Re: MLS + MCS?

["Christopher J. PeBenito" <cpebenito@tresys.com>]

On Thu, 2006-11-02 at 10:49 -0600, Michael C Thompson wrote:
> Christopher J. PeBenito wrote:
> > On Thu, 2006-11-02 at 09:48 -0600, Michael C Thompson wrote:
> >> While writing some policy, I came across a situation that was causing 
> >> the policy I was writing to be constructed in an invalid fashion. What 
> >> was happening was this:
> >>
> >> Using an old Makefile, my $(TYPE) was being generated as 
> >> 'strict-mls-mcs', which was causing the support template 'gen_context' 
> >> to get completely confused.
> >>
> >> The macro is defined thusly:
> > [cut]
> >> I'm wondering, how does this make sense? I'm unclear as to how having 
> >> both mls_sensitivity and [mcs_catergories] defined in this way has meaning.
> >>
> >> Because of having both '-mls' and '-mcs' in my $(TYPE), the invalid 
> >> policy I was compiling ended up looking like this:
> >> user:role:type:$2:s0:$3
> >>
> >> It would seem to me that MLS and MCS are mutually exclusive, at least in 
> >> this macro.
> > 
> > Yes, they are mutually exclusive.  Sounds like the Makefile that redhat
> > has is making a mistake on setting TYPE; it has to figure out more than
> > the upstream refpolicy Makefiles need to because of the
> > redhat /usr/share/selinux/*/devel setup.
> 
> I have since switched to the last Makefile redhat provides and that 
> resolves the problem I was having.
> 
> is there a better way to express the gen_context macro, or is this 
> another case of m4 limitations? (I am not familiar with m4 at all btw)

M4 doesn't really have any error handling since it is just a macro
language.  Since MLS and MCS are mutually exclusive, it hasn't been a
problem.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.