| Message ID | 20190930104850.5482-3-omosnace@redhat.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | Fix refpolicy build & build test_policy.pp in Travis | expand |
On 9/30/19 6:48 AM, Ondrej Mosnacek wrote: > dev_rw_infiniband_dev() and mount_rw_pid_files() are not defined in > refpolicy. Fall back to dev_rw_generic_files() and > mount_rw_runtime_files() if they are not defined. > > Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> > --- > policy/test_policy.if | 14 ++++++++++++++ > 1 file changed, 14 insertions(+) > > diff --git a/policy/test_policy.if b/policy/test_policy.if > index 40e7499..e31345e 100644 > --- a/policy/test_policy.if > +++ b/policy/test_policy.if > @@ -71,3 +71,17 @@ interface(`userdom_search_generic_user_home_dirs', ` > userdom_search_user_home_content($1) > ') > ') > + > +# Workarounds for refpolicy: > + > +ifdef(`dev_rw_infiniband_dev', `', ` dnl > +interface(`dev_rw_infiniband_dev', ` > + dev_rw_generic_files($1) > +') > +') dev_rw_infiniband_dev allows access to character and block devices labeled infiniband_device_t. dev_rw_generic_files() allows access to _regular_ files labeled device_t. dev_rw_generic_chr_files() and dev_rw_generic_blk_files() would be the equivalent interfaces. Alternatively, we could wrap the calls in the test_ib*.te files with ifdefs as we do for e.g. corenet_ib_pkey and other interfaces. Regardless, I don't think the infiniband tests will presently work on a system with only refpolicy. > + > +ifdef(`mount_rw_pid_files', `', ` dnl > +interface(`mount_rw_pid_files', ` > + mount_rw_runtime_files($1) > +') > +') >
On Mon, Sep 30, 2019 at 3:32 PM Stephen Smalley <sds@tycho.nsa.gov> wrote: > On 9/30/19 6:48 AM, Ondrej Mosnacek wrote: > > dev_rw_infiniband_dev() and mount_rw_pid_files() are not defined in > > refpolicy. Fall back to dev_rw_generic_files() and > > mount_rw_runtime_files() if they are not defined. > > > > Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> > > --- > > policy/test_policy.if | 14 ++++++++++++++ > > 1 file changed, 14 insertions(+) > > > > diff --git a/policy/test_policy.if b/policy/test_policy.if > > index 40e7499..e31345e 100644 > > --- a/policy/test_policy.if > > +++ b/policy/test_policy.if > > @@ -71,3 +71,17 @@ interface(`userdom_search_generic_user_home_dirs', ` > > userdom_search_user_home_content($1) > > ') > > ') > > + > > +# Workarounds for refpolicy: > > + > > +ifdef(`dev_rw_infiniband_dev', `', ` dnl > > +interface(`dev_rw_infiniband_dev', ` > > + dev_rw_generic_files($1) > > +') > > +') > > dev_rw_infiniband_dev allows access to character and block devices > labeled infiniband_device_t. dev_rw_generic_files() allows access to > _regular_ files labeled device_t. dev_rw_generic_chr_files() and > dev_rw_generic_blk_files() would be the equivalent interfaces. > Alternatively, we could wrap the calls in the test_ib*.te files with > ifdefs as we do for e.g. corenet_ib_pkey and other interfaces. > Regardless, I don't think the infiniband tests will presently work on a > system with only refpolicy. Fair enough, I'll switch to dev_rw_generic_chr_files()+dev_rw_generic_blk_files(). I think it is better to have the workaround in the common interface, as it will be a bit easier to remove/change it in the future. > > > + > > +ifdef(`mount_rw_pid_files', `', ` dnl > > +interface(`mount_rw_pid_files', ` > > + mount_rw_runtime_files($1) > > +') > > +') > > >
diff --git a/policy/test_policy.if b/policy/test_policy.if index 40e7499..e31345e 100644 --- a/policy/test_policy.if +++ b/policy/test_policy.if @@ -71,3 +71,17 @@ interface(`userdom_search_generic_user_home_dirs', ` userdom_search_user_home_content($1) ') ') + +# Workarounds for refpolicy: + +ifdef(`dev_rw_infiniband_dev', `', ` dnl +interface(`dev_rw_infiniband_dev', ` + dev_rw_generic_files($1) +') +') + +ifdef(`mount_rw_pid_files', `', ` dnl +interface(`mount_rw_pid_files', ` + mount_rw_runtime_files($1) +') +')
dev_rw_infiniband_dev() and mount_rw_pid_files() are not defined in refpolicy. Fall back to dev_rw_generic_files() and mount_rw_runtime_files() if they are not defined. Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> --- policy/test_policy.if | 14 ++++++++++++++ 1 file changed, 14 insertions(+)