All of lore.kernel.org
 help / color / mirror / Atom feed
* [RFC PATCH] selinux-testsuite: check the "expand-check" setting in semanage.conf
@ 2018-05-15 21:03 Paul Moore
  2018-05-16  7:31 ` Petr Lautrbach
  0 siblings, 1 reply; 4+ messages in thread
From: Paul Moore @ 2018-05-15 21:03 UTC (permalink / raw)
  To: selinux, Stephen Smalley

From: Paul Moore <paul@paul-moore.com>

If expand-check is non-zero in semanage.conf the policy load will likely fail,
try to provide a more helpful error to users running the tests.

Signed-off-by: Paul Moore <paul@paul-moore.com>
---
 policy/Makefile |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/policy/Makefile b/policy/Makefile
index 8ed5e46..cc022e3 100644
--- a/policy/Makefile
+++ b/policy/Makefile
@@ -87,6 +87,14 @@ build: $(BUILD_TARGET)
 load: $(LOAD_TARGET)
 unload: $(UNLOAD_TARGET)
 
+expand_check:
+	# Test for "expand-check = 0" in /etc/selinux/semanage.conf
+	@cat /etc/selinux/semanage.conf | \
+		sed -n 's/^[ \t]*expand-check[ \t]*=[ \t]*0/OK/p' | \
+		grep -q "OK" || \
+		(echo "ERROR: set 'expand-check = 0' in semanage.conf"; \
+		 /bin/false)
+
 build_rhel: $(TARGETS)
 	# RHEL specific policy build
 	$(MAKE) -C redhat/$(RHEL_VERS) all
@@ -103,11 +111,11 @@ build_general: $(TARGETS)
 		echo "ERROR: You must have selinux-policy-devel installed."; \
 	fi
 
-load_rhel: all
+load_rhel: expand_check all
 	# RHEL specific policy load
 	$(MAKE) -C redhat/$(RHEL_VERS) load
 
-load_general: all
+load_general: expand_check all
 	# General policy load
 	@-/usr/sbin/setsebool allow_domain_fd_use=0
 	$(SEMODULE) -i test_policy/test_policy.pp

^ permalink raw reply related	[flat|nested] 4+ messages in thread

* Re: [RFC PATCH] selinux-testsuite: check the "expand-check" setting in semanage.conf
  2018-05-15 21:03 [RFC PATCH] selinux-testsuite: check the "expand-check" setting in semanage.conf Paul Moore
@ 2018-05-16  7:31 ` Petr Lautrbach
  2018-05-16 12:48   ` Stephen Smalley
  0 siblings, 1 reply; 4+ messages in thread
From: Petr Lautrbach @ 2018-05-16  7:31 UTC (permalink / raw)
  To: Paul Moore; +Cc: selinux, Stephen Smalley

[-- Attachment #1: Type: text/plain, Size: 1699 bytes --]

On Tue, May 15, 2018 at 05:03:42PM -0400, Paul Moore wrote:
> From: Paul Moore <paul@paul-moore.com>
> 
> If expand-check is non-zero in semanage.conf the policy load will likely fail,
> try to provide a more helpful error to users running the tests.
> 
> Signed-off-by: Paul Moore <paul@paul-moore.com>
> ---
>  policy/Makefile |   12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/policy/Makefile b/policy/Makefile
> index 8ed5e46..cc022e3 100644
> --- a/policy/Makefile
> +++ b/policy/Makefile
> @@ -87,6 +87,14 @@ build: $(BUILD_TARGET)
>  load: $(LOAD_TARGET)
>  unload: $(UNLOAD_TARGET)
>  
> +expand_check:
> +	# Test for "expand-check = 0" in /etc/selinux/semanage.conf
> +	@cat /etc/selinux/semanage.conf | \
> +		sed -n 's/^[ \t]*expand-check[ \t]*=[ \t]*0/OK/p' | \
> +		grep -q "OK" || \
> +		(echo "ERROR: set 'expand-check = 0' in semanage.conf"; \
> +		 /bin/false)
> +

You can use grep directly:

+ grep -q '^[ \t]*expand-check[ \t]*=[ \t]*0' /etc/selinux/semanage.conf || \
+      (echo "ERROR: set 'expand-check = 0' in semanage.conf";
+      /bin/false)


>  build_rhel: $(TARGETS)
>  	# RHEL specific policy build
>  	$(MAKE) -C redhat/$(RHEL_VERS) all
> @@ -103,11 +111,11 @@ build_general: $(TARGETS)
>  		echo "ERROR: You must have selinux-policy-devel installed."; \
>  	fi
>  
> -load_rhel: all
> +load_rhel: expand_check all
>  	# RHEL specific policy load
>  	$(MAKE) -C redhat/$(RHEL_VERS) load
>  
> -load_general: all
> +load_general: expand_check all
>  	# General policy load
>  	@-/usr/sbin/setsebool allow_domain_fd_use=0
>  	$(SEMODULE) -i test_policy/test_policy.pp
> 
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re:  Re: [RFC PATCH] selinux-testsuite: check the "expand-check" setting in semanage.conf
  2018-05-16  7:31 ` Petr Lautrbach
@ 2018-05-16 12:48   ` Stephen Smalley
  2018-05-17 15:15     ` Paul Moore
  0 siblings, 1 reply; 4+ messages in thread
From: Stephen Smalley @ 2018-05-16 12:48 UTC (permalink / raw)
  To: Petr Lautrbach, Paul Moore; +Cc: selinux

On 05/16/2018 03:31 AM, Petr Lautrbach wrote:
> On Tue, May 15, 2018 at 05:03:42PM -0400, Paul Moore wrote:
>> From: Paul Moore <paul@paul-moore.com>
>>
>> If expand-check is non-zero in semanage.conf the policy load will likely fail,
>> try to provide a more helpful error to users running the tests.
>>
>> Signed-off-by: Paul Moore <paul@paul-moore.com>
>> ---
>>  policy/Makefile |   12 ++++++++++--
>>  1 file changed, 10 insertions(+), 2 deletions(-)
>>
>> diff --git a/policy/Makefile b/policy/Makefile
>> index 8ed5e46..cc022e3 100644
>> --- a/policy/Makefile
>> +++ b/policy/Makefile
>> @@ -87,6 +87,14 @@ build: $(BUILD_TARGET)
>>  load: $(LOAD_TARGET)
>>  unload: $(UNLOAD_TARGET)
>>  
>> +expand_check:
>> +	# Test for "expand-check = 0" in /etc/selinux/semanage.conf
>> +	@cat /etc/selinux/semanage.conf | \
>> +		sed -n 's/^[ \t]*expand-check[ \t]*=[ \t]*0/OK/p' | \
>> +		grep -q "OK" || \
>> +		(echo "ERROR: set 'expand-check = 0' in semanage.conf"; \
>> +		 /bin/false)
>> +
> 
> You can use grep directly:
> 
> + grep -q '^[ \t]*expand-check[ \t]*=[ \t]*0' /etc/selinux/semanage.conf || \
> +      (echo "ERROR: set 'expand-check = 0' in semanage.conf";
> +      /bin/false)

And you should probably put the full path for the file in the error message.

> 
>>  build_rhel: $(TARGETS)
>>  	# RHEL specific policy build
>>  	$(MAKE) -C redhat/$(RHEL_VERS) all
>> @@ -103,11 +111,11 @@ build_general: $(TARGETS)
>>  		echo "ERROR: You must have selinux-policy-devel installed."; \
>>  	fi
>>  
>> -load_rhel: all
>> +load_rhel: expand_check all
>>  	# RHEL specific policy load
>>  	$(MAKE) -C redhat/$(RHEL_VERS) load
>>  
>> -load_general: all
>> +load_general: expand_check all
>>  	# General policy load
>>  	@-/usr/sbin/setsebool allow_domain_fd_use=0
>>  	$(SEMODULE) -i test_policy/test_policy.pp
>>
>>

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: Re: [RFC PATCH] selinux-testsuite: check the "expand-check" setting in semanage.conf
  2018-05-16 12:48   ` Stephen Smalley
@ 2018-05-17 15:15     ` Paul Moore
  0 siblings, 0 replies; 4+ messages in thread
From: Paul Moore @ 2018-05-17 15:15 UTC (permalink / raw)
  To: Stephen Smalley, Petr Lautrbach; +Cc: Paul Moore, selinux

On Wed, May 16, 2018 at 8:48 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On 05/16/2018 03:31 AM, Petr Lautrbach wrote:
>> On Tue, May 15, 2018 at 05:03:42PM -0400, Paul Moore wrote:
>>> From: Paul Moore <paul@paul-moore.com>
>>>
>>> If expand-check is non-zero in semanage.conf the policy load will likely fail,
>>> try to provide a more helpful error to users running the tests.
>>>
>>> Signed-off-by: Paul Moore <paul@paul-moore.com>
>>> ---
>>>  policy/Makefile |   12 ++++++++++--
>>>  1 file changed, 10 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/policy/Makefile b/policy/Makefile
>>> index 8ed5e46..cc022e3 100644
>>> --- a/policy/Makefile
>>> +++ b/policy/Makefile
>>> @@ -87,6 +87,14 @@ build: $(BUILD_TARGET)
>>>  load: $(LOAD_TARGET)
>>>  unload: $(UNLOAD_TARGET)
>>>
>>> +expand_check:
>>> +    # Test for "expand-check = 0" in /etc/selinux/semanage.conf
>>> +    @cat /etc/selinux/semanage.conf | \
>>> +            sed -n 's/^[ \t]*expand-check[ \t]*=[ \t]*0/OK/p' | \
>>> +            grep -q "OK" || \
>>> +            (echo "ERROR: set 'expand-check = 0' in semanage.conf"; \
>>> +             /bin/false)
>>> +
>>
>> You can use grep directly:

Yes, you're correct.  I have an old habit of using sed for regex
processing as I used to work on a lot of systems where grep didn't
handle regular expressions.

Fixed.

> And you should probably put the full path for the file in the error message.

I figured that comment above (it is displayed when running 'make
test') was enough, but adding the full path couldn't hurt.

Fixed, and pushed to selinux-testsuite/master.  Thanks to both of you
for the quick review.

-- 
paul moore
www.paul-moore.com

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2018-05-17 15:18 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-05-15 21:03 [RFC PATCH] selinux-testsuite: check the "expand-check" setting in semanage.conf Paul Moore
2018-05-16  7:31 ` Petr Lautrbach
2018-05-16 12:48   ` Stephen Smalley
2018-05-17 15:15     ` Paul Moore

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.