Adjust sepolgen grammar to support allowxperm, et. al. #348
Conversation
Extend the grammar to support `allowxperm`, et. al. directives, which were added in policy version 30 to give more granular control. This commit adds basic support for the syntax, copying heavily from the grammar for `allowperm`, et. al. Signed-off-by: Chris Lindee <chris.lindee+github@gmail.com>
The `allowxperm` et. al. directives take a magical integer for one of the fields, which hinders readability. This commit adds support for basic names for a number or group of numbers. Notably, this does not support recursive definition of names, as that would require a larger grammar re-write to avoid parsing conflicts. Signed-off-by: Chris Lindee <chris.lindee+github@gmail.com>
ColMelvin
force-pushed
the
feature.wider-xperm-policy-support
branch
from
ab12659 to
9bcd61d
Compare
|
Thanks for the patches. Please send them to selinux@vger.selinux.org for review when you are ready, see https://github.com/SELinuxProject/selinux/blob/master/CONTRIBUTING.md If you, for any reason, can't send it I could do it for you. |
|
@ColMelvin As your PR with the patches for the ZFS PAM module was accepted, did you succeed in sending them over to the mailing list for review? If that doesn't work for you, there was also the offer by @bachradsusi to do this as an escrow for you. |
|
I sent 3 emails with the patches to selinux@vger.kernel.org at 2022-08-01T01:57Z, but never heard anything back. I'm not part of the mailing list, so could not confirm their receipt. @almereyda Do you have any advice for getting traction on the patches? |
They're on the mailing list archives: Try a resend and put something like [resend] in the subject line so |
Provide basic support for
allowxperm,auditallowxperm,dontauditxpermandneverallowxpermso/usr/bin/sepolgen-ifgenstops spewing errors on my policy every timeselinux-policy-targetedgets updated.While I would prefer additional changes to address magic numbers (e.g. a new macro, much like
interface, but for defining xperm numbers), this PR is sufficient for my and - hopefully - the majority of the community's needs.