about the configuration language grammar

about the configuration language grammar

[Giorgio Zanin]

i am having a look at the grammar of the SELinux configuration language. 
Productions for role declaration is the following:

role_type_def    :  ROLE identifier  TYPES names ';'

names    : identifier
               | nested_id_set
               | asterisk
               | tilde identifier
               | tilde nested_id_set
           
nested_id_set : '{' nested_id_list '}'

nested_id_list : nested_id_element
                         | nested_id_list nested_id_element

nested_id_element : identifier
                                | nested_id_set

Actually it's different from the ones in the document  "Configuring the 
SELinux Policy" (*) :

role_decl -> ROLE identifier TYPES types  ';'

types -> set

set ->  *  | identifier |  {  identifier_list  }  |  ~  identifier |  
~   {  identifier_ list  }

The former grammar is more difficult but more powerful. The latter is 
more natural and it seems to me to be enough. Why is it possible to 
express something like

role admin types { me { you { him } } }

and what's the meaning?

I'm working on a tool for configuration analisys. Am I safe if I change 
the grammar as in (*)?

Thanks

Giorgio


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: about the configuration language grammar

[Stephen D. Smalley]

Giorgio Zanin wrote:
> The former grammar is more difficult but more powerful. The latter is 
> more natural and it seems to me to be enough. Why is it possible to 
> express something like
> 
> role admin types { me { you { him } } }
> 
> and what's the meaning?
> 
> I'm working on a tool for configuration analisys. Am I safe if I change 
> the grammar as in (*)?

The change to the checkpolicy grammar (which hasn't been reflected in
the Configuring the SELinux Policy report, as you noted) was at the request
of users who wanted to be able to use macro names in the same manner
as individual names, e.g. intermingling macro names and individual names
in sets to specify their union, defining nested macros, etc.  This is
typically only used for permission sets in allow rules, e.g.

allow foo_t bar_t:file { r_file_perms create link_file_perms };

However, the grammar allows it in the general case.  The compiler simply
takes the union, so your example above is equivalent to:

role admin types { me you him };

--
Stephen Smalley, NSA
sds@epoch.ncsc.mil


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.