3
Fl�fz� � @ s6 d dl Z d dlZd dlZd dlZd dljZd dljZd dlZd dl Z d dl
Z
d dl Z dZ y:d dl
Z
i Zejd�k rxded< e
je fddd�e�� W nJ yd dlZeejd < W n& ek
r� d dlZeejd < Y nX Y nX d
Zd ZdZd Zd
ZdZ dZ dZ dZ dZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'i Z(de(d< d e(d < d e(d < d e(d < d e(d!< d"e(d#< d$e(d%< d&e(d'< d(e(d)< d(e(d*< d+e(d,< d+e(d-< d.e(d/< d0e(d1< i Z)e*d2�e)d3< e*d4�e)d5< e*d6�e)d7< e*d8�e)d9< e*d:�e)d;< e*d<�e)d=< e*d>�e)d?< e*d@�e)dA< i Z+d3e+dB< d5e+dC< d7e+dD< d9e+dE< d;e+dF< d=e+dG< d?e+dH< dAe+dI< da,da-da.da/da0g a1da2da3da4da5da6da7da8da9da:da;da<da=da>da?da@daAdaBdaCdaDdJdK� ZEd�dMdN�ZFdOdP� ZGdQdR� ZHdSdT� ZIyeF� ZJeHeJ� W n6 eKk
�r ZL zejM� d
k�reL�W Y ddZL[LX nX d�dUdV�ZNdWdX� ZOd�dYdZ�ZPd[d\� ZQd]d^� ZRd_d`� ZSdadb� ZTdcdd� ZUdedf� ZVdgdh� ZWg fdidj�ZXg fdkdl�ZYdmdn� ZZej[� fdodp�Z\ej[� fdqdr�Z]ej[� fdsdt�Z^ej[� fdudv�Z_dwdx� Z`dydz� Zad{d|� Zbd}d~� Zcdd�� Zdd�d�� Zed�d�� Zfd�d�� Zgd�d�� Zhd�d�� Zid�d�� Zjd�d�� Zkd�d�� Zld�d�� Zmd�d�� Znd�d�� Zod�d�� Zpd�d�� Zqd�d�� Zrd�d�� Zsd�d�� Ztd�d�� Zud�d�� Zvd�d�� Zwd�d�� Zxd�d�� Zyd�d�� Zzd�d�� Z{d�d�� Z|e|fd�d��Z}d�d�� Z~d�d�� Zd�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d Z�d�d�dńZ�d�d�dDŽZ�d�dɄ Z�d�d˄ Z�d�d̈́ Z�d�dτ Z�dS )�� Nzselinux-python� T�unicodez/usr/share/localezutf-8)Z localedirZcodeset�_� � � � � � �allowZ
auditallowZ
neverallowZ dontaudit�source�target�permlist�classZ
transitionZ
role_allowZetc_tz/etcZtmp_tz/tmpZ unit_file_tz/usr/lib/systemd/systemz/lib/systemd/systemz/etc/systemd/systemZ var_cache_tz
/var/cacheZ var_lib_tz/var/libZlog_tz/var/logZ var_run_tz/var/runz/runZ
var_lock_tz /run/lockz
/var/run/lockZ var_spool_tz
/var/spoolZ content_tz/var/wwwz all files�az regular file�fZ directory�dzcharacter device�cz block device�bz socket file�sz
symbolic link�lz
named pipe�p� z--z-dz-cz-bz-sz-lz-pc C s: | j dd�d }y t|�| fS tk
r4 d| fS X d S )Nz/policy.r r )�rsplit�int�
ValueError)Z policy_path� extension� r � /usr/lib/python3.6/__init__.py�policy_sortkeyy s
r �/c C sL y.| t j� }tjd| �}|jtd� |d S Y nX ttd���d S )Nz%s.*)�keyr zNo SELinux Policy installed���)�selinuxZselinux_binary_policy_path�glob�sortr r r )�root�path�policiesr r r �get_installed_policy� s r) c C s2 t j dtj� | f �}|s dS |jtd� |d S )z?Get the path to the policy file located in the given store namez%s%s/policy/policy.*N)r! r r" )r$ r# Z selinux_pathr% r )�storer( r r r �get_store_policy� s r+ c C sT d a d ad ad ad ad ad ad ad ayt j
| �a W n t t
d�| ��Y nX d S )Nz Failed to read %s policy file)� all_domains�all_attributes�bools� all_types� role_allowsZusers�roles�
file_types�
port_types�setoolsZ
SELinuxPolicy�_polr r )� policy_filer r r �policy� s
r7 c C s t | �}|sd S t|� d S )N)r+ r7 )r* r6 r r r �load_store_policy� s r8 c C s | t krZtjt�}||_t|j� �}|rLt|�dk rLd |_||_t|j� �}dd� |D �S | t kr�tj
t�}|rv||_dd� |j� D �S | t kr�tj t�}|r�||_dd� |j� D �S | t
k�rFtjt�}|�rdd� |jd�D �}t|�d k� r�||_n t|�dk�r|d
|d
f|_tj�r4d d� |j� D �S d d� |j� D �S | tk�r�tjt�}|�rf||_tj�r�d
d� |j� D �S dd� |j� D �S | tk�r�tjt�}|�r�||_dd� |j� D �S | tk�r�tjt�}|�r�||_dd� |j� D �S td��d S )Nr c s sB | ]:}t tt|j� ��t|�t|j�t tt|j� ��d �V qdS ))�aliases�nameZ
permissive�
attributesN)�list�map�strr9 �boolZ ispermissiver; )�.0�xr r r � <genexpr>� s zinfo.<locals>.<genexpr>c s s: | ]2}t |�ttt |j� ��ttt |j� ��d �V qdS ))r: r1 �typesN)r> r< r= �expandrC )r@ rA r r r rB � s c s s* | ]"}t |�ttt |j� ��d �V qdS ))r: rC N)r> r< r= rD )r@ rA r r r rB � s c S s g | ] }t |��qS r )r )r@ �ir r r �
<listcomp>� s zinfo.<locals>.<listcomp>�-r r c s s< | ]4}|j jt|j�t|jj�t|jj�|j jd �V qdS ))�high�protocol�range�type�lowN)�portsrH r> rI �contextZrange_�type_rL )r@ rA r r r rB � s c s s2 | ]*}|j jt|j�t|jj�|j jd �V qdS ))rH rI rK rL N)rM rH r> rI rN rO rL )r@ rA r r r rB � s c s s8 | ]0}t |j�t |�ttt |j��t |j�d �V qdS ))rJ r: r1 �levelN)r> Z mls_ranger< r= r1 Z mls_level)r@ rA r r r rB s c s s( | ] }t |�ttt |j��d �V qdS ))r: r1 N)r> r< r= r1 )r@ rA r r r rB
s c s s | ]}t |�|jd �V qdS ))r: �stateN)r> rQ )r@ rA r r r rB s c s s" | ]}t |�t|j�d �V qdS ))r: r N)r> r< �perms)r@ rA r r r rB s z Invalid type)�TYPEr4 Z TypeQueryr5 r: r< �results�len�alias�ROLE� RoleQuery� ATTRIBUTEZTypeAttributeQuery�PORTZ PortconQuery�splitrM �mls�USERZ UserQuery�BOOLEANZ BoolQuery�TCLASSZ
ObjClassQueryr )�setyper: �qrT rM r r r �info� sr
rb c 3 C s` t | j�t | j�t | j�t | j�d�}y<i }x | jjD ]}|j|t |�< q6W | jjf |�| j k}W n t
k
rz d}Y nX ||d< yt t t | j
��|d< W n t
k
r� Y nX yt | j�|d< W n t
k
r� Y nX ydd� | jjD �|d< W n t
k
�r
Y nX yt | j�|d < W n t
k
�r4 Y nX y| j|d
< W n t
k
�rZ Y nX |S ) N)rK r r
r T�enabledr � transtypec S s g | ]}t |�|jf�qS r )r> rQ )r@ r r r r rF H s z)_setools_rule_to_dict.<locals>.<listcomp>�booleans� conditional�filename)r> �ruletyper r
�tclassrf re rQ ZevaluateZconditional_block�AttributeErrorr< r= rR �defaultrg )Zruler Z boolstate�booleanrc r r r �_setools_rule_to_dict' sB
rm c
C s� |si }t ttttttg�}x&| D ] }||kr"tddj|� ��q"W d }t |kr\t
|t �}d }t |krtt
|t �}d }t |kr�t
|t �j
d�}g }g }t| kr�|jt� t| kr�|jt� t| kr�|jt� t| kr�|jt� t|�dk�r.tjt||||d�} t|k�r|t | _|dd� | j� D �7 }t| k�r�dd d
g}
tjt|
|||d�} t|k�rj|t | _|d d� | j� D �7 }t| k�r�d g} tjt| |||d�} x.| j� D ]"} |jt
| j�t
| j�d
�� �q�W |S )NzType has to be in %s� �,r )rh r r
ri c S s g | ] }t |��qS r )rm )r@ rA r r r rF � s zsearch.<locals>.<listcomp>�type_transitionZ type_changeZ type_memberc S s g | ] }t |��qS r )rm )r@ rA r r r rF � s r )r r
)�set�ALLOW�
AUDITALLOW�
NEVERALLOW� DONTAUDIT�
TRANSITION�
ROLE_ALLOWr �join�SOURCEr> �TARGET�CLASSr[ �appendrU r4 � TERuleQueryr5 �PERMSrR rT �
RBACRuleQueryr r
)
rC ZseinfoZ valid_typesr` r r
ri ZtoretZtertypesra ZrtypesZratypes�rr r r �searchY sn
r� c s i }g }�g�� g�y(�t t�fdd�t� ��d d 7 �W n Y nX y(�t t� fdd�t� ��d d 7 �W n Y nX tdd� t���fdd�t� ��}yHxB|D ]:}|j|d |d |d
fd �� ||kr�|j|� i }q�W W n tk
�r |S X |S ) Nc s | d � kS )Nr: r )rA )�srcr r �<lambda>� s z"get_conditionals.<locals>.<lambda>r r; c s | d � kS )Nr: r )rA )�destr r r� � s c S s | S )Nr )�yr r r r� � s c s2 | d �ko0| d � ko0t ��j| t �o0d| kS )Nr r
rf )rq �issubsetr~ )rA )� dest_list�perm�src_listr r r� � s r rf rc )r rf )r< �filter�get_all_types_infor= �get_all_allow_rules�updater| �KeyError)r� r� ri r� ZtdictZtlistZallowsrE r )r� r� r� r� r� r �get_conditionals� s. ((
r� c C sH d}x | D ]}|d d r
d}P q
W t d�|djttdd� | ���f S ) NFrf r Tz-- Allowed %s [ %s ]z || c S s d| d d | d d f S )Nz%s=%drf r r r )rA r r r r� � s z.get_conditionals_format_text.<locals>.<lambda>)r rx rq r= )Zcondrc rA r r r � get_conditionals_format_text� s
r� c C s t tt| ��d d S )Nr rC )r< rb rY )Z attributer r r �get_types_from_attribute� s r� c C s� g }i }x&t � D ] }|jt| ��r|j|� qW t� }xN|D ]F}y$|| d t|| d f||< W q< tk
r� g ||< Y q<X q<W |S )N�regex�ftype)�get_all_file_types�
startswith�gen_short_namer| �
get_fcdict�
file_type_strr� )r` �flist�mpathsr �fcdictr r r �get_file_types� s
$r� c C s8 | s| S yt tt| ��d S ttfk
r2 | S X dS )z�Return the real name of a type
* If 'name' refers to a type alias, return the corresponding type name.
* Otherwise return the original name (even if the type does not exist).
r: N)�nextrb rS � RuntimeError�
StopIteration)r: r r r �get_real_type_name� s r� c
C s< t � }g }i }ttg| ddgdd��}|d ks:t|�dkr>|S t� }ddg}x�|D ]�}|d |krdqRd |krv|d svqR|d jd
�r�|d |kr�qR|d |kr�|d | kr�|j|d � qRx&t|d �D ]}||kr�|j|� q�W qRW xP|D ]H} y$|| d t|| d f|| < W q� t k
�r2 g || < Y q�X q�W |S )
N�open�write�file)r r r r Z proc_typeZ sysctl_typer
rc �_tr� r� )
r� r� rr rU r� �endswithr| r� r� r� )
r` r2 Z
all_writesr� r r� r; rE �tr r r r �get_writable_files� s:
$r� c s� t jj| �r| gS ytjd| �� W n td| � g S | }|jd�rX|d d � d }t jj|��y�d
dkrz�d7 �W n tk
r� td� Y nX y4tjd| �� � fdd �t �fd
d �t j
���D �S g S d S )Nz%s$zbad reg:z(/.*)?r r r z try failed got an IndexErrorc s g | ]}� j |�r|�qS r )�match)r@ rA )�patr r rF ( s z find_file.<locals>.<listcomp>c s � | S )Nr )rA )r' r r r� ( s zfind_file.<locals>.<lambda>i����r" ) �osr' �exists�re�compile�printr� �dirname�
IndexErrorr= �listdir)Zregr r )r� r' r � find_file s,
&r� c C sV t | �}xH|j� D ]<}|jd�r||krx$|| D ]}xt|�D ]}|S W q2W qW d S )N�_exec_t)�get_entrypoints�keysr� r� )�domain� exclude_listZexecutable_files�exer' r r r r �find_all_files- s r� c C s` t � }y@| jd�rD| |krDx(|| d D ]}xt|�D ]}|S W q(W W n tk
rZ Y nX d S )Nr� r� )r� r� r� r� )r� r� r� r' r r r r �find_entrypoint_path7 s r� c C s� yZt |d��F}x>|D ]6}|j� }|r|d jd� r|d |d�| |d < qW W d Q R X W n0 tk
r� } z|jtjkrz� W Y d d }~X nX | S )Nr� r �#r )Zequiv�modify)r� r[ r� �OSError�errno�ENOENT)Zedict�fc_pathr� �fd�er r r r �read_file_equivC s
( r� c C s" t rt S i a tt | d dd�a t S )Nz.subsT)r� )�file_equiv_modifiedr� )r� r r r �get_file_equiv_modifiedP s
r� c C s& t rt S t| �a tt | d dd�a t S )Nz
.subs_distF)r� )�
file_equivr� r� )r� r r r �get_file_equivY s
r� c C s� t rt S g a y&t| d d��}|j� }W d Q R X W n. tk
r` } z|jtjkrR� g S d }~X nX xl|D ]d}|j� }t|�dkr�qhy4t|�dkr�t|d }nd}t j |d |f� W qh t
k
r� Y qhX qhW t S )Nz.localr� r r r r ) � local_filesr� � readlinesr� r� r� r[ rU �trans_file_type_strr| r� )r� r� �fcr� rE �recr� r r r �get_local_file_pathsb s,
r� c C s� t rt S t| d�}|j� }|j� t| d d�}||j� 7 }|j� i a y*t| d d��}||j� 7 }W d Q R X W n0 tk
r� } z|jtjkr�� W Y d d }~X nX x�|D ]�}|j� }yjt|�dkr�t |d }nd}|d jd�d }|t k�r
t | d j
|d � n|d g|d
�t |< W q� Y q�X q�W dd git d < dd
git d< ddgit d< ddgit d< ddgit d< ddgit d< ddgit d< ddgit d< ddgit d < t S ) Nr� z .homedirsz.localr r r �:r� r )r� r� z
all log filesZlogfilezall user tmp filesZ
user_tmp_typezall user home filesZuser_home_typezall virtual image filesZvirt_image_typezBall files on file systems which do not support extended attributesZ noxattrfsz)all sandbox content in tmpfs file systemsZsandbox_tmpfs_typez&all user content in tmpfs file systemsZuser_tmpfs_typezall files on the system� file_typezAuse this label for random content that will be shared using sambaZ
samba_share_tr" ) r� r� r� �closer� r� r� r[ rU r� r| )r� r� r� r� rE r� r� r� r r r r� ~ sJ
r� c s< y � fdd�t tgddi�D �S ttfk
r6 Y nX d S )Nc s g | ]}|d � kr|�qS )rd r )r@ rA )r` r r rF � s z(get_transitions_into.<locals>.<listcomp>r �process)r� rv � TypeErrorrj )r` r )r` r �get_transitions_into� s
r� c C s0 yt tg| dd��S ttfk
r* Y nX d S )Nr� )r r )r� rv r� rj )r` r r r �get_transitions� s
r� c C s8 ydd� t tgd| i�D �S ttfk
r2 Y nX d S )Nc S s g | ]}|d dkr|�qS )r r� r )r@ rA r r r rF � s z(get_file_transitions.<locals>.<listcomp>r )r� rv r� rj )r` r r r �get_file_transitions� s
r� c
C sd g }t tgd| i�}xJ|D ]B}d|kry(x"|d D ]}||kr2|j|� q2W W q Y qX qW |S )Nr re )r� rr r| )r` rl Zboollistr r r r r r �get_boolean_rules� s
r� c C s t d�S )NZ
entry_type)r� r r r r �get_all_entrypoints� s r� c s0 t jttg� dgdgd�}� fdd�|j� D �S )Nr� �
entrypoint)rh r ri rR c s g | ]}|j � krt|j��qS r )r r> r
)r@ rA )r` r r rF � s z(get_entrypoint_types.<locals>.<listcomp>)r4 r} r5 rr rT )r` ra r )r` r �get_entrypoint_types� s
r� c sh t j| �d jd�d � y0tt� fdd�ttgddd����}|d d
S ttt fk
rb Y nX d S ) Nr r� r c s | d � kS )Nr
r )rA )r� r r r� � s z$get_init_transtype.<locals>.<lambda>�init_tr� )r r r rd )
r# Z
getfileconr[ r< r� r� rv r� rj r� )r' � entrypointsr )r� r �get_init_transtype� s $ r� c C sb t jtdgddgd�}g }xB|j� D ]6}y|j| kr@|j|j� W q$ tk
rX w$Y q$X q$W |S )Nrp r� r� )rh r ri )r4 r} r5 rT rk r| r
rj )rd ra r� rE r r r �get_init_entrypoint� s
r� c C s� t jtdgddgd�} i }xd| j� D ]X}y<t|j�}||krR|| jt|j�� nt|j�g||< W q$ tk
rz w$Y q$X q$W |S )Nrp r� r� )rh r ri ) r4 r} r5 rT r> rk r| r
rj )ra r� rE rd r r r �get_init_entrypoints_str� s
r� c C sH y*t dd� ttgd| dd���}t|�d S ttfk
rB Y nX d S )Nc S s | d S )Nrd r )rA r r r r� s z,get_init_entrypoint_target.<locals>.<lambda>r� r� )r r
r r )r= r� rv r< r� r� )r� r� r r r �get_init_entrypoint_target
s r� c C sb t � }i }xRt| �D ]F}y$|| d t|| d f||< W q tk
rX g ||< Y qX qW |S )Nr� r� )r� r� r� r� )r` r� r� r r r r r� s $r� c C s� t t�dkrtS t� tj� } y4t| �}tj� }|j|� t |jj
� �a|j � W n& t j
jd| � t jd� Y nX tj� tS )Nr z#could not open interface info [%s]
r )rU �methods�gen_interfaces�defaults�interface_infor� �
interfacesZ InterfaceSetZ from_filer< r� r� �sys�stderrr� �exitr% )�fnr� Zifsr r r � get_methods s
r� c C s t d krdd� tt�D �a t S )Nc S s g | ] }|d �qS )r: r )r@ rA r r r rF 6 s z!get_all_types.<locals>.<listcomp>)r/ rb rS r r r r �
get_all_types3 s r� c C s t d krttt��a t S )N)�all_types_infor< rb rS r r r r r� 9 s r� c C s& t d kr"ttttd��d d �a t S )NZ
userdomainr rC )�
user_typesr< rb rY r r r r �get_user_types? s r� c C sz t rt S i a tjttgd�} xX| j� D ]L}t|j�}t|j�}|dks&|dkrPq&|t krht | j |� q&|gt |< q&W t S )N)rh Zsystem_r)
r0 r4 r r5 rr rT r> r r
r| )ra r� r� Ztgtr r r �get_all_role_allowsF s
r� c C sz dd l } g }tt� �}x^|D ]V}| jdd |�}t|�dkr t| jdd |d ��dkr |d |kr |j|d � q W |S )Nr z(.*)%sz_exec_t$z_initrc$)r� �sortedr� �findallrU r| )r� r, rC rE �mr r r �get_all_entrypoint_domainsZ s
(r� c C s� yddl m} W n tk
r0 ddlm} Y nX tj� }tj� }y tj|�j tj|�j kr`d S W n t
k
rv Y nX tj � dkr�t t
d���t| d�d � d S )Nr )�getstatusoutputzEYou must regenerate interface info by running /usr/bin/sepolgen-ifgenz/usr/bin/sepolgen-ifgenr )Zcommandsr� � ImportError�
subprocessr� r� �headersr� �stat�st_mtimer� �getuidr r r� )r� Zifiler� r r r r� f s r� c C s� t r t tfS i ai a x�tt�D ]�} | d | d kr@t| d �}n dt| d �t| d �f }| d | d ft kr�t | d | d f j|� n|gt | d | d f< d| kr�| d | d ft| d | d | d f< q | d t| d | d | d f< q W t tfS )NrL rH z%s-%srK rI rJ )�portrecs�
portrecsbynumrb rZ r> r| )rE Zportr r r �
gen_port_dictx s ("r� c C s" t s ttttd��d d �a t S )Nr� r rC )r, r< rb rY r r r r �get_all_domains� s r� c C s( t rt S tjt�} dd� | j� D �a t S )Nc S s g | ]}t |�d krt |��qS )Zobject_r)r> )r@ rA r r r rF � s z!get_all_roles.<locals>.<listcomp>)r1 r4 rX r5 rT )ra r r r �
get_all_roles� s
r� c C s@ t s<ttt��a tjr<x$t D ] } dj| d jd��| d< q W t S )Nr rJ rn )�selinux_user_listr< rb r] r5 r\ rx r[ )rA r r r �get_selinux_users� s
r c C s� t rt S ttj� d�} | j� }| j� g a xd|jd�D ]V}|j� }t|�dks6|j d�rZq6|jd�}t j
|d |d dj |dd � �d�� q6W t S ) Nr� �
r r� r� r r )r: Zseuserr\ ) �login_mappingsr� r# Zselinux_usersconf_path�readr� r[ �striprU r� r| rx )r� �bufr rA r r r �get_login_mappings� s
,r c C s t tdd� t� ��S )Nc S s | d S )Nr: r )rA r r r r� � s z get_all_users.<locals>.<lambda>)r� r= r r r r r �
get_all_users� s r c C s& t rt S ttttd��d d �a t S )Nr� r rC )r2 r< r� rb rY r r r r r� � s r� c C s& t rt S ttttd��d d �a t S )NZ port_typer rC )r3 r< r� rb rY r r r r �get_all_port_types� s r c C s t sttt��a t S )N)r. r< rb r^ r r r r �
get_all_bools� s r c C s dj | d t|� � jd��S )Nrn r )rx rU r[ )r Ztrimr r r � prettyprint� s r
c C s | S )Nr )r r r r �markup� s r c C sV d|| � }| j d�r(|dt| d� S | j d�rD|dt| d� S | j d�r`|dt| d� S | j d�r||d t| d� S | j d
�r�|d t| d � S | j d �r�|d t| d � S | j d
�s�| j d�r�|d S | j d�r�|d S | j d�r�|dt| d� S | j d��r |dt| d� S | j d��r:|dt| d� S | j d��rX|dt| d� S | j d��r~|d| d td� � S | j d��r�|d t| d� S | j d ��r�|d t| d � S | j d ��r�|d t| d � S | j d ��r�|d t| d � S | j d!��r|d"t| d!� S | j d#��r2|d$t| d#� S | j d%��rP|d&t| d%� S | j d'��rn|d(t| d'� S | j d)��r�|d*t| d'� S | j d+��r�|d$t| d+� S | j d,��r�|d-t| d,� S | j d.��r�|d/t| d.� S | j d0��r|d1t| d0� S | j d2��r"|d3t| d2� S | j d4��r@|d1t| d4� S | j d5��r^|d1t| d5� S | j d6��r||d1t| d6� S | j d5��r�|d7t| d5� S | j d8��r�|d9t| d8� S | j d:��r�|d;t| d8� S | j d<��r�|d=t| d<� S | j d>��r|d?t| d>� S | j d@��r&|dA S | j dB��rD|dCt| dB� S |dDt| dE� S )FNz+Set files with the %s type, if you want to Z
_var_run_tz8store the %s files under the /run or /var/run directory.Z_pid_tz,store the %s files under the /run directory.Z
_var_lib_tz0store the %s files under the /var/lib directory.Z_var_tz,store the %s files under the /var directory.Z _var_spool_tz2store the %s files under the /var/spool directory.Z_spool_tZ_cache_tZ _var_cache_tz/store the files under the /var/cache directory.Z _keytab_tz)treat the files as kerberos keytab files.Z_lock_tzEtreat the files as %s lock data, stored under the /var/lock directoryZ_log_tzKtreat the data as %s log data, usually stored under the /var/log directory.Z _config_tzRtreat the files as %s configuration data, usually stored under the /etc directory.Z_conf_tr� z,transition an executable to the %s_t domain.Z_cgi_content_tz"treat the files as %s cgi content.Z
_rw_content_tz)treat the files as %s read/write content.Z_rw_tZ_write_tZ_db_tz'treat the files as %s database content.Z
_ra_content_tz*treat the files as %s read/append content.Z_cert_tz'treat the files as %s certificate data.Z_key_tz treat the files as %s key data.Z _secret_tz"treat the files as %s secret data.Z_ra_tZ_ro_tz(treat the files as %s read/only content.Z
_modules_tz treat the files as %s modules.Z
_content_tz treat the files as %s content.Z_state_tz!treat the files as %s state data.Z_files_tZ_file_tZ_data_tz treat the data as %s content.Z_tmp_tz1store %s temporary files in the /tmp directories.Z_etc_tz'store %s files in the /etc directories.Z_home_tz+store %s files in the users home directory.Z_tmpfs_tz&store %s files on a tmpfs file system.Z _unit_file_tz#treat files as a systemd unit file.Z _htaccess_tz#treat the file as a %s access file.ztreat the files as %s data.r� )r� r
rU )r r Ztxtr r r �get_description� s�
r c C s" t s tttdd� tt����a t S )Nc S s | d S )Nr: r )rA r r r r� B s z$get_all_attributes.<locals>.<lambda>)r- r< r� r= rb rY r r r r �get_all_attributes? s r
c C s" x |D ]}|| t krdS qW dS )NFT)r~ )�dictrR r� r r r �_dict_has_permsF s
r c C sp t � }| jd�r&t| �} | d d� }n| }|d |krBtd| ��|d dkr`|d d � d }n|d }||fS )
Nr� r zdomain %s_t does not existr r r ���r" r" )r� r� r� r )r` r, �
domainname�
short_namer r r r� M s
r� c C s t sttg�a t S )N)�all_allow_rulesr� rr r r r r r� ] s
r� c C s0 t s,tjtddttgd�} dd� | j� D �a t S )Nz.*T)rl Z
boolean_regexrh c S s g | ] }t |��qS r )rm )r@ rA r r r rF h s z&get_all_bool_rules.<locals>.<listcomp>)�all_bool_rulesr4 r} r5 rr ru rT )ra r r r �get_all_bool_rulesc s
r c C s t stttg��a t S )N)�all_transitionsr< r� rv r r r r �get_all_transitionsk s r c
s g }g }t � �\}}x�tdd� t� fdd�t� ��D ]�}x�|D ]�}t|t�sNq>ytj|d �}W n tk
r| |d }Y nX |d j |�s�|d j |�r�|d |f|kr�|d | f|kr�|j
|d |f� q>|d |f|ko�|d | f|kr>|j
|d |f� q>W q4W ||fS )Nc S s | d S )Nre r )rA r r r r� u s zget_bools.<locals>.<lambda>c s d| ko| d � kS )Nre r r )rA )r` r r r� u s r r ) r� r= r� r �
isinstance�tupler# Zsecurity_get_boolean_activer� r� r| )r` r. Z domainboolsr r rE r rc r )r` r � get_boolsq s" $
""r c C s t stj� d a t S )Nr )re r# Zsecurity_get_boolean_namesr r r r �get_all_booleans� s r �#/usr/share/selinux/devel/policy.xmlc C sP y t j| �}|j� }|j� W n, tk
rJ t| �}|j� }|j� Y nX |S )N)�gzipr� r r� �IOError)r' r� r r r r �
policy_xml� s
r c
C s� t rt S dd l}i a �y�|jjjt| ��}�x2|jd�D �]"}x�|jd�D ]�}xX|jd�D ]J}|jd�jd�jj d�}t
j dd|�}|j d �|j d
�|ft |j d �< qZW xX|jd �D ]J}|jd�jd�jj d�}t
j dd|�}|j d �|j d
�|ft |j d �< q�W qJW xT|jd �D ]F}|jd�jd�jj d�}t
j dd|�}d |j d
�|ft |j d �< �qW q8W xT|jd�D ]F}|jd�jd�jj d�}t
j dd|�}d |j d
�|ft |j d �< �qlW W n t
k
�r� Y nX t S )
Nr Zlayer�moduleZtunable�descr r rn r: Zdftvalr? �global)�
booleans_dictZxml.etree.ElementTreeZetreeZ ElementTreeZ
fromstringr r� �find�textr r� �sub�getr )r' ZxmlZtreer r� r r! rE r r r �
gen_bool_dict� s6 $($$r( c C s* t � }| |kr t|| d �S td�S d S )Nr �unknown)r( r )rl r# r r r �boolean_category� s r* c C sJ t � }| |kr t|| d �S | jd�}d|d dj|dd � �f S d S )Nr r zAllow %s to %sr rn r )r( r r[ rx )rl r# r! r r r � boolean_desc� s
r+ c C sF d} y$t d��}|j� j� } W d Q R X W n tk
r@ d} Y nX | S )Nr z/etc/system-releaseZMisc)r� �readline�rstripr )Zsystem_releaser r r r �get_os_version� s
r. c C sP d a d ad ad ad ad ad ad ad ad a d a d a
d a d a d a
d ad ad ad ad S )N)r- r, r/ re r# r. r� r2 r� r� r� r� r3 r0 r1 r� r r� r r r r �reinit� s& r/ )r )r )N)N)r )r )�r� r# r4 r$ Zsepolgen.defaultsr� Zsepolgen.interfacesr� r� r� r� r ZPROGNAME�gettext�kwargs� version_infoZinstall�builtinsr> �__dict__r� Z __builtin__r rS rW rY rZ r] r^ r_ rr rs rt ru ry rz r~ r{ rv rw Z DEFAULT_DIRSr� r r� r5 r� r� r� r� r� r/ r� r� r0 r� r� r, r1 r� r r2 r3 r. r- re r# r r r r r) r+ r7 r8 r6 r r� Zis_selinux_enabledrb rm r� r� r� r� r� r� r� r� r� r� r� Zselinux_file_context_pathr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r� r r r
r r r
r r� r� r r r r r r( r* r+ r. r/ r r r r �<module> sZ
i2
H!
$
.
]