Allow M4 escaped strings inside QUOTED_STRING

[bachradsusi]

When a file name in type transition rule used in an interface is same as a keyword, it needs to be M4 escaped so that the keyword is not expanded by M4, e.g.

• filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "interface")

• filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''")

Fixes:

$ selint ./policy/modules/contrib/virt.if
Note: Check E-007 is not performed because no permission macro has been parsed.
./policy/modules/contrib/virt.if:169: (F): syntax error, unexpected UNKNOWN_TOKEN (F-001)
  169 |     filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''")
      |                                                                          ^
./policy/modules/contrib/virt.if:169: (F): Error: Invalid statement (F-001)
  169 |     filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''")
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Error: Failed to parse files

[bachradsusi]

Why it's necessary to escape "interface":

$ cat > test.m4 <<EOF
define(`interface',` dnl
        ifdef(`$1',`refpolicywarn(`duplicate definition of $1(). Original definition on '$1.) define(`__if_error')',`define(`$1',__file__:__line__)') dnl
        `define(`$1',` dnl
        pushdef(`policy_call_depth',incr(policy_call_depth)) dnl
        policy_m4_comment(policy_call_depth,begin `$1'(dollarsstar)) dnl
        $2
        popdef(`policy_call_depth') dnl
        policy_m4_comment(policy_call_depth,end `$1'(dollarsstar)) dnl
        '')
')

define(`filetrans_pattern',`
        allow $1 $2:dir rw_dir_perms;
        type_transition $1 $2:$4 $3 $5;
')

define(`virt_driver_template',`
filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "interface")
')

virt_driver_template(vms_t)
EOF

$ m4 test.m4 

        allow vms_t virt_var_run_t:dir rw_dir_perms;
        type_transition vms_t virt_var_run_t:dir virtinterfaced_var_run_t "       

with "``interface''":

$ cat > test.m4 <<EOF
define(`interface',` dnl
        ifdef(`$1',`refpolicywarn(`duplicate definition of $1(). Original definition on '$1.) define(`__if_error')',`define(`$1',__file__:__line__)') dnl
        `define(`$1',` dnl
        pushdef(`policy_call_depth',incr(policy_call_depth)) dnl
        policy_m4_comment(policy_call_depth,begin `$1'(dollarsstar)) dnl
        $2
        popdef(`policy_call_depth') dnl
        policy_m4_comment(policy_call_depth,end `$1'(dollarsstar)) dnl
        '')
')

define(`filetrans_pattern',`
        allow $1 $2:dir rw_dir_perms;
        type_transition $1 $2:$4 $3 $5;
')

define(`virt_driver_template',`
filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''")
')

virt_driver_template(vms_t)
EOF

$ m4 test.m4 
        allow vms_t virt_var_run_t:dir rw_dir_perms;
        type_transition vms_t virt_var_run_t:dir virtinterfaced_var_run_t "interface";

see also https://bugzilla.redhat.com/show_bug.cgi?id=2254206#c6

[cgzones]

See alternative with syntax

``"interface"''

in #291.

[bachradsusi]

Lets move to #291