From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
To: buildroot@busybox.net
Subject: [Buildroot] [PATCH] package/refpolicy: Add option to disable "dontaudit" rules
Date: Wed, 27 Jan 2021 11:01:48 +0100 [thread overview]
Message-ID: <20210127110148.1e7ef518@windsurf.home> (raw)
In-Reply-To: <20210127095627.789080-1-maxime.chevallier@bootlin.com>
On Wed, 27 Jan 2021 10:56:27 +0100
Maxime Chevallier <maxime.chevallier@bootlin.com> wrote:
> Some rules in the refpolicy are declared with "dontaudit", effectively
> suppressing any AVC violation log, while still denying the actions.
>
> This is useful in some cases, where denied actions are to be expected
> but won't prevent the system from operating.
>
> However in some other cases, the suppressed logs are important to
> troubleshoot some issues.
>
> Disabling the "dontaudit" rules can be done either from the running
> system by rebuilding the policy with "semodules -DB", or when initialy
> building the policy by using the "enableaudit" make target.
>
> This commit allows building the refpolicy with the "enableaudit" target
> prior to installing it, thanks to a dedicated config option.
>
> Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Thanks for the patch!
> define REFPOLICY_INSTALL_TARGET_CMDS
> - $(REFPOLICY_MAKE) -C $(@D) DESTDIR=$(TARGET_DIR) install
> + $(REFPOLICY_MAKE) -C $(@D) DESTDIR=$(TARGET_DIR) \
> + $(REFPOLICY_EXTRA_MAKE_INSTALL_TARGETS) install
The INSTALL_TARGET_CMDS should normally only *install* the policy. The
policy is built in BUILD_CMDS. In commit
fb2968707bc66afb2c246d92e15f295475f23868, Antoine did some effort to
make sure that the policy gets built in BUILD_CMDS, and not in the
install, so it would be good to keep this behavior.
That being said, I'm not clear between what the "policy" make target
does (invoked in BUILD_CMDS) and what the "enableaudit" make target
does.
Thomas
--
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
next prev parent reply other threads:[~2021-01-27 10:01 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-27 9:56 [Buildroot] [PATCH] package/refpolicy: Add option to disable "dontaudit" rules Maxime Chevallier
2021-01-27 10:01 ` Thomas Petazzoni [this message]
2021-01-27 10:34 ` Antoine Tenart
2021-01-27 14:40 ` Maxime Chevallier
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210127110148.1e7ef518@windsurf.home \
--to=thomas.petazzoni@bootlin.com \
--cc=buildroot@busybox.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.