commit: cf050c09f77027dd6ae24e17e5035b617e2d682b
Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Wed Mar 4 17:14:12 2015 +0000
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Wed Mar 4 17:39:39 2015 +0000
URL:
http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=cf050c09
Mark storage as base module
All modules within the base should not depend on anything that is
modular. However recently we had to allow kernel_t certain privileges
which are covered not only by an interface of the storage module (which
is not an issue) but also by an attribute that is managed by that
module.
As a result, base fails to build:
$ make base
Compiling mcs base module
/usr/bin/checkmodule: loading policy configuration from base.conf
policy/modules/kernel/kernel.te:433:ERROR 'attribute fixed_disk_raw_read
is not declared' at token ';' on line 23210:
typeattribute kernel_t fixed_disk_raw_read;
\#line 433
/usr/bin/checkmodule: error(s) encountered while parsing configuration
Rules.modular:98: recipe for target 'tmp/base.mod' failed
make: *** [tmp/base.mod] Error 1
Moving storage as a base module.
X-Gentoo-Bug: 535992
X-Gentoo-Bug-URL: https://bugs.gentoo.org/show_bug.cgi?id=535992
policy/modules.conf | 2 +-
policy/modules/kernel/storage.if | 4 ++++
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/policy/modules.conf b/policy/modules.conf
index b9b41d9..5d9eee7 100644
--- a/policy/modules.conf
+++ b/policy/modules.conf
@@ -2306,7 +2306,7 @@ zosremote = module
#
# Policy controlling access to storage devices
#
-storage = module
+storage = base
# Layer: roles
# Module: auditadm
diff --git a/policy/modules/kernel/storage.if b/policy/modules/kernel/storage.if
index 5c1be6b..8a7119d 100644
--- a/policy/modules/kernel/storage.if
+++ b/policy/modules/kernel/storage.if
@@ -1,4 +1,8 @@
## <summary>Policy controlling access to storage devices</summary>
+## <required val="true">
+## This module defines attributes that are used by other
+## required modules (such as kernel_t in the kernel module)
+## </required>
########################################
## <summary>
