Would someone please help me translate this module into something that will build on a current system (CentOS 6, checkpolicy-2.0.22-1.el6): policy_module(procmail_uncon, 1.0.18) =============== cut =================== gen_require(` type unconfined_t; type unconfined_exec_t; type procmail_t; role system_r; ') type my_uncon_exec_t; files_type(my_uncon_exec_t) allow procmail_t unconfined_t : process { transition sigchld }; domain_auto_trans(procmail_t, my_uncon_exec_t, unconfined_t) role system_r types unconfined_t;

=============== cut =================== After many hours of Google searches, this is a close as I've been able to come: =============== cut =================== module procmail_uncon 1.1.0; require { type unconfined_t; type unconfined_exec_t; type procmail_t; role system_r; } type my_uncon_exec_t; allow procmail_t unconfined_t : process { transition siginh }; role system_r types unconfined_t; =============== cut =================== I get an "unknown class process used in rule" from checkmodule. Looks like I'll be running my mail server with SELinux disabled for a while. I've already spent more time on this than it would take me to recover from a break in.

On 01/05/2015 03:29 AM, Miroslav Grepl wrote: > On 01/05/2015 01:55 AM, Robert Nichols wrote: >> Would someone please help me translate this module into something that >> will build on a current system (CentOS 6, checkpolicy-2.0.22-1.el6): >> >> policy_module(procmail_uncon, 1.0.18) >> >> =============== cut =================== >> gen_require(` >> type unconfined_t; >> type unconfined_exec_t; >> type procmail_t; >> role system_r; >> ') >> >> type my_uncon_exec_t; >> files_type(my_uncon_exec_t) >> >> allow procmail_t unconfined_t : process { transition sigchld }; >> domain_auto_trans(procmail_t, my_uncon_exec_t, unconfined_t) >> role system_r types unconfined_t; > > You say you are not able to build the above policy module on CentOS 6? I cannot. With that in a file called procmail_uncon.te in a directory with a Makefile copied from /usr/share/linux/devel, running "make" yields: ======== Compiling targeted procmail_uncon module /usr/bin/checkmodule: loading policy configuration from tmp/procmail_uncon.tmp procmail_uncon.te":13:ERROR 'unknown class file used in rule' at token ';' on line 1045: #line 13 allow procmail_t my_uncon_exec_t:file { getattr open read execute }; /usr/bin/checkmodule: error(s) encountered while parsing configuration make: *** [tmp/procmail_uncon.mod] Error 1 ======== The following packages are installed: libselinux-2.0.94-5.8.el6.x86_64 libselinux-devel-2.0.94-5.8.el6.x86_64 libselinux-python-2.0.94-5.8.el6.x86_64 libselinux-utils-2.0.94-5.8.el6.x86_64 selinux-policy-3.7.19-260.el6_6.1.noarch libsepol-devel-2.0.41-4.el6.x86_64 selinux-policy-targeted-3.7.19-260.el6_6.1.noarch I did dig up a procmail_uncon.pp file from an old Fedora 12 backup, and that file seems to install OK, so the problem is no longer critical for me, but I'd like to get this resolved.

On 01/05/2015 02:41 PM, Daniel J Walsh wrote: > > On 01/05/2015 10:11 AM, Robert Nichols wrote: >> On 01/05/2015 03:29 AM, Miroslav Grepl wrote: >>> On 01/05/2015 01:55 AM, Robert Nichols wrote: >>>> Would someone please help me translate this module into something >>>> that >>>> will build on a current system (CentOS 6, checkpolicy-2.0.22-1.el6): >>>> >>>> policy_module(procmail_uncon, 1.0.18) >>>> >>>> =============== cut =================== >>>> gen_require(` >>>> type unconfined_t; >>>> type unconfined_exec_t; >>>> type procmail_t; >>>> role system_r; >>>> ') >>>> >>>> type my_uncon_exec_t; >>>> files_type(my_uncon_exec_t) >>>> >>>> allow procmail_t unconfined_t : process { transition sigchld }; >>>> domain_auto_trans(procmail_t, my_uncon_exec_t, unconfined_t) >>>> role system_r types unconfined_t; >>> >>> You say you are not able to build the above policy module on CentOS 6? >> >> I cannot. With that in a file called procmail_uncon.te in a directory >> with >> a Makefile copied from /usr/share/linux/devel, running "make" yields: >> >> ======== >> Compiling targeted procmail_uncon module >> /usr/bin/checkmodule: loading policy configuration from >> tmp/procmail_uncon.tmp >> procmail_uncon.te":13:ERROR 'unknown class file used in rule' at token >> ';' on line 1045: >> #line 13 >> allow procmail_t my_uncon_exec_t:file { getattr open read >> execute }; >> /usr/bin/checkmodule: error(s) encountered while parsing configuration >> make: *** [tmp/procmail_uncon.mod] Error 1 >> ======== >> >> The following packages are installed: >> libselinux-2.0.94-5.8.el6.x86_64 >> libselinux-devel-2.0.94-5.8.el6.x86_64 >> libselinux-python-2.0.94-5.8.el6.x86_64 >> libselinux-utils-2.0.94-5.8.el6.x86_64 >> selinux-policy-3.7.19-260.el6_6.1.noarch >> libsepol-devel-2.0.41-4.el6.x86_64 >> selinux-policy-targeted-3.7.19-260.el6_6.1.noarch >> >> I did dig up a procmail_uncon.pp file from an old Fedora 12 backup, and >> that file seems to install OK, so the problem is no longer critical >> for me, >> but I'd like to get this resolved. >> > You need to run the Makefile on the te file with the > policy_module(procmail_uncon, 1.0.18) line. I have no idea what you mean by that. You don't run a Makefile _on_ a source file. OK, I'll try it anyway: ======== # make procmail_uncon.te make: Nothing to be done for `procmail_uncon.te'. ======== Yes, it already exists and has no dependencies.