sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

stig: fix chrony SELinux .te — use raw module syntax, not policy_module() macro

Browse Source 
The build failed: checkmodule rejected `policy_module(chrony_dhcp_dispatcher,
1.0.0)` with "Building a policy module, but no module specification found".
policy_module() is a refpolicy m4 macro expanded only by the refpolicy Makefile
(/usr/share/selinux/devel), not by checkmodule. Use the raw module-policy
declaration `module chrony_dhcp_dispatcher 1.0.0;`, which is exactly what
checkmodule -M -m parses. require{} + allow rule unchanged.
This commit is contained in:
Audiobuzz
2026-07-03 02:53:57 +00:00
parent 6fe623c727
commit d9d2b50bfb
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/stig/chrony-dhcp-dispatcher.te
+5 -1
View File
@@ -1,4 +1,8 @@
policy_module(chrony_dhcp_dispatcher, 1.0.0) # Raw module-policy syntax (compiled with `checkmodule -M -m`), NOT the refpolicy
# `policy_module()` m4 macro — that macro is only expanded by the refpolicy
# Makefile (/usr/share/selinux/devel) and checkmodule rejects it ("no module
# specification found"). `module <name> <version>;` is what checkmodule wants.
module chrony_dhcp_dispatcher 1.0.0;
######################################## ########################################
# Let chronyd reply to the chronyc that our NetworkManager dispatcher script # Let chronyd reply to the chronyc that our NetworkManager dispatcher script