error building file_contexts

error building file_contexts

[antoine]

Hi list,

Anyone knows how to figure out where this error is coming from:
# make
 * Creating policy.conf
 * Policy version: 19
 * Kernel version: 19
 * Compiling and installing policy.19
/usr/bin/checkpolicy:  loading policy configuration
from /etc/security/selinux/src/policy.conf
security:  3 users, 5 roles, 658 types, 3 bools
security:  55 classes, 57721 rules
/usr/bin/checkpolicy:  policy configuration loaded
/usr/bin/checkpolicy:  writing binary representation (version 19)
to /etc/security/selinux/policy.19
 * Building file_contexts
Traceback (most recent call last):
  File "/usr/sbin/genhomedircon", line 468, in ?
    oldgenhomedircon(cmds[0], cmds[1])
  File "/usr/sbin/genhomedircon", line 187, in oldgenhomedircon
    if re.search(regex, potential, 0):
  File "/usr/lib/python2.3/sre.py", line 137, in search
    return _compile(pattern, flags).search(string)
  File "/usr/lib/python2.3/sre.py", line 230, in _compile
    raise error, v # invalid expression
sre_constants.error: nothing to repeat
make: *** [file_contexts/file_contexts] Error 1

(non-enforcing mode makes no difference)
* kernel 2.6.13.1
* libselinux 1.24
* libsepol 1.6

Thanks
Antoine


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: error building file_contexts

[Stephen Smalley]

On Mon, 2005-09-12 at 23:18 +0100, antoine wrote:
> Hi list,
> 
> Anyone knows how to figure out where this error is coming from:
> # make
>  * Creating policy.conf
>  * Policy version: 19
>  * Kernel version: 19
>  * Compiling and installing policy.19
> /usr/bin/checkpolicy:  loading policy configuration
> from /etc/security/selinux/src/policy.conf
> security:  3 users, 5 roles, 658 types, 3 bools
> security:  55 classes, 57721 rules
> /usr/bin/checkpolicy:  policy configuration loaded
> /usr/bin/checkpolicy:  writing binary representation (version 19)
> to /etc/security/selinux/policy.19
>  * Building file_contexts
> Traceback (most recent call last):
>   File "/usr/sbin/genhomedircon", line 468, in ?
>     oldgenhomedircon(cmds[0], cmds[1])
>   File "/usr/sbin/genhomedircon", line 187, in oldgenhomedircon
>     if re.search(regex, potential, 0):
>   File "/usr/lib/python2.3/sre.py", line 137, in search
>     return _compile(pattern, flags).search(string)
>   File "/usr/lib/python2.3/sre.py", line 230, in _compile
>     raise error, v # invalid expression
> sre_constants.error: nothing to repeat
> make: *** [file_contexts/file_contexts] Error 1
> 
> (non-enforcing mode makes no difference)
> * kernel 2.6.13.1
> * libselinux 1.24
> * libsepol 1.6

You didn't mention the particular policycoreutils version (which
provides /usr/sbin/genhomedircon) or policy version (although I suppose
that is specific to Gentoo).  It looks like your policy Makefile is
still invoking genhomedircon using the old syntax (hence the call to
oldgenhomedircon), which is deprecated, although it should still work.
>From the error message, I assume that regex is not a legal regex at that
point.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: error building file_contexts

[Antoine Martin]

On Tue, 2005-09-13 at 09:17 -0400, Stephen Smalley wrote:
> On Mon, 2005-09-12 at 23:18 +0100, antoine wrote:
> > Hi list,
> > 
> > Anyone knows how to figure out where this error is coming from:
> > # make
> >  * Creating policy.conf
> >  * Policy version: 19
> >  * Kernel version: 19
> >  * Compiling and installing policy.19
> > /usr/bin/checkpolicy:  loading policy configuration
> > from /etc/security/selinux/src/policy.conf
> > security:  3 users, 5 roles, 658 types, 3 bools
> > security:  55 classes, 57721 rules
> > /usr/bin/checkpolicy:  policy configuration loaded
> > /usr/bin/checkpolicy:  writing binary representation (version 19)
> > to /etc/security/selinux/policy.19
> >  * Building file_contexts
> > Traceback (most recent call last):
> >   File "/usr/sbin/genhomedircon", line 468, in ?
> >     oldgenhomedircon(cmds[0], cmds[1])
> >   File "/usr/sbin/genhomedircon", line 187, in oldgenhomedircon
> >     if re.search(regex, potential, 0):
> >   File "/usr/lib/python2.3/sre.py", line 137, in search
> >     return _compile(pattern, flags).search(string)
> >   File "/usr/lib/python2.3/sre.py", line 230, in _compile
> >     raise error, v # invalid expression
> > sre_constants.error: nothing to repeat
> > make: *** [file_contexts/file_contexts] Error 1
> > 
> > (non-enforcing mode makes no difference)
> > * kernel 2.6.13.1
> > * libselinux 1.24
> > * libsepol 1.6
> 
> You didn't mention the particular policycoreutils version (which
sys-apps/policycoreutils 1.24-r1
> provides /usr/sbin/genhomedircon) or policy version (although I suppose
> that is specific to Gentoo).  It looks like your policy Makefile is
> still invoking genhomedircon using the old syntax (hence the call to
> oldgenhomedircon), which is deprecated, although it should still work.
> >From the error message, I assume that regex is not a legal regex at that
> point.
Where is this regex coming from? Is there any way to figure out which .fc
it is coming from? Is there a tool to validate .fc files individually?

Thanks
Antoine


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: error building file_contexts

[Stephen Smalley]

On Tue, 2005-09-13 at 14:28 +0100, Antoine Martin wrote:
> Where is this regex coming from? Is there any way to figure out which .fc
> it is coming from? Is there a tool to validate .fc files individually?

Given that this particular regex is being mutated by genhomedircon, I'd
suggest instrumenting the script itself or tracing it to see the actual
value of regex there.

File contexts files can be validated against a policy via setfiles -c,
but they have to be preprocessed, i.e. m4 ifdefs, HOME*, and ROLE* have
to be expanded already.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: error building file_contexts

[Antoine Martin]

On Tue, 2005-09-13 at 10:00 -0400, Stephen Smalley wrote:
> On Tue, 2005-09-13 at 14:28 +0100, Antoine Martin wrote:
> > Where is this regex coming from? Is there any way to figure out which .fc
> > it is coming from? Is there a tool to validate .fc files individually?
> 
> Given that this particular regex is being mutated by genhomedircon, I'd
> suggest instrumenting the script itself or tracing it to see the actual
> value of regex there.
I tried tracing it but didn't get anywhere :-(

> File contexts files can be validated against a policy via setfiles -c,
> but they have to be preprocessed, i.e. m4 ifdefs, HOME*, and ROLE* have
> to be expanded already.
Any code snippet to do the pre-processing? Or do I have to extract the
code from the Makefile?

Thanks
Antoine


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: error building file_contexts

[Stephen Smalley]

On Tue, 2005-09-13 at 15:07 +0100, Antoine Martin wrote:
> Any code snippet to do the pre-processing? Or do I have to extract the
> code from the Makefile?

Actually, the replacement of HOME* and ROLE* is what genhomedircon does.
Full circle.

Possibly you could just send a copy of your file_contexts file?  I
suppose it would be the temporary copy just prior to running
genhomedircon, i.e. file_contexts/file_contexts.tmp.  Might need to
modify your Makefile to not remove it.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: error building file_contexts

[antoine]

> The way I found the bug in the rpc_pipefs context when I wrote that
> regex ugliness in genhomedircon was by just adding a
> 
> sys.stderr.write("%s\n" % regex)
> sys.stderr.flush()
> 
> Right after the 
> 
> for regex in prefix_regex:
> (around line 190 of genhomedircon for me)
I tried that (also dumped the 'potential' string) and got some output,
but I can't see anything wrong with it:
(...)
-/home/rsyslog
-/emul/lib(64)?/*$
-/home/rsyslog
-/emul/lib(64)?/.*\.so(\.[^/]*)*/*$
-/home/rsyslog
-/emul/lib(64)?/ld-[^/]*\.so(\.[^/]*)*/*$
-/home/rsyslog
-/usr/sbin/amavisd(.*)?/*$
-/home/rsyslog
Traceback (most recent call last):
  File "/usr/sbin/genhomedircon", line 475, in ?
    oldgenhomedircon(cmds[0], cmds[1])
  File "/usr/sbin/genhomedircon", line 190, in oldgenhomedircon
    if re.search(regex, potential, 0):
  File "/usr/lib/python2.3/sre.py", line 137, in search
    return _compile(pattern, flags).search(string)
  File "/usr/lib/python2.3/sre.py", line 230, in _compile
    raise error, v # invalid expression
sre_constants.error: nothing to repeat
make: *** [file_contexts/file_contexts] Error 1

Any ideas?

Thanks
Antoine


For reference, here is the updated code snippet:
(...)
	for potential in potential_prefixes.keys():
                addme = 1
                for regex in prefix_regex:
                        #match a trailing (/*)? which is actually a bug
in rpc_pipefs
                        regex = re.sub("\(/\*\)\?$", "", regex)
                        #match a trailing .+
                        regex = re.sub("\.+$", "", regex)
                        #match a trailing .*
                        regex = re.sub("\.\*$", "", regex)
                        #strip a (/.*)? which matches anything trailing
to a /*$ which matches trailing /'s
                        regex = re.sub("\(\/\.\*\)\?", "", regex)
                        regex = regex + "/*$"
                        sys.stderr.write("-%s\n" % regex)
                        sys.stderr.write("-%s\n" % potential)
                        sys.stderr.flush()
                        if re.search(regex, potential, 0):
                                addme = 0

                if addme == 1:
                        if not prefixes.has_key(potential):
                                prefixes[potential] = ""
(...)


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: error building file_contexts

[Eric Paris]

> (...)
> -/home/rsyslog
> -/emul/lib(64)?/*$
> -/home/rsyslog
> -/emul/lib(64)?/.*\.so(\.[^/]*)*/*$
> -/home/rsyslog
> -/emul/lib(64)?/ld-[^/]*\.so(\.[^/]*)*/*$
> -/home/rsyslog
> -/usr/sbin/amavisd(.*)?/*$
> -/home/rsyslog
> Traceback (most recent call last):
>   File "/usr/sbin/genhomedircon", line 475, in ?
>     oldgenhomedircon(cmds[0], cmds[1])
>   File "/usr/sbin/genhomedircon", line 190, in oldgenhomedircon
>     if re.search(regex, potential, 0):
>   File "/usr/lib/python2.3/sre.py", line 137, in search
>     return _compile(pattern, flags).search(string)
>   File "/usr/lib/python2.3/sre.py", line 230, in _compile
>     raise error, v # invalid expression
> sre_constants.error: nothing to repeat
> make: *** [file_contexts/file_contexts] Error 1
> 
> Any ideas?
> 
> Thanks
> Antoine
> 
> 
> For reference, here is the updated code snippet:
> (...)
> 	for potential in potential_prefixes.keys():
>                 addme = 1
>                 for regex in prefix_regex:
>                         #match a trailing (/*)? which is actually a bug
> in rpc_pipefs
>                         regex = re.sub("\(/\*\)\?$", "", regex)
>                         #match a trailing .+
>                         regex = re.sub("\.+$", "", regex)
>                         #match a trailing .*
>                         regex = re.sub("\.\*$", "", regex)
>                         #strip a (/.*)? which matches anything trailing
> to a /*$ which matches trailing /'s
>                         regex = re.sub("\(\/\.\*\)\?", "", regex)
>                         regex = regex + "/*$"
>                         sys.stderr.write("-%s\n" % regex)
>                         sys.stderr.write("-%s\n" % potential)
>                         sys.stderr.flush()
>                         if re.search(regex, potential, 0):
>                                 addme = 0
> 
>                 if addme == 1:
>                         if not prefixes.has_key(potential):
>                                 prefixes[potential] = ""
> (...)


So I simplified the problem.  Maybe someone with more regex or python
foo can help us out.  Python refuses to use (.*)? as a valid regular
expression.  Seems like we want to say match anything 0 or more times.
Why is this invalid and what would be valid?

>>> import re
>>> test = re.sub("(.*)?", "", "hello")
Traceback (most recent call last):
  File "<stdin>", line 1, in ?
  File "/usr/lib/python2.3/sre.py", line 143, in sub
    return _compile(pattern, 0).sub(repl, string, count)
  File "/usr/lib/python2.3/sre.py", line 230, in _compile
    raise error, v # invalid expression
sre_constants.error: nothing to repeat



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: error building file_contexts

[Daniel J Walsh]

Eric Paris wrote:

>>(...)
>>-/home/rsyslog
>>-/emul/lib(64)?/*$
>>-/home/rsyslog
>>-/emul/lib(64)?/.*\.so(\.[^/]*)*/*$
>>-/home/rsyslog
>>-/emul/lib(64)?/ld-[^/]*\.so(\.[^/]*)*/*$
>>-/home/rsyslog
>>-/usr/sbin/amavisd(.*)?/*$
>>-/home/rsyslog
>>Traceback (most recent call last):
>>  File "/usr/sbin/genhomedircon", line 475, in ?
>>    oldgenhomedircon(cmds[0], cmds[1])
>>  File "/usr/sbin/genhomedircon", line 190, in oldgenhomedircon
>>    if re.search(regex, potential, 0):
>>  File "/usr/lib/python2.3/sre.py", line 137, in search
>>    return _compile(pattern, flags).search(string)
>>  File "/usr/lib/python2.3/sre.py", line 230, in _compile
>>    raise error, v # invalid expression
>>sre_constants.error: nothing to repeat
>>make: *** [file_contexts/file_contexts] Error 1
>>
>>Any ideas?
>>
>>Thanks
>>Antoine
>>
>>
>>For reference, here is the updated code snippet:
>>(...)
>>	for potential in potential_prefixes.keys():
>>                addme = 1
>>                for regex in prefix_regex:
>>                        #match a trailing (/*)? which is actually a bug
>>in rpc_pipefs
>>                        regex = re.sub("\(/\*\)\?$", "", regex)
>>                        #match a trailing .+
>>                        regex = re.sub("\.+$", "", regex)
>>                        #match a trailing .*
>>                        regex = re.sub("\.\*$", "", regex)
>>                        #strip a (/.*)? which matches anything trailing
>>to a /*$ which matches trailing /'s
>>                        regex = re.sub("\(\/\.\*\)\?", "", regex)
>>                        regex = regex + "/*$"
>>                        sys.stderr.write("-%s\n" % regex)
>>                        sys.stderr.write("-%s\n" % potential)
>>                        sys.stderr.flush()
>>                        if re.search(regex, potential, 0):
>>                                addme = 0
>>
>>                if addme == 1:
>>                        if not prefixes.has_key(potential):
>>                                prefixes[potential] = ""
>>(...)
>>    
>>
>
>
>So I simplified the problem.  Maybe someone with more regex or python
>foo can help us out.  Python refuses to use (.*)? as a valid regular
>expression.  Seems like we want to say match anything 0 or more times.
>Why is this invalid and what would be valid?
>
>  
>
>>>>import re
>>>>test = re.sub("(.*)?", "", "hello")
>>>>        
>>>>
>Traceback (most recent call last):
>  File "<stdin>", line 1, in ?
>  File "/usr/lib/python2.3/sre.py", line 143, in sub
>    return _compile(pattern, 0).sub(repl, string, count)
>  File "/usr/lib/python2.3/sre.py", line 230, in _compile
>    raise error, v # invalid expression
>sre_constants.error: nothing to repeat
>
>
>
>--
>This message was distributed to subscribers of the selinux mailing list.
>If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
>the words "unsubscribe selinux" without quotes as the message.
>  
>
Why not just .*

test=re.sub(".*","","hello")



-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: error building file_contexts

[Antoine Martin]

> -/usr/sbin/amavisd(.*)?/*$
For reference, this should have been (...)amavisd.*
(I had plenty of similar mistakes in my fc files)

Not sure why this has only surfaced now, I am pretty sure this mistake
has been in my *.fc files for a while.

The changes to the script were really helpful, maybe it would be helpful
to have a debug option to enable this output? (or somehow make it part
of the backtrace) - sorry I can't hack python to that extent.
>                         regex = regex + "/*$"
>                         sys.stderr.write("-%s\n" % regex)
>                         sys.stderr.write("-%s\n" % potential)
>                         sys.stderr.flush()
>                         if re.search(regex, potential, 0):
>                                 addme = 0
> 

Antoine


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: error building file_contexts

[Christopher J. PeBenito]

On Tue, 2005-09-13 at 09:17 -0400, Stephen Smalley wrote:
> On Mon, 2005-09-12 at 23:18 +0100, antoine wrote:
> > Hi list,
> > 
> > Anyone knows how to figure out where this error is coming from:
> > # make
> >  * Creating policy.conf
> >  * Policy version: 19
> >  * Kernel version: 19
> >  * Compiling and installing policy.19
> > /usr/bin/checkpolicy:  loading policy configuration
> > from /etc/security/selinux/src/policy.conf
> > security:  3 users, 5 roles, 658 types, 3 bools
> > security:  55 classes, 57721 rules
> > /usr/bin/checkpolicy:  policy configuration loaded
> > /usr/bin/checkpolicy:  writing binary representation (version 19)
> > to /etc/security/selinux/policy.19
> >  * Building file_contexts
> > Traceback (most recent call last):
> >   File "/usr/sbin/genhomedircon", line 468, in ?
> >     oldgenhomedircon(cmds[0], cmds[1])
> >   File "/usr/sbin/genhomedircon", line 187, in oldgenhomedircon
> >     if re.search(regex, potential, 0):
> >   File "/usr/lib/python2.3/sre.py", line 137, in search
> >     return _compile(pattern, flags).search(string)
> >   File "/usr/lib/python2.3/sre.py", line 230, in _compile
> >     raise error, v # invalid expression
> > sre_constants.error: nothing to repeat
> > make: *** [file_contexts/file_contexts] Error 1
> > 
> > (non-enforcing mode makes no difference)
> > * kernel 2.6.13.1
> > * libselinux 1.24
> > * libsepol 1.6
> 
> You didn't mention the particular policycoreutils version (which
> provides /usr/sbin/genhomedircon) or policy version (although I suppose
> that is specific to Gentoo).  It looks like your policy Makefile is
> still invoking genhomedircon using the old syntax (hence the call to
> oldgenhomedircon), which is deprecated, although it should still work.
> >From the error message, I assume that regex is not a legal regex at that
> point.

I've heard one other report of this error.  It was reported to only when
running genhomedircon as a regular user.  I haven't had a chance to look
into this.

As for genhomedircon, yes, Gentoo still uses the old syntax, as we still
use a single file_contexts file, not the separate files used in Fedora,
and also still use /etc/security.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.