Thanks a zillion times for your help, the building of the policy works fine
now that I have copied the .if file of the submodule to the directory you
I did not know I was reqired to copy the module's interface file to
SELinux's include dirs to make it available for other modules to use.
BTW, I was building my module from within my "policy builder and installer"
script using the "traditional" way of:
# make -f /usr/share/selinux/devel/Makefile A.pp
Now the build process works, thanks to your suggestion!
RHCE, License no. 150-053-692
E-mail: janos(a)szigetvari.com, jszigetvari(a)gmail.com
Phone: +36209440412 (Hungary)
Make the switch to open (source) applications, protocols, formats now:
- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice
- msn -> jabber protocol (Pidgin, Google Talk)
- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp
Gary Tierney <gary.tierney(a)gmx.com> ezt írta (időpont: 2019. ápr. 3., Sze,
> On Wed, Apr 03, 2019 at 10:34:08AM +0200, SZIGETVÁRI János wrote:
> >Could anyone please give me some insight on this?
> >Thanks a lot!
> How are you building and installing your policy modules? The interface
> definitions (.if files) aren't preserved in the compiled policy package,
> so are typically kept elsewhere. On Fedora this is under
> /usr/share/selinux/devel/include and its associated subdirectories
> (which are recursively walked to find .if files when building policy
> using the refpolicy framework, i.e., the selinux-policy-devel package).
> So it should be as simple as copying your .if files to:
> /usr/share/selinux/devel/include (though the "services" subdir is likely
> more appropriate).
> >Best Regards,
> >János Szigetvári
> >SZIGETVÁRI János <jszigetvari(a)gmail.com> ezt írta (időpont: 2019. márc.
> >31., V, 13:47):
> >> ... snip ...
> >selinux mailing list -- selinux(a)lists.fedoraproject.org
> >To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org
> >Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> >List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> >List Archives:
Hello all. I have been playing with CIL on Selinux and have ran into a problem trying to convert the filetrans_pattern interface into a CIL macro.
The filetrans_pattern is as follows:
allow $1 $2:dir rw_dir_perms;
type_transition $1 $2:$4 $3 $5;
I converted that into a CIL macro like so:
(macro filetrans_pattern ((type ARG1)(type ARG2)(type ARG3)(class
(allow ARG1 ARG2 (dirs (rw)))
(typetransition ARG1 ARG2 ARG4 ARG3 ARG5))
So far so good. The issue is when I try to call the Macro it says I am missing an argument and the .cil policy won't build. Here is my call statement:
(call filetrans_pattern (example_t example_tmp_t dir))
I want it so that whenever I run my process type of example_t it will transition into the example_tmp_t and store any tmp files inside of my newly created example_tmp_t directory. I know I'm missing something but can't figure out what. Let me know what you think. Thanks!