Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 924696

Summary: sepolicy generate: some generated setup scripts fail
Product: Red Hat Enterprise Linux 7 Reporter: Michal Trunecka <mtruneck>
Component: policycoreutilsAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED CURRENTRELEASE QA Contact: Michal Trunecka <mtruneck>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 7.1CC: dwalsh, ebenes, mgrepl, mmalik
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-13 11:46:47 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 917049    
Attachments:
Description Flags
policycoreutils-generate_man.patch none

Description Michal Trunecka 2013-03-22 10:54:08 UTC 
Description of problem:
The setup script generated for policy for example by this command:
sepolicy generate --customize -d glance_registry_t -n testpolicy

is failing with the error: ValueError: testpolicy_t must be an SELinux process domain: ....


Version-Release number of selected component (if applicable):
policycoreutils-2.1.14-24.el7.x86_64


Whole terminal output:

# sepolicy generate --customize -d glance_registry_t -n testpolicy
Created the following files:
/root/policycoreutils/Sanity/sepolicy-generate/mypol/testpolicy.te # Type Enforcement file
/root/policycoreutils/Sanity/sepolicy-generate/mypol/testpolicy.if # Interface file
/root/policycoreutils/Sanity/sepolicy-generate/mypol/testpolicy.fc # File Contexts file
/root/policycoreutils/Sanity/sepolicy-generate/mypol/testpolicy_selinux.spec # Spec file
/root/policycoreutils/Sanity/sepolicy-generate/mypol/testpolicy.sh # Setup Script

# ./testpolicy.sh 
Building and Loading Policy
+ make -f /usr/share/selinux/devel/Makefile testpolicy.pp
m4:testpolicy.if:2: ERROR: end of file in comment
Compiling targeted testpolicy module
/usr/bin/checkmodule:  loading policy configuration from tmp/testpolicy.tmp
/usr/bin/checkmodule:  policy configuration loaded
/usr/bin/checkmodule:  writing binary representation (version 17) to tmp/testpolicy.mod
Creating targeted testpolicy.pp policy package
rm tmp/testpolicy.mod tmp/testpolicy.mod.fc
+ /usr/sbin/semodule -i testpolicy.pp
+ sepolicy manpage -p . -d testpolicy_t
ValueError: testpolicy_t must be an SELinux process domain:
Valid domains: sosreport_t, git_session_t, sshd_sandbox_t, cfengine_execd_t, bootloader_t, netutils_t, qmail_tcp_env_t, devicekit_power_t, zoneminder_t, httpd_collectd_script_t, sandbox_x_client_t, nova_api_t, sblim_reposd_t, dkim_milter_t, admin_crontab_t, consolekit_t, nova_compute_t, nova_console_t, pam_console_t, zarafa_gateway_t, policykit_grant_t, logrotate_t, openvswitch_t, update_modules_t, ssh_keysign_t, nova_network_t, qmail_rspawn_t, uml_switch_t, qmail_inject_t, qmail_lspawn_t, dirsrvadmin_unconfined_script_t, gnomeclock_t, httpd_cvs_script_t, sandbox_net_client_t,...................
Comment 1 Miroslav Grepl 2013-05-14 08:18:50 UTC 
Yes, you are right. The question is how to handle it. Maybe we don't want to generate a man page if we declare

--customize

option.
Comment 2 Miroslav Grepl 2013-05-14 08:38:28 UTC 
Created attachment 747558 [details]
policycoreutils-generate_man.patch

Something like the attached patch.
Comment 3 Michal Trunecka 2013-05-14 09:58:59 UTC 
Ok, it works, but it fails afterwards when making rpm.

Executing(%install): /bin/sh -e /var/tmp/rpm-tmp.F5deoW
+ umask 022
+ cd /root/policycoreutils/Sanity/sepolicy-generate/test
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/test/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/packages
+ install -m 644 /root/policycoreutils/Sanity/sepolicy-generate/test/testpolicy.pp /root/policycoreutils/Sanity/sepolicy-generate/test/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/packages
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/test/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/devel/include/contrib
+ install -m 644 /root/policycoreutils/Sanity/sepolicy-generate/test/testpolicy.if /root/policycoreutils/Sanity/sepolicy-generate/test/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/devel/include/contrib/
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/test/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/man/man8/
+ install -m 644 /root/policycoreutils/Sanity/sepolicy-generate/test/testpolicy_selinux.8 /root/policycoreutils/Sanity/sepolicy-generate/test/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/man/man8/
install: cannot stat '/root/policycoreutils/Sanity/sepolicy-generate/test/testpolicy_selinux.8': No such file or directory
error: Bad exit status from /var/tmp/rpm-tmp.F5deoW (%install)
Comment 4 Miroslav Grepl 2013-05-14 11:26:57 UTC 
Ah, yes. I believe we also should not do a rpm pkg for --customize option.
Comment 5 Daniel Walsh 2013-05-16 16:08:58 UTC 
Fixed in policycoreutils-2.1.14-44.fc19

Rpm will still be generated but without the man page.
Comment 6 Michal Trunecka 2013-05-24 08:21:50 UTC 
VERIFIED using automated test:


:: [   PASS   ] :: Running 'sleep 1'
Created the following files:
mypolicy/testpolicy.te # Type Enforcement file
mypolicy/testpolicy.if # Interface file
mypolicy/testpolicy.fc # File Contexts file
mypolicy/testpolicy_selinux.spec # Spec file
mypolicy/testpolicy.sh # Setup Script

:: [   PASS   ] :: Running 'sepolicy generate -p mypolicy  -n testpolicy --customize -d httpd_t -a firewalld '
policy_module(testpolicy, 1.0.0)

gen_require(`
        type httpd_t;
')

########################################
#
# testpolicy customized policy
#

optional_policy(`
        firewalld_admin(httpd_t, system_r)
')
:: [   PASS   ] :: Running 'cat mypolicy/testpolicy.te'

## <summary>policy for testpolicy</summary>:: [   PASS   ] :: Running 'cat mypolicy/testpolicy.if'
:: [   PASS   ] :: Running 'cat mypolicy/testpolicy.fc'
Building and Loading Policy
+ make -f /usr/share/selinux/devel/Makefile testpolicy.pp
make[1]: Entering directory `/root/policycoreutils/Sanity/sepolicy-generate/mypolicy'
m4:testpolicy.if:2: ERROR: end of file in comment
Compiling targeted testpolicy module
/usr/bin/checkmodule:  loading policy configuration from tmp/testpolicy.tmp
/usr/bin/checkmodule:  policy configuration loaded
/usr/bin/checkmodule:  writing binary representation (version 17) to tmp/testpolicy.mod
Creating targeted testpolicy.pp policy package
rm tmp/testpolicy.mod tmp/testpolicy.mod.fc
make[1]: Leaving directory `/root/policycoreutils/Sanity/sepolicy-generate/mypolicy'
+ /usr/sbin/semodule -i testpolicy.pp
++ pwd
+ pwd=/root/policycoreutils/Sanity/sepolicy-generate/mypolicy
+ rpmbuild --define '_sourcedir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_specdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_builddir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_srcrpmdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_rpmdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_buildrootdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build' -ba testpolicy_selinux.spec
Executing(%install): /bin/sh -e /var/tmp/rpm-tmp.BT5E0D
+ umask 022
+ cd /root/policycoreutils/Sanity/sepolicy-generate/mypolicy
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/packages
+ install -m 644 /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/testpolicy.pp /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/packages
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/devel/include/contrib
+ install -m 644 /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/testpolicy.if /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/devel/include/contrib/
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/man/man8/
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/etc/selinux/targeted/contexts/users/
+ /usr/lib/rpm/brp-compress
+ /usr/lib/rpm/brp-strip /usr/bin/strip
+ /usr/lib/rpm/brp-strip-static-archive /usr/bin/strip
+ /usr/lib/rpm/brp-strip-comment-note /usr/bin/strip /usr/bin/objdump
Processing files: testpolicy_selinux-1.0-1.el7.noarch
Provides: testpolicy_selinux = 1.0-1.el7
Requires(interp): /bin/sh /bin/sh
Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1
Requires(post): /bin/sh policycoreutils selinux-policy-base >= 3.12.1-44
Requires(postun): /bin/sh policycoreutils
Checking for unpackaged file(s): /usr/lib/rpm/check-files /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64
Wrote: /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/testpolicy_selinux-1.0-1.el7.src.rpm
Wrote: /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/noarch/testpolicy_selinux-1.0-1.el7.noarch.rpm
Executing(%clean): /bin/sh -e /var/tmp/rpm-tmp.MRKZMX
+ umask 022
+ cd /root/policycoreutils/Sanity/sepolicy-generate/mypolicy
+ /usr/bin/rm -rf /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64
+ exit 0
:: [   PASS   ] :: Running 'mypolicy/testpolicy.sh'
testpolicy	1.0.0	
:: [   PASS   ] :: Running 'semodule -l | grep  testpolicy'
/usr/sbin/semanage: SELinux user testpolicy_u is not defined
:: [   PASS   ] :: Running 'semanage user -d testpolicy_u'
:: [   PASS   ] :: Running 'semodule -r testpolicy'
:: [   PASS   ] :: Running 'rm -rf mypolicy/*'
:: [   PASS   ] :: Running 'sleep 1'
Created the following files:
mypolicy/testpolicy.te # Type Enforcement file
mypolicy/testpolicy.if # Interface file
mypolicy/testpolicy.fc # File Contexts file
mypolicy/testpolicy_selinux.spec # Spec file
mypolicy/testpolicy.sh # Setup Script

:: [   PASS   ] :: Running 'sepolicy generate -p mypolicy -w /home   -n testpolicy --customize -d httpd_t -a firewalld '
policy_module(testpolicy, 1.0.0)

gen_require(`
        type httpd_t;
')

type testpolicy_rw_t;
files_type(testpolicy_rw_t)

########################################
#
# testpolicy customized policy
#

manage_dirs_pattern(httpd_t, testpolicy_rw_t, testpolicy_rw_t)
manage_files_pattern(httpd_t, testpolicy_rw_t, testpolicy_rw_t)
manage_lnk_files_pattern(httpd_t, testpolicy_rw_t, testpolicy_rw_t)

optional_policy(`
        firewalld_admin(httpd_t, system_r)
')
:: [   PASS   ] :: Running 'cat mypolicy/testpolicy.te'

## <summary>policy for testpolicy</summary>
########################################
## <summary>
##	Search testpolicy rw directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`testpolicy_search_rw_dir',`
	gen_require(`
		type testpolicy_rw_t;
	')

	allow $1 testpolicy_rw_t:dir search_dir_perms;
	files_search_rw($1)
')

########################################
## <summary>
##	Read testpolicy rw files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`testpolicy_read_rw_files',`
	gen_require(`
		type testpolicy_rw_t;
	')

	read_files_pattern($1, testpolicy_rw_t, testpolicy_rw_t)
	allow $1 testpolicy_rw_t:dir list_dir_perms;
	files_search_rw($1)
')

########################################
## <summary>
##	Manage testpolicy rw files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`testpolicy_manage_rw_files',`
	gen_require(`
		type testpolicy_rw_t;
	')

	manage_files_pattern($1, testpolicy_rw_t, testpolicy_rw_t)
')

########################################
## <summary>
##	Create, read, write, and delete
##	testpolicy rw dirs.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`testpolicy_manage_rw_dirs',`
	gen_require(`
		type testpolicy_rw_t;
	')

	manage_dirs_pattern($1, testpolicy_rw_t, testpolicy_rw_t)
')


########################################
## <summary>
##	All of the rules required to administrate
##	an testpolicy environment
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`testpolicy_admin',`
	gen_require(`
		type testpolicy_t;
		type testpolicy_rw_t;
	')

	allow $1 testpolicy_t:process { ptrace signal_perms };
	ps_process_pattern($1, testpolicy_t)

	files_search_etc($1)
	admin_pattern($1, testpolicy_rw_t)
	optional_policy(`
		systemd_passwd_agent_exec($1)
		systemd_read_fifo_file_passwd_run($1)
	')
')
:: [   PASS   ] :: Running 'cat mypolicy/testpolicy.if'

/home(/.*)?		gen_context(system_u:object_r:testpolicy_rw_t,s0)
:: [   PASS   ] :: Running 'cat mypolicy/testpolicy.fc'
Building and Loading Policy
+ make -f /usr/share/selinux/devel/Makefile testpolicy.pp
make[1]: Entering directory `/root/policycoreutils/Sanity/sepolicy-generate/mypolicy'
Compiling targeted testpolicy module
/usr/bin/checkmodule:  loading policy configuration from tmp/testpolicy.tmp
/usr/bin/checkmodule:  policy configuration loaded
/usr/bin/checkmodule:  writing binary representation (version 17) to tmp/testpolicy.mod
Creating targeted testpolicy.pp policy package
rm tmp/testpolicy.mod tmp/testpolicy.mod.fc
make[1]: Leaving directory `/root/policycoreutils/Sanity/sepolicy-generate/mypolicy'
+ /usr/sbin/semodule -i testpolicy.pp
+ /sbin/restorecon -F -R -v /home
++ pwd
+ pwd=/root/policycoreutils/Sanity/sepolicy-generate/mypolicy
+ rpmbuild --define '_sourcedir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_specdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_builddir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_srcrpmdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_rpmdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_buildrootdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build' -ba testpolicy_selinux.spec
Executing(%install): /bin/sh -e /var/tmp/rpm-tmp.RGDAyc
+ umask 022
+ cd /root/policycoreutils/Sanity/sepolicy-generate/mypolicy
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/packages
+ install -m 644 /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/testpolicy.pp /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/packages
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/devel/include/contrib
+ install -m 644 /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/testpolicy.if /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/devel/include/contrib/
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/man/man8/
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/etc/selinux/targeted/contexts/users/
+ /usr/lib/rpm/brp-compress
+ /usr/lib/rpm/brp-strip /usr/bin/strip
+ /usr/lib/rpm/brp-strip-static-archive /usr/bin/strip
+ /usr/lib/rpm/brp-strip-comment-note /usr/bin/strip /usr/bin/objdump
Processing files: testpolicy_selinux-1.0-1.el7.noarch
Provides: testpolicy_selinux = 1.0-1.el7
Requires(interp): /bin/sh /bin/sh
Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1
Requires(post): /bin/sh policycoreutils selinux-policy-base >= 3.12.1-44
Requires(postun): /bin/sh policycoreutils
Checking for unpackaged file(s): /usr/lib/rpm/check-files /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64
Wrote: /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/testpolicy_selinux-1.0-1.el7.src.rpm
Wrote: /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/noarch/testpolicy_selinux-1.0-1.el7.noarch.rpm
Executing(%clean): /bin/sh -e /var/tmp/rpm-tmp.MQyAv2
+ umask 022
+ cd /root/policycoreutils/Sanity/sepolicy-generate/mypolicy
+ /usr/bin/rm -rf /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64
+ exit 0
:: [   PASS   ] :: Running 'mypolicy/testpolicy.sh'
testpolicy	1.0.0	
:: [   PASS   ] :: Running 'semodule -l | grep  testpolicy'
/usr/sbin/semanage: SELinux user testpolicy_u is not defined
:: [   PASS   ] :: Running 'semanage user -d testpolicy_u'
:: [   PASS   ] :: Running 'semodule -r testpolicy'
:: [   PASS   ] :: Running 'rm -rf mypolicy/*'
:: [   PASS   ] :: Running 'sleep 1'
Created the following files:
mypolicy/testpolicy.te # Type Enforcement file
mypolicy/testpolicy.if # Interface file
mypolicy/testpolicy.fc # File Contexts file
mypolicy/testpolicy_selinux.spec # Spec file
mypolicy/testpolicy.sh # Setup Script

:: [   PASS   ] :: Running 'sepolicy generate -p mypolicy  -n testpolicy --customize -d httpd_t'
policy_module(testpolicy, 1.0.0)

gen_require(`
        type httpd_t;
')

########################################
#
# testpolicy customized policy
#
:: [   PASS   ] :: Running 'cat mypolicy/testpolicy.te'

## <summary>policy for testpolicy</summary>:: [   PASS   ] :: Running 'cat mypolicy/testpolicy.if'
:: [   PASS   ] :: Running 'cat mypolicy/testpolicy.fc'
Building and Loading Policy
+ make -f /usr/share/selinux/devel/Makefile testpolicy.pp
make[1]: Entering directory `/root/policycoreutils/Sanity/sepolicy-generate/mypolicy'
m4:testpolicy.if:2: ERROR: end of file in comment
Compiling targeted testpolicy module
/usr/bin/checkmodule:  loading policy configuration from tmp/testpolicy.tmp
/usr/bin/checkmodule:  policy configuration loaded
/usr/bin/checkmodule:  writing binary representation (version 17) to tmp/testpolicy.mod
Creating targeted testpolicy.pp policy package
rm tmp/testpolicy.mod tmp/testpolicy.mod.fc
make[1]: Leaving directory `/root/policycoreutils/Sanity/sepolicy-generate/mypolicy'
+ /usr/sbin/semodule -i testpolicy.pp
++ pwd
+ pwd=/root/policycoreutils/Sanity/sepolicy-generate/mypolicy
+ rpmbuild --define '_sourcedir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_specdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_builddir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_srcrpmdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_rpmdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_buildrootdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build' -ba testpolicy_selinux.spec
Executing(%install): /bin/sh -e /var/tmp/rpm-tmp.gE3ND9
+ umask 022
+ cd /root/policycoreutils/Sanity/sepolicy-generate/mypolicy
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/packages
+ install -m 644 /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/testpolicy.pp /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/packages
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/devel/include/contrib
+ install -m 644 /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/testpolicy.if /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/devel/include/contrib/
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/man/man8/
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/etc/selinux/targeted/contexts/users/
+ /usr/lib/rpm/brp-compress
+ /usr/lib/rpm/brp-strip /usr/bin/strip
+ /usr/lib/rpm/brp-strip-static-archive /usr/bin/strip
+ /usr/lib/rpm/brp-strip-comment-note /usr/bin/strip /usr/bin/objdump
Processing files: testpolicy_selinux-1.0-1.el7.noarch
Provides: testpolicy_selinux = 1.0-1.el7
Requires(interp): /bin/sh /bin/sh
Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1
Requires(post): /bin/sh policycoreutils selinux-policy-base >= 3.12.1-44
Requires(postun): /bin/sh policycoreutils
Checking for unpackaged file(s): /usr/lib/rpm/check-files /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64
Wrote: /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/testpolicy_selinux-1.0-1.el7.src.rpm
Wrote: /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/noarch/testpolicy_selinux-1.0-1.el7.noarch.rpm
Executing(%clean): /bin/sh -e /var/tmp/rpm-tmp.vEDiFi
+ umask 022
+ cd /root/policycoreutils/Sanity/sepolicy-generate/mypolicy
+ /usr/bin/rm -rf /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64
+ exit 0
:: [   PASS   ] :: Running 'mypolicy/testpolicy.sh'
testpolicy	1.0.0	
:: [   PASS   ] :: Running 'semodule -l | grep  testpolicy'
/usr/sbin/semanage: SELinux user testpolicy_u is not defined
:: [   PASS   ] :: Running 'semanage user -d testpolicy_u'
:: [   PASS   ] :: Running 'semodule -r testpolicy'
:: [   PASS   ] :: Running 'rm -rf mypolicy/*'
:: [   PASS   ] :: Running 'sleep 1'
Created the following files:
mypolicy/testpolicy.te # Type Enforcement file
mypolicy/testpolicy.if # Interface file
mypolicy/testpolicy.fc # File Contexts file
mypolicy/testpolicy_selinux.spec # Spec file
mypolicy/testpolicy.sh # Setup Script

:: [   PASS   ] :: Running 'sepolicy generate -p mypolicy -w /home   -n testpolicy --customize -d httpd_t'
policy_module(testpolicy, 1.0.0)

gen_require(`
        type httpd_t;
')

type testpolicy_rw_t;
files_type(testpolicy_rw_t)

########################################
#
# testpolicy customized policy
#

manage_dirs_pattern(httpd_t, testpolicy_rw_t, testpolicy_rw_t)
manage_files_pattern(httpd_t, testpolicy_rw_t, testpolicy_rw_t)
manage_lnk_files_pattern(httpd_t, testpolicy_rw_t, testpolicy_rw_t)
:: [   PASS   ] :: Running 'cat mypolicy/testpolicy.te'

## <summary>policy for testpolicy</summary>
########################################
## <summary>
##	Search testpolicy rw directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`testpolicy_search_rw_dir',`
	gen_require(`
		type testpolicy_rw_t;
	')

	allow $1 testpolicy_rw_t:dir search_dir_perms;
	files_search_rw($1)
')

########################################
## <summary>
##	Read testpolicy rw files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`testpolicy_read_rw_files',`
	gen_require(`
		type testpolicy_rw_t;
	')

	read_files_pattern($1, testpolicy_rw_t, testpolicy_rw_t)
	allow $1 testpolicy_rw_t:dir list_dir_perms;
	files_search_rw($1)
')

########################################
## <summary>
##	Manage testpolicy rw files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`testpolicy_manage_rw_files',`
	gen_require(`
		type testpolicy_rw_t;
	')

	manage_files_pattern($1, testpolicy_rw_t, testpolicy_rw_t)
')

########################################
## <summary>
##	Create, read, write, and delete
##	testpolicy rw dirs.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`testpolicy_manage_rw_dirs',`
	gen_require(`
		type testpolicy_rw_t;
	')

	manage_dirs_pattern($1, testpolicy_rw_t, testpolicy_rw_t)
')


########################################
## <summary>
##	All of the rules required to administrate
##	an testpolicy environment
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`testpolicy_admin',`
	gen_require(`
		type testpolicy_t;
		type testpolicy_rw_t;
	')

	allow $1 testpolicy_t:process { ptrace signal_perms };
	ps_process_pattern($1, testpolicy_t)

	files_search_etc($1)
	admin_pattern($1, testpolicy_rw_t)
	optional_policy(`
		systemd_passwd_agent_exec($1)
		systemd_read_fifo_file_passwd_run($1)
	')
')
:: [   PASS   ] :: Running 'cat mypolicy/testpolicy.if'

/home(/.*)?		gen_context(system_u:object_r:testpolicy_rw_t,s0)
:: [   PASS   ] :: Running 'cat mypolicy/testpolicy.fc'
Building and Loading Policy
+ make -f /usr/share/selinux/devel/Makefile testpolicy.pp
make[1]: Entering directory `/root/policycoreutils/Sanity/sepolicy-generate/mypolicy'
Compiling targeted testpolicy module
/usr/bin/checkmodule:  loading policy configuration from tmp/testpolicy.tmp
/usr/bin/checkmodule:  policy configuration loaded
/usr/bin/checkmodule:  writing binary representation (version 17) to tmp/testpolicy.mod
Creating targeted testpolicy.pp policy package
rm tmp/testpolicy.mod tmp/testpolicy.mod.fc
make[1]: Leaving directory `/root/policycoreutils/Sanity/sepolicy-generate/mypolicy'
+ /usr/sbin/semodule -i testpolicy.pp
+ /sbin/restorecon -F -R -v /home
++ pwd
+ pwd=/root/policycoreutils/Sanity/sepolicy-generate/mypolicy
+ rpmbuild --define '_sourcedir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_specdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_builddir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_srcrpmdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_rpmdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy' --define '_buildrootdir /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build' -ba testpolicy_selinux.spec
Executing(%install): /bin/sh -e /var/tmp/rpm-tmp.hDy6UA
+ umask 022
+ cd /root/policycoreutils/Sanity/sepolicy-generate/mypolicy
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/packages
+ install -m 644 /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/testpolicy.pp /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/packages
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/devel/include/contrib
+ install -m 644 /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/testpolicy.if /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/selinux/devel/include/contrib/
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/usr/share/man/man8/
+ install -d /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64/etc/selinux/targeted/contexts/users/
+ /usr/lib/rpm/brp-compress
+ /usr/lib/rpm/brp-strip /usr/bin/strip
+ /usr/lib/rpm/brp-strip-static-archive /usr/bin/strip
+ /usr/lib/rpm/brp-strip-comment-note /usr/bin/strip /usr/bin/objdump
Processing files: testpolicy_selinux-1.0-1.el7.noarch
Provides: testpolicy_selinux = 1.0-1.el7
Requires(interp): /bin/sh /bin/sh
Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1
Requires(post): /bin/sh policycoreutils selinux-policy-base >= 3.12.1-44
Requires(postun): /bin/sh policycoreutils
Checking for unpackaged file(s): /usr/lib/rpm/check-files /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64
Wrote: /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/testpolicy_selinux-1.0-1.el7.src.rpm
Wrote: /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/noarch/testpolicy_selinux-1.0-1.el7.noarch.rpm
Executing(%clean): /bin/sh -e /var/tmp/rpm-tmp.trvxXY
+ umask 022
+ cd /root/policycoreutils/Sanity/sepolicy-generate/mypolicy
+ /usr/bin/rm -rf /root/policycoreutils/Sanity/sepolicy-generate/mypolicy/.build/testpolicy_selinux-1.0-1.el7.x86_64
+ exit 0
:: [   PASS   ] :: Running 'mypolicy/testpolicy.sh'
testpolicy	1.0.0	
:: [   PASS   ] :: Running 'semodule -l | grep  testpolicy'
/usr/sbin/semanage: SELinux user testpolicy_u is not defined
:: [   PASS   ] :: Running 'semanage user -d testpolicy_u'
:: [   PASS   ] :: Running 'semodule -r testpolicy'
:: [   PASS   ] :: Running 'rm -rf mypolicy/*'
:: [   PASS   ] :: Running 'sleep 1'
Comment 7 Ludek Smid 2014-06-13 11:46:47 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.