Converting the filetrans_pattern interface into a CIL macro

[Daniel Skip]

Hello all. I have been playing with CIL on Selinux and have ran into a problem trying to convert the filetrans_pattern interface into a CIL macro.

The filetrans_pattern is as follows:

define(`filetrans_pattern',`
    allow $1 $2:dir rw_dir_perms;
    type_transition $1 $2:$4 $3 $5;
')

I converted that into a CIL macro like so:

(macro filetrans_pattern ((type ARG1)(type ARG2)(type ARG3)(class
    ARG4)(name ARG5))
    (allow ARG1 ARG2 (dirs (rw)))
    (typetransition ARG1 ARG2 ARG4 ARG3 ARG5))

So far so good. The issue is when I try to call the Macro it says I am missing an argument and the .cil policy won't build. Here is my call statement:

(call filetrans_pattern (example_t example_tmp_t dir))

I want it so that whenever I run my process type of example_t it will transition into the example_tmp_t and store any tmp files inside of my newly created example_tmp_t directory. I know I'm missing something but can't figure out what. Let me know what you think. Thanks!

[Non-DoD Source] Converting the filetrans_pattern interface into a CIL macro

[jwcart2]

On 10/20/19 4:29 AM, Daniel Skip wrote:
> Hello all. I have been playing with CIL on Selinux and have ran into a problem trying to convert the filetrans_pattern interface into a CIL macro.
>
> The filetrans_pattern is as follows:
>
> define(`filetrans_pattern',`
>    allow $1 $2:dir rw_dir_perms;
>    type_transition $1 $2:$4 $3 $5;
> ')
>
> I converted that into a CIL macro like so:
>
> (macro filetrans_pattern ((type ARG1)(type ARG2)(type ARG3)(class
>      ARG4)(name ARG5))
>      (allow ARG1 ARG2 (dirs (rw)))
>      (typetransition ARG1 ARG2 ARG4 ARG3 ARG5))
>
> So far so good. The issue is when I try to call the Macro it says I am missing an argument and the .cil policy won't build. Here is my call statement:
>
> (call filetrans_pattern (example_t example_tmp_t dir))

There are a couple of problems.
First, you are calling the macro with only three arguments. Although the 
filename is optional for a typetransition rule, it is not in this case because 
CIL does not have optional arguments. If you do not want to specify a filename, 
then use "*".
Second, the typetransition rule should be "(typetransition ARG1 ARG2 ARG4 ARG5 
ARG3)"

It sounds like example_tmp_t is the result that you want. The second argument 
should be the type of the directory where the tmp directory is being created.

Jim
> I want it so that whenever I run my process type of example_t it will transition into the example_tmp_t and store any tmp files inside of my newly created example_tmp_t directory. I know I'm missing something but can't figure out what. Let me know what you think. Thanks!
> _______________________________________________
> selinux mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]...

[Non-DoD Source] Converting the filetrans_pattern interface into a CIL macro

[Daniel Skip]

Hey thanks for replying. I fixed the typetransition rule like you said and I think I have it correct this time, but I just want to double check. When I call the Macro I have the following:

(call filetrans_pattern (example_t example_tmp_t example_tmp_t dir *))