Re: [Help] how to compile te with checkpolicy.

[Dominick Grift <dominick.grift@defensec.nl>]

BOBx <kabc005009@163.com> writes:

> Hi all,
>
> These days I tried to compile te with tools named checkpolicy. I have
> searched the process with google and chatgpt, and I followed the steps
> they told me but I failed.

Hi,

checkpolicy is for monolithic policy. see below for modular policy:

>
> The following is my te file,  cmd and response and other infomation.
>
> My te file(my_policy.te):
> ----------------------------------------------

This is modular policy that should be compiled with checkmodule and then
packaged with semodule_package:

checkmodule -M -m my_policy.te -o my_policy.mod
semodule_package -o my_policy.pp -m my_policy.mod
semodule -i my_policy.pp

for more information see:

man checkpolicy
man checkmodule
man semodule_package
man semodule

> policy_module(my_mypolicy, 1.0)
>
> # Define types
> type my_type_t;
> type my_type_exec_t, file_type;
>
> # Allow rules
> allow my_type_t my_type_exec_t:file execute;
> ----------------------------------------------
>
> The command:
> ----------------------------------------------
> sudo checkpolicy -M -o my_policy.pp my_policy.te
> ----------------------------------------------
>
> The response  from command:
> ----------------------------------------------
> my_policy.te:1:ERROR 'syntax error' at token 'policy_module' on line 1:
>
>
> checkpolicy:  error(s) encountered while parsing configuration
> ----------------------------------------------
>
> OS information: 6.11.0-29-generic, ubuntu 24.10.
>
> Would you like help me to compile te with checkpolicy please? Or which
> URL should I read please?
>
> Best regards
>
> BOBx
>
>
>

-- 
gpg --locate-keys dominick.grift@defensec.nl (wkd)
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl