[PATCH] python/sepolicy: Fix template for confined user policy modules

[PATCH] python/sepolicy: Fix template for confined user policy modules

[Vit Mojzis]

The following commit
https://github.com/SELinuxProject/refpolicy/commit/330b0fc3331d3b836691464734c96f3da3044490
changed the userdom_base_user_template, which now requires a role
corresponding to the user being created to be defined outside of the
template.
Similar change was also done to fedora-selinux/selinux-policy
https://github.com/fedora-selinux/selinux-policy/commit/e1e216b25df1bdb4eb7dbb8f73f32927ad6f3d1f

Although I believe the template should define the role (just as it
defines the new user), that will require extensive changes to refpolicy.
In the meantime the role needs to be defined separately.

Fixes:
\# sepolicy generate --term_user -n newuser
Created the following files:
/root/a/test/newuser.te # Type Enforcement file
/root/a/test/newuser.if # Interface file
/root/a/test/newuser.fc # File Contexts file
/root/a/test/newuser_selinux.spec # Spec file
/root/a/test/newuser.sh # Setup Script

\# ./newuser.sh
Building and Loading Policy
+ make -f /usr/share/selinux/devel/Makefile newuser.pp
Compiling targeted newuser module
Creating targeted newuser.pp policy package
rm tmp/newuser.mod tmp/newuser.mod.fc
+ /usr/sbin/semodule -i newuser.pp
Failed to resolve roleattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/newuser/cil:8
Failed to resolve AST
/usr/sbin/semodule:  Failed!

Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
---
 python/sepolicy/sepolicy/templates/user.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/python/sepolicy/sepolicy/templates/user.py b/python/sepolicy/sepolicy/templates/user.py
index 1ff9d2ce..7081fbae 100644
--- a/python/sepolicy/sepolicy/templates/user.py
+++ b/python/sepolicy/sepolicy/templates/user.py
@@ -28,6 +28,8 @@ policy_module(TEMPLATETYPE, 1.0.0)
 #
 # Declarations
 #
+role TEMPLATETYPE_r;
+
 userdom_unpriv_user_template(TEMPLATETYPE)
 """
 
@@ -38,6 +40,8 @@ policy_module(TEMPLATETYPE, 1.0.0)
 #
 # Declarations
 #
+role TEMPLATETYPE_r;
+
 userdom_admin_user_template(TEMPLATETYPE)
 """
 
@@ -48,6 +52,7 @@ policy_module(TEMPLATETYPE, 1.0.0)
 #
 # Declarations
 #
+role TEMPLATETYPE_r;
 
 userdom_restricted_user_template(TEMPLATETYPE)
 """
@@ -59,6 +64,7 @@ policy_module(TEMPLATETYPE, 1.0.0)
 #
 # Declarations
 #
+role TEMPLATETYPE_r;
 
 userdom_restricted_xwindows_user_template(TEMPLATETYPE)
 """
@@ -89,6 +95,7 @@ gen_tunable(TEMPLATETYPE_manage_user_files, false)
 #
 # Declarations
 #
+role TEMPLATETYPE_r;
 
 userdom_base_user_template(TEMPLATETYPE)
 """
-- 
2.40.0

Re: [PATCH] python/sepolicy: Fix template for confined user policy modules

[Petr Lautrbach]

Vit Mojzis <vmojzis@redhat.com> writes:

> The following commit
> https://github.com/SELinuxProject/refpolicy/commit/330b0fc3331d3b836691464734c96f3da3044490
> changed the userdom_base_user_template, which now requires a role
> corresponding to the user being created to be defined outside of the
> template.
> Similar change was also done to fedora-selinux/selinux-policy
> https://github.com/fedora-selinux/selinux-policy/commit/e1e216b25df1bdb4eb7dbb8f73f32927ad6f3d1f
>
> Although I believe the template should define the role (just as it
> defines the new user), that will require extensive changes to refpolicy.
> In the meantime the role needs to be defined separately.
>
> Fixes:
> \# sepolicy generate --term_user -n newuser
> Created the following files:
> /root/a/test/newuser.te # Type Enforcement file
> /root/a/test/newuser.if # Interface file
> /root/a/test/newuser.fc # File Contexts file
> /root/a/test/newuser_selinux.spec # Spec file
> /root/a/test/newuser.sh # Setup Script

If you don't mind, I'd push it with indented text, i.e.

Fixes:
    # sepolicy generate --term_user -n newuser
    Created the following files:
    /root/a/test/newuser.te # Type Enforcement file
    /root/a/test/newuser.if # Interface file
    /root/a/test/newuser.fc # File Contexts file
    /root/a/test/newuser_selinux.spec # Spec file
    /root/a/test/newuser.sh # Setup Script



> \# ./newuser.sh
> Building and Loading Policy
> + make -f /usr/share/selinux/devel/Makefile newuser.pp
> Compiling targeted newuser module
> Creating targeted newuser.pp policy package
> rm tmp/newuser.mod tmp/newuser.mod.fc
> + /usr/sbin/semodule -i newuser.pp
> Failed to resolve roleattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/newuser/cil:8
> Failed to resolve AST
> /usr/sbin/semodule:  Failed!
>
> Signed-off-by: Vit Mojzis <vmojzis@redhat.com>

Acked-by: Petr Lautrbach <lautrbach@redhat.com>


> ---
>  python/sepolicy/sepolicy/templates/user.py | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/python/sepolicy/sepolicy/templates/user.py b/python/sepolicy/sepolicy/templates/user.py
> index 1ff9d2ce..7081fbae 100644
> --- a/python/sepolicy/sepolicy/templates/user.py
> +++ b/python/sepolicy/sepolicy/templates/user.py
> @@ -28,6 +28,8 @@ policy_module(TEMPLATETYPE, 1.0.0)
>  #
>  # Declarations
>  #
> +role TEMPLATETYPE_r;
> +
>  userdom_unpriv_user_template(TEMPLATETYPE)
>  """
>  
> @@ -38,6 +40,8 @@ policy_module(TEMPLATETYPE, 1.0.0)
>  #
>  # Declarations
>  #
> +role TEMPLATETYPE_r;
> +
>  userdom_admin_user_template(TEMPLATETYPE)
>  """
>  
> @@ -48,6 +52,7 @@ policy_module(TEMPLATETYPE, 1.0.0)
>  #
>  # Declarations
>  #
> +role TEMPLATETYPE_r;
>  
>  userdom_restricted_user_template(TEMPLATETYPE)
>  """
> @@ -59,6 +64,7 @@ policy_module(TEMPLATETYPE, 1.0.0)
>  #
>  # Declarations
>  #
> +role TEMPLATETYPE_r;
>  
>  userdom_restricted_xwindows_user_template(TEMPLATETYPE)
>  """
> @@ -89,6 +95,7 @@ gen_tunable(TEMPLATETYPE_manage_user_files, false)
>  #
>  # Declarations
>  #
> +role TEMPLATETYPE_r;
>  
>  userdom_base_user_template(TEMPLATETYPE)
>  """
> -- 
> 2.40.0

Re: [PATCH] python/sepolicy: Fix template for confined user policy modules

[Petr Lautrbach]

Petr Lautrbach <lautrbach@redhat.com> writes:

> Vit Mojzis <vmojzis@redhat.com> writes:
>
>> The following commit
>> https://github.com/SELinuxProject/refpolicy/commit/330b0fc3331d3b836691464734c96f3da3044490
>> changed the userdom_base_user_template, which now requires a role
>> corresponding to the user being created to be defined outside of the
>> template.
>> Similar change was also done to fedora-selinux/selinux-policy
>> https://github.com/fedora-selinux/selinux-policy/commit/e1e216b25df1bdb4eb7dbb8f73f32927ad6f3d1f
>>
>> Although I believe the template should define the role (just as it
>> defines the new user), that will require extensive changes to refpolicy.
>> In the meantime the role needs to be defined separately.
>>
>> Fixes:
>> \# sepolicy generate --term_user -n newuser
>> Created the following files:
>> /root/a/test/newuser.te # Type Enforcement file
>> /root/a/test/newuser.if # Interface file
>> /root/a/test/newuser.fc # File Contexts file
>> /root/a/test/newuser_selinux.spec # Spec file
>> /root/a/test/newuser.sh # Setup Script
>
> If you don't mind, I'd push it with indented text, i.e.
>
> Fixes:
>     # sepolicy generate --term_user -n newuser
>     Created the following files:
>     /root/a/test/newuser.te # Type Enforcement file
>     /root/a/test/newuser.if # Interface file
>     /root/a/test/newuser.fc # File Contexts file
>     /root/a/test/newuser_selinux.spec # Spec file
>     /root/a/test/newuser.sh # Setup Script
>
>
>
>> \# ./newuser.sh
>> Building and Loading Policy
>> + make -f /usr/share/selinux/devel/Makefile newuser.pp
>> Compiling targeted newuser module
>> Creating targeted newuser.pp policy package
>> rm tmp/newuser.mod tmp/newuser.mod.fc
>> + /usr/sbin/semodule -i newuser.pp
>> Failed to resolve roleattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/newuser/cil:8
>> Failed to resolve AST
>> /usr/sbin/semodule:  Failed!
>>
>> Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
>
> Acked-by: Petr Lautrbach <lautrbach@redhat.com>
>

Merged with reformatted commit message. Thanks!


>> ---
>>  python/sepolicy/sepolicy/templates/user.py | 7 +++++++
>>  1 file changed, 7 insertions(+)
>>
>> diff --git a/python/sepolicy/sepolicy/templates/user.py b/python/sepolicy/sepolicy/templates/user.py
>> index 1ff9d2ce..7081fbae 100644
>> --- a/python/sepolicy/sepolicy/templates/user.py
>> +++ b/python/sepolicy/sepolicy/templates/user.py
>> @@ -28,6 +28,8 @@ policy_module(TEMPLATETYPE, 1.0.0)
>>  #
>>  # Declarations
>>  #
>> +role TEMPLATETYPE_r;
>> +
>>  userdom_unpriv_user_template(TEMPLATETYPE)
>>  """
>>  
>> @@ -38,6 +40,8 @@ policy_module(TEMPLATETYPE, 1.0.0)
>>  #
>>  # Declarations
>>  #
>> +role TEMPLATETYPE_r;
>> +
>>  userdom_admin_user_template(TEMPLATETYPE)
>>  """
>>  
>> @@ -48,6 +52,7 @@ policy_module(TEMPLATETYPE, 1.0.0)
>>  #
>>  # Declarations
>>  #
>> +role TEMPLATETYPE_r;
>>  
>>  userdom_restricted_user_template(TEMPLATETYPE)
>>  """
>> @@ -59,6 +64,7 @@ policy_module(TEMPLATETYPE, 1.0.0)
>>  #
>>  # Declarations
>>  #
>> +role TEMPLATETYPE_r;
>>  
>>  userdom_restricted_xwindows_user_template(TEMPLATETYPE)
>>  """
>> @@ -89,6 +95,7 @@ gen_tunable(TEMPLATETYPE_manage_user_files, false)
>>  #
>>  # Declarations
>>  #
>> +role TEMPLATETYPE_r;
>>  
>>  userdom_base_user_template(TEMPLATETYPE)
>>  """
>> -- 
>> 2.40.0