about the configuration language grammar

[Giorgio Zanin <giorgio.zanin@inwind.it>]

i am having a look at the grammar of the SELinux configuration language. 
Productions for role declaration is the following:

role_type_def    :  ROLE identifier  TYPES names ';'

names    : identifier
               | nested_id_set
               | asterisk
               | tilde identifier
               | tilde nested_id_set
           
nested_id_set : '{' nested_id_list '}'

nested_id_list : nested_id_element
                         | nested_id_list nested_id_element

nested_id_element : identifier
                                | nested_id_set

Actually it's different from the ones in the document  "Configuring the 
SELinux Policy" (*) :

role_decl -> ROLE identifier TYPES types  ';'

types -> set

set ->  *  | identifier |  {  identifier_list  }  |  ~  identifier |  
~   {  identifier_ list  }

The former grammar is more difficult but more powerful. The latter is 
more natural and it seems to me to be enough. Why is it possible to 
express something like

role admin types { me { you { him } } }

and what's the meaning?

I'm working on a tool for configuration analisys. Am I safe if I change 
the grammar as in (*)?

Thanks

Giorgio


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.