Re: [gentoo-hardened] SELinux base policy rev 11 in hardened-dev

[Sven Vermeulen]

On Tue, May 29, 2012 at 05:30:41PM +0200, Hinnerk van Bruinehsen wrote:
> I've got some problems with r11 on mcs. The error is:
>
> Creating mcs base module base.conf
> Compiling mcs base module
> /usr/bin/checkmodule:  loading policy configuration from base.conf
> base.conf:2184:ERROR 'permission execute is not defined' at token ';'
> on line 2184:
> 	( h1 dom h2 );
> mlsconstrain db_schema { drop getattr setattr relabelfrom execute }
> /usr/bin/checkmodule:  error(s) encountered while parsing configuration
> make: *** [tmp/base.mod] Error 1
>
> The error is introduced in
> "0098-all-sepostgresql_updates_backport-r11.patch".
>
> In older versions db_schema is db_language (which by the way is in the
> older versions defined two times). If I remove the "execute" from
> db_schema it builds. I don't know if db_schema needs execute, if not
> it should be dropped, otherwise execute should be defined for
> db_schema, I think.

You're right; the upstream patch didn't apply cleanly so I had to do some
stuff manually, and this one slipped.

There's also a "ype_transition" somewhere that should be "type_transition".

Wkr,
	Sven Vermeulen