RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

checkmodule: add support for specifying module policy version 

Currently checkpolicy can produce binary policies for earlier policy versions
to provide support for building policies on one machine and loading/analyzing
them on another machine with an earlier version of the kernel or libsepol,
respectively. However, checkmodule was lacking this capability.

This commit adds an identical `-c` flag that can be passed to checkmodule that
will build a modular policy file of the specified version.

Signed-off-by: Gary Tierney <gary.tierney@fastmail.com>
This commit is contained in:
Gary Tierney 2019-04-17 17:37:30 +01:00 committed by James Carter
parent 25ce102907
commit 4984a75f38
2 changed files with 30 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
checkpolicy/checkmodule.8
View File

@ -38,7 +38,7 @@ Generate a non-base policy module.
Enable the MLS/MCS support when checking and compiling the policy module.
.TP
.B \-V,\-\-version
Show policy versions created by this program. Note that you cannot currently build older versions.
Show policy versions created by this program.
.TP
.B \-o,\-\-output filename
Write a binary policy module file to the specified filename.
@ -47,6 +47,9 @@ and will not generate a binary module at all.
.TP
.B \-U,\-\-handle-unknown <action>
Specify how the kernel should handle unknown classes or permissions (deny, allow or reject).
.TP
.B \-c policyvers
Specify the policy version, defaults to the latest.
.SH EXAMPLE
.nf

28
checkpolicy/checkmodule.c
View File

@ -142,6 +142,8 @@ static __attribute__((__noreturn__)) void usage(const char *progname)
printf(" -m build a policy module instead of a base module\n");
printf(" -M enable MLS policy\n");
printf(" -o FILE write module to FILE (else just check syntax)\n");
printf(" -c VERSION build a policy module targeting a modular policy version (%d-%d)\n",
MOD_POLICYDB_VERSION_MIN, MOD_POLICYDB_VERSION_MAX);
exit(1);
}
@ -163,7 +165,7 @@ int main(int argc, char **argv)
{NULL, 0, NULL, 0}
};
while ((ch = getopt_long(argc, argv, "ho:bVU:mMC", long_options, NULL)) != -1) {
while ((ch = getopt_long(argc, argv, "ho:bVU:mMCc:", long_options, NULL)) != -1) {
switch (ch) {
case 'h':
usage(argv[0]);
@ -194,7 +196,6 @@ int main(int argc, char **argv)
usage(argv[0]);
case 'm':
policy_type = POLICY_MOD;
policyvers = MOD_POLICYDB_VERSION_MAX;
break;
case 'M':
mlspol = 1;
@ -202,6 +203,29 @@ int main(int argc, char **argv)
case 'C':
cil = 1;
break;
case 'c': {
long int n;
errno = 0;
n = strtol(optarg, NULL, 10);
if (errno) {
fprintf(stderr,
"Invalid policyvers specified: %s\n",
optarg);
usage(argv[0]);
}
if (n < MOD_POLICYDB_VERSION_MIN
|| n > MOD_POLICYDB_VERSION_MAX) {
fprintf(stderr,
"policyvers value %ld not in range %d-%d\n",
n, MOD_POLICYDB_VERSION_MIN,
MOD_POLICYDB_VERSION_MAX);
usage(argv[0]);
}
policyvers = n;
break;
}
default:
usage(argv[0]);
}