Policy format: apostrophe in comments

Policy format: apostrophe in comments

[Ivan Gyurdiev]

What about this bug? It complains about not being able to use
apostrophe in the policy config. Any chance this will be fixed,
or should I leave it alone? I ask because I was confused
what was wrong with my policy when adding apostr. comments. 

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=146553
-- 
Ivan Gyurdiev <ivg2@cornell.edu>
Cornell University


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Policy format: apostrophe in comments

[Stephen Smalley]

On Mon, 2005-01-31 at 17:29, Ivan Gyurdiev wrote:
> What about this bug? It complains about not being able to use
> apostrophe in the policy config. Any chance this will be fixed,
> or should I leave it alone? I ask because I was confused
> what was wrong with my policy when adding apostr. comments. 
> 
> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=146553

Yes, that has bothered me as well; it is a curious property of m4 that
it interprets quotes even within comments.  An option would be to use
the m4 changequote builtin to change the start-quote and end-quote
delimiters, but that would require rewriting all actual uses of the
existing quote characters in the existing policy to use the new
delimiters.  Obviously not my highest priority, but I'd be willing to
consider patches that make such a change.
  
-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Policy format: apostrophe in comments

[David Caplan]

Stephen Smalley wrote:
> On Mon, 2005-01-31 at 17:29, Ivan Gyurdiev wrote:
> 
>>What about this bug? It complains about not being able to use
>>apostrophe in the policy config. Any chance this will be fixed,
>>or should I leave it alone? I ask because I was confused
>>what was wrong with my policy when adding apostr. comments. 
>>
>>https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=146553
> 
> 
> Yes, that has bothered me as well; it is a curious property of m4 that
> it interprets quotes even within comments.  

I thought this as well.  I discovered, with some help from Gary Vaughan at 
gnu.org, that what I thought was a comment was actually embedded in a 
quoted string.  For example:

define(`only_trans',`
#
# Allow the user's process to transition.
#
allow $1 $3:process transition;
')

The comment is actually _in_ the quoted string, so the apostrophe in the 
comment matches the end delimeter of the string and problems occur.  It 
should really be written as:

define(`only_trans',
#
# Allow the user's process to transition.
#
`
allow $1 $3:process transition;
')

> An option would be to use
> the m4 changequote builtin to change the start-quote and end-quote
> delimiters, but that would require rewriting all actual uses of the
> existing quote characters in the existing policy to use the new
> delimiters.  

Changing the quote delimeter was the suggestion I received from Gary, but 
you are always going to end up vulnerable because of what someone puts into 
what they believe is a comment line.

Obviously not my highest priority, but I'd be willing to
> consider patches that make such a change.
>   

David

-- 
__________________________________

David Caplan     410 290 1411 x105
dac@tresys.com
Tresys Technology, LLC
8840 Stanford Blvd., Suite 2100
Columbia, MD 21045

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.