Boolean to permit guest_u access

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/01/2011 11:10 AM, Konstantin Ryabitsev wrote:
> Hi, all:
> 
> I have the following in my .te file:
> 
> optional_policy(` gen_require(` type guest_t; role guest_r; ')
> 
> my_app_run(guest_t, guest_r) ')
> 
> But really, I'd like to make it a boolean that an admin can toggle
> -- I'm not really keen on allowing guest_u to use this application
> by default. Something like:
> 
> tunable_policy(`allow_guest_myapp_exec');
> 
> How would I combine tunable_policy with optional_policy?
> 
> Best,

Well in a perfect world...

optional_policy(`
    gen_require(`
        type guest_t;
        role guest_r;
    ')
 tunable_policy(`allow_guest_myapp_exec', `
    my_app_run(guest_t, guest_r)
')

')
Except this will not work, because you can not have role assignement
within a tunable.  The latest policy from upstream is working around
this by using roleattributes.

But til now, I separated out my interface into to .

interface(`myapp_role',`
    gen_require(`
        type myapp_t;
    ')

    role $1 types myapp_t;
')

optional_policy(`
    gen_require(`
        type guest_t;
        role guest_r;
    ')
myapp_role(guest_r)
 tunable_policy(`allow_guest_myapp_exec', `
    my_app_domtrans(guest_t)
')

')

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk7X0J8ACgkQrlYvE4MpobOBsgCg6XJSv/p7MaSWEkjdGTx7AyN0
1cwAnR5g7DQv02qBy7x2mKKLw5EJpIK6
=7Epz
-----END PGP SIGNATURE-----