On 10/20/19 4:29 AM, Daniel Skip wrote:
Hello all. I have been playing with CIL on Selinux and have ran into
a problem trying to convert the filetrans_pattern interface into a CIL macro.
The filetrans_pattern is as follows:
allow $1 $2:dir rw_dir_perms;
type_transition $1 $2:$4 $3 $5;
I converted that into a CIL macro like so:
(macro filetrans_pattern ((type ARG1)(type ARG2)(type ARG3)(class
(allow ARG1 ARG2 (dirs (rw)))
(typetransition ARG1 ARG2 ARG4 ARG3 ARG5))
So far so good. The issue is when I try to call the Macro it says I am missing an
argument and the .cil policy won't build. Here is my call statement:
(call filetrans_pattern (example_t example_tmp_t dir))
There are a couple of problems.
First, you are calling the macro with only three arguments. Although the
filename is optional for a typetransition rule, it is not in this case because
CIL does not have optional arguments. If you do not want to specify a filename,
then use "*".
Second, the typetransition rule should be "(typetransition ARG1 ARG2 ARG4 ARG5
It sounds like example_tmp_t is the result that you want. The second argument
should be the type of the directory where the tmp directory is being created.
I want it so that whenever I run my process type of example_t it will transition into the
example_tmp_t and store any tmp files inside of my newly created example_tmp_t directory.
I know I'm missing something but can't figure out what. Let me know what you
selinux mailing list -- selinux(a)lists.fedoraproject.org
To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
James Carter <jwcart2(a)tycho.nsa.gov>
National Security Agency