Re: [PATCH testsuite 2/3] policy: add fallbacks for Fedora-specific macros

[Stephen Smalley <sds@tycho.nsa.gov>]

On 9/30/19 6:48 AM, Ondrej Mosnacek wrote:
> dev_rw_infiniband_dev() and mount_rw_pid_files() are not defined in
> refpolicy. Fall back to dev_rw_generic_files() and
> mount_rw_runtime_files() if they are not defined.
> 
> Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
> ---
>   policy/test_policy.if | 14 ++++++++++++++
>   1 file changed, 14 insertions(+)
> 
> diff --git a/policy/test_policy.if b/policy/test_policy.if
> index 40e7499..e31345e 100644
> --- a/policy/test_policy.if
> +++ b/policy/test_policy.if
> @@ -71,3 +71,17 @@ interface(`userdom_search_generic_user_home_dirs', `
>       userdom_search_user_home_content($1)
>   ')
>   ')
> +
> +# Workarounds for refpolicy:
> +
> +ifdef(`dev_rw_infiniband_dev', `', ` dnl
> +interface(`dev_rw_infiniband_dev', `
> +    dev_rw_generic_files($1)
> +')
> +')

dev_rw_infiniband_dev allows access to character and block devices 
labeled infiniband_device_t.  dev_rw_generic_files() allows access to 
_regular_ files labeled device_t. dev_rw_generic_chr_files() and 
dev_rw_generic_blk_files() would be the equivalent interfaces. 
Alternatively, we could wrap the calls in the test_ib*.te files with 
ifdefs as we do for e.g. corenet_ib_pkey and other interfaces. 
Regardless, I don't think the infiniband tests will presently work on a 
system with only refpolicy.

> +
> +ifdef(`mount_rw_pid_files', `', ` dnl
> +interface(`mount_rw_pid_files', `
> +    mount_rw_runtime_files($1)
> +')
> +')
>