From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.6 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22D78C3A59E for ; Wed, 21 Aug 2019 20:02:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E6BC323403 for ; Wed, 21 Aug 2019 20:02:47 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="FDLEdvRg" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730167AbfHUUCr (ORCPT ); Wed, 21 Aug 2019 16:02:47 -0400 Received: from mail-ed1-f48.google.com ([209.85.208.48]:35778 "EHLO mail-ed1-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727448AbfHUUCr (ORCPT ); Wed, 21 Aug 2019 16:02:47 -0400 Received: by mail-ed1-f48.google.com with SMTP id t50so4421166edd.2 for ; Wed, 21 Aug 2019 13:02:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:mail-followup-to:references :mime-version:content-disposition:in-reply-to:user-agent; bh=IziFteENTKUhoHsd8AaCdH43ON7Eaf7er6LphWyZ6QA=; b=FDLEdvRgxnIS3UD+CE4zi5dKsFkZ2rT4nMUN+WTgwKl2nky4ljtjlKFg99EzpNdx2M IrtsNTYrr3oHdlxCLEFfyb/baY7ciO8uCvHVZHLnARGHxFxA7Owulcz00CMpspKGLzC5 0bqXnogzNi0jyAiPIXDOKOAyqb2KJZEWGiRP8AYuwd428qZCi3YBvaBYV0pAvCbf0s2a BZZSvf9cIZn9ltoWd3X7FpQkr8QHvCssfhLc1ak9Xi/MpP/5N33PVhWuXLtF53+RFAOs SZgw62fWr+iwl0crbwzozP+RsS6JRIUVoeqteIxqk0sVRfu2GJzHqqdAM/WGICK/39+K kVnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id :mail-followup-to:references:mime-version:content-disposition :in-reply-to:user-agent; bh=IziFteENTKUhoHsd8AaCdH43ON7Eaf7er6LphWyZ6QA=; b=Uk3RkAHW4yoFZdG4mCm0SSVoQqxitCLm37ot3VpYyqZ2emKGlLuuID93xmh8uMDLl8 b6SL7fxN2HHsNQM5qBqj3qDD/mn6xuBB92OjhlygBOI5nOBrfvGLxqIDkBrPwWNc6EX3 KGPIlhJ7F+LrVROB5a33jzg22Zm6q3Dc37V2BcQ20lszBFA4i7sPxb8bvSMKzTA2EanE 4P8/PxEM4WWc7AuknQ2nHaY+LJorBPtp+4ktFkh5hzAQpkE8TiNqdDyCYaNndgqB+v/W fBQxMDj+JJnnPESd+FNWreqh06FPI0dz5oSAcaDKWrCeYUZkXcTFoJ+zrDpUsQcQt1BI VShg== X-Gm-Message-State: APjAAAUuJA0sSZtE83c9idxkvwQgxdXmdYWdVNpVT6WOiQ+2ymibv0Oo XXA274xjYPJAxX5tgyzMBpc= X-Google-Smtp-Source: APXvYqzMTtqlK/Vz66QnaX1HCGoVrKeeQ1Jgko0FMiIDuOtpZXjh3k30Wd9+A2lUeALIZUctg4fkDw== X-Received: by 2002:a50:f051:: with SMTP id u17mr37802308edl.300.1566417765579; Wed, 21 Aug 2019 13:02:45 -0700 (PDT) Received: from brutus.lan (brutus.defensec.nl. [2001:985:d55d::438]) by smtp.gmail.com with ESMTPSA id i5sm2535443edf.32.2019.08.21.13.02.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 21 Aug 2019 13:02:44 -0700 (PDT) Date: Wed, 21 Aug 2019 22:02:43 +0200 From: Dominick Grift To: Nicolas Iooss Cc: selinux-refpolicy@vger.kernel.org Subject: Re: Why is /usr/include matched with /usr/inclu.e? Message-ID: <20190821200243.GA5262@brutus.lan> Mail-Followup-To: Nicolas Iooss , selinux-refpolicy@vger.kernel.org References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="+QahgC5+KEYLbs62" Content-Disposition: inline In-Reply-To: User-Agent: Every email client sucks, this one just sucks less. X-PGP-Key: https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org --+QahgC5+KEYLbs62 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Aug 21, 2019 at 09:57:14PM +0200, Nicolas Iooss wrote: > Hi all, >=20 > While checking the patterns in refpolicy, I stumbled upon the > following line in > https://github.com/SELinuxProject/refpolicy/blob/RELEASE_2_20190609/polic= y/modules/kernel/files.fc#L200 >=20 > /usr/inclu.e(/.*)? gen_context(system_u:object_r:usr_t,s0) Probably to work around an m4-ism. There seems to be an m4 "include" built-= in. >=20 > This pattern matches /usr/include and its content, but why is a dot > used? Which other directories can it match? >=20 > The issue there is that a dot can match a slash, so the pattern also > matches /usr/inclu/e/, which seems strange. This pattern has been > introduced in the very early days of refpolicy's git repository, > according to https://github.com/SELinuxProject/refpolicy/commit/f8ec0ad43= b54437e2d9f0e48a773a64dbd9e543c#diff-e333cb52d2139f7a71f0dfbd32c06f70R117. > Does anyone remember why the pattern for /usr/include is so special? >=20 > Thanks, > Nicolas >=20 --=20 Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02 Dominick Grift --+QahgC5+KEYLbs62 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAl1do14ACgkQJXSOVTf5 R2nidwv/cBN7C5AWIILzwKm91F9nBujYgg1azcP17is3pLezip2eEPwx4ai0xrm0 dNdFBXGBSgJf3ANpuMaoG2kKtGOiDJZN+8MjVWcAOmO3VF+OS5fMVIHaGu80Uuoa Hyfven+prmd+tjoudbl8u6PWZqfidIX20qS8NAwONzhWDs6IbiELZ9Yh95Pg9Oe0 ZFW2+fsM4EDQXfCQFXJYXxhNoK7Abw6gugNYBhfdamlU8ei35GSUeyDG/392RRBC //si8WeIi0d0RcMx1MA5k3hSVI6XToli3yVhPXk+6iwPF7qEWWGGoFCPw3mDPB7G Crt8X8k9N5oearQwJn27olgFYsApdDT65VUzSIfBadGwkTTWkGKftAP7qu9MQyc5 kZIaOl++I1ymWn/wK+Ydu2CRCpxAEynmzCMBkY5FDP19kDNSrQWkTomj2jieNwbU 5RLwKhzmuGaKB+yhVKyNDshTqq3sy6IeQt1GzqxCKQdEH1V5asRXeuHugG1BrX/D oLfcAh7P =3aiE -----END PGP SIGNATURE----- --+QahgC5+KEYLbs62--