From: dac.override@gmail.com (Dominick Grift)
Date: Tue, 9 Sep 2014 20:51:28 +0200
Subject: [refpolicy] [PATCH] Fix minor typo in init.if
In-Reply-To: <540F49A2.2060503@tresys.com>
References: <1410125394-26905-1-git-send-email-nicolas.iooss@m4x.org>
	<20140908182740.GA24131@x220.network2> <540E31DD.5070506@m4x.org>
	<540EF681.208@tresys.com> <20140909132816.GA7167@x220.network2>
	<540F49A2.2060503@tresys.com>
Message-ID: <20140909185127.GB7167@x220.network2>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On Tue, Sep 09, 2014 at 02:40:34PM -0400, Christopher J. PeBenito wrote:
> On 9/9/2014 9:28 AM, Dominick Grift wrote:
> > On Tue, Sep 09, 2014 at 08:45:53AM -0400, Christopher J. PeBenito wrote:
> >> On 9/8/2014 6:46 PM, Nicolas Iooss wrote:
> >>> 2014-09-08 20:27 GMT+02:00 Dominick Grift:
> >>>> It seems that we have one or more commits that break reference policy since the last release
> >>>>
> >>>> I am trying to track down the culprits, it started after last release but before or during June 25th
> >>>>
> >>>> It is going to take time to track this down because build-testing reference policy is so slow.
> >>>>
> >>>> Looking forward to the day we fully moved to cil/secilc
> >>>>
> >>>
> >>> Tonight I had the idea of using travis-ci.org to automate some kind of
> >>> testing.  This free service can basically watch public Github
> >>> repositories and run tests after every commit.  I ran tests in some
> >>> configurations [1] and every test case failed.
> >>>
> >>> The monolithic build fails with [2]:
> >>>
> >>>   /usr/bin/checkpolicy -U deny policy.conf -o policy.26
> >>>   /usr/bin/checkpolicy: loading policy configuration from policy.conf
> >>>   checkpolicy: expand.c:721: role_fix_callback: Assertion `regular_role
> >>> != ((void *)0) && regular_role->flavor == 0' failed.
> >>>   make: *** [policy.26] Aborted
> >>>
> >>> The modular build verification ("make validate") fails with [3]:
> >>>
> >>>   /usr/bin/semodule_expand tmp/test.lnk tmp/policy.bin
> >>>   semodule_expand: expand.c:721: role_fix_callback: Assertion
> >>> `regular_role != ((void *)0) && regular_role->flavor == 0' failed.
> >>>   make: *** [validate] Aborted
> >>>
> >>> Is this assertion failure known?  I did not take time to investigate
> >>> further but travis-ci may run an old version of the build toolchain (on
> >>> Ubuntu) which breaks the latest refpolicy.
> >>
> >> I'd have to look at the code to better understand what the assertion means.
> >>
> >> Are you using HEAD version of refpolicy and HEAD refpolicy-contrib?  I'm
> >> not able to reproduce any build errors.
> >>
> > 
> > You aren't? did you run your "super-quicktest" script on the HEADS?
> 
> I ran my buildtest script.  Are you using the RC toolchain or last release?
> 

I found the bug that broken built. It was the presence on a non-existant boolean identifier

However this only breaks monolithic, modular just ignores it since it was called only once, and in an optional policy block

Thus if you do not test monolithic then you will not notice the bug.

Anyhow, It is fixed and i pushed the fix to refpolicy-contrib
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 648 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140909/d84905be/attachment.bin