Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: Why is /usr/include matched with /usr/inclu.e?
To:     Nicolas Iooss <nicolas.iooss@m4x.org>
Cc:     selinux-refpolicy@vger.kernel.org
References: <CAJfZ7=krh_TaCBQzFxLM394Sc5-82ZO0DdcfvWON-RXu-wqBVw@mail.gmail.com>
 <20190821200243.GA5262@brutus.lan>
 <CAJfZ7=nsmAsgA-8jsoavLNoxKO6dLU+6gYj5eFZMW9ODR7cn7Q@mail.gmail.com>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <cf6287af-cd3a-1967-cd76-3e6c4e8aa476@ieee.org>
Date:   Tue, 27 Aug 2019 00:06:59 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.6.1
MIME-Version: 1.0
In-Reply-To: <CAJfZ7=nsmAsgA-8jsoavLNoxKO6dLU+6gYj5eFZMW9ODR7cn7Q@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 8/21/19 4:29 PM, Nicolas Iooss wrote:
> On Wed, Aug 21, 2019 at 10:02 PM Dominick Grift <dac.override@gmail.com> wrote:
>>
>> On Wed, Aug 21, 2019 at 09:57:14PM +0200, Nicolas Iooss wrote:
>>> Hi all,
>>>
>>> While checking the patterns in refpolicy, I stumbled upon the
>>> following line in
>>> https://github.com/SELinuxProject/refpolicy/blob/RELEASE_2_20190609/policy/modules/kernel/files.fc#L200
>>>
>>> /usr/inclu.e(/.*)? gen_context(system_u:object_r:usr_t,s0)
>>
>> Probably to work around an m4-ism. There seems to be an m4 "include" built-in.
> 
> This seems to be a good explanation. The policy also uses workarounds
> for "index" built-in, with:
> 
> /etc/amanda/.*/index`'(/.*)?
> /var/lib/apt-xapian-inde(x)(/.*)?
> 
> In order not to introduce parentheses (which might change some
> ordering in the way the paths are matched with the patterns), I am
> thinking of replacing the pattern of /usr/include with:
> 
> /usr/includ[e](/.*)? gen_context(system_u:object_r:usr_t,s0)
> 
> ... with a comment about working around a m4 issue.

My preference would be an empty m4 string (`') over some regex trick, if 
possible, so the sorting isn't upset.

-- 
Chris PeBenito