djbdns needs optional_policy

djbdns needs optional_policy

[dwalsh]

--- nsaserefpolicy/policy/modules/services/djbdns.te	2007-05-29 14:10:57.000000000 -0400
+++ serefpolicy-3.0.1/policy/modules/services/djbdns.te	2007-05-30 07:35:54.000000000 -0400
@@ -44,4 +44,7 @@
 libs_use_ld_so(djbdns_axfrdns_t)
 libs_use_shared_libs(djbdns_axfrdns_t)
 
-ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
+optional_policy(`
+	ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
+')
+

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: djbdns needs optional_policy

[Petre Rodan]

[-- Attachment #1: Type: text/plain, Size: 659 bytes --]


Hi Daniel,

On Wed, May 30, 2007 at 10:51:20AM -0400, dwalsh@redhat.com wrote:
> --- nsaserefpolicy/policy/modules/services/djbdns.te	2007-05-29 14:10:57.000000000 -0400
> +++ serefpolicy-3.0.1/policy/modules/services/djbdns.te	2007-05-30 07:35:54.000000000 -0400
> @@ -44,4 +44,7 @@
>  libs_use_ld_so(djbdns_axfrdns_t)
>  libs_use_shared_libs(djbdns_axfrdns_t)
>  
> -ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
> +optional_policy(`
> +	ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
> +')
> +

http://marc.info/?l=selinux&m=117621284727331&w=2

what is the reason for your tweak? 

bye,
peter


[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]

Re: djbdns needs optional_policy

[Daniel J Walsh]

Petre Rodan wrote:
> Hi Daniel,
>
> On Wed, May 30, 2007 at 10:51:20AM -0400, dwalsh@redhat.com wrote:
>   
>> --- nsaserefpolicy/policy/modules/services/djbdns.te	2007-05-29 14:10:57.000000000 -0400
>> +++ serefpolicy-3.0.1/policy/modules/services/djbdns.te	2007-05-30 07:35:54.000000000 -0400
>> @@ -44,4 +44,7 @@
>>  libs_use_ld_so(djbdns_axfrdns_t)
>>  libs_use_shared_libs(djbdns_axfrdns_t)
>>  
>> -ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
>> +optional_policy(`
>> +	ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
>> +')
>> +
>>     
>
> http://marc.info/?l=selinux&m=117621284727331&w=2
>
> what is the reason for your tweak? 
>
> bye,
> peter
>
>   
It's been a while, but I believe if ucspictcp and djbdns are built as 
modules the packages will not build correctly. 

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: djbdns needs optional_policy

[Christopher J. PeBenito]

On Thu, 2007-05-31 at 07:15 -0400, Daniel J Walsh wrote:
> Petre Rodan wrote:
> > Hi Daniel,
> >
> > On Wed, May 30, 2007 at 10:51:20AM -0400, dwalsh@redhat.com wrote:
> >   
> >> --- nsaserefpolicy/policy/modules/services/djbdns.te	2007-05-29 14:10:57.000000000 -0400
> >> +++ serefpolicy-3.0.1/policy/modules/services/djbdns.te	2007-05-30 07:35:54.000000000 -0400
> >> @@ -44,4 +44,7 @@
> >>  libs_use_ld_so(djbdns_axfrdns_t)
> >>  libs_use_shared_libs(djbdns_axfrdns_t)
> >>  
> >> -ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
> >> +optional_policy(`
> >> +	ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
> >> +')
> >> +
> >>     
> >
> > http://marc.info/?l=selinux&m=117621284727331&w=2
> >
> > what is the reason for your tweak? 
> >
> > bye,
> > peter
> >
> >   
> It's been a while, but I believe if ucspictcp and djbdns are built as 
> modules the packages will not build correctly. 

Build or link fails?  I would expect the link to fail.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: djbdns needs optional_policy

[Daniel J Walsh]

Christopher J. PeBenito wrote:
> On Thu, 2007-05-31 at 07:15 -0400, Daniel J Walsh wrote:
>   
>> Petre Rodan wrote:
>>     
>>> Hi Daniel,
>>>
>>> On Wed, May 30, 2007 at 10:51:20AM -0400, dwalsh@redhat.com wrote:
>>>   
>>>       
>>>> --- nsaserefpolicy/policy/modules/services/djbdns.te	2007-05-29 14:10:57.000000000 -0400
>>>> +++ serefpolicy-3.0.1/policy/modules/services/djbdns.te	2007-05-30 07:35:54.000000000 -0400
>>>> @@ -44,4 +44,7 @@
>>>>  libs_use_ld_so(djbdns_axfrdns_t)
>>>>  libs_use_shared_libs(djbdns_axfrdns_t)
>>>>  
>>>> -ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
>>>> +optional_policy(`
>>>> +	ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
>>>> +')
>>>> +
>>>>     
>>>>         
>>> http://marc.info/?l=selinux&m=117621284727331&w=2
>>>
>>> what is the reason for your tweak? 
>>>
>>> bye,
>>> peter
>>>
>>>   
>>>       
>> It's been a while, but I believe if ucspictcp and djbdns are built as 
>> modules the packages will not build correctly. 
>>     
>
> Build or link fails?  I would expect the link to fail.
>
>   
Probably at link.  It happened a long time ago.  So I guess if both 
modules are installed at the same time and removed at the same time this 
is not needed.  I probably added one module to strict and had it blow up 
on me, so I changed it to optional.  Then later I added the other policy 
to strict.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.