Question about policy module error message

Question about policy module error message

[Moyer, Thomas - 0668 - MITLL]

[-- Attachment #1.1: Type: text/plain, Size: 1642 bytes --]

I am trying to build an SELinux policy module for a piece of software I am
writing. I used sepolgen to create an initial skeleton policy (running on
Red Hat Enterprise Linux 6). I get the following error when I try and
install the policy:

sudo ./interface.sh
Building and Loading Policy
+ make -f /usr/share/selinux/devel/Makefile
make: Nothing to be done for `all'.
+ /usr/sbin/semodule -i interface.pp
libsemanage.semanage_fc_sort: WARNING: semanage_fc_sort: Incomplete context.
libsepol.sepol_context_from_string: malformed context "dnl"
libsepol.sepol_context_from_string: could not construct context from string
libsepol.context_from_string: could not create context structure
libsepol.sepol_context_to_sid: could not convert dnl to sid
invalid context dnl
libsemanage.semanage_install_active: setfiles returned error code 1.
/usr/sbin/semodule:  Failed!

Below is the interface.fc file since I think the error might be in there.
/usr/local/bin/interface --
gen_context(system_u:object_r:interface_exec_t,s0)
/usr/local/libexec/interface gen_context(system_u:object_r:usr_t,s0)
/usr/local/libexec/interface/WebApp.jar --
gen_context(system_u:object_r:httpd_sys_content_t,s0)
/usr/local/libexec/interface/keystore --
gen_context(system_u:object_r:interfaceKey_t,s0)
/usr/local/libexec/interface/ui-files(/.*)?
gen_context(system_u:object_r:httpd_sys_content_t,s0)

Not sure how to go about debugging this.

Thanks for the help.

-Tom

-- 
Thomas Moyer, Technical Staff voice: (781) 981-1374
Cyber Systems Technology Group mobile: (857) 268-0493
MIT Lincoln Laboratory email: thomas.moyer@ll.mit.edu
244 Wood Street
Lexington, MA 02420



[-- Attachment #1.2: Type: text/html, Size: 3042 bytes --]

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 5142 bytes --]

Re: Question about policy module error message

[Dominick Grift]

On Tue, 2012-10-23 at 15:28 -0400, Moyer, Thomas - 0668 - MITLL wrote:
> I am trying to build an SELinux policy module for a piece of software
> I am writing. I used sepolgen to create an initial skeleton policy
> (running on Red Hat Enterprise Linux 6). I get the following error
> when I try and install the policy:
> 
> 
> sudo ./interface.sh
> Building and Loading Policy
> + make -f /usr/share/selinux/devel/Makefile
> make: Nothing to be done for `all'.
> + /usr/sbin/semodule -i interface.pp
> libsemanage.semanage_fc_sort: WARNING: semanage_fc_sort: Incomplete
> context.
> libsepol.sepol_context_from_string: malformed context "dnl"
> libsepol.sepol_context_from_string: could not construct context from
> string
> libsepol.context_from_string: could not create context structure
> libsepol.sepol_context_to_sid: could not convert dnl to sid
> invalid context dnl
> libsemanage.semanage_install_active: setfiles returned error code 1.
> /usr/sbin/semodule:  Failed!
> 
> 
> Below is the interface.fc file since I think the error might be in
> there.
> /usr/local/bin/interface --
> gen_context(system_u:object_r:interface_exec_t,s0)
> /usr/local/libexec/interface gen_context(system_u:object_r:usr_t,s0)
> /usr/local/libexec/interface/WebApp.jar --
> gen_context(system_u:object_r:httpd_sys_content_t,s0)
> /usr/local/libexec/interface/keystore --
> gen_context(system_u:object_r:interfaceKey_t,s0)
> /usr/local/libexec/interface/ui-files(/.*)?
> gen_context(system_u:object_r:httpd_sys_content_t,s0)
> 

Maybe "interface" is a keyword. Could you try another name for the sake
of testing?

The .fc contents look OK to me.

Also make sure that the .fc has a newline at the end ( but i do not
think this is what causes this

> Not sure how to go about debugging this.
> 
> 
> Thanks for the help.
> 
> 
> -Tom
> 
> 
> -- 
> Thomas Moyer, Technical Staff voice: (781) 981-1374
> Cyber Systems Technology Group mobile: (857) 268-0493
> MIT Lincoln Laboratory email: thomas.moyer@ll.mit.edu
> 244 Wood Street
> Lexington, MA 02420



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Question about policy module error message

[Moyer, Thomas - 0668 - MITLL]

[-- Attachment #1: Type: text/plain, Size: 2729 bytes --]

So it turns out that the name I used it didn't like and the second name I
used (ui-interface) is also didn't like.

When I tried uiInterface, things started working again. I don't know what
the difference is, but maybe someone can enlighten me as to why the
SELinux policy generation tools don't like things with hyphens in the name?

-Tom

-- 
Thomas Moyer, Technical Staff		voice: (781) 981-1374
Cyber Systems Technology Group		mobile: (857) 268-0493
MIT Lincoln Laboratory				email: thomas.moyer@ll.mit.edu
244 Wood Street
Lexington, MA 02420







On 10/23/12 3:52 PM, "Dominick Grift" <dominick.grift@gmail.com> wrote:

>
>
>On Tue, 2012-10-23 at 15:28 -0400, Moyer, Thomas - 0668 - MITLL wrote:
>> I am trying to build an SELinux policy module for a piece of software
>> I am writing. I used sepolgen to create an initial skeleton policy
>> (running on Red Hat Enterprise Linux 6). I get the following error
>> when I try and install the policy:
>> 
>> 
>> sudo ./interface.sh
>> Building and Loading Policy
>> + make -f /usr/share/selinux/devel/Makefile
>> make: Nothing to be done for `all'.
>> + /usr/sbin/semodule -i interface.pp
>> libsemanage.semanage_fc_sort: WARNING: semanage_fc_sort: Incomplete
>> context.
>> libsepol.sepol_context_from_string: malformed context "dnl"
>> libsepol.sepol_context_from_string: could not construct context from
>> string
>> libsepol.context_from_string: could not create context structure
>> libsepol.sepol_context_to_sid: could not convert dnl to sid
>> invalid context dnl
>> libsemanage.semanage_install_active: setfiles returned error code 1.
>> /usr/sbin/semodule:  Failed!
>> 
>> 
>> Below is the interface.fc file since I think the error might be in
>> there.
>> /usr/local/bin/interface --
>> gen_context(system_u:object_r:interface_exec_t,s0)
>> /usr/local/libexec/interface gen_context(system_u:object_r:usr_t,s0)
>> /usr/local/libexec/interface/WebApp.jar --
>> gen_context(system_u:object_r:httpd_sys_content_t,s0)
>> /usr/local/libexec/interface/keystore --
>> gen_context(system_u:object_r:interfaceKey_t,s0)
>> /usr/local/libexec/interface/ui-files(/.*)?
>> gen_context(system_u:object_r:httpd_sys_content_t,s0)
>> 
>
>Maybe "interface" is a keyword. Could you try another name for the sake
>of testing?
>
>The .fc contents look OK to me.
>
>Also make sure that the .fc has a newline at the end ( but i do not
>think this is what causes this
>
>> Not sure how to go about debugging this.
>> 
>> 
>> Thanks for the help.
>> 
>> 
>> -Tom
>> 
>> 
>> -- 
>> Thomas Moyer, Technical Staff voice: (781) 981-1374
>> Cyber Systems Technology Group mobile: (857) 268-0493
>> MIT Lincoln Laboratory email: thomas.moyer@ll.mit.edu
>> 244 Wood Street
>> Lexington, MA 02420
>
>

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 5142 bytes --]

Re: Question about policy module error message

[Dominick Grift]

On Tue, 2012-10-23 at 16:30 -0400, Moyer, Thomas - 0668 - MITLL wrote:
> So it turns out that the name I used it didn't like and the second name I
> used (ui-interface) is also didn't like.
> 
> When I tried uiInterface, things started working again. I don't know what
> the difference is, but maybe someone can enlighten me as to why the
> SELinux policy generation tools don't like things with hyphens in the name?
> 
> -Tom
> 

I suspect that it chokes on "interface". The hyphen might make
ui-interface seem like ui and interface to it or so

interface is used in the m4 macro's (it is a part of what makes selinux
policy modular):

> ##############################
> #
> # In the future interfaces should be in loadable modules
> #
> # interface(name,rules)
> #
> define(`interface',` dnl
> 	ifdef(`$1',`refpolicyerr(`duplicate definition of $1(). Original definition on '$1.) define(`__if_error')',`define(`$1',__line__)') dnl
> 	`define(`$1',` dnl
> 	pushdef(`policy_call_depth',incr(policy_call_depth)) dnl
> 	policy_m4_comment(policy_call_depth,begin `$1'(dollarsstar)) dnl
> 	$2
> 	popdef(`policy_call_depth') dnl
> 	policy_m4_comment(policy_call_depth,end `$1'(dollarsstar)) dnl
> 	'')
> ')
> 

So as long as you avoid keywords like (-)?interface(-)?, (-)?template(-)? (and maybe some others) it may work



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Question about policy module error message

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/23/2012 03:28 PM, Moyer, Thomas - 0668 - MITLL wrote:
> I am trying to build an SELinux policy module for a piece of software I am 
> writing. I used sepolgen to create an initial skeleton policy (running on
> Red Hat Enterprise Linux 6). I get the following error when I try and
> install the policy:
> 
> sudo ./interface.sh Building and Loading Policy + make -f
> /usr/share/selinux/devel/Makefile make: Nothing to be done for `all'. +
> /usr/sbin/semodule -i interface.pp libsemanage.semanage_fc_sort: WARNING:
> semanage_fc_sort: Incomplete context. libsepol.sepol_context_from_string:
> malformed context "dnl" libsepol.sepol_context_from_string: could not
> construct context from string libsepol.context_from_string: could not
> create context structure libsepol.sepol_context_to_sid: could not convert
> dnl to sid invalid context dnl libsemanage.semanage_install_active:
> setfiles returned error code 1. /usr/sbin/semodule:  Failed!
> 
> Below is the interface.fc file since I think the error might be in there. 
> /usr/local/bin/interface--gen_context(system_u:object_r:interface_exec_t,s0)
>
> 
/usr/local/libexec/interfacegen_context(system_u:object_r:usr_t,s0)
> /usr/local/libexec/interface/WebApp.jar--gen_context(system_u:object_r:httpd_sys_content_t,s0)
>
> 
/usr/local/libexec/interface/keystore--gen_context(system_u:object_r:interfaceKey_t,s0)
> /usr/local/libexec/interface/ui-files(/.*)?gen_context(system_u:object_r:httpd_sys_content_t,s0)
>
>  Not sure how to go about debugging this.
> 
> Thanks for the help.
> 
> -Tom
> 
> -- Thomas Moyer, Technical Staffvoice: (781) 981-1374 Cyber Systems
> Technology Groupmobile: (857) 268-0493 MIT Lincoln Laboratoryemail:
> thomas.moyer@ll.mit.edu <mailto:thomas.moyer@ll.mit.edu> 244 Wood Street 
> Lexington, MA 02420
Can you attach all the files  libsemanage seems to be complaining about dnl,
but not sure if that is really in one of your files.  Also defining context
for usr_t,  and httpd_sys_content_t should not be required or should be pushed
to the base httpd package.

- From looking at the file context layout it looks like your app should be
cleaned up to put content into better directories.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iEYEARECAAYFAlCH7WIACgkQrlYvE4MpobMNAgCguTt/8z+zEyTNx9nlFAA7EBgP
9aAAn1gWyEgUoP4yB06o3dan+GjvniJp
=3avV
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Question about policy module error message

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/23/2012 03:28 PM, Moyer, Thomas - 0668 - MITLL wrote:
> I am trying to build an SELinux policy module for a piece of software I am 
> writing. I used sepolgen to create an initial skeleton policy (running on
> Red Hat Enterprise Linux 6). I get the following error when I try and
> install the policy:
> 
> sudo ./interface.sh Building and Loading Policy + make -f
> /usr/share/selinux/devel/Makefile make: Nothing to be done for `all'. +
> /usr/sbin/semodule -i interface.pp libsemanage.semanage_fc_sort: WARNING:
> semanage_fc_sort: Incomplete context. libsepol.sepol_context_from_string:
> malformed context "dnl" libsepol.sepol_context_from_string: could not
> construct context from string libsepol.context_from_string: could not
> create context structure libsepol.sepol_context_to_sid: could not convert
> dnl to sid invalid context dnl libsemanage.semanage_install_active:
> setfiles returned error code 1. /usr/sbin/semodule:  Failed!
> 
> Below is the interface.fc file since I think the error might be in there. 
> /usr/local/bin/interface--gen_context(system_u:object_r:interface_exec_t,s0)
>
> 
/usr/local/libexec/interfacegen_context(system_u:object_r:usr_t,s0)
> /usr/local/libexec/interface/WebApp.jar--gen_context(system_u:object_r:httpd_sys_content_t,s0)
>
> 
/usr/local/libexec/interface/keystore--gen_context(system_u:object_r:interfaceKey_t,s0)
> /usr/local/libexec/interface/ui-files(/.*)?gen_context(system_u:object_r:httpd_sys_content_t,s0)
>
>  Not sure how to go about debugging this.
> 
> Thanks for the help.
> 
> -Tom
> 
> -- Thomas Moyer, Technical Staffvoice: (781) 981-1374 Cyber Systems
> Technology Groupmobile: (857) 268-0493 MIT Lincoln Laboratoryemail:
> thomas.moyer@ll.mit.edu <mailto:thomas.moyer@ll.mit.edu> 244 Wood Street 
> Lexington, MA 02420

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iEYEARECAAYFAlCH8V4ACgkQrlYvE4MpobPDWACg5xFkTK7zVH8iGcFiJlhNhL+g
gAMAmgIWUxhqjNqWPofHJPggPrA5u0mI
=DjZp
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Question about policy module error message

[Christopher J. PeBenito]

On 10/23/12 16:49, Dominick Grift wrote:
> 
> 
> On Tue, 2012-10-23 at 16:30 -0400, Moyer, Thomas - 0668 - MITLL wrote:
>> So it turns out that the name I used it didn't like and the second name I
>> used (ui-interface) is also didn't like.
>>
>> When I tried uiInterface, things started working again. I don't know what
>> the difference is, but maybe someone can enlighten me as to why the
>> SELinux policy generation tools don't like things with hyphens in the name?
>>
>> -Tom
>>
> 
> I suspect that it chokes on "interface". The hyphen might make
> ui-interface seem like ui and interface to it or so
> 
> interface is used in the m4 macro's (it is a part of what makes selinux
> policy modular):
> 
>> ##############################
>> #
>> # In the future interfaces should be in loadable modules
>> #
>> # interface(name,rules)
>> #
>> define(`interface',` dnl
>> 	ifdef(`$1',`refpolicyerr(`duplicate definition of $1(). Original definition on '$1.) define(`__if_error')',`define(`$1',__line__)') dnl
>> 	`define(`$1',` dnl
>> 	pushdef(`policy_call_depth',incr(policy_call_depth)) dnl
>> 	policy_m4_comment(policy_call_depth,begin `$1'(dollarsstar)) dnl
>> 	$2
>> 	popdef(`policy_call_depth') dnl
>> 	policy_m4_comment(policy_call_depth,end `$1'(dollarsstar)) dnl
>> 	'')
>> ')
>>
> 
> So as long as you avoid keywords like (-)?interface(-)?, (-)?template(-)? (and maybe some others) it may work

I'll see what I can do to fix this situation.  I think we should be able to adjust the refpolicy infrastructure to not have these keyword problems since the only macro we really need for processing .fc files is gen_context().

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.