAME ?= $(strip $(shell $(AWK) -F= '/^SELINUXTYPE/{ print $$2 }' /etc/selinux/config))

ifeq ($(MLSENABLED),) MLSENABLED := 1 endif

ifeq ($(MLSENABLED),1) NTYPE = mcs endif

ifeq ($(NAME),mls) NTYPE = mls endif

TYPE ?= $(NTYPE)

HEADERDIR := $(SHAREDIR)/devel/include include $(HEADERDIR)/Makefile

mylogging.if

interface(`logging_exec_syslog',` gen_require(` type syslogd_exec_t; '); can_exec($1, syslogd_exec_t) ')

mylogging.te

policy_module(mylogging, 0.2) gen_require(` type syslogd_t; ') bind_write_config(syslogd_t)

mysysadm.te

policy_module(mysysadm, 0.1) gen_require(` type sysadm_t; ') logging_exec_syslog(sysadm_t)

Did you load mylogging.pp before? _______________________________________________

selinux mailing list -- selinux@lists.fedoraproject.org To unsubscribe send an email to selinux-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.or...