* [refpolicy] [m4-isms patch 5/6] Modify *_except interfaces to not have caller supply the "-" @ 2010-08-24 19:50 James Carter 2010-08-25 13:05 ` Christopher J. PeBenito 0 siblings, 1 reply; 5+ messages in thread From: James Carter @ 2010-08-24 19:50 UTC (permalink / raw) To: refpolicy The *_except interfaces expect the caller to call it like this: files_read_all_dirs_except(foo_t, - bar_t) This makes the call argument hard to deal with because it is neither a type nor a set. Also an argument like $2 -shadow_t could either be a set or an MLS range. The *_except interfaces are never used except for in the *_except_shadow interfaces. The calls to the *_except_shadow interfaces never specify a second argument. files_manage_all_files is called only in portage.te (with no exception) and authlogin.if. --- policy/modules/kernel/files.if | 92 +++++++++++++++++++++++++++++-------- policy/modules/system/authlogin.if | 10 ++-- 2 files changed, 79 insertions(+), 23 deletions(-) diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index 5302dac..9212dea 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -689,7 +689,7 @@ interface(`files_read_all_dirs_except',` attribute file_type; ') - allow $1 { file_type $2 }:dir list_dir_perms; + allow $1 { file_type - $2 }:dir list_dir_perms; ') ######################################## @@ -714,7 +714,7 @@ interface(`files_read_all_files_except',` attribute file_type; ') - read_files_pattern($1, { file_type $2 }, { file_type $2 }) + read_files_pattern($1, { file_type - $2 }, { file_type - $2 }) ') ######################################## @@ -739,7 +739,7 @@ interface(`files_read_all_symlinks_except',` attribute file_type; ') - read_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) + read_lnk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) ') ######################################## @@ -1026,6 +1026,35 @@ interface(`files_read_all_chr_files',` ######################################## ## <summary> +## Relabel all files on the filesystem +## </summary> +## <param name="domain"> +## <summary> +## The type of the domain perfoming this action. +## </summary> +## </param> +## <rolecap/> +# +interface(`files_relabel_all_files',` + gen_require(` + attribute file_type; + ') + + allow $1 file_type : dir list_dir_perms; + relabel_dirs_pattern($1, file_type, file_type) + relabel_files_pattern($1, file_type, file_type) + relabel_lnk_files_pattern($1, file_type, file_type) + relabel_fifo_files_pattern($1, file_type, file_type) + relabel_sock_files_pattern($1, file_type, file_type) + relabelfrom_blk_files_pattern($1, file_type, file_type) + relabelfrom_chr_files_pattern($1, file_type, file_type) + + # satisfy the assertions: + seutil_relabelto_bin_policy($1) +') + +######################################## +## <summary> ## Relabel all files on the filesystem, except ## the listed exceptions. ## </summary> @@ -1042,21 +1071,21 @@ interface(`files_read_all_chr_files',` ## </param> ## <rolecap/> # -interface(`files_relabel_all_files',` +interface(`files_relabel_all_files_except',` gen_require(` attribute file_type; ') - allow $1 { file_type $2 }:dir list_dir_perms; - relabel_dirs_pattern($1, { file_type $2 }, { file_type $2 }) - relabel_files_pattern($1, { file_type $2 }, { file_type $2 }) - relabel_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) - relabel_fifo_files_pattern($1, { file_type $2 }, { file_type $2 }) - relabel_sock_files_pattern($1, { file_type $2 }, { file_type $2 }) + allow $1 { file_type - $2 }:dir list_dir_perms; + relabel_dirs_pattern($1, { file_type - $2 }, { file_type - $2 }) + relabel_files_pattern($1, { file_type - $2 }, { file_type - $2 }) + relabel_lnk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) + relabel_fifo_files_pattern($1, { file_type - $2 }, { file_type - $2 }) + relabel_sock_files_pattern($1, { file_type - $2 }, { file_type - $2 }) # this is only relabelfrom since there should be no # device nodes with file types. - relabelfrom_blk_files_pattern($1, { file_type $2 }, { file_type $2 }) - relabelfrom_chr_files_pattern($1, { file_type $2 }, { file_type $2 }) + relabelfrom_blk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) + relabelfrom_chr_files_pattern($1, { file_type - $2 }, { file_type - $2 }) # satisfy the assertions: seutil_relabelto_bin_policy($1) @@ -1090,6 +1119,33 @@ interface(`files_rw_all_files',` ######################################## ## <summary> +## Manage all files on the filesystem. +## </summary> +## <param name="domain"> +## <summary> +## The type of the domain perfoming this action. +## </summary> +## </param> +## <rolecap/> +# +interface(`files_manage_all_files',` + gen_require(` + attribute file_type; + ') + + manage_dirs_pattern($1, file_type, file_type) + manage_files_pattern($1, file_type, file_type) + manage_lnk_files_pattern($1, file_type, file_type) + manage_fifo_files_pattern($1, file_type, file_type) + manage_sock_files_pattern($1, file_type, file_type) + + # satisfy the assertions: + seutil_create_bin_policy($1) + files_manage_kernel_modules($1) +') + +######################################## +## <summary> ## Manage all files on the filesystem, except ## the listed exceptions. ## </summary> @@ -1106,16 +1162,16 @@ interface(`files_rw_all_files',` ## </param> ## <rolecap/> # -interface(`files_manage_all_files',` +interface(`files_manage_all_files_except',` gen_require(` attribute file_type; ') - manage_dirs_pattern($1, { file_type $2 }, { file_type $2 }) - manage_files_pattern($1, { file_type $2 }, { file_type $2 }) - manage_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) - manage_fifo_files_pattern($1, { file_type $2 }, { file_type $2 }) - manage_sock_files_pattern($1, { file_type $2 }, { file_type $2 }) + manage_dirs_pattern($1, { file_type - $2 }, { file_type - $2 }) + manage_files_pattern($1, { file_type - $2 }, { file_type - $2 }) + manage_lnk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) + manage_fifo_files_pattern($1, { file_type - $2 }, { file_type - $2 }) + manage_sock_files_pattern($1, { file_type - $2 }, { file_type - $2 }) # satisfy the assertions: seutil_create_bin_policy($1) diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if index 7fddc24..c116df6 100644 --- a/policy/modules/system/authlogin.if +++ b/policy/modules/system/authlogin.if @@ -1113,7 +1113,7 @@ interface(`auth_read_all_dirs_except_shadow',` type shadow_t; ') - files_read_all_dirs_except($1,$2 -shadow_t) + files_read_all_dirs_except($1, shadow_t) ') ######################################## @@ -1139,7 +1139,7 @@ interface(`auth_read_all_files_except_shadow',` type shadow_t; ') - files_read_all_files_except($1,$2 -shadow_t) + files_read_all_files_except($1, shadow_t) ') ######################################## @@ -1164,7 +1164,7 @@ interface(`auth_read_all_symlinks_except_shadow',` type shadow_t; ') - files_read_all_symlinks_except($1,$2 -shadow_t) + files_read_all_symlinks_except($1, shadow_t) ') ######################################## @@ -1190,7 +1190,7 @@ interface(`auth_relabel_all_files_except_shadow',` type shadow_t; ') - files_relabel_all_files($1,$2 -shadow_t) + files_relabel_all_files_except($1, shadow_t) ') ######################################## @@ -1242,7 +1242,7 @@ interface(`auth_manage_all_files_except_shadow',` type shadow_t; ') - files_manage_all_files($1,$2 -shadow_t) + files_manage_all_files_except($1, shadow_t) ') ######################################## -- James Carter <jwcart2@tycho.nsa.gov> National Security Agency ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [refpolicy] [m4-isms patch 5/6] Modify *_except interfaces to not have caller supply the "-" 2010-08-24 19:50 [refpolicy] [m4-isms patch 5/6] Modify *_except interfaces to not have caller supply the "-" James Carter @ 2010-08-25 13:05 ` Christopher J. PeBenito 2010-08-25 14:19 ` James Carter 0 siblings, 1 reply; 5+ messages in thread From: Christopher J. PeBenito @ 2010-08-25 13:05 UTC (permalink / raw) To: refpolicy On 08/24/10 15:50, James Carter wrote: > The *_except interfaces expect the caller to call it like this: > files_read_all_dirs_except(foo_t, - bar_t) > > This makes the call argument hard to deal with because it is neither a > type nor a set. Also an argument like $2 -shadow_t could either be a > set or an MLS range. > > The *_except interfaces are never used except for in the *_except_shadow > interfaces. The calls to the *_except_shadow interfaces never specify a > second argument. > > files_manage_all_files is called only in portage.te (with no exception) > and authlogin.if. Theres two issues with this change: 1. It breaks API stability. 2. It doesn't work if you want to specify a set, e.g. files_read_all_dirs_except(foo_t, { bar_t baz_t }) > --- > policy/modules/kernel/files.if | 92 +++++++++++++++++++++++++++++-------- > policy/modules/system/authlogin.if | 10 ++-- > 2 files changed, 79 insertions(+), 23 deletions(-) > > diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if > index 5302dac..9212dea 100644 > --- a/policy/modules/kernel/files.if > +++ b/policy/modules/kernel/files.if > @@ -689,7 +689,7 @@ interface(`files_read_all_dirs_except',` > attribute file_type; > ') > > - allow $1 { file_type $2 }:dir list_dir_perms; > + allow $1 { file_type - $2 }:dir list_dir_perms; > ') > > ######################################## > @@ -714,7 +714,7 @@ interface(`files_read_all_files_except',` > attribute file_type; > ') > > - read_files_pattern($1, { file_type $2 }, { file_type $2 }) > + read_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > ') > > ######################################## > @@ -739,7 +739,7 @@ interface(`files_read_all_symlinks_except',` > attribute file_type; > ') > > - read_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) > + read_lnk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > ') > > ######################################## > @@ -1026,6 +1026,35 @@ interface(`files_read_all_chr_files',` > > ######################################## > ##<summary> > +## Relabel all files on the filesystem > +##</summary> > +##<param name="domain"> > +##<summary> > +## The type of the domain perfoming this action. > +##</summary> > +##</param> > +##<rolecap/> > +# > +interface(`files_relabel_all_files',` > + gen_require(` > + attribute file_type; > + ') > + > + allow $1 file_type : dir list_dir_perms; > + relabel_dirs_pattern($1, file_type, file_type) > + relabel_files_pattern($1, file_type, file_type) > + relabel_lnk_files_pattern($1, file_type, file_type) > + relabel_fifo_files_pattern($1, file_type, file_type) > + relabel_sock_files_pattern($1, file_type, file_type) > + relabelfrom_blk_files_pattern($1, file_type, file_type) > + relabelfrom_chr_files_pattern($1, file_type, file_type) > + > + # satisfy the assertions: > + seutil_relabelto_bin_policy($1) > +') > + > +######################################## > +##<summary> > ## Relabel all files on the filesystem, except > ## the listed exceptions. > ##</summary> > @@ -1042,21 +1071,21 @@ interface(`files_read_all_chr_files',` > ##</param> > ##<rolecap/> > # > -interface(`files_relabel_all_files',` > +interface(`files_relabel_all_files_except',` > gen_require(` > attribute file_type; > ') > > - allow $1 { file_type $2 }:dir list_dir_perms; > - relabel_dirs_pattern($1, { file_type $2 }, { file_type $2 }) > - relabel_files_pattern($1, { file_type $2 }, { file_type $2 }) > - relabel_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) > - relabel_fifo_files_pattern($1, { file_type $2 }, { file_type $2 }) > - relabel_sock_files_pattern($1, { file_type $2 }, { file_type $2 }) > + allow $1 { file_type - $2 }:dir list_dir_perms; > + relabel_dirs_pattern($1, { file_type - $2 }, { file_type - $2 }) > + relabel_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > + relabel_lnk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > + relabel_fifo_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > + relabel_sock_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > # this is only relabelfrom since there should be no > # device nodes with file types. > - relabelfrom_blk_files_pattern($1, { file_type $2 }, { file_type $2 }) > - relabelfrom_chr_files_pattern($1, { file_type $2 }, { file_type $2 }) > + relabelfrom_blk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > + relabelfrom_chr_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > > # satisfy the assertions: > seutil_relabelto_bin_policy($1) > @@ -1090,6 +1119,33 @@ interface(`files_rw_all_files',` > > ######################################## > ##<summary> > +## Manage all files on the filesystem. > +##</summary> > +##<param name="domain"> > +##<summary> > +## The type of the domain perfoming this action. > +##</summary> > +##</param> > +##<rolecap/> > +# > +interface(`files_manage_all_files',` > + gen_require(` > + attribute file_type; > + ') > + > + manage_dirs_pattern($1, file_type, file_type) > + manage_files_pattern($1, file_type, file_type) > + manage_lnk_files_pattern($1, file_type, file_type) > + manage_fifo_files_pattern($1, file_type, file_type) > + manage_sock_files_pattern($1, file_type, file_type) > + > + # satisfy the assertions: > + seutil_create_bin_policy($1) > + files_manage_kernel_modules($1) > +') > + > +######################################## > +##<summary> > ## Manage all files on the filesystem, except > ## the listed exceptions. > ##</summary> > @@ -1106,16 +1162,16 @@ interface(`files_rw_all_files',` > ##</param> > ##<rolecap/> > # > -interface(`files_manage_all_files',` > +interface(`files_manage_all_files_except',` > gen_require(` > attribute file_type; > ') > > - manage_dirs_pattern($1, { file_type $2 }, { file_type $2 }) > - manage_files_pattern($1, { file_type $2 }, { file_type $2 }) > - manage_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) > - manage_fifo_files_pattern($1, { file_type $2 }, { file_type $2 }) > - manage_sock_files_pattern($1, { file_type $2 }, { file_type $2 }) > + manage_dirs_pattern($1, { file_type - $2 }, { file_type - $2 }) > + manage_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > + manage_lnk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > + manage_fifo_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > + manage_sock_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > > # satisfy the assertions: > seutil_create_bin_policy($1) > diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if > index 7fddc24..c116df6 100644 > --- a/policy/modules/system/authlogin.if > +++ b/policy/modules/system/authlogin.if > @@ -1113,7 +1113,7 @@ interface(`auth_read_all_dirs_except_shadow',` > type shadow_t; > ') > > - files_read_all_dirs_except($1,$2 -shadow_t) > + files_read_all_dirs_except($1, shadow_t) > ') > > ######################################## > @@ -1139,7 +1139,7 @@ interface(`auth_read_all_files_except_shadow',` > type shadow_t; > ') > > - files_read_all_files_except($1,$2 -shadow_t) > + files_read_all_files_except($1, shadow_t) > ') > > ######################################## > @@ -1164,7 +1164,7 @@ interface(`auth_read_all_symlinks_except_shadow',` > type shadow_t; > ') > > - files_read_all_symlinks_except($1,$2 -shadow_t) > + files_read_all_symlinks_except($1, shadow_t) > ') > > ######################################## > @@ -1190,7 +1190,7 @@ interface(`auth_relabel_all_files_except_shadow',` > type shadow_t; > ') > > - files_relabel_all_files($1,$2 -shadow_t) > + files_relabel_all_files_except($1, shadow_t) > ') > > ######################################## > @@ -1242,7 +1242,7 @@ interface(`auth_manage_all_files_except_shadow',` > type shadow_t; > ') > > - files_manage_all_files($1,$2 -shadow_t) > + files_manage_all_files_except($1, shadow_t) > ') > > ######################################## > -- Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com ^ permalink raw reply [flat|nested] 5+ messages in thread
* [refpolicy] [m4-isms patch 5/6] Modify *_except interfaces to not have caller supply the "-" 2010-08-25 13:05 ` Christopher J. PeBenito @ 2010-08-25 14:19 ` James Carter 2010-08-25 15:56 ` Christopher J. PeBenito 0 siblings, 1 reply; 5+ messages in thread From: James Carter @ 2010-08-25 14:19 UTC (permalink / raw) To: refpolicy On Wed, 2010-08-25 at 09:05 -0400, Christopher J. PeBenito wrote: > On 08/24/10 15:50, James Carter wrote: > > The *_except interfaces expect the caller to call it like this: > > files_read_all_dirs_except(foo_t, - bar_t) > > > > This makes the call argument hard to deal with because it is neither a > > type nor a set. Also an argument like $2 -shadow_t could either be a > > set or an MLS range. > > > > The *_except interfaces are never used except for in the *_except_shadow > > interfaces. The calls to the *_except_shadow interfaces never specify a > > second argument. > > > > files_manage_all_files is called only in portage.te (with no exception) > > and authlogin.if. > > Theres two issues with this change: > > 1. It breaks API stability. That may be true, but the current interface makes no sense to me. If I use files_read_all_dirs_except(foo_t, bar_t) the resulting policy allows access to file_type and bar_t. It doesn't exclude anything. > 2. It doesn't work if you want to specify a set, e.g. > > files_read_all_dirs_except(foo_t, { bar_t baz_t }) > Why doesn't that work? Doesn't that give { file_type - { bar_t baz_t } }? Again, if you don't like the changes, that's fine. It is just something that will have to be worked around. Any changes that you do accept just makes life a easier. > > --- > > policy/modules/kernel/files.if | 92 +++++++++++++++++++++++++++++-------- > > policy/modules/system/authlogin.if | 10 ++-- > > 2 files changed, 79 insertions(+), 23 deletions(-) > > > > diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if > > index 5302dac..9212dea 100644 > > --- a/policy/modules/kernel/files.if > > +++ b/policy/modules/kernel/files.if > > @@ -689,7 +689,7 @@ interface(`files_read_all_dirs_except',` > > attribute file_type; > > ') > > > > - allow $1 { file_type $2 }:dir list_dir_perms; > > + allow $1 { file_type - $2 }:dir list_dir_perms; > > ') > > > > ######################################## > > @@ -714,7 +714,7 @@ interface(`files_read_all_files_except',` > > attribute file_type; > > ') > > > > - read_files_pattern($1, { file_type $2 }, { file_type $2 }) > > + read_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > > ') > > > > ######################################## > > @@ -739,7 +739,7 @@ interface(`files_read_all_symlinks_except',` > > attribute file_type; > > ') > > > > - read_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) > > + read_lnk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > > ') > > > > ######################################## > > @@ -1026,6 +1026,35 @@ interface(`files_read_all_chr_files',` > > > > ######################################## > > ##<summary> > > +## Relabel all files on the filesystem > > +##</summary> > > +##<param name="domain"> > > +##<summary> > > +## The type of the domain perfoming this action. > > +##</summary> > > +##</param> > > +##<rolecap/> > > +# > > +interface(`files_relabel_all_files',` > > + gen_require(` > > + attribute file_type; > > + ') > > + > > + allow $1 file_type : dir list_dir_perms; > > + relabel_dirs_pattern($1, file_type, file_type) > > + relabel_files_pattern($1, file_type, file_type) > > + relabel_lnk_files_pattern($1, file_type, file_type) > > + relabel_fifo_files_pattern($1, file_type, file_type) > > + relabel_sock_files_pattern($1, file_type, file_type) > > + relabelfrom_blk_files_pattern($1, file_type, file_type) > > + relabelfrom_chr_files_pattern($1, file_type, file_type) > > + > > + # satisfy the assertions: > > + seutil_relabelto_bin_policy($1) > > +') > > + > > +######################################## > > +##<summary> > > ## Relabel all files on the filesystem, except > > ## the listed exceptions. > > ##</summary> > > @@ -1042,21 +1071,21 @@ interface(`files_read_all_chr_files',` > > ##</param> > > ##<rolecap/> > > # > > -interface(`files_relabel_all_files',` > > +interface(`files_relabel_all_files_except',` > > gen_require(` > > attribute file_type; > > ') > > > > - allow $1 { file_type $2 }:dir list_dir_perms; > > - relabel_dirs_pattern($1, { file_type $2 }, { file_type $2 }) > > - relabel_files_pattern($1, { file_type $2 }, { file_type $2 }) > > - relabel_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) > > - relabel_fifo_files_pattern($1, { file_type $2 }, { file_type $2 }) > > - relabel_sock_files_pattern($1, { file_type $2 }, { file_type $2 }) > > + allow $1 { file_type - $2 }:dir list_dir_perms; > > + relabel_dirs_pattern($1, { file_type - $2 }, { file_type - $2 }) > > + relabel_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > > + relabel_lnk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > > + relabel_fifo_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > > + relabel_sock_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > > # this is only relabelfrom since there should be no > > # device nodes with file types. > > - relabelfrom_blk_files_pattern($1, { file_type $2 }, { file_type $2 }) > > - relabelfrom_chr_files_pattern($1, { file_type $2 }, { file_type $2 }) > > + relabelfrom_blk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > > + relabelfrom_chr_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > > > > # satisfy the assertions: > > seutil_relabelto_bin_policy($1) > > @@ -1090,6 +1119,33 @@ interface(`files_rw_all_files',` > > > > ######################################## > > ##<summary> > > +## Manage all files on the filesystem. > > +##</summary> > > +##<param name="domain"> > > +##<summary> > > +## The type of the domain perfoming this action. > > +##</summary> > > +##</param> > > +##<rolecap/> > > +# > > +interface(`files_manage_all_files',` > > + gen_require(` > > + attribute file_type; > > + ') > > + > > + manage_dirs_pattern($1, file_type, file_type) > > + manage_files_pattern($1, file_type, file_type) > > + manage_lnk_files_pattern($1, file_type, file_type) > > + manage_fifo_files_pattern($1, file_type, file_type) > > + manage_sock_files_pattern($1, file_type, file_type) > > + > > + # satisfy the assertions: > > + seutil_create_bin_policy($1) > > + files_manage_kernel_modules($1) > > +') > > + > > +######################################## > > +##<summary> > > ## Manage all files on the filesystem, except > > ## the listed exceptions. > > ##</summary> > > @@ -1106,16 +1162,16 @@ interface(`files_rw_all_files',` > > ##</param> > > ##<rolecap/> > > # > > -interface(`files_manage_all_files',` > > +interface(`files_manage_all_files_except',` > > gen_require(` > > attribute file_type; > > ') > > > > - manage_dirs_pattern($1, { file_type $2 }, { file_type $2 }) > > - manage_files_pattern($1, { file_type $2 }, { file_type $2 }) > > - manage_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) > > - manage_fifo_files_pattern($1, { file_type $2 }, { file_type $2 }) > > - manage_sock_files_pattern($1, { file_type $2 }, { file_type $2 }) > > + manage_dirs_pattern($1, { file_type - $2 }, { file_type - $2 }) > > + manage_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > > + manage_lnk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > > + manage_fifo_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > > + manage_sock_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > > > > # satisfy the assertions: > > seutil_create_bin_policy($1) > > diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if > > index 7fddc24..c116df6 100644 > > --- a/policy/modules/system/authlogin.if > > +++ b/policy/modules/system/authlogin.if > > @@ -1113,7 +1113,7 @@ interface(`auth_read_all_dirs_except_shadow',` > > type shadow_t; > > ') > > > > - files_read_all_dirs_except($1,$2 -shadow_t) > > + files_read_all_dirs_except($1, shadow_t) > > ') > > > > ######################################## > > @@ -1139,7 +1139,7 @@ interface(`auth_read_all_files_except_shadow',` > > type shadow_t; > > ') > > > > - files_read_all_files_except($1,$2 -shadow_t) > > + files_read_all_files_except($1, shadow_t) > > ') > > > > ######################################## > > @@ -1164,7 +1164,7 @@ interface(`auth_read_all_symlinks_except_shadow',` > > type shadow_t; > > ') > > > > - files_read_all_symlinks_except($1,$2 -shadow_t) > > + files_read_all_symlinks_except($1, shadow_t) > > ') > > > > ######################################## > > @@ -1190,7 +1190,7 @@ interface(`auth_relabel_all_files_except_shadow',` > > type shadow_t; > > ') > > > > - files_relabel_all_files($1,$2 -shadow_t) > > + files_relabel_all_files_except($1, shadow_t) > > ') > > > > ######################################## > > @@ -1242,7 +1242,7 @@ interface(`auth_manage_all_files_except_shadow',` > > type shadow_t; > > ') > > > > - files_manage_all_files($1,$2 -shadow_t) > > + files_manage_all_files_except($1, shadow_t) > > ') > > > > ######################################## > > > > -- James Carter <jwcart2@tycho.nsa.gov> National Security Agency ^ permalink raw reply [flat|nested] 5+ messages in thread
* [refpolicy] [m4-isms patch 5/6] Modify *_except interfaces to not have caller supply the "-" 2010-08-25 14:19 ` James Carter @ 2010-08-25 15:56 ` Christopher J. PeBenito 2010-08-25 17:10 ` James Carter 0 siblings, 1 reply; 5+ messages in thread From: Christopher J. PeBenito @ 2010-08-25 15:56 UTC (permalink / raw) To: refpolicy On 08/25/10 10:19, James Carter wrote: > On Wed, 2010-08-25 at 09:05 -0400, Christopher J. PeBenito wrote: >> On 08/24/10 15:50, James Carter wrote: >>> The *_except interfaces expect the caller to call it like this: >>> files_read_all_dirs_except(foo_t, - bar_t) >>> >>> This makes the call argument hard to deal with because it is neither a >>> type nor a set. Also an argument like $2 -shadow_t could either be a >>> set or an MLS range. >>> >>> The *_except interfaces are never used except for in the *_except_shadow >>> interfaces. The calls to the *_except_shadow interfaces never specify a >>> second argument. >>> >>> files_manage_all_files is called only in portage.te (with no exception) >>> and authlogin.if. >> >> Theres two issues with this change: >> >> 1. It breaks API stability. > > That may be true, but the current interface makes no sense to me. If I > use files_read_all_dirs_except(foo_t, bar_t) the resulting policy allows > access to file_type and bar_t. It doesn't exclude anything. > >> 2. It doesn't work if you want to specify a set, e.g. >> >> files_read_all_dirs_except(foo_t, { bar_t baz_t }) >> > Why doesn't that work? Doesn't that give > { file_type - { bar_t baz_t } }? I didn't think that was valid. Is it? > Again, if you don't like the changes, that's fine. It is just something > that will have to be worked around. Any changes that you do accept just > makes life a easier. I'd like to get rid of the interfaces completely. I just haven't come up with a better way of getting { files_type -shadow_t } without breaking encapsulation. Perhaps we just have to rethink the access or concept. >>> --- >>> policy/modules/kernel/files.if | 92 +++++++++++++++++++++++++++++-------- >>> policy/modules/system/authlogin.if | 10 ++-- >>> 2 files changed, 79 insertions(+), 23 deletions(-) >>> >>> diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if >>> index 5302dac..9212dea 100644 >>> --- a/policy/modules/kernel/files.if >>> +++ b/policy/modules/kernel/files.if >>> @@ -689,7 +689,7 @@ interface(`files_read_all_dirs_except',` >>> attribute file_type; >>> ') >>> >>> - allow $1 { file_type $2 }:dir list_dir_perms; >>> + allow $1 { file_type - $2 }:dir list_dir_perms; >>> ') >>> >>> ######################################## >>> @@ -714,7 +714,7 @@ interface(`files_read_all_files_except',` >>> attribute file_type; >>> ') >>> >>> - read_files_pattern($1, { file_type $2 }, { file_type $2 }) >>> + read_files_pattern($1, { file_type - $2 }, { file_type - $2 }) >>> ') >>> >>> ######################################## >>> @@ -739,7 +739,7 @@ interface(`files_read_all_symlinks_except',` >>> attribute file_type; >>> ') >>> >>> - read_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) >>> + read_lnk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) >>> ') >>> >>> ######################################## >>> @@ -1026,6 +1026,35 @@ interface(`files_read_all_chr_files',` >>> >>> ######################################## >>> ##<summary> >>> +## Relabel all files on the filesystem >>> +##</summary> >>> +##<param name="domain"> >>> +##<summary> >>> +## The type of the domain perfoming this action. >>> +##</summary> >>> +##</param> >>> +##<rolecap/> >>> +# >>> +interface(`files_relabel_all_files',` >>> + gen_require(` >>> + attribute file_type; >>> + ') >>> + >>> + allow $1 file_type : dir list_dir_perms; >>> + relabel_dirs_pattern($1, file_type, file_type) >>> + relabel_files_pattern($1, file_type, file_type) >>> + relabel_lnk_files_pattern($1, file_type, file_type) >>> + relabel_fifo_files_pattern($1, file_type, file_type) >>> + relabel_sock_files_pattern($1, file_type, file_type) >>> + relabelfrom_blk_files_pattern($1, file_type, file_type) >>> + relabelfrom_chr_files_pattern($1, file_type, file_type) >>> + >>> + # satisfy the assertions: >>> + seutil_relabelto_bin_policy($1) >>> +') >>> + >>> +######################################## >>> +##<summary> >>> ## Relabel all files on the filesystem, except >>> ## the listed exceptions. >>> ##</summary> >>> @@ -1042,21 +1071,21 @@ interface(`files_read_all_chr_files',` >>> ##</param> >>> ##<rolecap/> >>> # >>> -interface(`files_relabel_all_files',` >>> +interface(`files_relabel_all_files_except',` >>> gen_require(` >>> attribute file_type; >>> ') >>> >>> - allow $1 { file_type $2 }:dir list_dir_perms; >>> - relabel_dirs_pattern($1, { file_type $2 }, { file_type $2 }) >>> - relabel_files_pattern($1, { file_type $2 }, { file_type $2 }) >>> - relabel_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) >>> - relabel_fifo_files_pattern($1, { file_type $2 }, { file_type $2 }) >>> - relabel_sock_files_pattern($1, { file_type $2 }, { file_type $2 }) >>> + allow $1 { file_type - $2 }:dir list_dir_perms; >>> + relabel_dirs_pattern($1, { file_type - $2 }, { file_type - $2 }) >>> + relabel_files_pattern($1, { file_type - $2 }, { file_type - $2 }) >>> + relabel_lnk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) >>> + relabel_fifo_files_pattern($1, { file_type - $2 }, { file_type - $2 }) >>> + relabel_sock_files_pattern($1, { file_type - $2 }, { file_type - $2 }) >>> # this is only relabelfrom since there should be no >>> # device nodes with file types. >>> - relabelfrom_blk_files_pattern($1, { file_type $2 }, { file_type $2 }) >>> - relabelfrom_chr_files_pattern($1, { file_type $2 }, { file_type $2 }) >>> + relabelfrom_blk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) >>> + relabelfrom_chr_files_pattern($1, { file_type - $2 }, { file_type - $2 }) >>> >>> # satisfy the assertions: >>> seutil_relabelto_bin_policy($1) >>> @@ -1090,6 +1119,33 @@ interface(`files_rw_all_files',` >>> >>> ######################################## >>> ##<summary> >>> +## Manage all files on the filesystem. >>> +##</summary> >>> +##<param name="domain"> >>> +##<summary> >>> +## The type of the domain perfoming this action. >>> +##</summary> >>> +##</param> >>> +##<rolecap/> >>> +# >>> +interface(`files_manage_all_files',` >>> + gen_require(` >>> + attribute file_type; >>> + ') >>> + >>> + manage_dirs_pattern($1, file_type, file_type) >>> + manage_files_pattern($1, file_type, file_type) >>> + manage_lnk_files_pattern($1, file_type, file_type) >>> + manage_fifo_files_pattern($1, file_type, file_type) >>> + manage_sock_files_pattern($1, file_type, file_type) >>> + >>> + # satisfy the assertions: >>> + seutil_create_bin_policy($1) >>> + files_manage_kernel_modules($1) >>> +') >>> + >>> +######################################## >>> +##<summary> >>> ## Manage all files on the filesystem, except >>> ## the listed exceptions. >>> ##</summary> >>> @@ -1106,16 +1162,16 @@ interface(`files_rw_all_files',` >>> ##</param> >>> ##<rolecap/> >>> # >>> -interface(`files_manage_all_files',` >>> +interface(`files_manage_all_files_except',` >>> gen_require(` >>> attribute file_type; >>> ') >>> >>> - manage_dirs_pattern($1, { file_type $2 }, { file_type $2 }) >>> - manage_files_pattern($1, { file_type $2 }, { file_type $2 }) >>> - manage_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) >>> - manage_fifo_files_pattern($1, { file_type $2 }, { file_type $2 }) >>> - manage_sock_files_pattern($1, { file_type $2 }, { file_type $2 }) >>> + manage_dirs_pattern($1, { file_type - $2 }, { file_type - $2 }) >>> + manage_files_pattern($1, { file_type - $2 }, { file_type - $2 }) >>> + manage_lnk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) >>> + manage_fifo_files_pattern($1, { file_type - $2 }, { file_type - $2 }) >>> + manage_sock_files_pattern($1, { file_type - $2 }, { file_type - $2 }) >>> >>> # satisfy the assertions: >>> seutil_create_bin_policy($1) >>> diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if >>> index 7fddc24..c116df6 100644 >>> --- a/policy/modules/system/authlogin.if >>> +++ b/policy/modules/system/authlogin.if >>> @@ -1113,7 +1113,7 @@ interface(`auth_read_all_dirs_except_shadow',` >>> type shadow_t; >>> ') >>> >>> - files_read_all_dirs_except($1,$2 -shadow_t) >>> + files_read_all_dirs_except($1, shadow_t) >>> ') >>> >>> ######################################## >>> @@ -1139,7 +1139,7 @@ interface(`auth_read_all_files_except_shadow',` >>> type shadow_t; >>> ') >>> >>> - files_read_all_files_except($1,$2 -shadow_t) >>> + files_read_all_files_except($1, shadow_t) >>> ') >>> >>> ######################################## >>> @@ -1164,7 +1164,7 @@ interface(`auth_read_all_symlinks_except_shadow',` >>> type shadow_t; >>> ') >>> >>> - files_read_all_symlinks_except($1,$2 -shadow_t) >>> + files_read_all_symlinks_except($1, shadow_t) >>> ') >>> >>> ######################################## >>> @@ -1190,7 +1190,7 @@ interface(`auth_relabel_all_files_except_shadow',` >>> type shadow_t; >>> ') >>> >>> - files_relabel_all_files($1,$2 -shadow_t) >>> + files_relabel_all_files_except($1, shadow_t) >>> ') >>> >>> ######################################## >>> @@ -1242,7 +1242,7 @@ interface(`auth_manage_all_files_except_shadow',` >>> type shadow_t; >>> ') >>> >>> - files_manage_all_files($1,$2 -shadow_t) >>> + files_manage_all_files_except($1, shadow_t) >>> ') >>> >>> ######################################## >>> >> >> > -- Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com ^ permalink raw reply [flat|nested] 5+ messages in thread
* [refpolicy] [m4-isms patch 5/6] Modify *_except interfaces to not have caller supply the "-" 2010-08-25 15:56 ` Christopher J. PeBenito @ 2010-08-25 17:10 ` James Carter 0 siblings, 0 replies; 5+ messages in thread From: James Carter @ 2010-08-25 17:10 UTC (permalink / raw) To: refpolicy On Wed, 2010-08-25 at 11:56 -0400, Christopher J. PeBenito wrote: > On 08/25/10 10:19, James Carter wrote: > > On Wed, 2010-08-25 at 09:05 -0400, Christopher J. PeBenito wrote: > >> On 08/24/10 15:50, James Carter wrote: > >>> The *_except interfaces expect the caller to call it like this: > >>> files_read_all_dirs_except(foo_t, - bar_t) > >>> > >>> This makes the call argument hard to deal with because it is neither a > >>> type nor a set. Also an argument like $2 -shadow_t could either be a > >>> set or an MLS range. > >>> > >>> The *_except interfaces are never used except for in the *_except_shadow > >>> interfaces. The calls to the *_except_shadow interfaces never specify a > >>> second argument. > >>> > >>> files_manage_all_files is called only in portage.te (with no exception) > >>> and authlogin.if. > >> > >> Theres two issues with this change: > >> > >> 1. It breaks API stability. > > > > That may be true, but the current interface makes no sense to me. If I > > use files_read_all_dirs_except(foo_t, bar_t) the resulting policy allows > > access to file_type and bar_t. It doesn't exclude anything. > > > >> 2. It doesn't work if you want to specify a set, e.g. > >> > >> files_read_all_dirs_except(foo_t, { bar_t baz_t }) > >> > > Why doesn't that work? Doesn't that give > > { file_type - { bar_t baz_t } }? > > I didn't think that was valid. Is it? You're right. It's not valid. I didn't realize the set expressions were that limited. And I went through all that trouble making sure that my parser could handle arbitrary set expressions. > > > Again, if you don't like the changes, that's fine. It is just something > > that will have to be worked around. Any changes that you do accept just > > makes life a easier. > > I'd like to get rid of the interfaces completely. I just haven't come > up with a better way of getting { files_type -shadow_t } without > breaking encapsulation. Perhaps we just have to rethink the access or > concept. > The interfaces are only used in Refpolicy for shadow_t. If special interfaces could be made for shadow_t, while retaining the old ones for compatibility, then at least Refpolicy itself would not have "-shadow_t" as an argument. That would help a bunch. > >>> --- > >>> policy/modules/kernel/files.if | 92 +++++++++++++++++++++++++++++-------- > >>> policy/modules/system/authlogin.if | 10 ++-- > >>> 2 files changed, 79 insertions(+), 23 deletions(-) > >>> > >>> diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if > >>> index 5302dac..9212dea 100644 > >>> --- a/policy/modules/kernel/files.if > >>> +++ b/policy/modules/kernel/files.if > >>> @@ -689,7 +689,7 @@ interface(`files_read_all_dirs_except',` > >>> attribute file_type; > >>> ') > >>> > >>> - allow $1 { file_type $2 }:dir list_dir_perms; > >>> + allow $1 { file_type - $2 }:dir list_dir_perms; > >>> ') > >>> > >>> ######################################## > >>> @@ -714,7 +714,7 @@ interface(`files_read_all_files_except',` > >>> attribute file_type; > >>> ') > >>> > >>> - read_files_pattern($1, { file_type $2 }, { file_type $2 }) > >>> + read_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > >>> ') > >>> > >>> ######################################## > >>> @@ -739,7 +739,7 @@ interface(`files_read_all_symlinks_except',` > >>> attribute file_type; > >>> ') > >>> > >>> - read_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) > >>> + read_lnk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > >>> ') > >>> > >>> ######################################## > >>> @@ -1026,6 +1026,35 @@ interface(`files_read_all_chr_files',` > >>> > >>> ######################################## > >>> ##<summary> > >>> +## Relabel all files on the filesystem > >>> +##</summary> > >>> +##<param name="domain"> > >>> +##<summary> > >>> +## The type of the domain perfoming this action. > >>> +##</summary> > >>> +##</param> > >>> +##<rolecap/> > >>> +# > >>> +interface(`files_relabel_all_files',` > >>> + gen_require(` > >>> + attribute file_type; > >>> + ') > >>> + > >>> + allow $1 file_type : dir list_dir_perms; > >>> + relabel_dirs_pattern($1, file_type, file_type) > >>> + relabel_files_pattern($1, file_type, file_type) > >>> + relabel_lnk_files_pattern($1, file_type, file_type) > >>> + relabel_fifo_files_pattern($1, file_type, file_type) > >>> + relabel_sock_files_pattern($1, file_type, file_type) > >>> + relabelfrom_blk_files_pattern($1, file_type, file_type) > >>> + relabelfrom_chr_files_pattern($1, file_type, file_type) > >>> + > >>> + # satisfy the assertions: > >>> + seutil_relabelto_bin_policy($1) > >>> +') > >>> + > >>> +######################################## > >>> +##<summary> > >>> ## Relabel all files on the filesystem, except > >>> ## the listed exceptions. > >>> ##</summary> > >>> @@ -1042,21 +1071,21 @@ interface(`files_read_all_chr_files',` > >>> ##</param> > >>> ##<rolecap/> > >>> # > >>> -interface(`files_relabel_all_files',` > >>> +interface(`files_relabel_all_files_except',` > >>> gen_require(` > >>> attribute file_type; > >>> ') > >>> > >>> - allow $1 { file_type $2 }:dir list_dir_perms; > >>> - relabel_dirs_pattern($1, { file_type $2 }, { file_type $2 }) > >>> - relabel_files_pattern($1, { file_type $2 }, { file_type $2 }) > >>> - relabel_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) > >>> - relabel_fifo_files_pattern($1, { file_type $2 }, { file_type $2 }) > >>> - relabel_sock_files_pattern($1, { file_type $2 }, { file_type $2 }) > >>> + allow $1 { file_type - $2 }:dir list_dir_perms; > >>> + relabel_dirs_pattern($1, { file_type - $2 }, { file_type - $2 }) > >>> + relabel_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > >>> + relabel_lnk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > >>> + relabel_fifo_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > >>> + relabel_sock_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > >>> # this is only relabelfrom since there should be no > >>> # device nodes with file types. > >>> - relabelfrom_blk_files_pattern($1, { file_type $2 }, { file_type $2 }) > >>> - relabelfrom_chr_files_pattern($1, { file_type $2 }, { file_type $2 }) > >>> + relabelfrom_blk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > >>> + relabelfrom_chr_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > >>> > >>> # satisfy the assertions: > >>> seutil_relabelto_bin_policy($1) > >>> @@ -1090,6 +1119,33 @@ interface(`files_rw_all_files',` > >>> > >>> ######################################## > >>> ##<summary> > >>> +## Manage all files on the filesystem. > >>> +##</summary> > >>> +##<param name="domain"> > >>> +##<summary> > >>> +## The type of the domain perfoming this action. > >>> +##</summary> > >>> +##</param> > >>> +##<rolecap/> > >>> +# > >>> +interface(`files_manage_all_files',` > >>> + gen_require(` > >>> + attribute file_type; > >>> + ') > >>> + > >>> + manage_dirs_pattern($1, file_type, file_type) > >>> + manage_files_pattern($1, file_type, file_type) > >>> + manage_lnk_files_pattern($1, file_type, file_type) > >>> + manage_fifo_files_pattern($1, file_type, file_type) > >>> + manage_sock_files_pattern($1, file_type, file_type) > >>> + > >>> + # satisfy the assertions: > >>> + seutil_create_bin_policy($1) > >>> + files_manage_kernel_modules($1) > >>> +') > >>> + > >>> +######################################## > >>> +##<summary> > >>> ## Manage all files on the filesystem, except > >>> ## the listed exceptions. > >>> ##</summary> > >>> @@ -1106,16 +1162,16 @@ interface(`files_rw_all_files',` > >>> ##</param> > >>> ##<rolecap/> > >>> # > >>> -interface(`files_manage_all_files',` > >>> +interface(`files_manage_all_files_except',` > >>> gen_require(` > >>> attribute file_type; > >>> ') > >>> > >>> - manage_dirs_pattern($1, { file_type $2 }, { file_type $2 }) > >>> - manage_files_pattern($1, { file_type $2 }, { file_type $2 }) > >>> - manage_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) > >>> - manage_fifo_files_pattern($1, { file_type $2 }, { file_type $2 }) > >>> - manage_sock_files_pattern($1, { file_type $2 }, { file_type $2 }) > >>> + manage_dirs_pattern($1, { file_type - $2 }, { file_type - $2 }) > >>> + manage_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > >>> + manage_lnk_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > >>> + manage_fifo_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > >>> + manage_sock_files_pattern($1, { file_type - $2 }, { file_type - $2 }) > >>> > >>> # satisfy the assertions: > >>> seutil_create_bin_policy($1) > >>> diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if > >>> index 7fddc24..c116df6 100644 > >>> --- a/policy/modules/system/authlogin.if > >>> +++ b/policy/modules/system/authlogin.if > >>> @@ -1113,7 +1113,7 @@ interface(`auth_read_all_dirs_except_shadow',` > >>> type shadow_t; > >>> ') > >>> > >>> - files_read_all_dirs_except($1,$2 -shadow_t) > >>> + files_read_all_dirs_except($1, shadow_t) > >>> ') > >>> > >>> ######################################## > >>> @@ -1139,7 +1139,7 @@ interface(`auth_read_all_files_except_shadow',` > >>> type shadow_t; > >>> ') > >>> > >>> - files_read_all_files_except($1,$2 -shadow_t) > >>> + files_read_all_files_except($1, shadow_t) > >>> ') > >>> > >>> ######################################## > >>> @@ -1164,7 +1164,7 @@ interface(`auth_read_all_symlinks_except_shadow',` > >>> type shadow_t; > >>> ') > >>> > >>> - files_read_all_symlinks_except($1,$2 -shadow_t) > >>> + files_read_all_symlinks_except($1, shadow_t) > >>> ') > >>> > >>> ######################################## > >>> @@ -1190,7 +1190,7 @@ interface(`auth_relabel_all_files_except_shadow',` > >>> type shadow_t; > >>> ') > >>> > >>> - files_relabel_all_files($1,$2 -shadow_t) > >>> + files_relabel_all_files_except($1, shadow_t) > >>> ') > >>> > >>> ######################################## > >>> @@ -1242,7 +1242,7 @@ interface(`auth_manage_all_files_except_shadow',` > >>> type shadow_t; > >>> ') > >>> > >>> - files_manage_all_files($1,$2 -shadow_t) > >>> + files_manage_all_files_except($1, shadow_t) > >>> ') > >>> > >>> ######################################## > >>> > >> > >> > > > > -- James Carter <jwcart2@tycho.nsa.gov> National Security Agency ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2010-08-25 17:10 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2010-08-24 19:50 [refpolicy] [m4-isms patch 5/6] Modify *_except interfaces to not have caller supply the "-" James Carter 2010-08-25 13:05 ` Christopher J. PeBenito 2010-08-25 14:19 ` James Carter 2010-08-25 15:56 ` Christopher J. PeBenito 2010-08-25 17:10 ` James Carter
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.