From: Ondrej Mosnacek <omosnace@redhat.com>
To: Stephen Smalley <sds@tycho.nsa.gov>
Cc: SElinux list <selinux@vger.kernel.org>
Subject: Re: [PATCH testsuite 1/3] policy: consolidate macros for home dirs access
Date: Mon, 30 Sep 2019 15:56:57 +0200 [thread overview]
Message-ID: <CAFqZXNsKBJ6TtfgpnEVBxxN4J3i02ak7A6XaUkQNzzrMmAYFJA@mail.gmail.com> (raw)
In-Reply-To: <6df6dafe-56a6-7de0-0196-d2b714b453bb@tycho.nsa.gov>
On Mon, Sep 30, 2019 at 3:24 PM Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On 9/30/19 6:48 AM, Ondrej Mosnacek wrote:
> > Use userdom_search_generic_user_home_dirs(), which is always defined,
> > and redefine it to match what overlayfs was doing (just in case),
> >
> > Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
> > ---
> > policy/test_overlayfs.te | 6 ++----
> > policy/test_policy.if | 9 +++++++--
> > 2 files changed, 9 insertions(+), 6 deletions(-)
> >
> > diff --git a/policy/test_overlayfs.te b/policy/test_overlayfs.te
> > index 6f1756e..f56ef78 100644
> > --- a/policy/test_overlayfs.te
> > +++ b/policy/test_overlayfs.te
> > @@ -50,8 +50,7 @@ fs_mount_xattr_fs(test_overlay_mounter_t)
> > corecmd_shell_entry_type(test_overlay_mounter_t)
> > corecmd_exec_bin(test_overlay_mounter_t)
> >
> > -userdom_search_admin_dir(test_overlay_mounter_t)
> > -userdom_search_user_home_content(test_overlay_mounter_t)
> > +userdom_search_generic_user_home_dirs(test_overlay_mounter_t)
> >
> > mount_exec(test_overlay_mounter_t)
> > mount_rw_pid_files(test_overlay_mounter_t)
> > @@ -122,8 +121,7 @@ corecmd_exec_bin(test_overlay_client_t)
> > kernel_read_system_state(test_overlay_client_t)
> > kernel_read_proc_symlinks(test_overlay_client_t)
> >
> > -userdom_search_admin_dir(test_overlay_client_t)
> > -userdom_search_user_home_content(test_overlay_client_t)
> > +userdom_search_generic_user_home_dirs(test_overlay_client_t)
> >
> > fs_getattr_xattr_fs(test_overlay_client_t)
> >
> > diff --git a/policy/test_policy.if b/policy/test_policy.if
> > index 5f4000f..40e7499 100644
> > --- a/policy/test_policy.if
> > +++ b/policy/test_policy.if
> > @@ -61,8 +61,13 @@ interface(`userdom_sysadm_entry_spec_domtrans_to',`
> > ')
> > ')
> >
> > -ifdef(`userdom_search_generic_user_home_dirs', `', ` dnl
> > +ifdef(`userdom_search_admin_dir', ` dnl
> > interface(`userdom_search_generic_user_home_dirs', `
> > - userdom_search_user_home_dirs($1)
> > + userdom_search_user_home_content($1)
> > + userdom_search_admin_dir($1)
> > +')
> > +', ` dnl
> > +interface(`userdom_search_generic_user_home_dirs', `
> > + userdom_search_user_home_content($1)
> > ')
> > ')
>
> Previously, if userdom_search_generic_user_home_dirs() was defined by
> the base policy (as it used to be), we would use that definition, else
> we would use userdom_search_user_home_dirs(). After, we will always
> redefine it, and the redefinition is more expansive than just search
> access to $HOME and its ancestors in the hierarchy. Might not affect
> the tests themselves but it seems a bit confusing.
You're right, I'm mixing up the semantics too much. Let me see if I
can handle this more nicely...
--
Ondrej Mosnacek <omosnace at redhat dot com>
Software Engineer, Security Technologies
Red Hat, Inc.
next prev parent reply other threads:[~2019-09-30 13:58 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-30 10:48 [PATCH testsuite 0/3] Fix refpolicy build & build test_policy.pp in Travis Ondrej Mosnacek
2019-09-30 10:48 ` [PATCH testsuite 1/3] policy: consolidate macros for home dirs access Ondrej Mosnacek
2019-09-30 13:24 ` Stephen Smalley
2019-09-30 13:56 ` Ondrej Mosnacek [this message]
2019-09-30 10:48 ` [PATCH testsuite 2/3] policy: add fallbacks for Fedora-specific macros Ondrej Mosnacek
2019-09-30 13:32 ` Stephen Smalley
2019-09-30 14:21 ` Ondrej Mosnacek
2019-09-30 10:48 ` [PATCH testsuite 3/3] travis: test building the test policy package Ondrej Mosnacek
2019-09-30 13:43 ` Stephen Smalley
2019-09-30 13:51 ` Stephen Smalley
2019-09-30 15:02 ` Ondrej Mosnacek
2019-09-30 18:05 ` Stephen Smalley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAFqZXNsKBJ6TtfgpnEVBxxN4J3i02ak7A6XaUkQNzzrMmAYFJA@mail.gmail.com \
--to=omosnace@redhat.com \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).