12:03 p.m.
On Wed, Apr 07, 2021 at 06:14:58AM -0700, Vit Mojzis wrote:
Sorry for the long delay. This is our first request to ship a policy
for
multiple selinux stores (targeted, mls and minimum).
Changes:
* Replace all selinux-policy-%{policytype} dependencies with selinux-policy-base
* Add Ghost files representing installed policy modules in all policy stores
* Rewrite policy compilation script in python
* Compile the policy module twice (1 version for targeted/minimum - with
enable_mcs, and 1 for mls - with enable_mls)
* Manage policy (un)installation using triggers based on which policy
type is available
The new policy was only tested in "targeted" mode so far and we'll need to
make
sure it works properly in "mls". As for "minimum", we know it will
not
work properly (as is the case of the current policy) by default (some
other "contrib" policy modules need to be enabled).
I'd argue there is no point trying to get it to work in "minimum",
mostly because it (minimum) will be retired soon.
Running a build with this seris causes a tonne of warning messages
on the console:
[1310/1319] Generating virt.pp with a custom command
/usr/share/selinux/devel/include/services/container.if:13: Error: duplicate definition of
container_runtime_domtrans(). Original definition on 13.
/usr/share/selinux/devel/include/services/container.if:40: Error: duplicate definition of
container_runtime_run(). Original definition on 40.
/usr/share/selinux/devel/include/services/container.if:61: Error: duplicate definition of
container_runtime_exec(). Original definition on 61.
/usr/share/selinux/devel/include/services/container.if:80: Error: duplicate definition of
container_read_state(). Original definition on 80.
/usr/share/selinux/devel/include/services/container.if:98: Error: duplicate definition of
container_search_lib(). Original definition on 98.
/usr/share/selinux/devel/include/services/container.if:117: Error: duplicate definition of
container_exec_lib(). Original definition on 117.
/usr/share/selinux/devel/include/services/container.if:136: Error: duplicate definition of
container_read_lib_files(). Original definition on 136.
/usr/share/selinux/devel/include/services/container.if:155: Error: duplicate definition of
container_read_share_files(). Original definition on 155.
/usr/share/selinux/devel/include/services/container.if:176: Error: duplicate definition of
container_runtime_read_tmpfs_files(). Original definition on 176.
/usr/share/selinux/devel/include/services/container.if:197: Error: duplicate definition of
container_manage_share_files(). Original definition on 197.
/usr/share/selinux/devel/include/services/container.if:218: Error: duplicate definition of
container_manage_share_dirs(). Original definition on 218.
/usr/share/selinux/devel/include/services/container.if:238: Error: duplicate definition of
container_exec_share_files(). Original definition on 238.
/usr/share/selinux/devel/include/services/container.if:256: Error: duplicate definition of
container_manage_config_files(). Original definition on 256.
/usr/share/selinux/devel/include/services/container.if:275: Error: duplicate definition of
container_manage_lib_files(). Original definition on 275.
/usr/share/selinux/devel/include/services/container.if:295: Error: duplicate definition of
container_manage_files(). Original definition on 295.
/usr/share/selinux/devel/include/services/container.if:314: Error: duplicate definition of
container_manage_dirs(). Original definition on 314.
/usr/share/selinux/devel/include/services/container.if:332: Error: duplicate definition of
container_manage_lib_dirs(). Original definition on 332.
/usr/share/selinux/devel/include/services/container.if:368: Error: duplicate definition of
container_lib_filetrans(). Original definition on 368.
/usr/share/selinux/devel/include/services/container.if:386: Error: duplicate definition of
container_read_pid_files(). Original definition on 386.
/usr/share/selinux/devel/include/services/container.if:405: Error: duplicate definition of
container_systemctl(). Original definition on 405.
/usr/share/selinux/devel/include/services/container.if:430: Error: duplicate definition of
container_rw_sem(). Original definition on 430.
/usr/share/selinux/devel/include/services/container.if:449: Error: duplicate definition of
container_append_file(). Original definition on 449.
/usr/share/selinux/devel/include/services/container.if:467: Error: duplicate definition of
container_use_ptys(). Original definition on 467.
/usr/share/selinux/devel/include/services/container.if:485: Error: duplicate definition of
container_filetrans_named_content(). Original definition on 485.
/usr/share/selinux/devel/include/services/container.if:549: Error: duplicate definition of
container_stream_connect(). Original definition on 549.
/usr/share/selinux/devel/include/services/container.if:570: Error: duplicate definition of
container_spc_stream_connect(). Original definition on 570.
/usr/share/selinux/devel/include/services/container.if:591: Error: duplicate definition of
container_admin(). Original definition on 591.
/usr/share/selinux/devel/include/services/container.if:638: Error: duplicate definition of
container_auth_domtrans(). Original definition on 638.
/usr/share/selinux/devel/include/services/container.if:657: Error: duplicate definition of
container_auth_exec(). Original definition on 657.
/usr/share/selinux/devel/include/services/container.if:676: Error: duplicate definition of
container_auth_stream_connect(). Original definition on 676.
/usr/share/selinux/devel/include/services/container.if:695: Error: duplicate definition of
container_runtime_typebounds(). Original definition on 695.
/usr/share/selinux/devel/include/services/container.if:714: Error: duplicate definition of
container_runtime_entrypoint(). Original definition on 714.
/usr/share/selinux/devel/include/services/container.if:721: Error: duplicate definition of
docker_exec_lib(). Original definition on 721.
/usr/share/selinux/devel/include/services/container.if:725: Error: duplicate definition of
docker_read_share_files(). Original definition on 725.
/usr/share/selinux/devel/include/services/container.if:729: Error: duplicate definition of
docker_exec_share_files(). Original definition on 729.
/usr/share/selinux/devel/include/services/container.if:733: Error: duplicate definition of
docker_manage_lib_files(). Original definition on 733.
/usr/share/selinux/devel/include/services/container.if:738: Error: duplicate definition of
docker_manage_lib_dirs(). Original definition on 738.
/usr/share/selinux/devel/include/services/container.if:742: Error: duplicate definition of
docker_lib_filetrans(). Original definition on 742.
/usr/share/selinux/devel/include/services/container.if:746: Error: duplicate definition of
docker_read_pid_files(). Original definition on 746.
/usr/share/selinux/devel/include/services/container.if:750: Error: duplicate definition of
docker_systemctl(). Original definition on 750.
/usr/share/selinux/devel/include/services/container.if:754: Error: duplicate definition of
docker_use_ptys(). Original definition on 754.
/usr/share/selinux/devel/include/services/container.if:758: Error: duplicate definition of
docker_stream_connect(). Original definition on 758.
/usr/share/selinux/devel/include/services/container.if:762: Error: duplicate definition of
docker_spc_stream_connect(). Original definition on 762.
/usr/share/selinux/devel/include/services/container.if:776: Error: duplicate definition of
container_spc_read_state(). Original definition on 776.
/usr/share/selinux/devel/include/services/container.if:795: Error: duplicate definition of
container_runtime_domain_template(). Original definition on 795.
/usr/share/selinux/devel/include/services/container.if:833: Error: duplicate definition of
container_domain_template(). Original definition on 833.
/usr/share/selinux/devel/include/services/container.if:861: Error: duplicate definition of
container_spc_rw_pipes(). Original definition on 861.
../selinux/virt.if:13: Error: duplicate definition of virt_stub_lxc(). Original definition
on 13.
../selinux/virt.if:29: Error: duplicate definition of virt_stub_svirt_sandbox_domain().
Original definition on 29.
../selinux/virt.if:45: Error: duplicate definition of virt_stub_container_image().
Original definition on 45.
../selinux/virt.if:51: Error: duplicate definition of virt_stub_svirt_sandbox_file().
Original definition on 51.
../selinux/virt.if:69: Error: duplicate definition of virt_domain_template(). Original
definition on 69.
../selinux/virt.if:206: Error: duplicate definition of virt_image(). Original definition
on 112.
../selinux/virt.if:228: Error: duplicate definition of virt_getattr_exec(). Original
definition on 134.
../selinux/virt.if:248: Error: duplicate definition of virt_domtrans(). Original
definition on 152.
../selinux/virt.if:266: Error: duplicate definition of virt_exec(). Original definition on
170.
../selinux/virt.if:286: Error: duplicate definition of virt_stream_connect(). Original
definition on 205.
../selinux/virt.if:328: Error: duplicate definition of virt_stream_connect_svirt().
Original definition on 224.
../selinux/virt.if:348: Error: duplicate definition of virt_rw_stream_sockets_svirt().
Original definition on 244.
../selinux/virt.if:366: Error: duplicate definition of virt_attach_tun_iface(). Original
definition on 262.
../selinux/virt.if:387: Error: duplicate definition of virt_attach_sandbox_tun_iface().
Original definition on 281.
../selinux/virt.if:406: Error: duplicate definition of virt_read_config(). Original
definition on 300.
../selinux/virt.if:427: Error: duplicate definition of virt_manage_config(). Original
definition on 321.
../selinux/virt.if:448: Error: duplicate definition of virt_getattr_content(). Original
definition on 342.
../selinux/virt.if:466: Error: duplicate definition of virt_read_content(). Original
definition on 360.
../selinux/virt.if:504: Error: duplicate definition of virt_write_content(). Original
definition on 398.
../selinux/virt.if:522: Error: duplicate definition of virt_read_pid_symlinks(). Original
definition on 416.
../selinux/virt.if:543: Error: duplicate definition of virt_read_pid_files(). Original
definition on 435.
../selinux/virt.if:566: Error: duplicate definition of virt_manage_pid_dirs(). Original
definition on 455.
../selinux/virt.if:590: Error: duplicate definition of virt_manage_pid_files(). Original
definition on 477.
../selinux/virt.if:630: Error: duplicate definition of virt_pid_filetrans(). Original
definition on 515.
../selinux/virt.if:650: Error: duplicate definition of virt_search_lib(). Original
definition on 533.
../selinux/virt.if:669: Error: duplicate definition of virt_read_lib_files(). Original
definition on 552.
../selinux/virt.if:690: Error: duplicate definition of virt_dontaudit_read_lib_files().
Original definition on 573.
../selinux/virt.if:709: Error: duplicate definition of virt_manage_lib_files(). Original
definition on 592.
../selinux/virt.if:729: Error: duplicate definition of virt_read_log(). Original
definition on 612.
../selinux/virt.if:749: Error: duplicate definition of virt_append_log(). Original
definition on 632.
../selinux/virt.if:768: Error: duplicate definition of virt_manage_log(). Original
definition on 651.
../selinux/virt.if:788: Error: duplicate definition of virt_getattr_images(). Original
definition on 671.
../selinux/virt.if:807: Error: duplicate definition of virt_search_images(). Original
definition on 690.
../selinux/virt.if:826: Error: duplicate definition of virt_read_images(). Original
definition on 709.
../selinux/virt.if:863: Error: duplicate definition of virt_read_blk_images(). Original
definition on 746.
../selinux/virt.if:881: Error: duplicate definition of virt_rw_chr_files(). Original
definition on 764.
../selinux/virt.if:900: Error: duplicate definition of virt_manage_cache(). Original
definition on 783.
../selinux/virt.if:921: Error: duplicate definition of virt_manage_images(). Original
definition on 804.
../selinux/virt.if:946: Error: duplicate definition of virt_manage_default_image_type().
Original definition on 829.
../selinux/virt.if:986: Error: duplicate definition of virt_systemctl(). Original
definition on 851.
../selinux/virt.if:1010: Error: duplicate definition of virt_ptrace(). Original definition
on 875.
../selinux/virt.if:1028: Error: duplicate definition of virt_exec_sandbox_files().
Original definition on 893.
../selinux/virt.if:1047: Error: duplicate definition of virt_sandbox_entrypoint().
Original definition on 912.
../selinux/virt.if:1064: Error: duplicate definition of virt_list_sandbox_dirs(). Original
definition on 929.
../selinux/virt.if:1082: Error: duplicate definition of virt_read_sandbox_files().
Original definition on 947.
../selinux/virt.if:1102: Error: duplicate definition of virt_manage_sandbox_files().
Original definition on 967.
../selinux/virt.if:1125: Error: duplicate definition of virt_getattr_sandbox_filesystem().
Original definition on 990.
../selinux/virt.if:1143: Error: duplicate definition of virt_relabel_sandbox_filesystem().
Original definition on 1008.
../selinux/virt.if:1161: Error: duplicate definition of virt_mounton_sandbox_file().
Original definition on 1026.
../selinux/virt.if:1179: Error: duplicate definition of virt_stream_connect_sandbox().
Original definition on 1044.
../selinux/virt.if:1207: Error: duplicate definition of virt_transition_svirt(). Original
definition on 1072.
../selinux/virt.if:1241: Error: duplicate definition of virt_dontaudit_write_pipes().
Original definition on 1106.
../selinux/virt.if:1260: Error: duplicate definition of virt_kill_svirt(). Original
definition on 1125.
../selinux/virt.if:1278: Error: duplicate definition of virt_kill(). Original definition
on 1143.
../selinux/virt.if:1298: Error: duplicate definition of virt_signal(). Original definition
on 1161.
../selinux/virt.if:1318: Error: duplicate definition of virt_signull(). Original
definition on 1179.
../selinux/virt.if:1338: Error: duplicate definition of virt_signal_svirt(). Original
definition on 1197.
../selinux/virt.if:1356: Error: duplicate definition of virt_signal_sandbox(). Original
definition on 1215.
../selinux/virt.if:1374: Error: duplicate definition of virt_manage_home_files(). Original
definition on 1233.
../selinux/virt.if:1394: Error: duplicate definition of virt_read_tmpfs_files(). Original
definition on 1253.
../selinux/virt.if:1413: Error: duplicate definition of virt_manage_tmpfs_files().
Original definition on 1272.
../selinux/virt.if:1432: Error: duplicate definition of virt_filetrans_home_content().
Original definition on 1291.
../selinux/virt.if:1462: Error: duplicate definition of virt_dontaudit_read_chr_dev().
Original definition on 1321.
../selinux/virt.if:1518: Error: duplicate definition of virt_sandbox_domain_template().
Original definition on 1340.
../selinux/virt.if:1550: Error: duplicate definition of virt_sandbox_domain(). Original
definition on 1372.
../selinux/virt.if:1568: Error: duplicate definition of virt_sandbox_net_domain().
Original definition on 1390.
../selinux/virt.if:1605: Error: duplicate definition of virt_exec_qemu(). Original
definition on 1409.
../selinux/virt.if:1623: Error: duplicate definition of virt_filetrans_named_content().
Original definition on 1427.
../selinux/virt.if:1651: Error: duplicate definition of virt_transition_svirt_sandbox().
Original definition on 1455.
../selinux/virt.if:1676: Error: duplicate definition of virt_sandbox_read_state().
Original definition on 1480.
../selinux/virt.if:1694: Error: duplicate definition of virt_rw_svirt_dev(). Original
definition on 1498.
../selinux/virt.if:1712: Error: duplicate definition of virt_rw_svirt_image(). Original
definition on 1516.
../selinux/virt.if:1730: Error: duplicate definition of virt_rlimitinh(). Original
definition on 1534.
../selinux/virt.if:1748: Error: duplicate definition of virt_noatsecure(). Original
definition on 1552.
../selinux/virt.if:1773: Error: duplicate definition of virt_admin(). Original definition
on 1577.
../selinux/virt.if:1820: Error: duplicate definition of virt_default_capabilities().
Original definition on 1622.
../selinux/virt.if:1839: Error: duplicate definition of virt_dbus_chat(). Original
definition on 1642.
../selinux/virt.if:1879: Error: duplicate definition of virt_sandbox_domtrans(). Original
definition on 1678.
../selinux/virt.if:1897: Error: duplicate definition of virt_dontaudit_read_state().
Original definition on 1696.
../selinux/virt.if:1917: Error: duplicate definition of virt_dgram_send(). Original
definition on 1716.
../selinux/virt.if:1956: Error: duplicate definition of virt_svirt_manage_tmp(). Original
definition on 1735.
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|