[PATCH] Re: ANN: Reference Policy Release

From: Serge E. Hallyn <serue_at_us.ibm.com>
Date: Wed, 21 Dec 2005 19:25:51 -0600

Quoting Daniel J Walsh (dwalsh@redhat.com):
> Serge E. Hallyn wrote:
> >Hmm, I'm trying to compile this as a modular policy. I've selected
> >"nis = off" in my modules.conf. But I get
> >
> > policy/modules/admin/netutils.te:88:ERROR 'syntax error' at token
> > 'nis_use_ypbind' on line 33005:
> > #line 88
> > nis_use_ypbind(netutils_t)
> >
> >when I try 'make load'.
> >
> >Is this me misunderstanding how I can use modules.conf, or is
> >the module policy mostly unsupported? (I'm happy to help get it
> >working, just am not sure how it's supposed to work now :) My first
> >instinct of course is that the "optional_policy" macro in
> >policy/support/loadable_module.spt would need to be more complicated
> >to handle using modules.conf... But man that's one ugly macro.
> >
> Looks like this should be optional.

Right :) I just had no idea how it was meant to be implemented.

The following patch is one way of implementing the optional_policy macro for policy modules. Likely not the best, but I can now do a full 'make modules'.

thanks,
-serge

Index: refpolicy/Rules.modular

---

• refpolicy.orig/Rules.modular 2005-12-21 17:15:50.000000000 -0600 +++ refpolicy/Rules.modular 2005-12-21 18:48:49.000000000 -0600 @@ -37,7 +37,12 @@ all: base modules

 base: $(BASE_PKG)  

-modules: $(MOD_PKGS)

+active_modules: $(MOD_CONF)
+	echo $(MOD_MODS) | sed -e 's/ /\n/g' \
+		| sed -e 's/^\(.*\)$$/define(`\1\x27,1)/' \
+		> active_modules
+
+modules: active_modules $(MOD_PKGS)
 

 install: $(INSTPKG) $(APPFILES)  

@@ -62,7 +67,7 @@ $(MODPKGDIR)/%.pp: %.pp

 #
 # Build module packages
 #

-tmp/%.mod: $(M4SUPPORT) tmp/generated_definitions.conf tmp/all_interfaces.conf %.te +tmp/%.mod: active_modules $(M4SUPPORT) tmp/generated_definitions.conf tmp/all_interfaces.conf %.te

 	@echo "Compliling $(NAME) $(@F) module"
 	$(QUIET) m4 $(M4PARAM) -s $^ > $(@:.mod=.tmp)
 	$(QUIET) $(CHECKMODULE) -m $(@:.mod=.tmp) -o $@
@@ -186,5 +191,6 @@ clean:
 	rm -f *.pp
 	rm -f $(BASE_FC)
 	rm -fR tmp
+	rm -f active_modules
 

 .PHONY: default all base modules install load clean Index: refpolicy/policy/support/loadable_module.spt

---

• refpolicy.orig/policy/support/loadable_module.spt 2005-12-21 17:15:59.000000000 -0600 +++ refpolicy/policy/support/loadable_module.spt 2005-12-21 18:45:56.000000000 -0600 @@ -86,17 +86,7 @@ define(`policy_call_depth',0) # Optional policy handling # define(`optional_policy',` - ifdef(`self_contained_policy',` - ifdef(`$1.te',`$2',`$3') - ',` - optional { - $2 - ifelse(`$3',`',`',` - } else { - $3 - ') - } - ') + ifdef(`$1.te',`$2',`$3') ')

 ##############################

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Received on Wed 21 Dec 2005 - 20:26:01 EST