upgrading to modular policy

upgrading to modular policy

[Antoine Martin]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi list,

I am finally getting around to upgrading some custom modules to the
modular policy and I have encountered a few issues:
* How do I find the new equivalent for macros which have been renamed?
ie: file_type_auto_trans, domain_auto_trans, append_logdir_domain,
general_domain_access, etc...
* trying to load one of the modules gives:
libsepol.permission_copy_callback: Module local depends on permission
dccp_recv in class node, not satisfied
libsemanage.semanage_link_sandbox: Link packages failed
semodule:  Failed!

Thanks
Antoine

PS: running gentoo selinux 2006.1 profile
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGZXjFGK2zHPGK1rsRCnd9AJ947LsFxODgvjMN47sVRtcOhdvwSQCdE2mv
GGZEGPnoFml1RIYY+BxuExw=
=6GHU
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: upgrading to modular policy

[Christopher J. PeBenito]

On Tue, 2007-06-05 at 15:52 +0100, Antoine Martin wrote:
> I am finally getting around to upgrading some custom modules to the
> modular policy and I have encountered a few issues:
> * How do I find the new equivalent for macros which have been renamed?
> ie: file_type_auto_trans, domain_auto_trans, append_logdir_domain,
> general_domain_access, etc...

You can look at this:

http://oss.tresys.com/projects/refpolicy/browser/docs/macro_conversion_guide

It hasn't been updated in 10 months, so its probably a little out of
date, but it should get you started.

> * trying to load one of the modules gives:
> libsepol.permission_copy_callback: Module local depends on permission
> dccp_recv in class node, not satisfied
> libsemanage.semanage_link_sandbox: Link packages failed
> semodule:  Failed!

It means the headers you are compiling against are newer than the base
policy you have installed.  The dccp_recv permission does not exist in
the base policy, but it exists, according to the headers.  You probably
just need to recompile your base module to include these new perms.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.