* [RFC PATCH] selinux-testsuite: check the "expand-check" setting in semanage.conf
@ 2018-05-15 21:03 Paul Moore
2018-05-16 7:31 ` Petr Lautrbach
0 siblings, 1 reply; 4+ messages in thread
From: Paul Moore @ 2018-05-15 21:03 UTC (permalink / raw)
To: selinux, Stephen Smalley
From: Paul Moore <paul@paul-moore.com>
If expand-check is non-zero in semanage.conf the policy load will likely fail,
try to provide a more helpful error to users running the tests.
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
policy/Makefile | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/policy/Makefile b/policy/Makefile
index 8ed5e46..cc022e3 100644
--- a/policy/Makefile
+++ b/policy/Makefile
@@ -87,6 +87,14 @@ build: $(BUILD_TARGET)
load: $(LOAD_TARGET)
unload: $(UNLOAD_TARGET)
+expand_check:
+ # Test for "expand-check = 0" in /etc/selinux/semanage.conf
+ @cat /etc/selinux/semanage.conf | \
+ sed -n 's/^[ \t]*expand-check[ \t]*=[ \t]*0/OK/p' | \
+ grep -q "OK" || \
+ (echo "ERROR: set 'expand-check = 0' in semanage.conf"; \
+ /bin/false)
+
build_rhel: $(TARGETS)
# RHEL specific policy build
$(MAKE) -C redhat/$(RHEL_VERS) all
@@ -103,11 +111,11 @@ build_general: $(TARGETS)
echo "ERROR: You must have selinux-policy-devel installed."; \
fi
-load_rhel: all
+load_rhel: expand_check all
# RHEL specific policy load
$(MAKE) -C redhat/$(RHEL_VERS) load
-load_general: all
+load_general: expand_check all
# General policy load
@-/usr/sbin/setsebool allow_domain_fd_use=0
$(SEMODULE) -i test_policy/test_policy.pp
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [RFC PATCH] selinux-testsuite: check the "expand-check" setting in semanage.conf
2018-05-15 21:03 [RFC PATCH] selinux-testsuite: check the "expand-check" setting in semanage.conf Paul Moore
@ 2018-05-16 7:31 ` Petr Lautrbach
2018-05-16 12:48 ` Stephen Smalley
0 siblings, 1 reply; 4+ messages in thread
From: Petr Lautrbach @ 2018-05-16 7:31 UTC (permalink / raw)
To: Paul Moore; +Cc: selinux, Stephen Smalley
[-- Attachment #1: Type: text/plain, Size: 1699 bytes --]
On Tue, May 15, 2018 at 05:03:42PM -0400, Paul Moore wrote:
> From: Paul Moore <paul@paul-moore.com>
>
> If expand-check is non-zero in semanage.conf the policy load will likely fail,
> try to provide a more helpful error to users running the tests.
>
> Signed-off-by: Paul Moore <paul@paul-moore.com>
> ---
> policy/Makefile | 12 ++++++++++--
> 1 file changed, 10 insertions(+), 2 deletions(-)
>
> diff --git a/policy/Makefile b/policy/Makefile
> index 8ed5e46..cc022e3 100644
> --- a/policy/Makefile
> +++ b/policy/Makefile
> @@ -87,6 +87,14 @@ build: $(BUILD_TARGET)
> load: $(LOAD_TARGET)
> unload: $(UNLOAD_TARGET)
>
> +expand_check:
> + # Test for "expand-check = 0" in /etc/selinux/semanage.conf
> + @cat /etc/selinux/semanage.conf | \
> + sed -n 's/^[ \t]*expand-check[ \t]*=[ \t]*0/OK/p' | \
> + grep -q "OK" || \
> + (echo "ERROR: set 'expand-check = 0' in semanage.conf"; \
> + /bin/false)
> +
You can use grep directly:
+ grep -q '^[ \t]*expand-check[ \t]*=[ \t]*0' /etc/selinux/semanage.conf || \
+ (echo "ERROR: set 'expand-check = 0' in semanage.conf";
+ /bin/false)
> build_rhel: $(TARGETS)
> # RHEL specific policy build
> $(MAKE) -C redhat/$(RHEL_VERS) all
> @@ -103,11 +111,11 @@ build_general: $(TARGETS)
> echo "ERROR: You must have selinux-policy-devel installed."; \
> fi
>
> -load_rhel: all
> +load_rhel: expand_check all
> # RHEL specific policy load
> $(MAKE) -C redhat/$(RHEL_VERS) load
>
> -load_general: all
> +load_general: expand_check all
> # General policy load
> @-/usr/sbin/setsebool allow_domain_fd_use=0
> $(SEMODULE) -i test_policy/test_policy.pp
>
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Re: [RFC PATCH] selinux-testsuite: check the "expand-check" setting in semanage.conf
2018-05-16 7:31 ` Petr Lautrbach
@ 2018-05-16 12:48 ` Stephen Smalley
2018-05-17 15:15 ` Paul Moore
0 siblings, 1 reply; 4+ messages in thread
From: Stephen Smalley @ 2018-05-16 12:48 UTC (permalink / raw)
To: Petr Lautrbach, Paul Moore; +Cc: selinux
On 05/16/2018 03:31 AM, Petr Lautrbach wrote:
> On Tue, May 15, 2018 at 05:03:42PM -0400, Paul Moore wrote:
>> From: Paul Moore <paul@paul-moore.com>
>>
>> If expand-check is non-zero in semanage.conf the policy load will likely fail,
>> try to provide a more helpful error to users running the tests.
>>
>> Signed-off-by: Paul Moore <paul@paul-moore.com>
>> ---
>> policy/Makefile | 12 ++++++++++--
>> 1 file changed, 10 insertions(+), 2 deletions(-)
>>
>> diff --git a/policy/Makefile b/policy/Makefile
>> index 8ed5e46..cc022e3 100644
>> --- a/policy/Makefile
>> +++ b/policy/Makefile
>> @@ -87,6 +87,14 @@ build: $(BUILD_TARGET)
>> load: $(LOAD_TARGET)
>> unload: $(UNLOAD_TARGET)
>>
>> +expand_check:
>> + # Test for "expand-check = 0" in /etc/selinux/semanage.conf
>> + @cat /etc/selinux/semanage.conf | \
>> + sed -n 's/^[ \t]*expand-check[ \t]*=[ \t]*0/OK/p' | \
>> + grep -q "OK" || \
>> + (echo "ERROR: set 'expand-check = 0' in semanage.conf"; \
>> + /bin/false)
>> +
>
> You can use grep directly:
>
> + grep -q '^[ \t]*expand-check[ \t]*=[ \t]*0' /etc/selinux/semanage.conf || \
> + (echo "ERROR: set 'expand-check = 0' in semanage.conf";
> + /bin/false)
And you should probably put the full path for the file in the error message.
>
>> build_rhel: $(TARGETS)
>> # RHEL specific policy build
>> $(MAKE) -C redhat/$(RHEL_VERS) all
>> @@ -103,11 +111,11 @@ build_general: $(TARGETS)
>> echo "ERROR: You must have selinux-policy-devel installed."; \
>> fi
>>
>> -load_rhel: all
>> +load_rhel: expand_check all
>> # RHEL specific policy load
>> $(MAKE) -C redhat/$(RHEL_VERS) load
>>
>> -load_general: all
>> +load_general: expand_check all
>> # General policy load
>> @-/usr/sbin/setsebool allow_domain_fd_use=0
>> $(SEMODULE) -i test_policy/test_policy.pp
>>
>>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Re: [RFC PATCH] selinux-testsuite: check the "expand-check" setting in semanage.conf
2018-05-16 12:48 ` Stephen Smalley
@ 2018-05-17 15:15 ` Paul Moore
0 siblings, 0 replies; 4+ messages in thread
From: Paul Moore @ 2018-05-17 15:15 UTC (permalink / raw)
To: Stephen Smalley, Petr Lautrbach; +Cc: Paul Moore, selinux
On Wed, May 16, 2018 at 8:48 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On 05/16/2018 03:31 AM, Petr Lautrbach wrote:
>> On Tue, May 15, 2018 at 05:03:42PM -0400, Paul Moore wrote:
>>> From: Paul Moore <paul@paul-moore.com>
>>>
>>> If expand-check is non-zero in semanage.conf the policy load will likely fail,
>>> try to provide a more helpful error to users running the tests.
>>>
>>> Signed-off-by: Paul Moore <paul@paul-moore.com>
>>> ---
>>> policy/Makefile | 12 ++++++++++--
>>> 1 file changed, 10 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/policy/Makefile b/policy/Makefile
>>> index 8ed5e46..cc022e3 100644
>>> --- a/policy/Makefile
>>> +++ b/policy/Makefile
>>> @@ -87,6 +87,14 @@ build: $(BUILD_TARGET)
>>> load: $(LOAD_TARGET)
>>> unload: $(UNLOAD_TARGET)
>>>
>>> +expand_check:
>>> + # Test for "expand-check = 0" in /etc/selinux/semanage.conf
>>> + @cat /etc/selinux/semanage.conf | \
>>> + sed -n 's/^[ \t]*expand-check[ \t]*=[ \t]*0/OK/p' | \
>>> + grep -q "OK" || \
>>> + (echo "ERROR: set 'expand-check = 0' in semanage.conf"; \
>>> + /bin/false)
>>> +
>>
>> You can use grep directly:
Yes, you're correct. I have an old habit of using sed for regex
processing as I used to work on a lot of systems where grep didn't
handle regular expressions.
Fixed.
> And you should probably put the full path for the file in the error message.
I figured that comment above (it is displayed when running 'make
test') was enough, but adding the full path couldn't hurt.
Fixed, and pushed to selinux-testsuite/master. Thanks to both of you
for the quick review.
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-05-17 15:18 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-05-15 21:03 [RFC PATCH] selinux-testsuite: check the "expand-check" setting in semanage.conf Paul Moore
2018-05-16 7:31 ` Petr Lautrbach
2018-05-16 12:48 ` Stephen Smalley
2018-05-17 15:15 ` Paul Moore
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.