Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
From:   Nicolas Iooss <nicolas.iooss@m4x.org>
Date:   Wed, 21 Aug 2019 21:57:14 +0200
Message-ID: <CAJfZ7=krh_TaCBQzFxLM394Sc5-82ZO0DdcfvWON-RXu-wqBVw@mail.gmail.com>
Subject: Why is /usr/include matched with /usr/inclu.e?
To:     selinux-refpolicy@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

Hi all,

While checking the patterns in refpolicy, I stumbled upon the
following line in
https://github.com/SELinuxProject/refpolicy/blob/RELEASE_2_20190609/policy/modules/kernel/files.fc#L200

/usr/inclu.e(/.*)? gen_context(system_u:object_r:usr_t,s0)

This pattern matches /usr/include and its content, but why is a dot
used? Which other directories can it match?

The issue there is that a dot can match a slash, so the pattern also
matches /usr/inclu/e/, which seems strange. This pattern has been
introduced in the very early days of refpolicy's git repository,
according to https://github.com/SELinuxProject/refpolicy/commit/f8ec0ad43b54437e2d9f0e48a773a64dbd9e543c#diff-e333cb52d2139f7a71f0dfbd32c06f70R117.
Does anyone remember why the pattern for /usr/include is so special?

Thanks,
Nicolas