3
Kl�f�� � @ s2 d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlT dZ d dl
Z
d dl Z d dl Z y:d dl
Z
i ZejdRk r�ded< e
je fddd �e�� W nJ yd dlZeejd
< W n& ek
r� d dlZeejd
< Y nX Y nX d dlZi Zeed < eed < eed
< eed< eed< eed< eed< eed< eed< e ed< e ed< e ed< e ed< e ed< e ed< e ed< e ed< e ed < e ed < e ed < e ed < e ed < e ed!< e ed"< d
ddddd d d d#�Z!d$d$d%d&d'd(d)d*dd+� Z"y(d dl#Z#e#j$e#j%� � G d,d-� d-�Z&W n( e'efk
�r4 G d.d-� d-�Z&Y nX G d/d0� d0�Z(d1d2� Z)dSd4d5�Z*dTd6d7�Z+G d8d9� d9�Z,G d:d;� d;e,�Z-G d<d=� d=e,�Z.G d>d?� d?e,�Z/G d@dA� dAe,�Z0G dBdC� dCe,�Z1G dDdE� dEe,�Z2G dFdG� dGe,�Z3G dHdI� dIe,�Z4G dJdK� dKe,�Z5G dLdM� dMe,�Z6G dNdO� dOe,�Z7G dPdQ� dQe,�Z8dS )U� N)�*zselinux-python� T�unicodez/usr/share/localezutf-8)Z localedirZcodeset�_� z all files�az regular filez--�fz-d� directory�dz-czcharacter device�cz-bz block device�bz-s�socket�sz-l�lz
symbolic link�pz-pz
named pipe)z all filesz regular filer zcharacter devicez block devicer
z
symbolic linkz
named pipe�any�block�char�dir�file�symlink�pipe) r r r r r
r r r r c @ s8 e Zd Zdd� Zd
dd�Zddd�Zdd � Zd
d � Zd S )�loggerc C s t j� | _g | _g | _d S )N)�audit�
audit_open�audit_fd�log_list�log_change_list)�self� r � /usr/lib/python3.6/seobject.py�__init__l s
zlogger.__init__r c
C s� d} ||kr || d 7 }d} ||kr4|| d 7 }d} ||krL|| d 7 }d} | j j| jtjtjd t|�|d||||||dddg� d S )N�-�sename�,�role�ranger r )r �appendr r ZAUDIT_ROLE_ASSIGN�sys�argv�str)
r �msg�namer# �serole�serange� oldsename� oldserole�
oldserange�sepr r r �logq s z
logger.logc C s< | j j| jtjtjd t|�|d||||||dddg� d S )Nr r )r r' r r ZAUDIT_ROLE_REMOVEr( r) r* ) r r+ r, r# r- r. r/ r0 r1 r r r �
log_remove� s zlogger.log_removec C s& | j j| jtjt|�ddddg� d S )N�semanager )r r' r r Z AUDIT_USER_MAC_CONFIG_CHANGEr* )r r+ r r r �
log_change� s zlogger.log_changec C sP x | j D ]}tj||g � qW x | jD ]}tj||g � q(W g | _ g | _d S )N)r r Zaudit_log_semanage_messager Zaudit_log_user_comm_message)r �successr r r r �commit� s z
logger.commitN)r r r r r r r )r r r r r r r )�__name__�
__module__� __qualname__r! r3 r4 r6 r8 r r r r r j s
r c @ s8 e Zd Zdd� Zd
dd�Zddd�Zdd � Zd
d � Zd S )r c C s
g | _ d S )N)r )r r r r r! � s zlogger.__init__r c
C s� d||f } |dkr | d| 7 } |dkr4| d| 7 } |dkrH| d| 7 } |dkr\| d| 7 } |dkrx|d k rx| d| 7 } |dkr�|d k r�| d| 7 } | j j| � d S ) Nz %s name=%sr z sename=z oldsename=z role=z
old_role=z
MLSRange=z old_MLSRange=)r r' )
r r+ r, r# r- r. r/ r0 r1 �messager r r r3 � s z
logger.logc C s | j ||||||||� d S )N)r3 ) r r+ r, r# r- r. r/ r0 r1 r r r r4 � s zlogger.log_removec C s | j jd| � d S )Nz %s)r r' )r r+ r r r r6 � s zlogger.log_changec C s8 |dkrd}nd}x | j D ]}tjtj|| � qW d S )N� z Successful: zFailed: )r �syslogZLOG_INFO)r r7 r< r r r r r8 � s
z
logger.commitN)r r r r r r r )r r r r r r r )r9 r: r; r! r3 r4 r6 r8 r r r r r � s
c @ s0 e Zd Zd dd�Zd dd�Zdd� Zdd � Zd
S )
�
nullloggerr c C s d S )Nr ) r r+ r, r# r- r. r/ r0 r1 r r r r3 � s znulllogger.logc C s d S )Nr ) r r+ r, r# r- r. r/ r0 r1 r r r r4 � s znulllogger.log_removec C s d S )Nr )r r+ r r r r6 � s znulllogger.log_changec C s d S )Nr )r r7 r r r r8 � s znulllogger.commitN)r r r r r r r )r r r r r r r )r9 r: r; r3 r4 r6 r8 r r r r r? � s
r? c C sX d}d}|d | d }|d | d }|d | d d | d }t jd | d
| �S ) Nzs[0-9]*zc[0-9]*z(\.z)?z(\,z)*z(-z(:�^�$)�re�search)�rawZ sensitivity�categoryZ cat_rangeZ
categoriesZregr r r �validate_level� s rF r= c C s` d}|dkrd|| f }n| }t j|�\}}|dkr8| S |rL|t|�d � }|dkrX| S |S d S )Nza:b:c:r= z%s%sr r )�selinuxZ selinux_raw_to_trans_context�len)rD �prepend�filler�context�rc�transr r r � translate� s rN c C s` d}|dkrd|| f }n| }t j|�\}}|dkr8| S |rL|t|�d � }|dkrX| S |S d S )Nza:b:c:r= z%s%sr r )rG Z selinux_trans_to_raw_contextrH )rM rI rJ rK rL rD r r r � untranslate� s rO c @ sf e Zd ZdZdZdZdZddd�Zdd� Zdd� Z d d
� Z
d d � Z d
d� Z dd� Z
dd� Zdd� ZdS )�semanageRecordsFNc C s� |r t |�tkr|| _n|| _t|dd�| _| js@t|dd�| _| j| j�| _tj � \}}| jdksn| j|krxt
� | _ n,t j
| j� tjdtj� | jf � t� | _ d S )N�noreloadF�storer z%s%s)�typer* rR �args�getattrrQ �
get_handle�shrG �selinux_getpolicytyper �mylog�sepolicyZload_store_policyZselinux_set_policy_rootZ selinux_pathr? )r rT rL Z
localstorer r r r! � s
zsemanageRecords.__init__c C s | | _ d S )N)rQ )r �loadr r r �
set_reload
s zsemanageRecords.set_reloadc C s� t jr t jS t� }|s"ttd���t j rD|dkrDt||t� |t _t |�s`t
|� ttd���t |�}|t k r�t
|� ttd���t
|�}|dk r�t
|� ttd���t|�atdk r�t
|� ttd���|t _t jS )Nz Could not create semanage handler z:SELinux policy is not managed or store cannot be accessed.zCannot read policy store.r z'Could not establish semanage connectionz!Could not test MLS enabled status)rP �handleZsemanage_handle_create�
ValueErrorr � transactionZsemanage_select_storeZSEMANAGE_CON_DIRECTrR Zsemanage_is_managedZsemanage_handle_destroyZsemanage_access_checkZSEMANAGE_CAN_READZsemanage_connectZsemanage_mls_enabled�is_mls_enabled)r rR r] rL r r r rV
s2 zsemanageRecords.get_handlec C s t td���d S )NzNot yet implemented)r^ r )r r r r � deleteall1 s zsemanageRecords.deleteallc C s$ t jrttd���| j� dt _d S )Nz(Semanage transaction already in progressT)rP r_ r^ r �begin)r r r r �start4 s zsemanageRecords.startc C s, t jr
d S t| j�}|dk r(ttd���d S )Nr z$Could not start semanage transaction)rP r_ Zsemanage_begin_transactionrW r^ r )r rL r r r rb : s
zsemanageRecords.beginc C s t td���d S )NzNot yet implemented)r^ r )r r r r �
customizedA s zsemanageRecords.customizedc C sV t jr
d S | jr t| jd� t| j�}|dk rF| jjd� tt d���| jjd� d S )Nr z%Could not commit semanage transactionr= )
rP r_ rQ Zsemanage_set_reloadrW Zsemanage_commitrY r8 r^ r )r rL r r r r8 D s
zsemanageRecords.commitc C s$ t jsttd���dt _| j� d S )Nz$Semanage transaction not in progressF)rP r_ r^ r r8 )r r r r �finishP s zsemanageRecords.finish)N)r9 r: r; r_ r] rR rT r! r\ rV ra rc rb rd r8 re r r r r rP � s
$ rP c @ sP e Zd Zddd�Zdd� Zdd� Zdd
d �Zd d
� Zdd� Zdd� Z dd� Z
dS )�
moduleRecordsNc C s t j| |� d S )N)rP r! )r rT r r r r! Y s zmoduleRecords.__init__c C s g }t | j�\}}}|dk r(ttd���x�t|�D ]�}t||�}t| j|�\}}|dk rdttd���t| j|�\}}|dk r�ttd���t| j|�\}} |dk r�ttd���t | j|�\}}
|dk r�ttd���|j
||| |
f� q2W |j dd� d d
� |j d d� d � |S )
Nr z Could not list SELinux moduleszCould not get module namez Could not get module enabledz Could not get module priorityz Could not get module lang_extc S s | d S )Nr r )�tr r r �<lambda>x s z'moduleRecords.get_all.<locals>.<lambda>T)�key�reversec S s | d S )Nr r )rg r r r rh y s )ri ) Zsemanage_module_list_allrW r^ r r& �semanage_module_list_nthZ semanage_module_info_get_nameZ semanage_module_info_get_enabledZ!semanage_module_info_get_priorityZ!semanage_module_info_get_lang_extr' �sort) r r rL �mlist�number�i�modr, Zenabled�priorityZlang_extr r r �get_all\ s,
zmoduleRecords.get_allc C s0 | j � }t|�dkrg S dd� dd� |D �D �S )Nr c S s g | ]}d |d �qS )z-d %sr r )�.0�xr r r �
<listcomp>� s z,moduleRecords.customized.<locals>.<listcomp>c S s g | ]}|d dkr|�qS )r= r r )rs rg r r r ru � s )rr rH )r �allr r r rd | s zmoduleRecords.customizedr= r c C s� | j � }t|�dkrd S |r:tdtd�td�td�f � xL|D ]D}|d dkrZtd�}n
|r`q@d}td |d |d
|d |f � q@W d S ) Nr z
%-25s %-9s %s
z Module NameZPriorityZLanguager= ZDisabledr z%-25s %-9s %-5s %s� r )rr rH �printr )r �heading� locallistrv rg Zdisabledr r r �list� s
zmoduleRecords.listc C s` t jj|�s ttd�| ��t| j|�}|dk r@ttd�| ��t| j|�}|dkr\| j� d S )NzModule does not exist: %s r z3Invalid priority %d (needs to be between 1 and 999)) �os�path�existsr^ r � semanage_set_default_priorityrW Z semanage_module_install_filer8 )r r rq rL r r r �add� s zmoduleRecords.addc C s� x�|j � D ]�}t| j�\}}|dk r0ttd���t| j||�}|dk rRttd���t| j||�}|dk r
|r~ttd�| ��q
ttd�| ��q
W | j� d S )Nr zCould not create module keyz Could not set module key namezCould not enable module %szCould not disable module %s)�splitZsemanage_module_key_createrW r^ r Z semanage_module_key_set_nameZsemanage_module_set_enabledr8 )r �module�enable�mrL ri r r r � set_enabled� s zmoduleRecords.set_enabledc C sn t | j|�}|dk r$ttd�| ��x<|j� D ]0}t| j|�}|dk r.|dkr.ttd�| ��q.W | j� d S )Nr z3Invalid priority %d (needs to be between 1 and 999)rw z*Could not remove module %s (remove failed)���)r rW r^ r r� �semanage_module_remover8 )r r� rq rL r� r r r �delete� s zmoduleRecords.deletec C s: dd� dd� | j � D �D �}x|D ]}| j|d� q"W d S )Nc S s g | ] }|d �qS )r r )rs rt r r r ru � s z+moduleRecords.deleteall.<locals>.<listcomp>c S s g | ]}|d dkr|�qS )r= r r )rs rg r r r ru � s T)rr r� )r r r� r r r ra � s
zmoduleRecords.deleteall)N)r= r ) r9 r: r; r! rr rd r{ r� r� r� ra r r r r rf W s
rf c @ s e Zd Zddd�Zdd� ZdS )�dontauditClassNc C s t j| |� d S )N)rP r! )r rT r r r r! � s zdontauditClass.__init__c C s8 |dkrt td���| j� t| j|dk� | j� d S )N�on�offz'dontaudit requires either 'on' or 'off')r� r� )r^ r rb Z semanage_set_disable_dontauditrW r8 )r Z dontauditr r r �toggle� s
zdontauditClass.toggle)N)r9 r: r; r! r� r r r r r� � s
r� c @ sH e Zd Zddd�Zdd� Zdd� Zdd
d �Zd d
� Zdd� Zdd� Z dS )�permissiveRecordsNc C s t j| |� d S )N)rP r! )r rT r r r r! � s zpermissiveRecords.__init__c C sr g }t | j�\}}}|dk r(ttd���xDt|�D ]8}t||�}t|�}|r2|jd�r2|j|j d�d � q2W |S )Nr z Could not list SELinux modulesZ permissive_r= )
Zsemanage_module_listrW r^ r r& rk Zsemanage_module_get_name�
startswithr' r� )r r rL rm rn ro rp r, r r r rr � s
zpermissiveRecords.get_allc C s dd� t | j� �D �S )Nc S s g | ] }d | �qS )z-a %sr )rs rt r r r ru � s z0permissiveRecords.customized.<locals>.<listcomp>)�sortedrr )r r r r rd � s z permissiveRecords.customizedr= r c C s� dd� dd� t jt j�D �D �}t|�dkr0d S |rDtdtd� � | j� }x |D ]}||krRt|� qRW t|�dkrzd S |r�tdtd� � x|D ] }t|� q�W d S )Nc S s g | ] }|d �qS )r, r )rs �yr r r ru � s z*permissiveRecords.list.<locals>.<listcomp>c S s g | ]}|d r|�qS )Z
permissiver )rs rt r r r ru � s r z
%-25s
zBuiltin Permissive TypeszCustomized Permissive Types)rZ �infoZTYPErH rx r rr )r ry rz rv rd rg r r r r{ � s
zpermissiveRecords.listc C s� ydd l j}W n tk
r. ttd���Y nX d| }d| }t| j|t|�|d�}|dkrf| j� |dk r~ttd�| ��d S )Nr z�The sepolgen python module is required to setup permissive domains.
In some distributions it is included in the policycoreutils-devel package.
# yum install policycoreutils-devel
Or similar for your distro.z
permissive_%sz(typepermissive %s)Zcilz?Could not set permissive domain %s (module installation failed)) Zsepolgen.moduler� � ImportErrorr^ r Zsemanage_module_installrW rH r8 )r rS r� r, ZmodtxtrL r r r r� � s zpermissiveRecords.addc C sF x8|j � D ],}t| jd| �}|dk r
ttd�| ��q
W | j� d S )Nz
permissive_%sr z5Could not remove permissive domain %s (remove failed))r� r� rW r^ r r8 )r r, �nrL r r r r� s
zpermissiveRecords.deletec C s, | j � }t|�dkr(dj|�}| j|� d S )Nr � )rr rH �joinr� )r r rv r r r ra s
zpermissiveRecords.deleteall)N)r= r )
r9 r: r; r! rr rd r{ r� r� ra r r r r r� � s
r� c @ s~ e Zd Zd dd�Zdd� Zdd� Zdd � Zd d d �Zd!d
d�Zdd� Z dd� Z
dd� Z dd� Z d"dd�Z
dd� Zd#d d �ZdS )$� loginRecordsNc C s( t j| |� d | _d | _d | _d | _d S )N)rP r! r/ r1 r# r. )r rT r r r r! s
zloginRecords.__init__c C s� t j|�\}| _| _|dkr d}t| j�}|j| j�\}\}}|j|�\}\}} tdkrn|dkrjt|�}n|}t | j
|�\}}
|dk r�t t d�| ��|d dkr�yt
j|dd � � W n$ t t d�|dd � ��Y nX n,ytj|� W n t t d�| ��Y nX t| j
�\}} |dk �r4t t d �| ��t| j
| |�}|dk �r\t t d
�| ��tdk�r�|dk�r�t| j
| |�}|dk �r�t t d �| ��t| j
| |�}|dk �r�t t d �| ��t| j
|
| �}|dk �r�t t d
�| ��t|
� t| � d S )Nr Zuser_ur= r z Could not create a key for %s�%z Linux Group %s does not existz Linux User %s does not existz%Could not create login mapping for %szCould not set name for %sz Could not set MLS range for %sz!Could not set SELinux user for %sz"Could not add login mapping for %s)rG �getseuserbynamer/ r1 �seluserRecordsrT �getr` rO �semanage_seuser_key_createrW r^ r �grpZgetgrnam�pwd�getpwnamZsemanage_seuser_createZsemanage_seuser_set_name� semanage_seuser_set_mlsrange�semanage_seuser_set_sename� semanage_seuser_modify_local�semanage_seuser_key_free�semanage_seuser_free) r r, r# r. �rec�userrecr& rL r0 r- �k�ur r r �__add sP
zloginRecords.__addc C sx yL| j � | j|�r4ttd�| � | j|||� n| j|||� | j� W n& tk
rr } z
|�W Y d d }~X nX d S )Nz:Login mapping for %s is already defined, modifying instead)rb �_loginRecords__existsrx r �_loginRecords__modify�_loginRecords__addr8 r^ )r r, r# r. �errorr r r r� V s
zloginRecords.addc C s\ t | j|�\}}|dk r(ttd�| ��t| j|�\}}|dk rPttd�| ��t|� |S )Nr z Could not create a key for %sz2Could not check if login mapping for %s is defined)r� rW r^ r �semanage_seuser_existsr� )r r, rL r� r~ r r r �__existsd s zloginRecords.__existsr c
C s� t j|�\}| _| _|dkr0|dkr0ttd���t| j�}|j| j�\}\}}|dkrj|j|�\}\}} n|} |dkr~|| _ n|| _ t
| j |�\}}
|dk r�ttd�| ��t | j |
�\}} |dk r�ttd�| ��| s�ttd�| ��t
| j |
�\}} |dk �rttd�| ��t| �| _t| �| _tdk�rL|dk�rLt| j | t|�� |dk�rlt| j | |� || _n| j| _t| j |
| �}|dk �r�ttd �| ��t|
� t| � d S )
Nr zRequires seuser or seranger z Could not create a key for %sz2Could not check if login mapping for %s is definedz#Login mapping for %s is not definedz Could not query seuser for %sr= z%Could not modify login mapping for %s)rG r� r/ r1 r^ r r� rT r� r. r� rW r� Zsemanage_seuser_query� semanage_seuser_get_mlsrange�semanage_seuser_get_senamer` r� rO r� r# r� r� r� )
r r, r# r. r� r� r& rL r0 r- r� r~ r� r r r �__modifyp sF
zloginRecords.__modifyc C sN y"| j � | j|||� | j� W n& tk
rH } z
|�W Y d d }~X nX d S )N)rb r� r8 r^ )r r, r# r. r� r r r �modify� s zloginRecords.modifyc
C s* t j|�\}| _| _t| j�}|j| j�\}\}}t| j|�\}}|dk rZt t
d�| ��t | j|�\}}|dk r�t t
d�| ��|s�t t
d�| ��t | j|�\}}|dk r�t t
d�| ��|s�t t
d�| ��t
| j|�}|dk r�t t
d�| ��t|� t jd�\}| _| _|j| j�\}\}} d S )Nr z Could not create a key for %sz2Could not check if login mapping for %s is definedz#Login mapping for %s is not definedz<Login mapping for %s is defined in policy, cannot be deletedz%Could not delete login mapping for %sZ __default__)rG r� r/ r1 r� rT r� r� rW r^ r r� Z semanage_seuser_exists_localZsemanage_seuser_del_localr� r# r. )
r r, r� r� r& rL r0 r� r~ r- r r r �__delete� s,
zloginRecords.__deletec C sJ y | j � | j|� | j� W n& tk
rD } z
|�W Y d d }~X nX d S )N)rb �_loginRecords__deleter8 r^ )r r, r� r r r r� � s
zloginRecords.deletec C s~ t | j�\}}|dk r"ttd���y0| j� x|D ]}| jt|�� q2W | j� W n& tk
rx } z
|�W Y d d }~X nX d S )Nr z Could not list login mappings)�semanage_seuser_list_localrW r^ r rb r� �semanage_seuser_get_namer8 )r rL �ulistr� r� r r r ra � s
zloginRecords.deleteallc
C s� i }t j� d | _x�tj| j�D ]�\}}}|| jkr xj|D ]b}yHt|d | �}|j� j� jd�}|j � |d |d |d f||< W q: t
k
r� Y q:X q:W q W |S )Nz/logins�/�:r= rw r ) rG Zselinux_policy_root� logins_pathr| �walk�open�read�rstripr� �close�
IndexError)r �ddictr} �dirs�filesr, �fdr� r r r �get_all_logins� s
zloginRecords.get_all_loginsr c C sp i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���x,| jD ]"}t|�}t|�t|�df||< qFW |S )Nr z Could not list login mappingsr ) r� rW r� Zsemanage_seuser_listr^ r r� r� r� )r rz r� rL r� r, r r r rr � s zloginRecords.get_allc C st g }| j d�}x`t|j� �D ]P}|| d rR|jd|| d || d |f � q |jd|| d |f � q W |S )NTr= z-a -s %s -r '%s' %sr z -a -s %s %s)rr r� �keysr' )r r r� r� r r r rd � s
& zloginRecords.customizedr= c C sN | j |�}| j� }t|j� �}t|j� �}t|�dkrFt|�dkrFd S tdk�r|rxtdtd�td�td�td�f � x8|D ]0}|| }td||d t|d �|d f � q~W t|�r�td
| j � x�|D ]0}|| }td||d t|d �|d f � q�W nF|�r"td td�td�f � x&|D ] }td ||| d f � �q(W d S )
Nr r= z
%-20s %-20s %-20s %s
z
Login Namez SELinux Userz
MLS/MCS RangeZServicez%-20s %-20s %-20s %srw z
Local customization in %sz
%-25s %-25s
z %-25s %-25s)
rr r� r� r� rH r` rx r rN r� ) r ry rz r� ZldictZlkeysr� r� r� r r r r{ s*
$
(
*
zloginRecords.list)N)r r )r r )r )r= r )r9 r: r; r! r� r� r� r� r� r� r� ra r� rr rd r{ r r r r r� s
6
2
r� c @ s� e Zd Zd dd�Zdd� Zdd� Zdd � Zd
d � Zg d d d fd
d�Zg d d d fdd�Z dd� Z
dd� Z dd� Z d dd�Z
dd� Zd!d d �ZdS )"r� Nc C s t j| |� d S )N)rP r! )r rT r r r r! " s zseluserRecords.__init__c C s� t | j|�\}}|dk r(ttd�| ��t| j|�\}}|dk rPttd�| ��t| j|�\}}|dk rxttd�| ��t|�}t| j|�}t|� t |� ||fS )Nr z Could not create a key for %sz-Could not check if SELinux user %s is definedzCould not query user for %s)
�semanage_user_key_createrW r^ r �semanage_user_exists�semanage_user_query�semanage_user_get_mlsrange�semanage_user_get_roles�semanage_user_key_free�semanage_user_free)r r, rL r� r~ r� r. r- r r r r� % s zseluserRecords.getc C s t dkr4|dkrd}nt|�}|dkr,d}nt|�}t|�dk rPttd�| ��t| j|�\}}|dk rxttd�| ��t| j�\}}|dk r�ttd�| ��t| j||�}|dk r�ttd�| ��x6|D ].} t | j|| �}|dk r�ttd �| |f ��q�W t dk�rVt
| j||�}|dk �r.ttd
�| ��t | j||�}|dk �rVttd �| ��t | j||�}|dk �r�ttd �| |f ��t
| j|�\}}
|dk �r�ttd
�| ��t| j||�}|dk �r�ttd�| ��t|� t|� | jjd|dj|�|d� d S )Nr= r �s0z%You must add at least one role for %sr z Could not create a key for %sz$Could not create SELinux user for %szCould not set name for %sz Could not add role %s for %sz Could not set MLS range for %sz Could not set MLS level for %sz Could not add prefix %s for %sz Could not extract key for %sz Could not add SELinux user %s�seuserr$ )r# r- r. )r` rO rH r^ r r� rW Zsemanage_user_createZsemanage_user_set_name�semanage_user_add_role�semanage_user_set_mlsrange�semanage_user_set_mlslevel�semanage_user_set_prefixZsemanage_user_key_extract�semanage_user_modify_localr� r� rY r3 r� ) r r, �roles�selevelr. �prefixrL r� r� �rri r r r r� 5 sR
zseluserRecords.__addc C s� yT| j � | j|�r8ttd�| � | j|||||� n| j|||||� | j� W n2 tk
r� } z| jjd� |�W Y d d }~X nX d S )Nz5SELinux user %s is already defined, modifying insteadr ) rb �_seluserRecords__existsrx r �_seluserRecords__modify�_seluserRecords__addr8 r^ rY )r r, r� r� r. r� r� r r r r� l s
zseluserRecords.addc C s\ t | j|�\}}|dk r(ttd�| ��t| j|�\}}|dk rPttd�| ��t|� |S )Nr z Could not create a key for %sz-Could not check if SELinux user %s is defined)r� rW r^ r r� r� )r r, rL r� r~ r r r r� y s zseluserRecords.__existsr c C s@ d}d}dj |�}|dkrXt|�dkrX|dkrX|dkrXtdkrLttd���n ttd���t| j|�\} }
| dk r�ttd�| ��t| j|
�\} } | dk r�ttd�| ��| s�ttd �| ��t| j|
�\} } | dk r�ttd
�| ��t | �}t
| j| �\} }
| dk�rdj |
�}tdk�r6|dk�r6t | j| t |�� tdk�r\|dk�r\t
| j| t |�� |dk�rtt| j| |� t|�dk�r�x"|
D ]}||k�r�t| |� �q�W x&|D ] }||
k�r�t| j| |� �q�W t| j|
| �} | dk �r�ttd �| ��t|
� t| � d j |j� �}d j |j� �}| jjd
||||||d� d S )Nr r� r r= z&Requires prefix, roles, level or rangezRequires prefix or rolesz Could not create a key for %sz-Could not check if SELinux user %s is definedz SELinux user %s is not definedzCould not query user for %sz Could not modify SELinux user %sr$ r� )r# r/ r- r. r0 r1 )r� rH r` r^ r r� rW r� r� r� r� r� rO r� r� Zsemanage_user_del_roler� r� r� r� r� rY r3 )r r, r� r� r. r� r0 r1 ZnewrolesrL r� r~ r� �rlistr� r% r r r r� � sV
$
zseluserRecords.__modifyc C s^ y&| j � | j|||||� | j� W n2 tk
rX } z| jjd� |�W Y d d }~X nX d S )Nr )rb r� r8 r^ rY )r r, r� r� r. r� r� r r r r� � s zseluserRecords.modifyc C s8 t | j|�\}}|dk r(ttd�| ��t| j|�\}}|dk rPttd�| ��|sdttd�| ��t| j|�\}}|dk r�ttd�| ��|s�ttd�| ��t| j|�\}}|dk r�ttd�| ��t|�}t| j|�\}}dj |�}t
| j|�}|dk �rttd�| ��t |� t |� | j
jd |||d
� d S ) Nr z Could not create a key for %sz-Could not check if SELinux user %s is definedz SELinux user %s is not definedz7SELinux user %s is defined in policy, cannot be deletedzCould not query user for %sr$ z Could not delete SELinux user %sr� )r/ r1 r0 )r� rW r^ r r� Zsemanage_user_exists_localr� r� r� r� Zsemanage_user_del_localr� r� rY r4 ) r r, rL r� r~ r� r1 r� r0 r r r r� � s2
zseluserRecords.__deletec C sV y | j � | j|� | j� W n2 tk
rP } z| jjd� |�W Y d d }~X nX d S )Nr )rb �_seluserRecords__deleter8 r^ rY )r r, r� r r r r� � s
zseluserRecords.deletec C s� t | j�\}}|dk r"ttd���y0| j� x|D ]}| jt|�� q2W | j� W n2 tk
r� } z| jjd� |�W Y d d }~X nX d S )Nr z Could not list login mappings) �semanage_user_list_localrW r^ r rb r� �semanage_user_get_namer8 rY )r rL r� r� r� r r r ra � s
zseluserRecords.deleteallr c C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���xh| jD ]^}t|�}t| j|�\}}|dk rzttd�| ��dj|�}t |�t
|�t |�|f|t|�< qFW |S )Nr z Could not list SELinux usersz Could not list roles for user %sr� ) r� rW r� Zsemanage_user_listr^ r r� r� r� Zsemanage_user_get_prefixZsemanage_user_get_mlslevelr� )r rz r� rL r� r, r� r� r r r rr � s
$zseluserRecords.get_allc C s� g }| j d�}xvt|j� �D ]f}|| d s8|| d rh|jd|| d || d || d |f � q |jd|| d |f � q W |S )NTr= rw z-a -L %s -r %s -R '%s' %sr z
-a -R '%s' %s)rr r� r� r' )r r r� r� r r r rd s
0 zseluserRecords.customizedr= c C s | j |�}t|�dkrd S t|j� �}tdkr�|r|tddtd�td�td�f � tdtd�td �td
�td �td �f � x�|D ]B}td
||| d t|| d �t|| d �|| d f � q�W nB|r�tdtd�td �f � x$|D ] }td||| d f � q�W d S )Nr r= z
%-15s %-10s %-10s %-30sr ZLabelingzMLS/z%-15s %-10s %-10s %-30s %s
z SELinux UserZPrefixz MCS Levelz MCS Rangez
SELinux Rolesz%-15s %-10s %-10s %-30s %srw r z %-15s %s
z%-15s %s)rr rH r� r� r` rx r rN )r ry rz r� r� r� r r r r{ s
*
D
zseluserRecords.list)N)r )r= r )r9 r: r; r! r� r� r� r� r� r� r� r� ra rr rd r{ r r r r r� s
7
8 !
r� c @ s� e Zd Zg Zd dd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Z dd� Z
dd� Z dd� Z dd� Z
d!dd�Zd"dd�Zdd � Zd#d d �ZdS )$� portRecordsNc C sJ t j| |� y$tttjtjd��d d �| _W n tk
rD Y nX d S )NZ port_typer �types)rP r! r{ rZ r� � ATTRIBUTE� valid_types� RuntimeError)r rT r r r r! 4 s
$zportRecords.__init__c
C s� t tttd�}||j� kr$|| }n ttd���|dkrDttd���|jd�}t|�dkrlt |d � }}nt |d �}t |d �}|dkr�ttd ���t
| j |||�\}} |dk r�ttd
�||f ��| |||fS ) N)ZtcpZudpZsctpZdccpz0Protocol has to be one of udp, tcp, dccp or sctpr zPort is requiredr" r= r i�� z Invalid Portz Could not create a key for %s/%s) ZSEMANAGE_PROTO_TCPZSEMANAGE_PROTO_UDPZSEMANAGE_PROTO_SCTPZSEMANAGE_PROTO_DCCPr� r^ r r� rH �intZsemanage_port_key_createrW )
r �port�protoZ protocols�proto_dZports�high�lowrL r� r r r �__genkey; s(
zportRecords.__genkeyc C s, t dkr |dkrd}nt|�}|dkr2ttd���tj|�}|| jkrVttd�| ��| j||�\}}}}t| j �\} }
| dk r�ttd�||f ��t
|
|� t |
||� t | j �\} } | dk r�ttd�||f ��t
| j | d �} | dk r�ttd
�||f ��t| j | d �} | dk �r*ttd �||f ��t| j | |�} | dk �rVttd
�||f ��t dk�r�|dk�r�t| j | |�} | dk �r�ttd�||f ��t| j |
| �} | dk �r�ttd�||f ��t| j ||
�} | dk �r�ttd�||f ��t| � t|� t|
� | jjd|tj|�d d ||f � d S )Nr= r r� zType is requiredz'Type %s is invalid, must be a port typer z Could not create port for %s/%sz"Could not create context for %s/%s�system_uz,Could not set user in port context for %s/%s�object_rz,Could not set role in port context for %s/%sz,Could not set type in port context for %s/%sz2Could not set mls fields in port context for %s/%sz$Could not set port context for %s/%szCould not add port %s/%sz8resrc=port op=add lport=%s proto=%s tcontext=%s:%s:%s:%s)r` rO r^ r rZ �get_real_type_namer� �_portRecords__genkeyZsemanage_port_createrW Zsemanage_port_set_protoZsemanage_port_set_range�semanage_context_create�semanage_context_set_user�semanage_context_set_role�semanage_context_set_type�semanage_context_set_mlsZsemanage_port_set_con�semanage_port_modify_local�semanage_context_free�semanage_port_key_free�semanage_port_freerY r6 r
�getprotobyname) r r� r� r. rS r� r� r� r� rL r �conr r r r� W sR
zportRecords.__addc C sX | j � | j||�r<ttd�j||d�� | j||||� n| j||||� | j� d S )Nz6Port {proto}/{port} already defined, modifying instead)r� r� )rb �_portRecords__existsrx r �format�_portRecords__modify�_portRecords__addr8 )r r� r� r. rS r r r r� � s zportRecords.addc C sN | j ||�\}}}}t| j|�\}}|dk rBttd�j||d���t|� |S )Nr z1Could not check if port {proto}/{port} is defined)r� r� )r� �semanage_port_existsrW r^ r r� r� ) r r� r� r� r� r� r� rL r~ r r r r� � s zportRecords.__existsc
C s� |dkr2|dkr2t dkr&ttd���n ttd���tj|�}|rZ|| jkrZttd�| ��| j||�\}}}}t| j|�\} }
| dk r�ttd�||f ��|
s�ttd�||f ��t | j|�\} } | dk r�ttd �||f ��t
| �} t dk�r|dk�r d
}nt | j| t |�� |dk�r*t
| j| |� t| j|| �} | dk �rVttd �||f ��t|� t| � | jjd |tj|�d
d||f � d S )Nr r= zRequires setype or serangezRequires setypez'Type %s is invalid, must be a port typer z(Could not check if port %s/%s is definedzPort %s/%s is not definedzCould not query port %s/%sr� zCould not modify port %s/%sz;resrc=port op=modify lport=%s proto=%s tcontext=%s:%s:%s:%sr� r� )r` r^ r rZ r� r� r� r� rW Zsemanage_port_query�semanage_port_get_conr� rO r� r� r� r� rY r6 r
r� )
r r� r� r. �setyper� r� r� r� rL r~ r r� r r r r� � s:
zportRecords.__modifyc C s$ | j � | j||||� | j� d S )N)rb r� r8 )r r� r� r. r r r r r� � s zportRecords.modifyc C s� t | j�\}}|dk r"ttd���| j� x�|D ]�}t|�}t|�}t|�}t|�}d||f }| j ||�\} }
}}|dk r�ttd�| ��t
| j| �}|dk r�ttd�| ��t | � ||kr�|}| j j
d|tj|�f � q0W | j� d S )Nr zCould not list the portsz%s-%sz Could not create a key for %sz Could not delete the port %sz&resrc=port op=delete lport=%s proto=%s)�semanage_port_list_localrW r^ r rb �semanage_port_get_proto�semanage_port_get_proto_str�semanage_port_get_low�semanage_port_get_highr� �semanage_port_del_localr� rY r6 r
r� r8 ) r rL �plistr� r� � proto_strr� r� Zport_strr� r� r r r ra � s*
zportRecords.deleteallc C s� | j ||�\}}}}t| j|�\}}|dk r@ttd�||f ��|sXttd�||f ��t| j|�\}}|dk r�ttd�||f ��|s�ttd�||f ��t| j|�}|dk r�ttd�||f ��t|� | jj d|t
j |�f � d S )Nr z(Could not check if port %s/%s is definedzPort %s/%s is not definedz2Port %s/%s is defined in policy, cannot be deletedzCould not delete port %s/%sz&resrc=port op=delete lport=%s proto=%s) r� r� rW r^ r Zsemanage_port_exists_localr r� rY r6 r
r� ) r r� r� r� r� r� r� rL r~ r r r r� � s zportRecords.__deletec C s | j � | j||� | j� d S )N)rb �_portRecords__deleter8 )r r� r� r r r r� s zportRecords.deleter c C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���xX| jD ]N}t|�}t|�}t|�}t |�}t
|�} t |�}
t |�} ||f||
| | f< qFW |S )Nr zCould not list ports)
r rW r �semanage_port_listr^ r r �semanage_context_get_type�semanage_context_get_mlsr r r r ) r rz r� rL r� r� �ctype�levelr� r r� r� r r r rr s zportRecords.get_allc C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���x�| jD ]�}t|�}t|�}t|�}t |�}t
|�} t |�}
||f|j � kr�g |||f< | |
kr�|||f j
d| � qF|||f j
d| |
f � qFW |S )Nr zCould not list portsz%dz%d-%d)r rW r r r^ r r r r r r r r� r' ) r rz r� rL r� r� r r� r r� r� r r r �get_all_by_type s& zportRecords.get_all_by_typec C s� g }| j d�}x�t|j� �D ]�}|d |d kr8|d nd|d |d f }|| d r�|jd|| d || d |d |f � q |jd|| d |d |f � q W |S )NTr r= z%s-%sz-a -t %s -r '%s' -p %s %srw z-a -t %s -p %s %s)rr r� r� r' )r r r� r� r� r r r rd 8 s
, ,$zportRecords.customizedr= c C s� | j |�}t|�dkrd S t|j� �}|rHtdtd�td�td�f � xV|D ]N}d| }|d|| d 7 }x$|| dd � D ]}|d | 7 }q�W t|� qNW d S )
Nr z%-30s %-8s %s
zSELinux Port TypeZProtoz Port Numberz %-30s %-8s z%sr= z, %s)r rH r� r� rx r )r ry rz r� r� ro r� r r r r r{ C s
zportRecords.list)N)r )r )r= r )r9 r: r; r� r! r� r� r� r� r� r� ra r
r� rr r rd r{ r r r r r� 0 s
:
*
r� c @ s� e Zd Zg Zd dd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Z dd� Z
dd� Z dd� Z dd� Z
d!dd�Zd"dd�Zdd � Zd#d d �ZdS )$�
ibpkeyRecordsNc
C sX t j| |� y:tjtjtj| j��dgd�}tdd� |j � D ��| _
W n Y nX d S )NZ ibpkey_type)�attrsc s s | ]}t |�V qd S )N)r* )rs rg r r r � <genexpr>Z s z)ibpkeyRecords.__init__.<locals>.<genexpr>) rP r! �setools� TypeQuery�
SELinuxPolicyrZ �get_store_policyrR r� �resultsr� )r rT �qr r r r! V s zibpkeyRecords.__init__c C s� |dkrt td���|jd�}t|�dkr>t|d d� }}n t|d d�}t|d d�}|dkrnt td���t| j|||�\}}|dk r�t td�||f ��||||fS ) Nr zSubnet Prefix is requiredr" r= r i�� z Invalid Pkeyz Could not create a key for %s/%s)r^ r r� rH r� Zsemanage_ibpkey_key_createrW )r �pkey�
subnet_prefixZpkeysr� r� rL r� r r r r� ^ s
zibpkeyRecords.__genkeyc C s t dkr |dkrd}nt|�}|dkr2ttd���tj|�}|| jkrVttd�| ��| j||�\}}}}t| j �\}} |dk r�ttd�||f ��t
| j | |� t | ||� t | j �\}}
|dk r�ttd�||f ��t
| j |
d �}|dk �rttd
�||f ��t| j |
d �}|dk �r0ttd �||f ��t| j |
|�}|dk �r\ttd
�||f ��t dk�r�|dk�r�t| j |
|�}|dk �r�ttd�||f ��t| j | |
�}|dk �r�ttd�||f ��t| j || �}|dk �r�ttd�||f ��t|
� t|� t| � d S )Nr= r r� zType is requiredz)Type %s is invalid, must be a ibpkey typer z!Could not create ibpkey for %s/%sz"Could not create context for %s/%sr� z.Could not set user in ibpkey context for %s/%sr� z.Could not set role in ibpkey context for %s/%sz.Could not set type in ibpkey context for %s/%sz4Could not set mls fields in ibpkey context for %s/%sz&Could not set ibpkey context for %s/%szCould not add ibpkey %s/%s)r` rO r^ r rZ r� r� �_ibpkeyRecords__genkeyZsemanage_ibpkey_createrW Z!semanage_ibpkey_set_subnet_prefixZsemanage_ibpkey_set_ranger� r� r� r� r� Zsemanage_ibpkey_set_con� semanage_ibpkey_modify_localr� �semanage_ibpkey_key_free�semanage_ibpkey_free) r r r r. rS r� r� r� rL r r� r r r r� q sP
zibpkeyRecords.__addc C sX | j � | j||�r<ttd�j||d�� | j||||� n| j||||� | j� d S )Nz@ibpkey {subnet_prefix}/{pkey} already defined, modifying instead)r r )rb �_ibpkeyRecords__existsrx r r� �_ibpkeyRecords__modify�_ibpkeyRecords__addr8 )r r r r. rS r r r r� � s zibpkeyRecords.addc C sN | j ||�\}}}}t| j|�\}}|dk rBttd�j||d���t|� |S )Nr z;Could not check if ibpkey {subnet_prefix}/{pkey} is defined)r r )r �semanage_ibpkey_existsrW r^ r Zformnatr )r r r r� r� r� rL r~ r r r r� � s zibpkeyRecords.__existsc C sb |dkr2|dkr2t dkr&ttd���n ttd���tj|�}|rZ|| jkrZttd�| ��| j||�\}}}}t| j|�\}} |dk r�ttd�||f ��| s�ttd�||f ��t | j|�\}}
|dk r�ttd �||f ��t
|
�} t dko�|dk�r
t | j| t |�� |dk�r"t
| j| |� t| j||
�}|dk �rNttd
�||f ��t|� t|
� d S ) Nr r= zRequires setype or serangezRequires setypez)Type %s is invalid, must be a ibpkey typer z*Could not check if ibpkey %s/%s is definedzibpkey %s/%s is not definedz Could not query ibpkey %s/%sz Could not modify ibpkey %s/%s)r` r^ r rZ r� r� r r# rW Zsemanage_ibpkey_query�semanage_ibpkey_get_conr� rO r� r r r ) r r r r. r r� r� r� rL r~ r r� r r r r� � s4
zibpkeyRecords.__modifyc C s$ | j � | j||||� | j� d S )N)rb r! r8 )r r r r. r r r r r� � s zibpkeyRecords.modifyc C s� t | j�\}}|dk r"ttd���| j� x�|D ]�}t| j|�\}}t|�}t|�}d||f }| j||�\}}}}|dk r�ttd�| ��t | j|�}|dk r�ttd�| ��t
|� q0W | j � d S )Nr zCould not list the ibpkeysz%s-%sz Could not create a key for %sz Could not delete the ibpkey %s) �semanage_ibpkey_list_localrW r^ r rb �!semanage_ibpkey_get_subnet_prefix�semanage_ibpkey_get_low�semanage_ibpkey_get_highr �semanage_ibpkey_del_localr r8 ) r rL r �ibpkeyr r� r� Zpkey_strr� r r r ra � s"
zibpkeyRecords.deleteallc C s� | j ||�\}}}}t| j|�\}}|dk r@ttd�||f ��|sXttd�||f ��t| j|�\}}|dk r�ttd�||f ��|s�ttd�||f ��t| j|�}|dk r�ttd�||f ��t|� d S )Nr z*Could not check if ibpkey %s/%s is definedzibpkey %s/%s is not definedz4ibpkey %s/%s is defined in policy, cannot be deletedz Could not delete ibpkey %s/%s)r r# rW r^ r Z semanage_ibpkey_exists_localr) r )r r r r� r� r� rL r~ r r r r� � s zibpkeyRecords.__deletec C s | j � | j||� | j� d S )N)rb �_ibpkeyRecords__deleter8 )r r r r r r r� s zibpkeyRecords.deleter c C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���xb| jD ]X}t|�}t|�}|dkrdqFt|�}t | j|�\}}t
|�} t |�}
||f|| |
|f< qFW |S )Nr zCould not list ibpkeysZreserved_ibpkey_t) r% rW r �semanage_ibpkey_listr^ r r$ r r
r& r' r( ) r rz r� rL r* r� r r r r� r� r r r rr s" zibpkeyRecords.get_allc
C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���x�| jD ]�}t|�}t|�}t| j|�\}}t |�}t
|�} ||f|j � kr�g |||f< || kr�|||f j d| � qF|||f j d|| f � qFW |S )Nr zCould not list ibpkeysz0x%xz 0x%x-0x%x)
r% rW r r, r^ r r$ r r& r' r( r� r' )
r rz r� rL r* r� r r r� r� r r r r , s$ z ibpkeyRecords.get_all_by_typec C s� g }| j d�}x�t|j� �D ]�}|d |d kr8|d nd|d |d f }|| d r�|jd|| d || d |d |f � q |jd|| d |d |f � q W |S )NTr r= z%s-%sz-a -t %s -r '%s' -x %s %srw z-a -t %s -x %s %s)rr r� r� r' )r r r� r� r� r r r rd C s
, ,$zibpkeyRecords.customizedr= c C s� | j |�}|j� }t|�dkr"d S |rDtdtd�td�td�f � xZt|�D ]N}d| }|d|| d 7 }x$|| dd � D ]}|d | 7 }q�W t|� qNW d S )
Nr z%-30s %-18s %s
zSELinux IB Pkey TypeZ
Subnet_Prefixz Pkey Numberz %-30s %-18s z%sr= z, %s)r r� rH rx r r� )r ry rz r� r� ro r� r r r r r{ O s
zibpkeyRecords.list)N)r )r )r= r )r9 r: r; r� r! r r" r� r r! r� ra r+ r� rr r rd r{ r r r r r R s
8
&
r c @ s� e Zd Zg Zd dd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Z dd� Z
dd� Z dd� Z dd� Z
d!dd�Zd"dd�Zdd � Zd#d d �ZdS )$�ibendportRecordsNc
C sX t j| |� y:tjtjtj| j��dgd�}tdd� |j � D ��| _
W n Y nX d S )NZibendport_type)r c s s | ]}t |�V qd S )N)r* )rs rg r r r r f s z,ibendportRecords.__init__.<locals>.<genexpr>) rP r! r r r rZ r rR �setr r� )r rT r r r r r! b s zibendportRecords.__init__c C sp |dkrt td���t|�}|dks,|dk r8t td���t| j||�\}}|dk rft td�||f ��|||fS )Nr zIB device name is required� r= zInvalid Port Numberr z*Could not create a key for ibendport %s/%s)r^ r r� Z semanage_ibendport_key_createrW )r � ibendport�
ibdev_namer� rL r� r r r r� j s zibendportRecords.__genkeyc
C s
t dkr |dkrd}nt|�}|dkr2ttd���tj|�}|| jkrVttd�| ��| j||�\}}}t| j �\}}|dk r�ttd�||f ��t
| j ||� t ||� t | j �\}} |dk r�ttd�||f ��t
| j | d �}|dk r�ttd
�||f ��t| j | d �}|dk �r*ttd �||f ��t| j | |�}|dk �rVttd
�||f ��t dk�r�|dk�r�t| j | |�}|dk �r�ttd�||f ��t| j || �}|dk �r�ttd�||f ��t| j ||�}|dk �r�ttd�||f ��t| � t|� t|� d S )Nr= r r� zType is requiredz-Type %s is invalid, must be an ibendport typer z$Could not create ibendport for %s/%sz"Could not create context for %s/%sr� z1Could not set user in ibendport context for %s/%sr� z1Could not set role in ibendport context for %s/%sz1Could not set type in ibendport context for %s/%sz7Could not set mls fields in ibendport context for %s/%sz)Could not set ibendport context for %s/%sz Could not add ibendport %s/%s)r` rO r^ r rZ r� r� �_ibendportRecords__genkeyZsemanage_ibendport_createrW Z!semanage_ibendport_set_ibdev_nameZsemanage_ibendport_set_portr� r� r� r� r� Zsemanage_ibendport_set_con� semanage_ibendport_modify_localr� �semanage_ibendport_key_free�semanage_ibendport_free)
r r0 r1 r. rS r� r� rL r r� r r r r� x sP
zibendportRecords.__addc C sX | j � | j||�r<ttd�j|td�� | j||||� n| j||||� | j� d S )Nz@ibendport {ibdev_name}/{port} already defined, modifying instead)r1 r� ) rb �_ibendportRecords__existsrx r r� r� �_ibendportRecords__modify�_ibendportRecords__addr8 )r r0 r1 r. rS r r r r� � s zibendportRecords.addc C sL | j ||�\}}}t| j|�\}}|dk r@ttd�j||d���t|� |S )Nr z;Could not check if ibendport {ibdev_name}/{port} is defined)r1 r� )r2 �semanage_ibendport_existsrW r^ r r� r4 )r r0 r1 r� r� rL r~ r r r r� � s zibendportRecords.__existsc C s` |dkr2|dkr2t dkr&ttd���n ttd���tj|�}|rZ|| jkrZttd�| ��| j||�\}}}t| j|�\}}|dk r�ttd�||f ��|s�ttd�||f ��t | j|�\}} |dk r�ttd �||f ��t
| �}
t dko�|dk�rt | j|
t |�� |dk�r t
| j|
|� t| j|| �}|dk �rLttd
�||f ��t|� t| � d S ) Nr r= zRequires setype or serangezRequires setypez-Type %s is invalid, must be an ibendport typer z-Could not check if ibendport %s/%s is definedz ibendport %s/%s is not definedz Could not query ibendport %s/%sz Could not modify ibendport %s/%s)r` r^ r rZ r� r� r2 r9 rW Zsemanage_ibendport_query�semanage_ibendport_get_conr� rO r� r3 r4 r5 ) r r0 r1 r. r r� r� rL r~ r r� r r r r� � s4
zibendportRecords.__modifyc C s$ | j � | j||||� | j� d S )N)rb r7 r8 )r r0 r1 r. r r r r r� � s zibendportRecords.modifyc C s� t | j�\}}|dk r"ttd���| j� x�|D ]~}t| j|�\}}t|�}| jt|�|�\}}}|dk r~ttd�t |f ��t
| j|�}|dk r�ttd�||f ��t |� q0W | j � d S )Nr z Could not list the ibendportsz Could not create a key for %s/%dz$Could not delete the ibendport %s/%d)
� semanage_ibendport_list_localrW r^ r rb �!semanage_ibendport_get_ibdev_name�semanage_ibendport_get_portr2 r* Z ibdevname� semanage_ibendport_del_localr4 r8 )r rL r r0 r1 r� r� r r r ra � s
zibendportRecords.deleteallc C s� | j ||�\}}}t| j|�\}}|dk r>ttd�||f ��|sVttd�||f ��t| j|�\}}|dk r�ttd�||f ��|s�ttd�||f ��t| j|�}|dk r�ttd�||f ��t|� d S )Nr z-Could not check if ibendport %s/%s is definedz ibendport %s/%s is not definedz7ibendport %s/%s is defined in policy, cannot be deletedz Could not delete ibendport %s/%s)r2 r9 rW r^ r Z semanage_ibendport_exists_localr> r4 )r r0 r1 r� r� rL r~ r r r r� s zibendportRecords.__deletec C s | j � | j||� | j� d S )N)rb �_ibendportRecords__deleter8 )r r0 r1 r r r r� s zibendportRecords.deleter c
C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���xX| jD ]N}t|�}t|�}|dkrdqFt|�}t | j|�\}}t
|�} ||f|| |f< qFW |S )Nr zCould not list ibendportsZreserved_ibendport_t) r; rW r �semanage_ibendport_listr^ r r: r r
r< r= )
r rz r� rL r0 r� r r r1 r� r r r rr s zibendportRecords.get_allc C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���xh| jD ]^}t|�}t|�}t| j|�\}}t |�}||f|j
� kr�g |||f< |||f j d| � qFW |S )Nr zCould not list ibendportsz0x%x) r; rW r r@ r^ r r: r r< r= r� r' ) r rz r� rL r0 r� r r1 r� r r r r / s z ibendportRecords.get_all_by_typec C s� g }| j d�}xtt|j� �D ]d}|| d r\|jd|| d || d |d |d f � q |jd|| d |d |d f � q W |S )NTr= z-a -t %s -r '%s' -z %s %sr z-a -t %s -z %s %s)rr r� r� r' )r r r� r� r r r rd B s
0(zibendportRecords.customizedr= c C s� | j |�}|j� }t|�dkr"d S |rDtdtd�td�td�f � xZt|�D ]N}d| }|d|| d 7 }x$|| dd � D ]}|d | 7 }q�W t|� qNW d S )
Nr z%-30s %-18s %s
zSELinux IB End Port TypezIB Device Namez Port Numberz %-30s %-18s z%sr= z, %s)r r� rH rx r r� )r ry rz r� r� ro r� r r r r r{ M s
zibendportRecords.list)N)r )r )r= r )r9 r: r; r� r! r2 r8 r� r6 r7 r� ra r? r� rr r rd r{ r r r r r- ^ s
7
&
r- c @ s~ e Zd Zg Zd dd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Z dd� Z
dd� Z dd� Z dd� Z
d dd�Zdd� Zd d d �ZdS )!� nodeRecordsNc C sT t j| |� ddg| _y$tttjtjd��d d �| _W n tk
rN Y nX d S )NZipv4Zipv6Z node_typer r� ) rP r! �protocolr{ rZ r� r� r� r� )r rT r r r r! ` s
$znodeRecords.__init__c C s� |}|}d}|dkr t td���t|�dks8|d dkrztj|| �}t|j�}t|j�}|dkrp|jdkrpd}d|j }y| j j
|�}W n t td ���Y nX |||fS )
Nr zNode Address is requiredr r� z0.0.0.0� z::zipv%dzUnknown or missing protocol) r^ r rH � ipaddressZ
ip_networkr* Znetwork_addressZnetmask�versionrB �index)r �addr�maskrB ZnewaddrZnewmaskZ newprotocolro r r r �validateh s"
znodeRecords.validatec
C sp | j |||�\}}}tdkr2|dkr*d}nt|�}|dkrFttd���tj|�}|| jkrjttd�| ��t| j |||�\}}|dk r�ttd�| ��t
| j �\}}|dk r�ttd�| ��t ||� t | j |||�}t
| j �\}} |dk r�ttd �| ��t| j |||�}|dk �r&ttd
�| ��t| j | d �}|dk �rNttd �| ��t| j | d
�}|dk �rvttd�| ��t| j | |�}|dk �r�ttd�| ��tdk�r�|dk�r�t| j | |�}|dk �r�ttd�| ��t| j || �}|dk �rttd�| ��t| j ||�}|dk �r*ttd�| ��t| � t|� t|� | jjd||tj| j | �d d
||f � d S )Nr= r r� z SELinux node type is requiredz'Type %s is invalid, must be a node typer zCould not create key for %sz Could not create addr for %sz Could not create context for %szCould not set mask for %sr� z)Could not set user in addr context for %sr� z)Could not set role in addr context for %sz)Could not set type in addr context for %sz/Could not set mls fields in addr context for %sz!Could not set addr context for %szCould not add addr %szCresrc=node op=add laddr=%s netmask=%s proto=%s tcontext=%s:%s:%s:%s) rI r` rO r^ r rZ r� r� �semanage_node_key_createrW Zsemanage_node_createZsemanage_node_set_protoZsemanage_node_set_addrr� Zsemanage_node_set_maskr� r� r� r� Zsemanage_node_set_con�semanage_node_modify_localr� �semanage_node_key_free�semanage_node_freerY r6 r
r� rB )
r rG rH r� r. r rL r� �noder� r r r r� � s^
znodeRecords.__addc C sX | j � | j|||�r:ttd�| � | j|||||� n| j|||||� | j� d S )Nz*Addr %s already defined, modifying instead)rb �_nodeRecords__existsrx r �_nodeRecords__modify�_nodeRecords__addr8 )r rG rH r� r. r r r r r� � s znodeRecords.addc C st | j |||�\}}}t| j|||�\}}|dk r@ttd�| ��t| j|�\}}|dk rhttd�| ��t|� |S )Nr zCould not create key for %sz%Could not check if addr %s is defined)rI rJ rW r^ r �semanage_node_existsrL )r rG rH r� rL r� r~ r r r r� � s znodeRecords.__existsc C s� | j |||�\}}}|dkr0|dkr0ttd���tj|�}|rX|| jkrXttd�| ��t| j|||�\}}|dk r�ttd�| ��t| j|�\}}|dk r�ttd�| ��|s�ttd�| ��t | j|�\}} |dk r�ttd�| ��t
| �}
t d k�r|dk�rt | j|
t
|�� |dk�r.t| j|
|� t| j|| �}|dk �rVttd
�| ��t|� t| � | jjd ||tj| j| �d d
||f � d S )Nr zRequires setype or serangez'Type %s is invalid, must be a node typer zCould not create key for %sz%Could not check if addr %s is definedzAddr %s is not definedzCould not query addr %sr= zCould not modify addr %szFresrc=node op=modify laddr=%s netmask=%s proto=%s tcontext=%s:%s:%s:%sr� r� )rI r^ r rZ r� r� rJ rW rR Zsemanage_node_query�semanage_node_get_conr` r� rO r� rK rL rM rY r6 r
r� rB ) r rG rH r� r. r rL r� r~ rN r� r r r r� � s8
znodeRecords.__modifyc C s& | j � | j|||||� | j� d S )N)rb rP r8 )r rG rH r� r. r r r r r� s znodeRecords.modifyc C s
| j |||�\}}}t| j|||�\}}|dk r@ttd�| ��t| j|�\}}|dk rhttd�| ��|s|ttd�| ��t| j|�\}}|dk r�ttd�| ��|s�ttd�| ��t| j|�}|dk r�ttd�| ��t|� | j j
d||t j | j
| �f � d S )Nr zCould not create key for %sz%Could not check if addr %s is definedzAddr %s is not definedz/Addr %s is defined in policy, cannot be deletedzCould not delete addr %sz1resrc=node op=delete laddr=%s netmask=%s proto=%s)rI rJ rW r^ r rR Zsemanage_node_exists_localZsemanage_node_del_localrL rY r6 r
r� rB )r rG rH r� rL r� r~ r r r r� s& znodeRecords.__deletec C s" | j � | j|||� | j� d S )N)rb �_nodeRecords__deleter8 )r rG rH r� r r r r� # s znodeRecords.deletec C st t | j�\}}|dk r"ttd���| j� x<|D ]4}| jt| j|�d t| j|�d | jt |� � q0W | j
� d S )Nr z!Could not deleteall node mappingsr= ) �semanage_node_list_localrW r^ r rb rT �semanage_node_get_addr�semanage_node_get_maskrB �semanage_node_get_protor8 )r rL ZnlistrN r r r ra ( s
4znodeRecords.deleteallr c C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���xj| jD ]`}t|�}t| j|�}t| j|�}| j t
|� }t |�t |�t
|�t|�f||d |d |f< qFW |S )Nr zCould not list addrsr= )rU rW �ilistZsemanage_node_listr^ r rS rV rW rB rX �semanage_context_get_user�semanage_context_get_roler r
) r rz r� rL rN r� rG rH r� r r r rr 2 s 2znodeRecords.get_allc C s� g }| j d�}x�t|j� �D ]p}|| d rb|jd|d |d || d || d |d f � q |jd|d |d || d |d f � q W |S )NTr z -a -M %s -p %s -t %s -r '%s' %sr= rw r z-a -M %s -p %s -t %s %s)rr r� r� r' )r r r� r� r r r rd D s
6.znodeRecords.customizedr= c C s | j |�}t|�dkrd S t|j� �}|r6tdd � tr�x�|D ]r}d}x |D ]}|d t|� }qNW td |d |d
|d || d || d
|| d t|| d d
�f � q@W nJxH|D ]@}td|d |d
|d || d || d
|| d f � q�W d S )Nr z%-18s %-18s %-5s %-5s
�
IP Address�Netmask�Protocol�Contextr � z %-18s %-18s %-5s %s:%s:%s:%s r= rw r Fz%-18s %-18s %-5s %s:%s:%s )r\ r] r^ r_ )rr rH r� r� rx r` r* rN )r ry rz r� r� r� �valZfieldsr r r r{ N s
R
znodeRecords.list)N)r )r= r )r9 r: r; r� r! rI rQ r� rO rP r� rT r� ra rr rd r{ r r r r rA \ s
B (
rA c @ sr e Zd Zd dd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Zdd� Z dd� Z
dd� Z d dd�Z dd� Z
d dd�ZdS ) �interfaceRecordsNc C s t j| |� d S )N)rP r! )r rT r r r r! c s zinterfaceRecords.__init__c C s t dkr |dkrd}nt|�}|dkr2ttd���t| j|�\}}|dk rZttd�| ��t| j�\}}|dk r�ttd�| ��t| j||�}t| j�\}}|dk r�ttd�| ��t | j|d �}|dk r�ttd
�| ��t
| j|d �}|dk �rttd �| ��t | j||�}|dk �r*ttd
�| ��t dk�rf|dk�rft | j||�}|dk �rfttd�| ��t
| j||�}|dk �r�ttd�| ��t| j||�}|dk �r�ttd�| ��t| j||�}|dk �r�ttd�| ��t|� t|� t|� | jjd|d d ||f � d S )Nr= r r� zSELinux Type is requiredr zCould not create key for %sz!Could not create interface for %sz Could not create context for %sr� z.Could not set user in interface context for %sr� z.Could not set role in interface context for %sz.Could not set type in interface context for %sz4Could not set mls fields in interface context for %sz&Could not set interface context for %sz$Could not set message context for %szCould not add interface %sz4resrc=interface op=add netif=%s tcontext=%s:%s:%s:%s)r` rO r^ r �semanage_iface_key_createrW Zsemanage_iface_createZsemanage_iface_set_namer� r� r� r� r� Zsemanage_iface_set_ifconZsemanage_iface_set_msgcon�semanage_iface_modify_localr� �semanage_iface_key_free�semanage_iface_freerY r6 )r � interfacer. r rL r� �ifacer� r r r r� f sT
zinterfaceRecords.__addc C sL | j � | j|�r2ttd�| � | j|||� n| j|||� | j� d S )Nz/Interface %s already defined, modifying instead)rb �_interfaceRecords__existsrx r �_interfaceRecords__modify�_interfaceRecords__addr8 )r rg r. r r r r r� � s
zinterfaceRecords.addc C s\ t | j|�\}}|dk r(ttd�| ��t| j|�\}}|dk rPttd�| ��t|� |S )Nr zCould not create key for %sz*Could not check if interface %s is defined)rc rW r^ r �semanage_iface_existsre )r rg rL r� r~ r r r r� � s zinterfaceRecords.__existsc C s> |dkr |dkr t td���t| j|�\}}|dk rDt td�| ��t| j|�\}}|dk rlt td�| ��|s�t td�| ��t| j|�\}}|dk r�t td�| ��t|�}tdkr�|dkr�t| j|t |�� |dkr�t
| j||� t | j||�}|dk �rt td �| ��t |� t
|� | jjd
|d d ||f � d S )
Nr zRequires setype or seranger zCould not create key for %sz*Could not check if interface %s is definedzInterface %s is not definedz Could not query interface %sr= z Could not modify interface %sz7resrc=interface op=modify netif=%s tcontext=%s:%s:%s:%sr� r� )r^ r rc rW rl Zsemanage_iface_query�semanage_iface_get_ifconr` r� rO r� rd re rf rY r6 ) r rg r. r rL r� r~ rh r� r r r r� � s0
zinterfaceRecords.__modifyc C s" | j � | j|||� | j� d S )N)rb rj r8 )r rg r. r r r r r� � s zinterfaceRecords.modifyc C s� t | j|�\}}|dk r(ttd�| ��t| j|�\}}|dk rPttd�| ��|sdttd�| ��t| j|�\}}|dk r�ttd�| ��|s�ttd�| ��t| j|�}|dk r�ttd�| ��t|� | jj d| � d S )Nr zCould not create key for %sz*Could not check if interface %s is definedzInterface %s is not definedz4Interface %s is defined in policy, cannot be deletedz Could not delete interface %sz"resrc=interface op=delete netif=%s)
rc rW r^ r rl Zsemanage_iface_exists_localZsemanage_iface_del_localre rY r6 )r rg rL r� r~ r r r r� � s$ zinterfaceRecords.__deletec C s | j � | j|� | j� d S )N)rb �_interfaceRecords__deleter8 )r rg r r r r� � s
zinterfaceRecords.deletec C sR t | j�\}}|dk r"ttd���| j� x|D ]}| jt|�� q0W | j� d S )Nr z(Could not delete all interface mappings)�semanage_iface_list_localrW r^ r rb rn �semanage_iface_get_namer8 )r rL r� ro r r r ra � s
zinterfaceRecords.deleteallr c C s~ i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���x:| jD ]0}t|�}t|�t|�t |�t
|�f|t |�< qFW |S )Nr zCould not list interfaces) ro rW rY Zsemanage_iface_listr^ r rm rZ r[ r r
rp )r rz r� rL rg r� r r r rr s (zinterfaceRecords.get_allc C st g }| j d�}x`t|j� �D ]P}|| d rR|jd|| d || d |f � q |jd|| d |f � q W |S )NTr z-a -t %s -r '%s' %srw z -a -t %s %s)rr r� r� r' )r r r� r� r r r rd s
& zinterfaceRecords.customizedr= c
C s� | j |�}t|�dkrd S t|j� �}|rBtdtd�td�f � tr�x�|D ]@}td||| d || d || d t|| d d �f � qLW n:x8|D ]0}td
||| d || d || d f � q�W d S ) Nr z %-30s %s
zSELinux Interfacer_ z%-30s %s:%s:%s:%s r= rw r Fz%-30s %s:%s:%s )rr rH r� r� rx r r` rN )r ry rz r� r� r� r r r r{ s
B
zinterfaceRecords.list)N)r )r= r )r9 r: r; r! rk r� ri rj r� rn r� ra rr rd r{ r r r r rb a s
: "
rb c @ s� e Zd Zg Zd(dd�Zdd� Zdd� Zdd � Zd)d d �Zd
d� Z d*dd�Z
d+dd�Z dd� Z dd� Z
dd� Zdd� Zd d � Zd d � Zd,d!d"�Zd#d$� Zd-d&d'�ZdS ).�fcontextRecordsNc C s� t j| |� yLtttjtjd��d d �| _| jtttjtjd��d d �7 _W n tk
rl Y nX i | _i | _ d| _
ydt t j
� d�}xH|j� D ]<}|j� }t|�dkr�q�|jd�r�q�|j� \}}|| j|< q�W |j� W n tk
r� Y nX ynt t j� d�}xR|j� D ]F}|j� }t|�dk�r2�q|jd��rB�q|j� \}}|| j |< �qW |j� W n tk
�r~ Y nX d S )NZ file_typer r� Z device_nodeFr� �#)rP r! r{ rZ r� r� r� r� �equiv�
equiv_dist� equal_indr� rG � selinux_file_context_subs_path� readlines�striprH r� r� r� �IOErrorZ#selinux_file_context_subs_dist_path)r rT r� ro �target�
substituter r r r! 1 sF ,
zfcontextRecords.__init__c
C s� | j r�tj� }d| }t|d�}x*| jj� D ] }|jd|| j| f � q,W |j� y tj |tj
|�t
j � W n Y nX tj ||� d| _ t
j| � d S )Nz%s.tmp�wz%s %s
F)ru rG rv r� rs r� �writer� r| �chmod�stat�ST_MODE�renamerP r8 )r Z subs_fileZtmpfiler� rz r r r r8 W s
zfcontextRecords.commitc C sL | j � |dkr,|d
dkr,ttd�| ��|dkrP|d dkrPttd�| ��|| jj� kr�ttd�| � || j|< d| _| jjdt j
d|d �t j
d
|d �f � | j � d S | j |� xJ| j| j
fD ]:}x4|D ],}|j|d �r�ttd �|||| f ��q�W q�W | jjd t j
d|d �t j
d
|d �f � || j|< d| _| j � d S )Nr� r= z=Target %s is not valid. Target is not allowed to end with '/'zESubstitute %s is not valid. Substitute is not allowed to end with '/'z:Equivalence class for %s already exists, modifying insteadTz$resrc=fcontext op=modify-equal %s %s�sglobr �tglobz4File spec %s conflicts with equivalency rule '%s %s'z!resrc=fcontext op=add-equal %s %s���r� )rb r^ r rs r� rx ru rY r6 r �audit_encode_nv_stringr8 rI rt r� )r rz r{ �fdictro r r r � add_equalg s*
(
"(
zfcontextRecords.add_equalc C sj | j � || jj� kr&ttd�| ��|| j|< d| _| jjdtj d|d�tj d|d�f � | j
� d S )Nz'Equivalence class for %s does not existTz$resrc=fcontext op=modify-equal %s %sr� r r� ) rb rs r� r^ r ru rY r6 r r� r8 )r rz r{ r r r � modify_equal� s
(z fcontextRecords.modify_equalr� c C s� t | j�\}}|dk r&ttd�| ��|dkr2d}t| j||�}|dk rXttd�| ��t| j|d�}|dk r~ttd�| ��tdkr�t| j|d �}|dk r�ttd
�| ��|S ) Nr z Could not create context for %sr r� z)Could not set user in file context for %sr� z)Could not set role in file context for %sr= r� z/Could not set mls fields in file context for %s)r� rW r^ r r� r� r` r� )r rz r� rL r� r r r � createcon� s zfcontextRecords.createconc C s� |dks|j d�dkr"ttd���|j d�d
kr<ttd���x^| j| jfD ]N}xH|D ]@}|j|d �rTtj||| |�}ttd �|||| |f ��qTW qJW d S ) Nr �
r zInvalid file specificationr� r= z)File specification can not include spacesr� zMFile spec %s conflicts with equivalency rule '%s %s'; Try adding '%s' insteadr� )�findr^ r rs rt r� rB �sub)r rz r� ro rg r r r rI � s
zfcontextRecords.validater c
C s� | j |� tdkrt|�}|dkr.ttd���|dkrZtj|�}|| jkrZttd�| ��t| j |t
| �\}}|dk r�ttd�| ��t | j �\}}|dk r�ttd�| ��t | j ||�}|dk�r\| j
||�} t| j | |�}|dk r�ttd �| ��tdk�r4|dk�r4t| j | |�}|dk �r4ttd
�| ��t| j || �}|dk �r\ttd �| ��t|t
| � t| j ||�}|dk �r�ttd �| ��|dk�r�t| � t|� t|� |�s�d
}| jjdtjd|d�t| |d||f � d S )Nr= r zSELinux Type is requiredz<<none>>z1Type %s is invalid, must be a file or device typer zCould not create key for %sz$Could not create file context for %sz)Could not set type in file context for %sz/Could not set mls fields in file context for %sz!Could not set file context for %sz!Could not add file context for %sr� z6resrc=fcontext op=add %s ftype=%s tcontext=%s:%s:%s:%sr� r� )rI r` rO r^ r rZ r� r� � semanage_fcontext_key_createrW �
file_typesZsemanage_fcontext_createZsemanage_fcontext_set_exprr� r� r� �semanage_fcontext_set_conZsemanage_fcontext_set_type� semanage_fcontext_modify_localr� �semanage_fcontext_key_free�semanage_fcontext_freerY r6 r r� �ftype_to_audit)
r rz rS �ftyper. r� rL r� �fcontextr� r r r r� � sN
zfcontextRecords.__addc C sV | j � | j||�r8ttd�| � | j|||||� n| j|||||� | j� d S )Nz6File context for %s already defined, modifying instead)rb �_fcontextRecords__existsrx r �_fcontextRecords__modify�_fcontextRecords__addr8 )r rz rS r� r. r� r r r r� � s zfcontextRecords.addc C s� t | j|t| �\}}|dk r.ttd�| ��t| j|�\}}|dk rVttd�| ��|s�t| j|�\}}|dk r�ttd�| ��t|� |S )Nr zCould not create key for %sz1Could not check if file context for %s is defined)r� rW r� r^ r �semanage_fcontext_exists� semanage_fcontext_exists_localr� )r rz r� rL r� r~ r r r r� � s zfcontextRecords.__existsc C s� |dkr$|dkr$|dkr$t td���|dkrPtj|�}|| jkrPt td�| ��| j|� t| j|t| �\}}|dk r�t td�| ��t | j|�\}}|dk r�t td�| ��|r�yt
| j|�\}} W n$ t k
r� t td�| ��Y nX n|t | j|�\}}|dk �rt td�| ��|�s0t td �| ��yt
| j|�\}} W n& t k
�rj t td�| ��Y nX |dk�rt| �}
|
d k�r�| j|�}
td
k�r�|dk�r�t| j|
t|�� |dk�r�t| j|
|� |dk�r�t| j|
|� t| j| |
�}|dk �r:t td �| ��n(t| j| d �}|dk �r:t td �| ��t| j|| �}|dk �rbt td �| ��t|� t| � |�s|d
}| jjdtj d|d�t | |d||f � d S )Nr z"Requires setype, serange or seuser�<<none>>z1Type %s is invalid, must be a file or device typer z Could not create a key for %sz1Could not check if file context for %s is definedz#Could not query file context for %sz"File context for %s is not definedr= z!Could not set file context for %sz$Could not modify file context for %sr� z9resrc=fcontext op=modify %s ftype=%s tcontext=%s:%s:%s:%sr� r� )r r� ) r^ r rZ r� r� rI r� rW r� r� Zsemanage_fcontext_query�OSErrorr� Z semanage_fcontext_query_local�semanage_fcontext_get_conr� r` r� rO r� r� r� r� r� r� rY r6 r r� r� ) r rz r r� r. r� rL r� r~ r� r� r r r r�
sf
zfcontextRecords.__modifyc C s& | j � | j|||||� | j� d S )N)rb r� r8 )r rz r r� r. r� r r r r� C
s zfcontextRecords.modifyc C s� t | j�\}}|dk r"ttd���| j� x�|D ]�}t|�}t|�}t|�}t| j|t | �\}}|dk rzttd�| ��t
| j|�}|dk r�ttd�| ��t |� | j j
dtjd|d�tt| f � q0W i | _d| _| j� d S )Nr z Could not list the file contextsz Could not create a key for %sz$Could not delete the file context %sz$resrc=fcontext op=delete %s ftype=%sr� T)� semanage_fcontext_list_localrW r^ r rb �semanage_fcontext_get_expr�semanage_fcontext_get_type� semanage_fcontext_get_type_strr� r� �semanage_fcontext_del_localr� rY r6 r r� r� �file_type_str_to_optionrs ru r8 )r rL �flistr� rz r� � ftype_strr� r r r ra H
s&
*zfcontextRecords.deleteallc C s: || j j� kr>| j j|� d| _| jjdtjd|d� � d S t| j |t
| �\}}|dk rlt t d�| ��t
| j |�\}}|dk r�t t d�| ��|s�t| j |�\}}|dk r�t t d�| ��|r�t t d�| ��nt t d�| ��t| j |�}|dk �r t t d �| ��t|� | jjd
tjd|d�t| f � d S ) NTz!resrc=fcontext op=delete-equal %sr� r z Could not create a key for %sz1Could not check if file context for %s is definedz;File context for %s is defined in policy, cannot be deletedz"File context for %s is not definedz$Could not delete file context for %sz$resrc=fcontext op=delete %s ftype=%s)rs r� �popru rY r6 r r� r� rW r� r^ r r� r� r� r� r� )r rz r� rL r� r~ r r r r� b
s.
zfcontextRecords.__deletec C s | j � | j||� | j� d S )N)rb �_fcontextRecords__deleter8 )r rz r� r r r r� �
s zfcontextRecords.deleter c C s |rt | j�\}| _n�t| j�\}| _|dk r:ttd���t| j�\}}|dk r\ttd���t | j�\}}|dk r~ttd���| j|7 _| j|7 _i }xd| jD ]Z}t|�}t|�}t |�} t
|�}
|
r�t |
�t |
�t
|
�t|
�f||| f< q�|
||| f< q�W |S )Nr z Could not list file contextsz1Could not list file contexts for home directoriesz"Could not list local file contexts)r� rW r� Zsemanage_fcontext_listr^ r Z semanage_fcontext_list_homedirsr� r� r� r� rZ r[ r r
) r rz rL Z
fchomedirsZfclocalr� r� �exprr� r� r� r r r rr �
s. &zfcontextRecords.get_allc C s� g }| j d�}x�|j� D ]t}|| r|| d rd|jdt|d || d || d |d f � q|jdt|d || d |d f � qW t| j�r�x*| jj� D ] }|jd| j| |f � q�W |S ) NTr z-a -f %s -t %s -r '%s' '%s'r= rw r z-a -f %s -t %s '%s'z -a -e %s %s)rr r� r' r� rH rs )r r � fcon_dictr� rz r r r rd �
s
4,
zfcontextRecords.customizedr= c C s� | j |�}t|�dk�r|r:tdtd�td�td�f � |rH|j� }n t|j� �}x�|D ]�}|| r�tr�td|d |d || d || d || d t|| d d
�f � n6td |d |d || d || d || d f � qZtd |d |d f � qZW t| j��rV|�sV|�r*ttd
�� x*| jj� D ] }td|| j| f � �q6W t| j ��r�|�rtttd�� x*| j j� D ] }td|| j | f � �q�W d S )Nr z%-50s %-18s %s
zSELinux fcontextrS r_ z%-50s %-18s %s:%s:%s:%s r= rw r Fz%-50s %-18s %s:%s:%s z%-50s %-18s <<None>>z,
SELinux Distribution fcontext Equivalence
z%s = %sz%
SELinux Local fcontext Equivalence
)
rr rH rx r r� r� r` rN rt rs )r ry rz r� Zfkeysr� rz r r r r{ �
s0
H8 zfcontextRecords.list)N)r� )r r r� )r r r� )r )r= r )r9 r: r; r� r! r8 r� r� r� rI r� r� r� r� r� ra r� r� rr rd r{ r r r r rq - s$
&
6
C!
rq c @ sl e Zd Zddd�Zdd� Zd dd�Zd d
� Zd d � Zd
d� Zd dd�Z dd� Z
dd� Z dd� Z d dd�Z
dS ) �booleanRecordsNc C s� t j| |� i | _d| jd< d| jd< d| jd< d| jd< d| jd< d| jd< y tj� \}| _tj� \}}W n g | _d }Y nX | jd ks�| j|kr�d
| _nd | _d S ) Nr= ZTRUEr ZFALSEZONZOFF�1�0r TF) rP r! �dictrG Zsecurity_get_boolean_names�current_booleansrX rR � modify_local)r rT rL Zptyper r r r! �
s"
zbooleanRecords.__init__c C sL t j|�}t| j|�\}}|dk r2ttd�| ��t| j|�\}}|dk rZttd�| ��|snttd�| ��t| j|�\}}|dk r�ttd�| ��|j� | j kr�t
|| j |j� � n ttd�dj | j j � � ��| j
o�|| jk�rt| j||�}|dk �rttd�| ��t| j||�}|dk �r8ttd �| ��t|� t|� d S )
Nr z Could not create a key for %sz(Could not check if boolean %s is definedzBoolean %s is not definedz Could not query file context %sz0You must specify one of the following values: %sz, z(Could not set active value of boolean %szCould not modify boolean %s)rG �selinux_boolean_sub�semanage_bool_key_createrW r^ r �semanage_bool_existsZsemanage_bool_query�upperr� Zsemanage_bool_set_valuer� r� r� r� Zsemanage_bool_set_activeZsemanage_bool_modify_local�semanage_bool_key_freeZsemanage_bool_free)r r, �valuerL r� r~ r r r r Z__mod�
s0
zbooleanRecords.__modFc C s� | j � |r�t|�}x||j� jd�D ]j}|j� }t|�dkr>q$y|jd�\}}W n( tk
rx ttd||f ���Y nX | j|j� |j� � q$W |j � n | j||� | j
� d S )Nr� r �=zBad format %s: Record %s) rb r� r� r� rx rH r^ r �_booleanRecords__modr� r8 )r r, r� �use_filer� r Zboolnamera r r r r� s
zbooleanRecords.modifyc C s� t j|�}t| j|�\}}|dk r2ttd�| ��t| j|�\}}|dk rZttd�| ��|snttd�| ��t| j|�\}}|dk r�ttd�| ��|s�ttd�| ��t| j|�}|dk r�ttd�| ��t |� d S )Nr z Could not create a key for %sz(Could not check if boolean %s is definedzBoolean %s is not definedz2Boolean %s is defined in policy, cannot be deletedzCould not delete boolean %s)
rG r� r� rW r^ r r� Zsemanage_bool_exists_localZsemanage_bool_del_localr� )r r, rL r� r~ r r r r� # s$
zbooleanRecords.__deletec C s | j � | j|� | j� d S )N)rb �_booleanRecords__deleter8 )r r, r r r r� ; s
zbooleanRecords.deletec C sZ t | j�\}| _|dk r$ttd���| j� x | jD ]}t|�}| j|� q4W | j� d S )Nr zCould not list booleans) �semanage_bool_list_localrW �blistr^ r rb �semanage_bool_get_namer� r8 )r rL �booleanr, r r r ra @ s zbooleanRecords.deleteallr c C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���x~| jD ]t}g }t|�}|jt|�� | j r�|| j
kr�|jt j |�� |jt j
|�� n |j|d � |j|d � |||< qFW |S )Nr zCould not list booleans)r� rW r� Zsemanage_bool_listr^ r r� r' Zsemanage_bool_get_valuer� r� rG Z security_get_boolean_pendingZsecurity_get_boolean_active)r rz r� rL r� r� r, r r r rr M s" zbooleanRecords.get_allc C s t j|�}tj|�S )N)rG r� rZ Z boolean_desc)r r, r r r �get_descd s
zbooleanRecords.get_descc C s t j|�}tj|�S )N)rG r� rZ Zboolean_category)r r, r r r � get_categoryh s
zbooleanRecords.get_categoryc C sJ g }| j d�}x6t|j� �D ]&}|| r |jd|| d |f � q W |S )NTz -m -%s %srw )rr r� r� r' )r r r� r� r r r rd l s
zbooleanRecords.customizedTc C s� t d�t d�f}|rX| j|�}x4t|j� �D ]$}|| r,td||| d f � q,W d S | j|�}t|�dkrrd S |r�tdt d�t d�t d �t d
�f � xNt|j� �D ]>}|| r�td |||| d ||| d | j|�f � q�W d S ) Nr� r� z%s=%srw r z%-30s %s %s %s
zSELinux booleanZStateZDefaultZ Descriptionz%-30s (%-5s,%5s) %s)r rr r� r� rx rH r� )r ry rz r� Zon_offr� r� r r r r{ t s
$zbooleanRecords.list)N)NF)r )TFF)r9 r: r; r! r� r� r� r� ra rr r� r� rd r{ r r r r r� �
s
r� )r )r= )r= )9r� r� rG r| rB r( r r
r5 ZPROGNAMErZ r rD �gettext�kwargs� version_infoZinstall�builtinsr* �__dict__r� Z __builtin__r r> r� ZSEMANAGE_FCONTEXT_ALLZSEMANAGE_FCONTEXT_REGZSEMANAGE_FCONTEXT_DIRZSEMANAGE_FCONTEXT_CHARZSEMANAGE_FCONTEXT_BLOCKZSEMANAGE_FCONTEXT_SOCKZSEMANAGE_FCONTEXT_LINKZSEMANAGE_FCONTEXT_PIPEr� r� r Z audit_closer r r� r? rF rN rO rP rf r� r� r� r� r� r r- rA rb rq r� r r r r �<module> s�
$$
ik
H $ M .