Re: [PATCH] checkpolicy: Allow attribute assignment to attributes

["Christian Göttsche" <cgzones@googlemail.com>]

Jun 23, 2025 12:27:47 Vit Mojzis <vmojzis@redhat.com>:

> Allow "typeattribute <attribute> <attribute>" to pass checkpolicy,
> since (typeattributeset <attribute> <attribute>) is valid in CIL.
>
> Fixes:
>   $ cat myattributetest.te
>   policy_module(attributetest, 1.0.0)
>
>   gen_require(`
>     attribute domain;
>   ')
>
>   attribute myattribute;
>
>   typeattribute myattribute domain;
>
>   $ make -f /usr/share/selinux/devel/Makefile attributetest.pp                                                                                                                            2 ↵
>   Compiling targeted attributetest module
>   attributetest.te:9:ERROR 'unknown type myattribute' at token ';' on line 3418:
>   typeattribute myattribute domain;
>
> Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
> ---
> After some simple tests with CIL policies, it seems that attribute
> assignment works as expected. Is there a reason checkpolicy does not
> recognise it?

Did you test that all types associated with myattribute are the also associated with domain?

>
> $ cat a.cil
> (typeattribute a)
> (typeattribute b)
> (typeattribute c)
> (type mytype_t)
> (typeattributeset a b)
> (typeattributeset b c)
> (typeattributeset c mytype_t)
> (allow a user_home_t (dir (getattr open search)))
> (allow b tmp_t (dir (getattr open search)))
> (allow c etc_t (dir (getattr open search)))
>
> $semodule -i a.cil
>
> $sesearch -A -s mytype_t
> allow a user_home_t:dir { getattr open search };
> allow b tmp_t:dir { getattr open search };
> allow c etc_t:dir { getattr open search };
>
> $seinfo -xa a                      
>
> Type Attributes: 1
>    attribute a;
>     mytype_t
>
>
> checkpolicy/policy_define.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
> index 4e0ddcc6..be788e8e 100644
> --- a/checkpolicy/policy_define.c
> +++ b/checkpolicy/policy_define.c
> @@ -1440,7 +1440,7 @@ int define_typeattribute(void)
>         return -1;
>     }
>     t = hashtab_search(policydbp->p_types.table, id);
> -   if (!t || t->flavor == TYPE_ATTRIB) {
> +   if (!t) {
>         yyerror2("unknown type %s", id);
>         free(id);
>         return -1;
> --
> 2.49.0