Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Makefile: add target rebuild-interface-db #201

Merged
merged 3 commits into from Jun 3, 2020
Merged

Makefile: add target rebuild-interface-db #201

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a3811f4
Makefile: add target build-interface-db
cgzones May 28, 2020
dcb01ec
devices/storage: quote arguments to tunable_policy
cgzones May 28, 2020
b418061
apache: quote gen_tunable name argument
cgzones May 28, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 12 additions & 1 deletion Makefile
View file
Open in desktop
Expand Up @@ -62,6 +62,7 @@ SEMOD_PKG ?= $(tc_usrbindir)/semodule_package
SEMOD_LNK ?= $(tc_usrbindir)/semodule_link
SEMOD_EXP ?= $(tc_usrbindir)/semodule_expand
LOADPOLICY ?= $(tc_usrsbindir)/load_policy
SEPOLGEN_IFGEN ?= $(tc_usrbindir)/sepolgen-ifgen
SETFILES ?= $(tc_sbindir)/setfiles
XMLLINT ?= $(BINDIR)/xmllint
SECHECK ?= $(BINDIR)/sechecker
Expand Down Expand Up @@ -228,6 +229,8 @@ MCS_CATS ?= 1024

ifeq ($(QUIET),y)
verbose = @
else
VERBOSE_FLAG = --verbose
endif

M4PARAM += -D mls_num_sens=$(MLS_SENS) -D mls_num_cats=$(MLS_CATS) -D mcs_num_cats=$(MCS_CATS) -D hide_broken_symptoms
Expand Down Expand Up @@ -554,6 +557,14 @@ endif
$(verbose) echo "override MCS_CATS := $(MCS_CATS)" >> $(headerdir)/build.conf
$(verbose) $(INSTALL) -m 644 $(support)/Makefile.devel $(headerdir)/Makefile

########################################
#
# Build policy interface database
#
build-interface-db: install-headers
@mkdir -p $(DESTDIR)/var/lib/sepolgen $(tmpdir)
$(verbose) $(SEPOLGEN_IFGEN) $(VERBOSE_FLAG) --interfaces $(headerdir) --output $(DESTDIR)/var/lib/sepolgen/interface_info

########################################
#
# Install policy documentation
Expand Down Expand Up @@ -657,4 +668,4 @@ ifneq ($(generated_fc),)
endif
endif

.PHONY: install-src install-appconfig install-headers generate xml conf html bare tags
.PHONY: install-src install-appconfig install-headers build-interface-db generate xml conf html bare tags
5 changes: 5 additions & 0 deletions README
View file
Open in desktop
Expand Up @@ -60,6 +60,11 @@ install-headers Install the policy headers into /usr/share/selinux/NAME.
for this policy configuration should be set before
using this target.

build-interface-db Build the policy interface database with
'sepolgen-ifgen'. This database is required for
reference style policy generation by
'audit2allow --reference'.

Make targets specific to monolithic policies:

policy Compile a policy locally for development and testing.
Expand Down
6 changes: 3 additions & 3 deletions policy/modules/kernel/devices.if
View file
Open in desktop
Expand Up @@ -2802,7 +2802,7 @@ interface(`dev_read_raw_memory_cond',`
')

typeattribute $1 memory_raw_read;
tunable_policy($2, `
tunable_policy(`$2', `
read_chr_files_pattern($1, device_t, memory_device_t)
allow $1 self:capability sys_rawio;
')
Expand Down Expand Up @@ -2880,7 +2880,7 @@ interface(`dev_write_raw_memory_cond',`
')

typeattribute $1 memory_raw_write;
tunable_policy($2, `
tunable_policy(`$2', `
write_chr_files_pattern($1, device_t, memory_device_t)
allow $1 self:capability sys_rawio;
')
Expand Down Expand Up @@ -2956,7 +2956,7 @@ interface(`dev_wx_raw_memory_cond',`

typeattribute $1 memory_raw_write;
dev_write_raw_memory_cond($1, $2)
tunable_policy($2, `
tunable_policy(`$2', `
allow $1 memory_device_t:chr_file { map execute };
')
')
Expand Down
2 changes: 1 addition & 1 deletion policy/modules/kernel/storage.if
View file
Open in desktop
Expand Up @@ -130,7 +130,7 @@ interface(`storage_raw_read_fixed_disk_cond',`
')

typeattribute $1 fixed_disk_raw_read;
tunable_policy($2, `
tunable_policy(`$2', `
dev_list_all_dev_nodes($1)
allow $1 fixed_disk_device_t:blk_file read_blk_file_perms;
allow $1 fixed_disk_device_t:chr_file read_chr_file_perms;
Expand Down
2 changes: 1 addition & 1 deletion policy/modules/services/apache.if
View file
Open in desktop
Expand Up @@ -32,7 +32,7 @@ template(`apache_content_template',`
## be labeled public_content_rw_t.
## </p>
## </desc>
gen_tunable(allow_httpd_$1_script_anon_write, false)
gen_tunable(`allow_httpd_$1_script_anon_write', false)

type httpd_$1_content_t, httpdcontent, httpd_ro_content; # customizable
files_type(httpd_$1_content_t)
Expand Down