Re: Fedora Core 2 setools RPM

[ramsdell@mitre.org (John D. Ramsdell)]

"Karl MacMillan" <kmacmillan@tresys.com> writes:

> In general, we have not spent many resources addressing the use of
> libapol outside of setools.

>From my perspective, the application programmer's interface provided
by libapol seems to provide an attractive platform on top of which I
should be able to build a version of slat that can analyze binary
policy configuration files.  The alternative for me is to cobble
something together from the sources in the checkpolicy directory.  My
guess is that I would have to duplicate functionality already present
in libapol.

My greatest concern with using libapol for slat is that it seems to
provide no routines that expose CONSTRAIN statements in a policy.
When I did a grep on the sources, I notice the word "constrain" is not
in any header file but one, and libapol/binpol/borrowed.h contains the
following comment.

/* needed for constraints (which apol currently ignores */

John

$ grep -i constrain libapol/*.* libapol/*/*.*
libapol/apolicy_parse.y:/* from originial constraint.h */
libapol/apolicy_parse.y:typedef struct constraint_expr {
libapol/apolicy_parse.y:	struct constraint_expr *left;
libapol/apolicy_parse.y:	struct constraint_expr *right;
libapol/apolicy_parse.y:} constraint_expr_t;
libapol/apolicy_parse.y:/* end from constraint.h */
libapol/apolicy_parse.y:static int define_constraint(void);
libapol/apolicy_parse.y:static constraint_expr_t *define_cexpr(__u32 expr_type, __u32 arg1, __u32 arg2);
libapol/apolicy_parse.y:%token CONSTRAIN
libapol/apolicy_parse.y:			  opt_mls te_rbac users opt_constraints 
libapol/apolicy_parse.y:/* added July 2002; made constraints optional */
libapol/apolicy_parse.y:opt_constraints         : constraints
libapol/apolicy_parse.y:constraints		: constraint_def
libapol/apolicy_parse.y:			| constraints constraint_def
libapol/apolicy_parse.y:constraint_def		: CONSTRAIN names names cexpr ';'
libapol/apolicy_parse.y:			{ if (define_constraint()) return -1; }
libapol/apolicy_parse.y:static int define_constraint(void)
libapol/apolicy_parse.y:static constraint_expr_t *
libapol/apolicy_parse.y:	return (constraint_expr_t *)1; /* any non-NULL value */
libapol/apolicy_scan.l:CONSTRAIN |
libapol/apolicy_scan.l:constrain			{ return(CONSTRAIN); }
libapol/binpol/binpol.c:	 * buf[5] num constraints (ignore constraints) */	
libapol/binpol/binpol.c:	/* ignore constraints */
libapol/binpol/borrowed.h:/* needed for constraints (which apol currently ignores */


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.