无法为SELinux编译Debian RefPolicy

Question

I am using Debian 6 with SELinux enabled.

Now, I just want to change default policy and make my-policy as a active policy. For that I have downloaded debian's refpolicy and tried to compile it.

It seems rolemap file is not found. But rolemap is defined in Makefile.src .

Also, parsing /tmp/example.tmp file failed at 'introduce()' line:28 .

Find output of make at below:

debian:/opt/policy-src/debian# make -f Makefile.src all Compiling default example module echo "ifdef(\`""example""_per_role_template',\`" > tmp/example.mod.role m4
-D distro_debian -D direct_sysadm_daemon -D hide_broken_symptoms -D mls_num_sens=16 -D mls_num_cats=1024 -D mcs_num_cats=1024 -D mandatory_mcs rolemap | gawk '/^[[:blank:]]*[A-Za-z]/{ print "gen_require(type " $3 "; role " $1 ";)\nexample_per_role_template(" $2 "," $3 "," $1 ")" }' >> tmp/example.mod.role echo "')" >> tmp/example.mod.role echo "ifdef(\`""example""_per_userdomain_template',\`" >> tmp/example.mod.role echo "errprint(\`Warning: per_userdomain_templates have been renamed to per_role_templates (""example""_per_userdomain_template)'__endline__)" >> tmp/example.mod.role m4 -D distro_debian -D direct_sysadm_daemon -D hide_broken_symptoms -D mls_num_sens=16 -D mls_num_cats=1024 -D mcs_num_cats=1024 -D mandatory_mcs rolemap | gawk '/^[[:blank:]]*[A-Za-z]/{ print "gen_require(type " $3 "; role " $1 ";)\nexample_per_userdomain_template(" $2 "," $3 "," $1 ")" }' >> tmp/example.mod.role echo "')" >> tmp/example.mod.role m4 -D distro_debian -D direct_sysadm_daemon -D hide_broken_symptoms -D mls_num_sens=16 -D mls_num_cats=1024 -D mcs_num_cats=1024 -D mandatory_mcs -s tmp/all_interfaces.conf example.te tmp/example.mod.role > tmp/example.tmp /usr/bin/checkmodule -m tmp/example.tmp -o tmp/example.mod /usr/bin/checkmodule:  loading policy configuration from tmp/example.tmp tmp/all_interfaces.conf":28:ERROR 'Building a policy module, but no module specification found. ' at token 'interface' on line 28: interface(myapp_domtrans,
# /usr/bin/checkmodule:  error(s) encountered while parsing configuration make: *** [tmp/example.mod] Error 1

How could I compile this policy?

Answer 1

To add your my-policy into the debian's refpolicy you have to work with the refpolicy (original sources) and the debian package (contains the example files).

See how to work with debian sources . Instead of make you should use the Debian build tools.

Step by step:

• Source Package files for Debian 6 selinux-policy-default
• run dpkg-source -x refpolicy_0.2.20100524-7+squeeze1.dsc
• goto "refpolicy-0.2.20100524" directory and make your changes
• build new debian package dpkg-buildpackage
• install new package dpkg -i ../selinux-policy-default_0.2.20100524-7+squeeze1_all.deb