[refpolicy] [PATCH] Remove optional else block for dhcp ping

[refpolicy] [PATCH] Remove optional else block for dhcp ping

[Steve Lawrence]

Else blocks with optional statements are not supported in CIL.
Currently, if the pp to CIL compiler comes across one of these in a pp
module, it just drops the block and outputs a warning. Fortunately,
these are very rare. In fact, this is the only place in refpolicy where
an optional else block is used, and it is not clear if it is even
needed. This patch is untested, and is more to spark discussions to see
if there are any thoughts about whether or not this piece of policy is
needed.

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
---
 policy/modules/system/sysnetwork.te | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
index 705496d..ddb5a92 100644
--- a/policy/modules/system/sysnetwork.te
+++ b/policy/modules/system/sysnetwork.te
@@ -195,9 +195,6 @@ optional_policy(`
 optional_policy(`
 	netutils_run_ping(dhcpc_t, dhcpc_roles)
 	netutils_run(dhcpc_t, dhcpc_roles)
-',`
-	allow dhcpc_t self:capability setuid;
-	allow dhcpc_t self:rawip_socket create_socket_perms;
 ')
 
 optional_policy(`
-- 
1.9.3

[refpolicy] [PATCH] Remove optional else block for dhcp ping

[Christopher J. PeBenito]

On 12/2/2014 11:27 AM, Steve Lawrence wrote:
> Else blocks with optional statements are not supported in CIL.
> Currently, if the pp to CIL compiler comes across one of these in a pp
> module, it just drops the block and outputs a warning. Fortunately,
> these are very rare. In fact, this is the only place in refpolicy where
> an optional else block is used, and it is not clear if it is even
> needed. This patch is untested, and is more to spark discussions to see
> if there are any thoughts about whether or not this piece of policy is
> needed.
> 
> Signed-off-by: Steve Lawrence <slawrence@tresys.com>
> ---
>  policy/modules/system/sysnetwork.te | 3 ---
>  1 file changed, 3 deletions(-)
> 
> diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
> index 705496d..ddb5a92 100644
> --- a/policy/modules/system/sysnetwork.te
> +++ b/policy/modules/system/sysnetwork.te
> @@ -195,9 +195,6 @@ optional_policy(`
>  optional_policy(`
>  	netutils_run_ping(dhcpc_t, dhcpc_roles)
>  	netutils_run(dhcpc_t, dhcpc_roles)
> -',`
> -	allow dhcpc_t self:capability setuid;
> -	allow dhcpc_t self:rawip_socket create_socket_perms;
>  ')
>  
>  optional_policy(`

In practice, it's probably not used, so I think we could remove it.


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] [PATCH] Remove optional else block for dhcp ping

[Jason Zaman]

On Tue, Dec 02, 2014 at 11:27:14AM -0500, Steve Lawrence wrote:
> Else blocks with optional statements are not supported in CIL.
> Currently, if the pp to CIL compiler comes across one of these in a pp
> module, it just drops the block and outputs a warning. Fortunately,
> these are very rare. In fact, this is the only place in refpolicy where
> an optional else block is used, and it is not clear if it is even
> needed. This patch is untested, and is more to spark discussions to see
> if there are any thoughts about whether or not this piece of policy is
> needed.
> 
> Signed-off-by: Steve Lawrence <slawrence@tresys.com>
> ---
>  policy/modules/system/sysnetwork.te | 3 ---
>  1 file changed, 3 deletions(-)
> 
> diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
> index 705496d..ddb5a92 100644
> --- a/policy/modules/system/sysnetwork.te
> +++ b/policy/modules/system/sysnetwork.te
> @@ -195,9 +195,6 @@ optional_policy(`
>  optional_policy(`
>  	netutils_run_ping(dhcpc_t, dhcpc_roles)
>  	netutils_run(dhcpc_t, dhcpc_roles)
> -',`
> -	allow dhcpc_t self:capability setuid;
> -	allow dhcpc_t self:rawip_socket create_socket_perms;
>  ')
>  
>  optional_policy(`
> -- 
> 1.9.3

Hi Christopher,

I do not see this patch in the repo yet. Was it missed perhaps?

Thanks,
Jason