From: Russell Coker <russell.coker@daisee.com>
To: Nicolas Iooss <nicolas.iooss@m4x.org>
Cc: "selinux@vger.kernel.org" <selinux@vger.kernel.org>
Subject: Re: wildcards in file_contexts.subs for NixOS
Date: Mon, 25 Feb 2019 00:18:56 +0000 [thread overview]
Message-ID: <2478884.YWGnduq3BQ@neuromancer> (raw)
In-Reply-To: <CAJfZ7=m4Nv5ynUPhekij+Bn4MXOw6xm9x27mFERZ3+Xw9X7Ojw@mail.gmail.com>
On Sunday, 24 February 2019 11:36:34 PM AEDT Nicolas Iooss wrote:
> I agree it would be nice to be able to use SELinux on NixOS, and that
> the first step consists in handling the file paths that are very
> specific to this distribution. The patch you submitted adds the
> support of source file contexts ending with "/*", but it does not
> allow things like "match /chroot/nix/*/bin and replace it with
> /usr/bin". This could be solved in several ways. The most
> straightforward way probably consists in making selabel_sub_key() call
> selabel_sub() several times, until no substitution occurred. An other
> possibility could consist in using fnmatch() or regexp to match the
> source pattern of substitution files, but I guess this would impact
> performance too much.
We should be able to accept the performance overhead of regexs because we
typically do less than a dozen checks of the subs file before doing hundreds of
checks of the file_contexts file which has regexes (on my Debian/Stretch laptop
there are 4572 lines in the file_contexts file and 27 in the subst file including
comments). I'm not advocating regexs as such, merely suggesting that we
shouldn't rule out the possibility.
You are correct that my patch misses the double level needed. The way the
code works is that the custom subst file is checked and then the distribution
subst file is checked afterwards. I had put in my NixOS rule as a custom subst
file (via semanage fcontext) so the tests passed. I had also misread the
source to think that it was already doing recursive checks of the subst files.
> I agree with adding support of source entries ending with "/*" in file
> context substitution files. If others agree with this, for the next
> iteration of the patch I suggest naming the new member of struct
> selabel_sub "ends_with_star" instead of "wildcard". This would make
> the code easier to understand.
Sure, that sounds like a reasonable idea.
Before I get to the stage of submitting a patch with a merge request I'll put
in some comments too.
Russell Coker
prev parent reply other threads:[~2019-02-25 0:19 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-22 4:26 wildcards in file_contexts.subs for NixOS Russell Coker
2019-02-24 22:36 ` Nicolas Iooss
2019-02-25 0:18 ` Russell Coker [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2478884.YWGnduq3BQ@neuromancer \
--to=russell.coker@daisee.com \
--cc=nicolas.iooss@m4x.org \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.