<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><P>Hi,</P>
<P> </P>
<P>I think i'm having a policy compilation problem here</P>
<P> </P>
<P>I've moved the domain_auto_trans($1_t, vmware_exec_t, $1_vmware_t) statement to vmware.if. I was following the domain_auto_trans rules for other apps such as mozilla. The syntax error problem went away. </P>
<P> </P>
<P>But the problem is that the domain transition didn't take place. My vmplayer is still running in unconfined state.</P>
<P> </P>
<P>I'm doing compilation of the vmware.pp module using make -f /usr/share/selinux/devel/Makefile. I've tried to purposely introduce errors into vmware.if to see if the compilation is effective:</P>
<P> </P>
<P>e.g. domain_auto_trans($2, $2, $1_t, vmware_exec_t, $1_vmware_t)</P>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><BR>But the make process didn't detect any errors and the compilation still went on. I did a diff between the vmware.pp at the /etc/selinux/targeted/modules/active/modules/vmware.pp and the development directory (where I do all my compilation), but there are no differences.</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Does it mean if the vmware.if file is modified it will not affect the make? </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">How do you ensure that the changes at vmware.if effective? (well at least cause some compilation errors?)</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Thanks,</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Louis</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><BR> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">----- Original Message ----<BR>From: Ken YANG <spng.yang@gmail.com><BR>To: Louis Lam <lshoujun@yahoo.com><BR>Cc: Daniel J Walsh <dwalsh@redhat.com>; fedora-selinux-list@redhat.com<BR>Sent: Saturday, July 28, 2007 5:28:25 PM<BR>Subject: Re: Containing vmware player 2.0.0 with SELINUX<BR><BR>
<DIV>Louis Lam wrote:<BR>> My mistakes, apologies for the confusion, under part 2, I was trying to do domain_auto_trans instead of doman_entry_file, so...<BR>> <BR>> 2. Created a domain transition so that the vmware user programs e.g.<BR>> /usr/lib/vmplayer script, /usr/lib/vmware/bin/vmplayer that are<BR>> labelleled system_u:object_r:vmware_exec_t will transit to<BR>> system_u:object_r:vmware_t when executed. I put it also in vmware.te:<BR>> <BR>> domain_auto_trans($1_t, vmware_exec_t, $1_vmware_t)<BR>> <BR>> but<BR>> on making the vmware.pp module I get this warning and error:<BR>> <BR>> 'syntax error' at token '1' on line 81143:<BR>> #line 13<BR>> allow $1_t vmware_exec_t: file {getattr read execute};<BR><BR>this rule is generated by domain_auto_trans, so i think the<BR>syntax error should be caused by other rules.<BR><BR>you may check other rules in your
policy.<BR><BR>> <BR>> Thanks in advance,<BR>> Louis<BR>> <BR>> <BR>> ----- Original Message ----<BR>> From: Louis Lam <lshoujun@yahoo.com><BR>> To: Daniel J Walsh <dwalsh@redhat.com><BR>> Cc: fedora-selinux-list@redhat.com<BR>> Sent: Friday, July 27, 2007 5:05:05 AM<BR>> Subject: Re: Containing vmware player 2.0.0 with SELINUX<BR>> <BR>> Thanks Daniel for the information, hi everyone<BR>> <BR>> I've tried to make the following changes:<BR>> <BR>> 1. Defined the vmware_t type in vmware.te:<BR>> type vmware_t;<BR>> <BR>> I need to do this since I'm trying to let the vmware user program run under vmware_t domain but this is not defined. In terms of overall code compliance is it correct to define here? or should be at the vmware.if?<BR><BR>type definition should be in vmware.te</DIV></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><BR></DIV></div><br>Send instant messages to your online friends http://uk.messenger.yahoo.com </body></html>