* [PATCH] python/sepolgen: allow any policy statement in ifndef
@ 2021-01-11 21:14 Vit Mojzis
2021-01-19 13:55 ` Ondrej Mosnacek
0 siblings, 1 reply; 5+ messages in thread
From: Vit Mojzis @ 2021-01-11 21:14 UTC (permalink / raw)
To: selinux
"ifndef" statements can be used to conditionally define an interface,
but this syntax is not recognised by sepolgen-ifgen.
Fix sepolgen-ifgen to allow any policy statement inside an "ifndef"
statement.
Fixes:
$ cat <<EOF > i.if
ifndef(`apache_manage_pid_files',`
interface(`apache_manage_pid_files',`
manage_files_pattern($1, httpd_var_run_t, httpd_var_run_t)
')
')
#sepolgen-ifgen --interface=i.if
i.if: Syntax error on line 2 interface [type=INTERFACE]
i.if: Syntax error on line 4 ' [type=SQUOTE]
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
---
python/sepolgen/src/sepolgen/refparser.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/python/sepolgen/src/sepolgen/refparser.py b/python/sepolgen/src/sepolgen/refparser.py
index 9f850990..3c69904a 100644
--- a/python/sepolgen/src/sepolgen/refparser.py
+++ b/python/sepolgen/src/sepolgen/refparser.py
@@ -434,7 +434,7 @@ def p_ifelse(p):
def p_ifdef(p):
'''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
- | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
+ | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statement SQUOTE CPAREN optional_semi
| IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
'''
x = refpolicy.IfDef(p[4])
--
2.29.2
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] python/sepolgen: allow any policy statement in ifndef
2021-01-11 21:14 [PATCH] python/sepolgen: allow any policy statement in ifndef Vit Mojzis
@ 2021-01-19 13:55 ` Ondrej Mosnacek
2021-01-22 15:25 ` [PATCH v2] python/sepolgen: allow any policy statement in if(n)def Vit Mojzis
0 siblings, 1 reply; 5+ messages in thread
From: Ondrej Mosnacek @ 2021-01-19 13:55 UTC (permalink / raw)
To: Vit Mojzis; +Cc: SElinux list
On Mon, Jan 11, 2021 at 10:16 PM Vit Mojzis <vmojzis@redhat.com> wrote:
> "ifndef" statements can be used to conditionally define an interface,
> but this syntax is not recognised by sepolgen-ifgen.
> Fix sepolgen-ifgen to allow any policy statement inside an "ifndef"
> statement.
>
> Fixes:
> $ cat <<EOF > i.if
> ifndef(`apache_manage_pid_files',`
> interface(`apache_manage_pid_files',`
> manage_files_pattern($1, httpd_var_run_t, httpd_var_run_t)
> ')
> ')
>
> #sepolgen-ifgen --interface=i.if
> i.if: Syntax error on line 2 interface [type=INTERFACE]
> i.if: Syntax error on line 4 ' [type=SQUOTE]
>
> Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
> ---
> python/sepolgen/src/sepolgen/refparser.py | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/python/sepolgen/src/sepolgen/refparser.py b/python/sepolgen/src/sepolgen/refparser.py
> index 9f850990..3c69904a 100644
> --- a/python/sepolgen/src/sepolgen/refparser.py
> +++ b/python/sepolgen/src/sepolgen/refparser.py
> @@ -434,7 +434,7 @@ def p_ifelse(p):
>
> def p_ifdef(p):
> '''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
> - | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
> + | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statement SQUOTE CPAREN optional_semi
> | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
IMHO we should be consistent and allow any statements also in ifdefs
(i.e. make an equivalent change in the line before and after).
> '''
> x = refpolicy.IfDef(p[4])
> --
> 2.29.2
>
--
Ondrej Mosnacek
Software Engineer, Platform Security - SELinux kernel
Red Hat, Inc.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v2] python/sepolgen: allow any policy statement in if(n)def
2021-01-19 13:55 ` Ondrej Mosnacek
@ 2021-01-22 15:25 ` Vit Mojzis
2021-01-22 16:32 ` Ondrej Mosnacek
0 siblings, 1 reply; 5+ messages in thread
From: Vit Mojzis @ 2021-01-22 15:25 UTC (permalink / raw)
To: selinux
"ifdef/ifndef" statements can be used to conditionally define
an interface, but this syntax is not recognised by sepolgen-ifgen.
Fix sepolgen-ifgen to allow any policy statement inside an
"fidef/ifndef" statement.
Fixes:
$ cat <<EOF > i.if
ifndef(`apache_manage_pid_files',`
interface(`apache_manage_pid_files',`
manage_files_pattern($1, httpd_var_run_t, httpd_var_run_t)
')
')
#sepolgen-ifgen --interface=i.if
i.if: Syntax error on line 2 interface [type=INTERFACE]
i.if: Syntax error on line 4 ' [type=SQUOTE]
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
---
Thanks. Fixed. And I replaced "statement" with "statements" to allow
multiple statements (as was possible with interface_stmts).
I'm not all that sure about the last line since I didn't manage to find
it's meaning (but I assume IF-THEN-ELSE).
python/sepolgen/src/sepolgen/refparser.py | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/python/sepolgen/src/sepolgen/refparser.py b/python/sepolgen/src/sepolgen/refparser.py
index 9f850990..e611637f 100644
--- a/python/sepolgen/src/sepolgen/refparser.py
+++ b/python/sepolgen/src/sepolgen/refparser.py
@@ -433,9 +433,9 @@ def p_ifelse(p):
def p_ifdef(p):
- '''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
- | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
- | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
+ '''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
+ | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
+ | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
'''
x = refpolicy.IfDef(p[4])
if p[1] == 'ifdef':
--
2.29.2
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH v2] python/sepolgen: allow any policy statement in if(n)def
2021-01-22 15:25 ` [PATCH v2] python/sepolgen: allow any policy statement in if(n)def Vit Mojzis
@ 2021-01-22 16:32 ` Ondrej Mosnacek
2021-01-27 16:18 ` Ondrej Mosnacek
0 siblings, 1 reply; 5+ messages in thread
From: Ondrej Mosnacek @ 2021-01-22 16:32 UTC (permalink / raw)
To: Vit Mojzis; +Cc: SElinux list
On Fri, Jan 22, 2021 at 4:29 PM Vit Mojzis <vmojzis@redhat.com> wrote:
> "ifdef/ifndef" statements can be used to conditionally define
> an interface, but this syntax is not recognised by sepolgen-ifgen.
> Fix sepolgen-ifgen to allow any policy statement inside an
> "fidef/ifndef" statement.
>
> Fixes:
> $ cat <<EOF > i.if
> ifndef(`apache_manage_pid_files',`
> interface(`apache_manage_pid_files',`
> manage_files_pattern($1, httpd_var_run_t, httpd_var_run_t)
> ')
> ')
>
> #sepolgen-ifgen --interface=i.if
> i.if: Syntax error on line 2 interface [type=INTERFACE]
> i.if: Syntax error on line 4 ' [type=SQUOTE]
>
> Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
> ---
> Thanks. Fixed. And I replaced "statement" with "statements" to allow
> multiple statements (as was possible with interface_stmts).
> I'm not all that sure about the last line since I didn't manage to find
> it's meaning (but I assume IF-THEN-ELSE).
Yes, the third argument is basically an optional 'else' branch:
https://www.gnu.org/software/m4/manual/m4-1.4.15/html_node/Ifdef.html
>
> python/sepolgen/src/sepolgen/refparser.py | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/python/sepolgen/src/sepolgen/refparser.py b/python/sepolgen/src/sepolgen/refparser.py
> index 9f850990..e611637f 100644
> --- a/python/sepolgen/src/sepolgen/refparser.py
> +++ b/python/sepolgen/src/sepolgen/refparser.py
> @@ -433,9 +433,9 @@ def p_ifelse(p):
>
>
> def p_ifdef(p):
> - '''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
> - | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
> - | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
> + '''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
> + | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
> + | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
> '''
> x = refpolicy.IfDef(p[4])
> if p[1] == 'ifdef':
> --
> 2.29.2
>
Acked-by: Ondrej Mosnacek <omosnace@redhat.com>
--
Ondrej Mosnacek
Software Engineer, Platform Security - SELinux kernel
Red Hat, Inc.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] python/sepolgen: allow any policy statement in if(n)def
2021-01-22 16:32 ` Ondrej Mosnacek
@ 2021-01-27 16:18 ` Ondrej Mosnacek
0 siblings, 0 replies; 5+ messages in thread
From: Ondrej Mosnacek @ 2021-01-27 16:18 UTC (permalink / raw)
To: Vit Mojzis; +Cc: SElinux list
On Fri, Jan 22, 2021 at 5:32 PM Ondrej Mosnacek <omosnace@redhat.com> wrote:
> On Fri, Jan 22, 2021 at 4:29 PM Vit Mojzis <vmojzis@redhat.com> wrote:
> > "ifdef/ifndef" statements can be used to conditionally define
> > an interface, but this syntax is not recognised by sepolgen-ifgen.
> > Fix sepolgen-ifgen to allow any policy statement inside an
> > "fidef/ifndef" statement.
> >
> > Fixes:
> > $ cat <<EOF > i.if
> > ifndef(`apache_manage_pid_files',`
> > interface(`apache_manage_pid_files',`
> > manage_files_pattern($1, httpd_var_run_t, httpd_var_run_t)
> > ')
> > ')
> >
> > #sepolgen-ifgen --interface=i.if
> > i.if: Syntax error on line 2 interface [type=INTERFACE]
> > i.if: Syntax error on line 4 ' [type=SQUOTE]
> >
> > Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
> > ---
> > Thanks. Fixed. And I replaced "statement" with "statements" to allow
> > multiple statements (as was possible with interface_stmts).
> > I'm not all that sure about the last line since I didn't manage to find
> > it's meaning (but I assume IF-THEN-ELSE).
>
> Yes, the third argument is basically an optional 'else' branch:
> https://www.gnu.org/software/m4/manual/m4-1.4.15/html_node/Ifdef.html
>
> >
> > python/sepolgen/src/sepolgen/refparser.py | 6 +++---
> > 1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/python/sepolgen/src/sepolgen/refparser.py b/python/sepolgen/src/sepolgen/refparser.py
> > index 9f850990..e611637f 100644
> > --- a/python/sepolgen/src/sepolgen/refparser.py
> > +++ b/python/sepolgen/src/sepolgen/refparser.py
> > @@ -433,9 +433,9 @@ def p_ifelse(p):
> >
> >
> > def p_ifdef(p):
> > - '''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
> > - | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
> > - | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
> > + '''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
> > + | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
> > + | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
> > '''
> > x = refpolicy.IfDef(p[4])
> > if p[1] == 'ifdef':
> > --
> > 2.29.2
> >
>
> Acked-by: Ondrej Mosnacek <omosnace@redhat.com>
Merged:
https://github.com/SELinuxProject/selinux/commit/e12f71e82f523513c249dbe5a2e35c1916370992
--
Ondrej Mosnacek
Software Engineer, Platform Security - SELinux kernel
Red Hat, Inc.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-01-27 16:20 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-11 21:14 [PATCH] python/sepolgen: allow any policy statement in ifndef Vit Mojzis
2021-01-19 13:55 ` Ondrej Mosnacek
2021-01-22 15:25 ` [PATCH v2] python/sepolgen: allow any policy statement in if(n)def Vit Mojzis
2021-01-22 16:32 ` Ondrej Mosnacek
2021-01-27 16:18 ` Ondrej Mosnacek
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.