-
Notifications
You must be signed in to change notification settings - Fork 352
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Adjust sepolgen grammar to support allowxperm, et. al. #348
base: master
Are you sure you want to change the base?
Adjust sepolgen grammar to support allowxperm, et. al. #348
Conversation
Extend the grammar to support `allowxperm`, et. al. directives, which were added in policy version 30 to give more granular control. This commit adds basic support for the syntax, copying heavily from the grammar for `allowperm`, et. al. Signed-off-by: Chris Lindee <[email protected]>
The `allowxperm` et. al. directives take a magical integer for one of the fields, which hinders readability. This commit adds support for basic names for a number or group of numbers. Notably, this does not support recursive definition of names, as that would require a larger grammar re-write to avoid parsing conflicts. Signed-off-by: Chris Lindee <[email protected]>
ab12659
to
9bcd61d
Compare
Thanks for the patches. Please send them to [email protected] for review when you are ready, see https://github.com/SELinuxProject/selinux/blob/master/CONTRIBUTING.md If you, for any reason, can't send it I could do it for you. |
@ColMelvin As your PR with the patches for the ZFS PAM module was accepted, did you succeed in sending them over to the mailing list for review? If that doesn't work for you, there was also the offer by @bachradsusi to do this as an escrow for you. |
I sent 3 emails with the patches to [email protected] at 2022-08-01T01:57Z, but never heard anything back. I'm not part of the mailing list, so could not confirm their receipt. @almereyda Do you have any advice for getting traction on the patches? |
They're on the mailing list archives: Try a resend and put something like [resend] in the subject line so |
Provide basic support for
allowxperm
,auditallowxperm
,dontauditxperm
andneverallowxperm
so/usr/bin/sepolgen-ifgen
stops spewing errors on my policy every timeselinux-policy-targeted
gets updated.While I would prefer additional changes to address magic numbers (e.g. a new macro, much like
interface
, but for defining xperm numbers), this PR is sufficient for my and - hopefully - the majority of the community's needs.