perfinion
commented
4 years ago For reference, the semodule verbosity fix is here: https://github.com/SELinuxProject/selinux/pull/182
Open mikhailnov opened 4 years ago
perfinion
commented
4 years ago For reference, the semodule verbosity fix is here: https://github.com/SELinuxProject/selinux/pull/182
zpytela
commented
4 years ago This issue seems to be a policycoreutils one, @vmojzis could you please take a look?
bachradsusi
commented
4 years ago @zpytela It's expected in the current state of Fedora SELinux policy. E,g. alsa.te contains optional blocks referencing hald_t type but Fedora does not ship hal module:
optional_policy(`
hal_use_fds(alsa_t)
hal_write_log(alsa_t)
')it expands to
198(optional alsa_optional_2
199 (typeattributeset cil_gen_require var_t)
200 (typeattributeset cil_gen_require hald_t)
201 (typeattributeset cil_gen_require hald_log_t)
202 (typeattributeset cil_gen_require var_log_t)
203 (allow alsa_t hald_t (fd (use)))
204 (allow alsa_t var_t (dir (getattr open search)))
205 (allow alsa_t var_log_t (dir (getattr open search)))
206 (allow alsa_t hald_log_t (dir (getattr open search)))
207 (allow alsa_t hald_log_t (file (ioctl write getattr lock append open)))
208) and semodule -v -v -i alsa.cil correctly reports:
ailed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/alsa/cil:200
Disabling optional 'alsa_optional_2' at /var/lib/selinux/targeted/tmp/modules/400/alsa/cil:198
Failed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/alsa/cil:201
Disabling optional 'alsa_optional_2' at /var/lib/selinux/targeted/tmp/modules/400/alsa/cil:198
Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/400/alsa/cil:203
Disabling optional 'alsa_optional_2' at /var/lib/selinux/targeted/tmp/modules/400/alsa/cil:198
Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/400/alsa/cil:206
Disabling optional 'alsa_optional_2' at /var/lib/selinux/targeted/tmp/modules/400/alsa/cil:198
Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/400/alsa/cil:207
Disabling optional 'alsa_optional_2' at /var/lib/selinux/targeted/tmp/modules/400/alsa/cil:198
wrabcak
commented
4 years ago Work we need to do here is to drop unused SELinux modules in our policy and also do clean up of these optional blocks.
zpytela
commented
4 years ago I understand that if there is a final decision not to support a module, large cleanup should be in place.
wrabcak
commented
4 years ago In general, we should do cleanup of SELinux modules we have in SELinux policy but they are not active so decision was made in past, we just need to drop it from sources.
arymangupta
commented
3 years ago I am facing this issue not sure what is the reason here
[user@redhat7 ~]$ sudo semodule -v -v -i user.pp Attempting to install module 'user.pp': Ok: return value of 0. Committing changes: Failed to resolve typeattributeset statement at /etc/selinux/targeted/tmp/modules/400/user/cil:4 semodule: Failed!
[user@redhat7 ~]$ sudo semodule -v -v -i user.cil Attempting to install module 'user.cil': libsemanage.map_file: Unable to open user.cil (No such file or directory). libsemanage.semanage_direct_install_file: Unable to read file user.cil (No such file or directory). semodule: Failed on user.cil!
I have recently found that in
semoduleutility and inlibsepolin general it is impossible to turn on maximal debug level. See https://github.com/SELinuxProject/selinux/issues/176When Fedora's selinux-policy and fedora-policy-contrib are built with libsepol with that patch applied, libsepol thows a lot of warnings about depreceated and unresolvable statements.
I think policy developers did not see them due to libsepol not telling about them by default (or meybe it does tell it?)
Github does not allow to post full log here (it is too long), bellow is a fragment. Full log is attached as a file.
Full log: script_output.zip