Lukas,
I experimented a bit using the files below from SELinux cookbook (sources below). The mysysadm policy uses interface from mylogging
When compiling mysysadm.te with JUST mylogging.if in the same directory I get the following eeror
Compiling targeted mysysadm module /usr/bin/checkmodule: loading policy configuration from tmp/mysysadm.tmp mysysadm.te:5:ERROR 'syntax error' at token 'logging_exec_syslog' on line 3340: logging_exec_syslog(sysadm_t)
/usr/bin/checkmodule: error(s) encountered while parsing configuration make: *** [tmp/mysysadm.mod] Error 1
When compiling mysysadm.te with mylogging.if and mylogging.te in the same directory. mysysadm policy compiles successfully. I was under the impression that having just .if file will allow another policy to compile apparently that is not the case.
Makefile ---------- # installation paths SHAREDIR := /usr/share/selinux
AWK ?= gawk NAME ?= $(strip $(shell $(AWK) -F= '/^SELINUXTYPE/{ print $$2 }' /etc/selinux/config))
ifeq ($(MLSENABLED),) MLSENABLED := 1 endif
ifeq ($(MLSENABLED),1) NTYPE = mcs endif
ifeq ($(NAME),mls) NTYPE = mls endif
TYPE ?= $(NTYPE)
HEADERDIR := $(SHAREDIR)/devel/include include $(HEADERDIR)/Makefile
mylogging.if ------------ interface(`logging_exec_syslog',` gen_require(` type syslogd_exec_t; '); can_exec($1, syslogd_exec_t) ')
mylogging.te -------------- policy_module(mylogging, 0.2) gen_require(` type syslogd_t; ') bind_write_config(syslogd_t)
mysysadm.te --------------- policy_module(mysysadm, 0.1) gen_require(` type sysadm_t; ') logging_exec_syslog(sysadm_t)