Re: Boolean change of names.

[Daniel J Walsh <dwalsh@redhat.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/11/2012 01:34 PM, Stephen Smalley wrote:
> On Mon, 2012-06-11 at 13:21 -0400, Eric Paris wrote:
>> On Mon, Jun 11, 2012 at 12:51 PM, Stephen Smalley <sds@tycho.nsa.gov>
>> wrote:
>>> On Mon, 2012-06-11 at 12:12 -0400, Daniel J Walsh wrote:
>>>> We have started pushing a boolean change into Fedora 18.
>>>> 
>>>> https://fedoraproject.org/wiki/Features/SELinuxBooleansRename
>>>> 
>>>> The problem we are seeing is that boolean names used within an
>>>> interface are causing the install to fail on rebuild of policy.
>>>> 
>>>> IE If I installed a custom policy with a boolean used in it, and the
>>>> boolean changed then the module will blow up the policy compile.
>>>> 
>>>> 
>>>> interface(`kerberos_manage_host_rcache',` gen_require(` type
>>>> krb5_host_rcache_t; ')
>>>> 
>>>> ...
>>>> 
>>>> tunable_policy(`allow_kerberos',` allow $1 self:process setfscreate; 
>>>> ... ')
>>>> 
>>>> ... ')
>>>> 
>>>> And change the allow_kerberos to kerberos_enabled.
>>>> 
>>>> One idea would be to pull the translations into the semanage, or
>>>> would I need to do this at a lower level.  Or are we stuck with these
>>>> bad names forever...
>>> 
>>> Adding boolean aliases to the policy language, including kernel
>>> support, seems like the best route if you truly want to do this.
>> 
>> What does 'including kernel support' mean?  Expose both names in the 
>> booleans/ directory?
> 
> Yes, you would need to do that if you want [gs]etsebool or semanage boolean
> to support use of either name.
> 
> I guess if you only want this support for policy modules, you could do it
> entirely within libsepol and have it remap all aliases to their primary
> names during policy link/expand.
> 
> 
Adding a
boolalias newbool alias oldbool;

Is fine with me, although I still think we would need to generate a
translation table for libselinux.

getsebool allow_ypbind
nis_enabled --> off


And the kernel does not see the aliases.



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk/WL6gACgkQrlYvE4MpobM7DQCglWRmFTs5UAsO2RiJMiDc5F+0
BK0AoOrmGk7uS3MJD9Vxu5/CkO3LHHSr
=HgF6
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.