* [Buildroot] [PATCH 1/1] package/refpolicy: fix build with wireguard
@ 2021-09-22 22:22 Fabrice Fontaine
2021-09-25 14:42 ` Yann E. MORIN
0 siblings, 1 reply; 2+ messages in thread
From: Fabrice Fontaine @ 2021-09-22 22:22 UTC (permalink / raw)
To: buildroot; +Cc: Antoine Tenart, Fabrice Fontaine
Fix the following build failure with wireguard raised since bump to
version 2.20210908 in commit 78e0af476228ffacc83b4840d401a75eb5b625ff:
Compiling targeted policy.33
env LD_LIBRARY_PATH="/tmp/instance-0/output-1/host/lib:/tmp/instance-0/output-1/host/usr/lib" /tmp/instance-0/output-1/host/usr/bin/checkpolicy -c 33 -U deny -S -O -E policy.conf -o policy.33
policy/modules/services/wireguard.te:66:ERROR 'type iptables_exec_t is not within scope' at token ';' on line 591892:
#line 66
allow wireguard_t iptables_exec_t:file { getattr open map read execute ioctl };
checkpolicy: error(s) encountered while parsing configuration
make[1]: *** [Rules.monolithic:79: policy.33] Error 1
Fixes:
- http://autobuild.buildroot.org/results/a4223accc6adb70b06fd4e74ca4f28484446b6fa
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
...ervices-wireguard.te-make-iptables-o.patch | 54 +++++++++++++++++++
1 file changed, 54 insertions(+)
create mode 100644 package/refpolicy/0002-policy-modules-services-wireguard.te-make-iptables-o.patch
diff --git a/package/refpolicy/0002-policy-modules-services-wireguard.te-make-iptables-o.patch b/package/refpolicy/0002-policy-modules-services-wireguard.te-make-iptables-o.patch
new file mode 100644
index 0000000000..4cd1f96558
--- /dev/null
+++ b/package/refpolicy/0002-policy-modules-services-wireguard.te-make-iptables-o.patch
@@ -0,0 +1,54 @@
+From 67394d078c2e1438293b25d08cf408b0b0d55755 Mon Sep 17 00:00:00 2001
+From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+Date: Wed, 22 Sep 2021 23:55:59 +0200
+Subject: [PATCH] policy/modules/services/wireguard.te: make iptables optional
+
+Make iptables optional to avoid the following build failure raised since
+version 2.20210908 and
+https://github.com/SELinuxProject/refpolicy/commit/7f1a7b1cacd5d211077ce62fbb4e91890e65c820:
+
+ Compiling targeted policy.33
+ env LD_LIBRARY_PATH="/tmp/instance-0/output-1/host/lib:/tmp/instance-0/output-1/host/usr/lib" /tmp/instance-0/output-1/host/usr/bin/checkpolicy -c 33 -U deny -S -O -E policy.conf -o policy.33
+ policy/modules/services/wireguard.te:66:ERROR 'type iptables_exec_t is not within scope' at token ';' on line 591892:
+ #line 66
+ allow wireguard_t iptables_exec_t:file { getattr open map read execute ioctl };
+ checkpolicy: error(s) encountered while parsing configuration
+ make[1]: *** [Rules.monolithic:79: policy.33] Error 1
+
+Fixes:
+ - http://autobuild.buildroot.org/results/a4223accc6adb70b06fd4e74ca4f28484446b6fa
+
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+[Upstream status: https://github.com/SELinuxProject/refpolicy/pull/408]
+---
+ policy/modules/services/wireguard.te | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/policy/modules/services/wireguard.te b/policy/modules/services/wireguard.te
+index 7241f65e6..33fd3c55d 100644
+--- a/policy/modules/services/wireguard.te
++++ b/policy/modules/services/wireguard.te
+@@ -61,10 +61,6 @@ corecmd_exec_shell(wireguard_t)
+
+ domain_use_interactive_fds(wireguard_t)
+
+-# wg-quick can be configured to run iptables and other networking
+-# config tools when bringing up/down the wg interfaces
+-iptables_domtrans(wireguard_t)
+-
+ # wg-quick tries to read /proc/filesystem when running "stat" and "mv" commands
+ kernel_dontaudit_read_system_state(wireguard_t)
+ kernel_dontaudit_search_kernel_sysctl(wireguard_t)
+@@ -75,3 +71,9 @@ miscfiles_read_localization(wireguard_t)
+ sysnet_run_ifconfig(wireguard_t, wireguard_roles)
+
+ userdom_use_user_terminals(wireguard_t)
++
++# wg-quick can be configured to run iptables and other networking
++# config tools when bringing up/down the wg interfaces
++optional_policy(`
++ iptables_domtrans(wireguard_t)
++')
+--
+2.33.0
+
--
2.33.0
_______________________________________________
buildroot mailing list
buildroot@lists.buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [Buildroot] [PATCH 1/1] package/refpolicy: fix build with wireguard
2021-09-22 22:22 [Buildroot] [PATCH 1/1] package/refpolicy: fix build with wireguard Fabrice Fontaine
@ 2021-09-25 14:42 ` Yann E. MORIN
0 siblings, 0 replies; 2+ messages in thread
From: Yann E. MORIN @ 2021-09-25 14:42 UTC (permalink / raw)
To: Fabrice Fontaine; +Cc: Antoine Tenart, buildroot
Fabrice, All
On 2021-09-23 00:22 +0200, Fabrice Fontaine spake thusly:
> Fix the following build failure with wireguard raised since bump to
> version 2.20210908 in commit 78e0af476228ffacc83b4840d401a75eb5b625ff:
>
> Compiling targeted policy.33
> env LD_LIBRARY_PATH="/tmp/instance-0/output-1/host/lib:/tmp/instance-0/output-1/host/usr/lib" /tmp/instance-0/output-1/host/usr/bin/checkpolicy -c 33 -U deny -S -O -E policy.conf -o policy.33
> policy/modules/services/wireguard.te:66:ERROR 'type iptables_exec_t is not within scope' at token ';' on line 591892:
> #line 66
> allow wireguard_t iptables_exec_t:file { getattr open map read execute ioctl };
> checkpolicy: error(s) encountered while parsing configuration
> make[1]: *** [Rules.monolithic:79: policy.33] Error 1
>
> Fixes:
> - http://autobuild.buildroot.org/results/a4223accc6adb70b06fd4e74ca4f28484446b6fa
>
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Applied to master, thanks.
Regards,
Yann E. MORIN.
> ---
> ...ervices-wireguard.te-make-iptables-o.patch | 54 +++++++++++++++++++
> 1 file changed, 54 insertions(+)
> create mode 100644 package/refpolicy/0002-policy-modules-services-wireguard.te-make-iptables-o.patch
>
> diff --git a/package/refpolicy/0002-policy-modules-services-wireguard.te-make-iptables-o.patch b/package/refpolicy/0002-policy-modules-services-wireguard.te-make-iptables-o.patch
> new file mode 100644
> index 0000000000..4cd1f96558
> --- /dev/null
> +++ b/package/refpolicy/0002-policy-modules-services-wireguard.te-make-iptables-o.patch
> @@ -0,0 +1,54 @@
> +From 67394d078c2e1438293b25d08cf408b0b0d55755 Mon Sep 17 00:00:00 2001
> +From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> +Date: Wed, 22 Sep 2021 23:55:59 +0200
> +Subject: [PATCH] policy/modules/services/wireguard.te: make iptables optional
> +
> +Make iptables optional to avoid the following build failure raised since
> +version 2.20210908 and
> +https://github.com/SELinuxProject/refpolicy/commit/7f1a7b1cacd5d211077ce62fbb4e91890e65c820:
> +
> + Compiling targeted policy.33
> + env LD_LIBRARY_PATH="/tmp/instance-0/output-1/host/lib:/tmp/instance-0/output-1/host/usr/lib" /tmp/instance-0/output-1/host/usr/bin/checkpolicy -c 33 -U deny -S -O -E policy.conf -o policy.33
> + policy/modules/services/wireguard.te:66:ERROR 'type iptables_exec_t is not within scope' at token ';' on line 591892:
> + #line 66
> + allow wireguard_t iptables_exec_t:file { getattr open map read execute ioctl };
> + checkpolicy: error(s) encountered while parsing configuration
> + make[1]: *** [Rules.monolithic:79: policy.33] Error 1
> +
> +Fixes:
> + - http://autobuild.buildroot.org/results/a4223accc6adb70b06fd4e74ca4f28484446b6fa
> +
> +Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> +[Upstream status: https://github.com/SELinuxProject/refpolicy/pull/408]
> +---
> + policy/modules/services/wireguard.te | 10 ++++++----
> + 1 file changed, 6 insertions(+), 4 deletions(-)
> +
> +diff --git a/policy/modules/services/wireguard.te b/policy/modules/services/wireguard.te
> +index 7241f65e6..33fd3c55d 100644
> +--- a/policy/modules/services/wireguard.te
> ++++ b/policy/modules/services/wireguard.te
> +@@ -61,10 +61,6 @@ corecmd_exec_shell(wireguard_t)
> +
> + domain_use_interactive_fds(wireguard_t)
> +
> +-# wg-quick can be configured to run iptables and other networking
> +-# config tools when bringing up/down the wg interfaces
> +-iptables_domtrans(wireguard_t)
> +-
> + # wg-quick tries to read /proc/filesystem when running "stat" and "mv" commands
> + kernel_dontaudit_read_system_state(wireguard_t)
> + kernel_dontaudit_search_kernel_sysctl(wireguard_t)
> +@@ -75,3 +71,9 @@ miscfiles_read_localization(wireguard_t)
> + sysnet_run_ifconfig(wireguard_t, wireguard_roles)
> +
> + userdom_use_user_terminals(wireguard_t)
> ++
> ++# wg-quick can be configured to run iptables and other networking
> ++# config tools when bringing up/down the wg interfaces
> ++optional_policy(`
> ++ iptables_domtrans(wireguard_t)
> ++')
> +--
> +2.33.0
> +
> --
> 2.33.0
>
> _______________________________________________
> buildroot mailing list
> buildroot@lists.buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
--
.-----------------.--------------------.------------------.--------------------.
| Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ |
| +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-09-25 14:42 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-22 22:22 [Buildroot] [PATCH 1/1] package/refpolicy: fix build with wireguard Fabrice Fontaine
2021-09-25 14:42 ` Yann E. MORIN
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).