Re: secilc genfscon parsing error

[Matthew Sheets <masheets@linux.microsoft.com>]

On 11/23/2022 9:15 AM, James Carter wrote:
> On Wed, Nov 23, 2022 at 10:55 AM Matthew Sheets
> <masheets@linux.microsoft.com> wrote:
>>
>> Hi,
>>
>> I am seeing a parsing error from secilc when trying to compile the
>> following line:
>> (genfscon sysfs "/zap" file (system_u object_r foo ((s0) (s0))))
>>
>> But according to the documentation here:
>> https://github.com/SELinuxProject/selinux/blob/master/secilc/docs/cil_file_labeling_statements.md#genfscon
>> I believe this should be a valid line.
>>
>> The compiler error given is:
>> Invalid syntax
>> Bad genfscon declaration at out.cil:129
>> Failed to build AST
>> Failed to compile cildb: -1
>>
>> If I remove the file keyword everything compiles correctly.
>>
>> Other interesting points of data:
>>
>> In ref policy there is the following line in selinux.te
>> genfscon selinuxfs /booleans/ -- gen_context(system_u:object_r:boolean_t,s0)
>>
>> When compiling this to cil with checkpolicy the following line is produced:
>> (genfscon selinuxfs "/booleans/" (system_u object_r boolean_t (systemlow
>> systemlow)))
>> Which has no reference to the optional file_type field.
> 
> CIL did not properly handle the optional file type until a year ago.
> The SELinux userspace version 3.4, released last May, would be the
> only one that has the fix.
> Your rule will work with the latest release.
> 
> Thanks,
> Jim

Hi Jim,

I pulled the newest master (fb7f35495fbad468d6efa76c5fed727659903038) 
rebuilt & installed the whole selinux repo and I am seeing the same issue.

I also made the following change:
diff --git a/secilc/test/policy.cil b/secilc/test/policy.cil
index e6b78618..1bcac523 100644
--- a/secilc/test/policy.cil
+++ b/secilc/test/policy.cil
@@ -279,7 +279,7 @@
         (portcon tcp 22 system_u_bin_t_l2h)
         (portcon dccp (2048 2096) system_u_bin_t_l2h)
         (portcon sctp (1024 1035) system_u_bin_t_l2h)
-       (genfscon - "/usr/bin" system_u_bin_t_l2h)
+       (genfscon - "/usr/bin" file system_u_bin_t_l2h)
         (netifcon eth0 system_u_bin_t_l2h system_u_bin_t_l2h) 
;different contexts?
         (fsuse xattr ext3 system_u_bin_t_l2h)

And ran 'make test' in the secilc directory and saw the same error in 
the previous email.

Is there possibly something else I am missing in my environment?