| Message ID | 20230601163430.2062951-1-vmojzis@redhat.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Petr Lautrbach |
| Headers | show |
| Series | python/sepolicy: Fix template for confined user policy modules | expand |
Vit Mojzis <vmojzis@redhat.com> writes: > The following commit > https://github.com/SELinuxProject/refpolicy/commit/330b0fc3331d3b836691464734c96f3da3044490 > changed the userdom_base_user_template, which now requires a role > corresponding to the user being created to be defined outside of the > template. > Similar change was also done to fedora-selinux/selinux-policy > https://github.com/fedora-selinux/selinux-policy/commit/e1e216b25df1bdb4eb7dbb8f73f32927ad6f3d1f > > Although I believe the template should define the role (just as it > defines the new user), that will require extensive changes to refpolicy. > In the meantime the role needs to be defined separately. > > Fixes: > \# sepolicy generate --term_user -n newuser > Created the following files: > /root/a/test/newuser.te # Type Enforcement file > /root/a/test/newuser.if # Interface file > /root/a/test/newuser.fc # File Contexts file > /root/a/test/newuser_selinux.spec # Spec file > /root/a/test/newuser.sh # Setup Script If you don't mind, I'd push it with indented text, i.e. Fixes: # sepolicy generate --term_user -n newuser Created the following files: /root/a/test/newuser.te # Type Enforcement file /root/a/test/newuser.if # Interface file /root/a/test/newuser.fc # File Contexts file /root/a/test/newuser_selinux.spec # Spec file /root/a/test/newuser.sh # Setup Script > \# ./newuser.sh > Building and Loading Policy > + make -f /usr/share/selinux/devel/Makefile newuser.pp > Compiling targeted newuser module > Creating targeted newuser.pp policy package > rm tmp/newuser.mod tmp/newuser.mod.fc > + /usr/sbin/semodule -i newuser.pp > Failed to resolve roleattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/newuser/cil:8 > Failed to resolve AST > /usr/sbin/semodule: Failed! > > Signed-off-by: Vit Mojzis <vmojzis@redhat.com> Acked-by: Petr Lautrbach <lautrbach@redhat.com> > --- > python/sepolicy/sepolicy/templates/user.py | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/python/sepolicy/sepolicy/templates/user.py b/python/sepolicy/sepolicy/templates/user.py > index 1ff9d2ce..7081fbae 100644 > --- a/python/sepolicy/sepolicy/templates/user.py > +++ b/python/sepolicy/sepolicy/templates/user.py > @@ -28,6 +28,8 @@ policy_module(TEMPLATETYPE, 1.0.0) > # > # Declarations > # > +role TEMPLATETYPE_r; > + > userdom_unpriv_user_template(TEMPLATETYPE) > """ > > @@ -38,6 +40,8 @@ policy_module(TEMPLATETYPE, 1.0.0) > # > # Declarations > # > +role TEMPLATETYPE_r; > + > userdom_admin_user_template(TEMPLATETYPE) > """ > > @@ -48,6 +52,7 @@ policy_module(TEMPLATETYPE, 1.0.0) > # > # Declarations > # > +role TEMPLATETYPE_r; > > userdom_restricted_user_template(TEMPLATETYPE) > """ > @@ -59,6 +64,7 @@ policy_module(TEMPLATETYPE, 1.0.0) > # > # Declarations > # > +role TEMPLATETYPE_r; > > userdom_restricted_xwindows_user_template(TEMPLATETYPE) > """ > @@ -89,6 +95,7 @@ gen_tunable(TEMPLATETYPE_manage_user_files, false) > # > # Declarations > # > +role TEMPLATETYPE_r; > > userdom_base_user_template(TEMPLATETYPE) > """ > -- > 2.40.0
Petr Lautrbach <lautrbach@redhat.com> writes: > Vit Mojzis <vmojzis@redhat.com> writes: > >> The following commit >> https://github.com/SELinuxProject/refpolicy/commit/330b0fc3331d3b836691464734c96f3da3044490 >> changed the userdom_base_user_template, which now requires a role >> corresponding to the user being created to be defined outside of the >> template. >> Similar change was also done to fedora-selinux/selinux-policy >> https://github.com/fedora-selinux/selinux-policy/commit/e1e216b25df1bdb4eb7dbb8f73f32927ad6f3d1f >> >> Although I believe the template should define the role (just as it >> defines the new user), that will require extensive changes to refpolicy. >> In the meantime the role needs to be defined separately. >> >> Fixes: >> \# sepolicy generate --term_user -n newuser >> Created the following files: >> /root/a/test/newuser.te # Type Enforcement file >> /root/a/test/newuser.if # Interface file >> /root/a/test/newuser.fc # File Contexts file >> /root/a/test/newuser_selinux.spec # Spec file >> /root/a/test/newuser.sh # Setup Script > > If you don't mind, I'd push it with indented text, i.e. > > Fixes: > # sepolicy generate --term_user -n newuser > Created the following files: > /root/a/test/newuser.te # Type Enforcement file > /root/a/test/newuser.if # Interface file > /root/a/test/newuser.fc # File Contexts file > /root/a/test/newuser_selinux.spec # Spec file > /root/a/test/newuser.sh # Setup Script > > > >> \# ./newuser.sh >> Building and Loading Policy >> + make -f /usr/share/selinux/devel/Makefile newuser.pp >> Compiling targeted newuser module >> Creating targeted newuser.pp policy package >> rm tmp/newuser.mod tmp/newuser.mod.fc >> + /usr/sbin/semodule -i newuser.pp >> Failed to resolve roleattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/newuser/cil:8 >> Failed to resolve AST >> /usr/sbin/semodule: Failed! >> >> Signed-off-by: Vit Mojzis <vmojzis@redhat.com> > > Acked-by: Petr Lautrbach <lautrbach@redhat.com> > Merged with reformatted commit message. Thanks! >> --- >> python/sepolicy/sepolicy/templates/user.py | 7 +++++++ >> 1 file changed, 7 insertions(+) >> >> diff --git a/python/sepolicy/sepolicy/templates/user.py b/python/sepolicy/sepolicy/templates/user.py >> index 1ff9d2ce..7081fbae 100644 >> --- a/python/sepolicy/sepolicy/templates/user.py >> +++ b/python/sepolicy/sepolicy/templates/user.py >> @@ -28,6 +28,8 @@ policy_module(TEMPLATETYPE, 1.0.0) >> # >> # Declarations >> # >> +role TEMPLATETYPE_r; >> + >> userdom_unpriv_user_template(TEMPLATETYPE) >> """ >> >> @@ -38,6 +40,8 @@ policy_module(TEMPLATETYPE, 1.0.0) >> # >> # Declarations >> # >> +role TEMPLATETYPE_r; >> + >> userdom_admin_user_template(TEMPLATETYPE) >> """ >> >> @@ -48,6 +52,7 @@ policy_module(TEMPLATETYPE, 1.0.0) >> # >> # Declarations >> # >> +role TEMPLATETYPE_r; >> >> userdom_restricted_user_template(TEMPLATETYPE) >> """ >> @@ -59,6 +64,7 @@ policy_module(TEMPLATETYPE, 1.0.0) >> # >> # Declarations >> # >> +role TEMPLATETYPE_r; >> >> userdom_restricted_xwindows_user_template(TEMPLATETYPE) >> """ >> @@ -89,6 +95,7 @@ gen_tunable(TEMPLATETYPE_manage_user_files, false) >> # >> # Declarations >> # >> +role TEMPLATETYPE_r; >> >> userdom_base_user_template(TEMPLATETYPE) >> """ >> -- >> 2.40.0
diff --git a/python/sepolicy/sepolicy/templates/user.py b/python/sepolicy/sepolicy/templates/user.py index 1ff9d2ce..7081fbae 100644 --- a/python/sepolicy/sepolicy/templates/user.py +++ b/python/sepolicy/sepolicy/templates/user.py @@ -28,6 +28,8 @@ policy_module(TEMPLATETYPE, 1.0.0) # # Declarations # +role TEMPLATETYPE_r; + userdom_unpriv_user_template(TEMPLATETYPE) """ @@ -38,6 +40,8 @@ policy_module(TEMPLATETYPE, 1.0.0) # # Declarations # +role TEMPLATETYPE_r; + userdom_admin_user_template(TEMPLATETYPE) """ @@ -48,6 +52,7 @@ policy_module(TEMPLATETYPE, 1.0.0) # # Declarations # +role TEMPLATETYPE_r; userdom_restricted_user_template(TEMPLATETYPE) """ @@ -59,6 +64,7 @@ policy_module(TEMPLATETYPE, 1.0.0) # # Declarations # +role TEMPLATETYPE_r; userdom_restricted_xwindows_user_template(TEMPLATETYPE) """ @@ -89,6 +95,7 @@ gen_tunable(TEMPLATETYPE_manage_user_files, false) # # Declarations # +role TEMPLATETYPE_r; userdom_base_user_template(TEMPLATETYPE) """
The following commit https://github.com/SELinuxProject/refpolicy/commit/330b0fc3331d3b836691464734c96f3da3044490 changed the userdom_base_user_template, which now requires a role corresponding to the user being created to be defined outside of the template. Similar change was also done to fedora-selinux/selinux-policy https://github.com/fedora-selinux/selinux-policy/commit/e1e216b25df1bdb4eb7dbb8f73f32927ad6f3d1f Although I believe the template should define the role (just as it defines the new user), that will require extensive changes to refpolicy. In the meantime the role needs to be defined separately. Fixes: \# sepolicy generate --term_user -n newuser Created the following files: /root/a/test/newuser.te # Type Enforcement file /root/a/test/newuser.if # Interface file /root/a/test/newuser.fc # File Contexts file /root/a/test/newuser_selinux.spec # Spec file /root/a/test/newuser.sh # Setup Script \# ./newuser.sh Building and Loading Policy + make -f /usr/share/selinux/devel/Makefile newuser.pp Compiling targeted newuser module Creating targeted newuser.pp policy package rm tmp/newuser.mod tmp/newuser.mod.fc + /usr/sbin/semodule -i newuser.pp Failed to resolve roleattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/newuser/cil:8 Failed to resolve AST /usr/sbin/semodule: Failed! Signed-off-by: Vit Mojzis <vmojzis@redhat.com> --- python/sepolicy/sepolicy/templates/user.py | 7 +++++++ 1 file changed, 7 insertions(+)