Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <858c9383f7c75e1e39bafaeab6388cd6af902c4f.camel@btinternet.com>
Subject: Re: How is policy.31 created from modules under /usr/share/selinux
From:   Richard Haines <richard_c_haines@btinternet.com>
To:     Ashish Mishra <ashishm@mvista.com>
Cc:     selinux-refpolicy@vger.kernel.org,
        Paul Moore <paul@paul-moore.com>,
        SElinux list <selinux@vger.kernel.org>
Date:   Sun, 06 Dec 2020 15:29:32 +0000
In-Reply-To: <CAP2OjcjCFYiyMfqa=X__X6g0U0143U5Fd-xGaKJgGNabFUpr7w@mail.gmail.com>
References: <CAP2OjcjCFYiyMfqa=X__X6g0U0143U5Fd-xGaKJgGNabFUpr7w@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.38.1 (3.38.1-1.fc33) 
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

On Sun, 2020-12-06 at 00:49 +0530, Ashish Mishra wrote:
> Hi All  ,
> 
> Good Morning .
> 
> I am following the SELINUX NOTEBOOK & trying the same at my end .
> 
> - The refpolicy modules are copied at /usr/share/selinux/refpolicy
>    i can see around 400+ modules there .
>    But can senior member' s please help me understand how is the
>    /etc/selinux/refpolicy/policy/policy.31  created using the modules
> available at
>    /usr/share/selinux
>    The command i followed :
>                 $ make install-src
>                 $ make conf
>                 $ make load ( tried even $ make install )
>                 $ make install-headers
> 

Just to be clear (as you didn't state whether the binary policy file
was built at all), if you run these commands:

mkdir refpol
cd refpol
git clone https://github.com/SELinuxProject/refpolicy.git
Edit build.conf file to requirements (e.g. NAME = refpolicy etc.)
make install-src
cd /etc/selinux/refpolicy/src/policy
make conf
make load
make install-headers

The policy binary file should now be created at:
  /etc/selinux/refpolicy/policy/policy.31 (or .32 if Fedora 33)
True ??

To add a new module (that will rebuild the binary policy file) you can
install the new *.te *.if and *.fc files in a directory and run from
that directory (you will need to ensure /etc/selinux/config has
SELINUXTYPE=refpolicy set):

make -f /usr/share/selinux/refpolicy/include/Makefile load

This Makefile basically reads the build.conf file, uses checkmodule to
build the *.pp file, then semodule to add to store and build the binary
policy (also using the prebuilt /usr/share/selinux/refpolicy/*.pp
files).

I've just tried this on Fedora 33 with no problems.

Note: While running through example this I noticed an error in the
Notebook - the Reference policy does not have a contibute section, I'll
send patch to remove:

Add the contibuted modules (policy/modules/contrib)
git submodule init
git submodule update

> 
> - This can help me to debug an issue where i am trying to get selinux
> of my custom
>    distro where all the make command are successfully executed but
> the policy.31
>    is not getting created
> 
> - I can even see the "include" folder also getting created for make
> install-headers
> 
> Any pointers will be helpful or please let me know if i am missing
> any
> aspect here .
> 
> Thanks ,
> Ashish.