3
Fl�f�� � @ s� d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZ d dlZd dl Z ddl
m Z ddl
m Z ddl
m
Z
ddl
mZ ddl
mZ dd l
mZ dd
l
mZ dd l
mZ dd l
mZ dd
l
mZ ddl
mZ ddl
mZ ddl
mZ ddl
mZ ddl
mZ d dljZd dl j Z dZ y<d dl Z i Z ej!dBk �r:de d< e j"e fddd�e �� W nL yd dl#Z#e$e#j%d< W n( e&k
�r� d dl'Z'e(e'j%d< Y nX Y nX dd � Z)d d � Z*d d � Z+d!d"� Z,d Z-dZ.d#Z/dZ0d$Z1d%Z2d Z3dZ4d#Z5dZ6d&Z7d'Z8d(Z9d)Z:d*Z;d+Z<d,Z=d-Z>d.Z?i Z@eAd/�e@e3< eAd0�e@e4< eAd1�e@e5< eAd2�e@e6< eAd3�e@e7< eAd4�e@e8< eAd5�e@e9< eAd6�e@e:< eAd7�e@e;< eAd8�e@e<< eAd9�e@e=< eAd:�e@e>< eAd;�e@e?< d<d=� ZBe3e4e5e8e6gZCe;e:e<e=e>gZDd>d?� ZEG d@dA� dA�ZFdS )C� N)�
get_all_types�get_all_attributes�
get_all_roles� )�
executable)�boolean)�etc_rw)� unit_file)� var_cache)� var_spool)�var_lib)�var_log)�var_run)�tmp)�rw)�network)�script)�spec)�userzselinux-python� T�unicodez/usr/share/localezutf-8)Z localedirZcodeset�_c C sF | d }| d }| d }|d |j d�d }|j d�d }|||gS )z6Given an RPM header return the package NVR as a string�name�version�release�-�.r r )�split)Zhdrr r r Zrelease_versionZ
os_version� r � /usr/lib/python3.6/generate.py�get_rpm_nvr_from_headerG s r c C s` y>dd l }d }|j� }|j|j| �}x|D ]}t|�}P q*W W n td| � d }Y nX |S )Nr z"Failed to retrieve rpm info for %s)�rpm�tsZdbMatchZ RPMTAG_NAMEr �print)�packager! Znvrr" Zmi�hr r r �get_rpm_nvr_listR s
r& c C s� i } xzt jt j�D ]j}|d dks|d dks|d dks|d dks|d dkrTq|d |jd�f| |d |d |d
f< qW | S ) N�typeZreserved_port_tZport_tZhi_reserved_port_tZephemeral_port_tZunreserved_port_t�rangeZlowZhigh�protocol)�sepolicy�infoZPORT�get)�dict�pr r r �
get_all_portsb s ,r/ c C s6 dd� t jt j�D �} | jd� | jd� | j� | S )Nc S s g | ] }|d �qS )r r )�.0�xr r r �
<listcomp>p s z!get_all_users.<locals>.<listcomp>Zsystem_u�root)r* r+ �USER�remove�sort)�usersr r r �
get_all_userso s
r8 � z_admin$z_role$� � � � � � �
� � zStandard Init DaemonzDBUS System DaemonzInternet Services Daemonz Web Application/Script (CGI)ZSandboxzUser ApplicationzExisting Domain Typez Minimal Terminal Login User Rolez!Minimal X Windows Login User RolezDesktop Login User Rolez Administrator Login User Rolez Confined Root Administrator Rolez!Module information for a new typec C s> t j� } | j� td�}x | D ]}|d|t | f 7 }q W |S )Nz
Valid Types:
z%2s: %s
)�poltype�keysr6 r )rD �msg�kr r r �get_poltype_desc� s
rG c C s� | dkr g S d }y�g }x�| j d�D ]�}|j d�}t|�dkr@t�t|�dkrft|d �}t|d �}n$t|d �}t|d �}||kr�t�x4t||d �D ]"}|dk s�||kr�t�|j|� q�W q"W |S tk
r� ttd�| ��Y nX d S )
N� r9 � �,r r r z8Ports must be numbers or ranges of numbers from 1 to %d i )r �len�
ValueError�intr( �appendr )�portsZmax_port�temp�a�r�begin�endr. r r r � verify_ports� s.
rU c @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd � Zd�d d �Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&dJdK� Z'dLdM� Z(dNdO� Z)dPdQ� Z*dRdS� Z+dTdU� Z,dVdW� Z-dXdY� Z.dZd[� Z/d\d]� Z0d^d_� Z1d`da� Z2dbdc� Z3ddde� Z4dfdg� Z5dhdi� Z6djdk� Z7dldm� Z8dndo� Z9dpdq� Z:drds� Z;dtdu� Z<dvdw� Z=dxdy� Z>dzd{� Z?d|d}� Z@d~d� ZAd�d�� ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�� ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�� ZOd�d�� ZPd�d�� ZQd�d�� ZRd�d�� ZSd�d�� ZTd�d�� ZUd�d�� ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�� ZZd�d�� Z[d�d�� Z\d�d�� Z]d�d�� Z^d�d�� Z_d�d�� Z`d�d�� Zad�d�� Zbd�dÄ Zcd�dń Zdd�dDŽ Zed�dɄ Zfd�d˄ Zgd�d̈́ Zhd�dτ Zid�dф Zjd�dӄ Zkd�dՄ Zld�dׄ Zmd�dل Znd�dۄ Zod�d݄ Zpd�d߄ Zqd�d� Zrd�d� Zsetju� fd�d�Zvd�S )��policyc C s g | _ i | _t� | _g | _|tkr.ttd���|sFttd�t| ��y t� | _W nT tk
r| } zt d� W Y d d }~X n, t
k
r� } zt d|� W Y d d }~X nX i | _ d| j d< d| j d< d| j d< d | j d
< d | j d < d | j d < d| j d
< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d < d | j d < d | j d < d!| j d"< d#| j d$< d%| j d&< d'| j d(< d)| j d*< d+| j d,< d-| j d.< d/| j d0< d1| j d2< d3| j d4< d5| j d6< d7| j d8< d9| j d:< d;| j d<< d=| j d>< d?| j d@< dA| j dB< dC| j dD< dE| j dF< dG| j dH< dI| j dJ< dK| j dL< dM| j dN< dO| j dP< dQ| j dR< dS| j dT< dU| j dV< dW| j dX< dY| j dZ< d[| j d\< d]| j d^< d_| j d`< da| j db< da| j dc< da| j dd< da| j de< df| j dg< df| j dh< df| j di< df| j dj< df| j dg< dk| j dl< dm| j dn< do| j dp< dq| j dr< ds| j dt< du| j dv< dw| j dx< dy| j dz< d{| j d|< d}| j d~< d| j d�< d| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< i | _ d�g t
g| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< i | _t| jd�< t| jd�< t| jd�< t| jd�< t| jd�< t| jd�< t| jd�< t| jd�< d�d�d�d�d�d�d�d�d�d�d�g | _| j| jf| j| j f| j | j f| j | j f| j!| j"f| j#| j$f| j%| j&f| j'| j(f| j)| j*f| j+| j(f| j,| j(f| j-| j.f| j/| j0ff
| _1t2j3d�|��s�ttd����|t4k�r�d�| | _5n|| _5|| _6g | _7g | _8|| _9d�| _:d | _;d�d�d�g g| _<d�d�d�g g| _=d�d�d�g g| _>d�d�d�g g| _?d�| _@d�| _Ad�| _Bd�| _Cd�| _Dd�| _Ed�| _Fd�| _Gd�| _H| j9tItJgk| _K| j9tItJgk| _L| j9tItJgk| _Md�| _Nd�| _Oi | _Pi | _Qi | _Rg | _Sg | _Td�| _Ud�| _Vg | _Wg | _Xg | _Yg | _Zg | _[d S )�Nz"You must enter a valid policy typez;You must enter a name for your policy module for your '%s'.z9Can not get port types, must be root for this informationzCan not get port typeszset_use_kerberos(True)Zopenlogzset_use_kerb_rcache(True)zset_use_syslog(True)zset_use_resolve(True)Z gethostbyZ getaddrinfoZ getnameinfoZkrbz set_manage_krb5_rcache(True)Zgss_accept_sec_contextZkrb5_verify_init_credsZ krb5_rd_reqZ __syslog_chkzset_use_uid(True)�getpwnam�getpwuidzset_use_dbus(True)Zdbus_zset_use_pam(True)Zpam_zset_use_audit(True)zadd_process('fork')�forkzadd_process('transition')Z
transitionzadd_process('sigchld')Zsigchldzadd_process('sigkill')Zsigkillzadd_process('sigstop')Zsigstopzadd_process('signull')Zsignullzadd_process('ptrace')Zptracezadd_process('getsched')Zgetschedzadd_process('setsched')Zsetschedzadd_process('getsession')Z
getsessionzadd_process('getpgid')�getpgidzadd_process('setpgid')�setpgidzadd_process('getcap')Zgetcapzadd_process('setcap')Zsetcapzadd_process('share')Zsharezadd_process('getattr')�getattrzadd_process('setexec')Zsetexeczadd_process('setfscreate')Z setfscreatezadd_process('noatsecure')Z
noatsecurezadd_process('siginh')Zsiginhzadd_process('signal_perms')�killzadd_process('setrlimit')Z setrlimitzadd_process('rlimitinh')Z rlimitinhz add_process('dyntransition')Z
dyntransitionzadd_process('setcurrent')Z
setcurrentzadd_process('execmem')Zexecmemzadd_process('execstack')Z execstackzadd_process('execheap')Zexecheapzadd_process('setkeycreate')Z setkeycreatez add_process('setsockcreate')Z
setsockcreatezadd_capability('chown')�chownz add_capability('dac_override')Z dac_overridez!add_capability('dac_read_search')Zdac_read_searchzadd_capability('fowner')Zfownerzadd_capability('fsetid')Zfsetidzadd_capability('setgid')�setgid�setegid� setresgid�setregidzadd_capability('setuid')� setresuid�setuid�seteuid�setreuidzadd_capability('setpcap')Zsetpcapz!add_capability('linux_immutable')Zlinux_immutablez"add_capability('net_bind_service')Znet_bind_servicez add_capability('net_broadcast')Z
net_broadcastzadd_capability('net_admin')Z net_adminzadd_capability('net_raw')Znet_rawzadd_capability('ipc_lock')Zipc_lockzadd_capability('ipc_owner')Z ipc_ownerz add_capability('sys_module')�
sys_modulezadd_capability('sys_rawio')Z sys_rawioz add_capability('sys_chroot')�chrootZ
sys_chrootz add_capability('sys_ptrace')Z
sys_ptracezadd_capability('sys_pacct')Z sys_pacctzadd_capability('sys_admin')ZmountZunshareZ sys_adminzadd_capability('sys_boot')Zsys_bootzadd_capability('sys_nice')Zsys_nicez add_capability('sys_resource')Z sys_resourcezadd_capability('sys_time')Zsys_timez add_capability('sys_tty_config')Zsys_tty_configzadd_capability('mknod')�mknodzadd_capability('lease')Zleasez add_capability('audit_write')Z audit_writez add_capability('audit_control')Z
audit_controlzadd_capability('setfcap')Zsetfcapr z/etcr z/tmpr r z/usr/lib/systemd/systemz/lib/systemd/systemz/etc/systemd/systemr
z
/var/cacher z/var/libr
z/var/logr z/var/runr z
/var/spoolZ_tmp_tZ _unit_file_tZ _var_cache_tZ
_var_lib_tZ
_var_log_tZ
_var_run_tZ _var_spool_tZ_port_tz^[a-zA-Z0-9-_]+$zQName must be alpha numberic with no spaces. Consider using option "-n MODULENAME"zhttpd_%s_scriptrH F)\�rpmsrO r � all_roles�typesrC rL r r/ r# � RuntimeError�symbols� DEFAULT_DIRSr r r r r
r r
r r � DEFAULT_EXTr � DEFAULT_KEYS�generate_daemon_types�generate_daemon_rules�generate_dbusd_types�generate_dbusd_rules�generate_inetd_types�generate_inetd_rules�generate_cgi_types�generate_cgi_rules�generate_sandbox_types�generate_sandbox_rules�generate_userapp_types�generate_userapp_rules� generate_existing_user_types� generate_existing_user_rules� generate_min_login_user_types�generate_login_user_rules�generate_x_login_user_types�generate_x_login_user_rules�generate_login_user_types�generate_admin_user_types�generate_root_user_types�generate_root_user_rules�generate_new_types�generate_new_rules�
DEFAULT_TYPES�re�match�CGIr � file_name� capabilities� processesr' �
initscript�program�in_tcp�in_udp�out_tcp�out_udp� use_resolve�use_tmp�use_uid�
use_syslog� use_kerberos�manage_krb5_rcache�use_pam�use_dbus� use_audit�EUSER�NEWTYPE�use_etc�use_localization�use_fd� use_terminal�use_mail�booleans�files�dirs�found_tcp_ports�found_udp_ports�
need_tcp_type�
need_udp_type�
admin_domains�existing_domains�transition_domains�transition_users�roles)�selfr r' �er r r �__init__� sd
zpolicy.__init__c C s( |t p&|t p&|t p&t|t �dkS )Nr )�ALL�RESERVED�
UNRESERVEDrK �PORTS)r� �lr r r Z
__isnetset� s zpolicy.__isnetsetc C s
|| _ d S )N)r� )r� r� r r r �set_admin_domains� s zpolicy.set_admin_domainsc C s
|| _ d S )N)r� )r� r� r r r �set_existing_domains� s zpolicy.set_existing_domainsc C s
|| _ d S )N)r� )r� r� r r r �set_admin_roles� s zpolicy.set_admin_rolesc C s
|| _ d S )N)r� )r� r� r r r �set_transition_domains� s z policy.set_transition_domainsc C s
|| _ d S )N)r� )r� r� r r r �set_transition_users� s zpolicy.set_transition_usersc C s | j | j�S )N)�_policy__isnetsetr� )r� r r r �
use_in_udp� s zpolicy.use_in_udpc C s | j | j�S )N)r� r� )r� r r r � use_out_udp� s zpolicy.use_out_udpc C s | j � p| j� S )N)r� r� )r� r r r �use_udp� s zpolicy.use_udpc C s | j | j�S )N)r� r� )r� r r r �
use_in_tcp� s zpolicy.use_in_tcpc C s | j | j�S )N)r� r� )r� r r r � use_out_tcp� s zpolicy.use_out_tcpc C s | j � p| j� S )N)r� r� )r� r r r �use_tcp� s zpolicy.use_tcpc C s | j � p| j� S )N)r� r� )r� r r r � use_network� s zpolicy.use_network�tcpc C sF x@| j j� D ]2\}}}||kr ||kr ||kr | j |||f S q W d S )N)rO rD )r� Zportr) rS rT r. r r r � find_port� s zpolicy.find_portc C s | j tkrttd���|| _d S )Nz0User Role types can not be assigned executables.)r' � APPLICATIONSrL r r� )r� r� r r r � set_program� s
zpolicy.set_programc C s | j tkrttd���|| _d S )Nz)Only Daemon apps can use an init script..)r' �DAEMONrL r r� )r� r� r r r �set_init_script� s
zpolicy.set_init_scriptc C s |||t |�g| _d S )N)rU r� )r� �all�reserved�
unreservedrO r r r �
set_in_tcp� s zpolicy.set_in_tcpc C s |||t |�g| _d S )N)rU r� )r� r� r� r� rO r r r �
set_in_udp� s zpolicy.set_in_udpc C s |ddt |�g| _d S )NF)rU r� )r� r� rO r r r � set_out_tcp� s zpolicy.set_out_tcpc C s |ddt |�g| _d S )NF)rU r� )r� r� rO r r r � set_out_udp� s zpolicy.set_out_udpc C s" t |�tk rttd���|| _d S )Nz$use_resolve must be a boolean value )r' �boolrL r r� )r� �valr r r �set_use_resolve� s zpolicy.set_use_resolvec C s" t |�tk rttd���|| _d S )Nz#use_syslog must be a boolean value )r' r� rL r r� )r� r� r r r �set_use_syslog� s zpolicy.set_use_syslogc C s" t |�tk rttd���|| _d S )Nz%use_kerberos must be a boolean value )r' r� rL r r� )r� r� r r r �set_use_kerberos� s zpolicy.set_use_kerberosc C s" t |�tk rttd���|| _d S )Nz+manage_krb5_rcache must be a boolean value )r' r� rL r r� )r� r� r r r �set_manage_krb5_rcache� s z policy.set_manage_krb5_rcachec C s |dk| _ d S )NT)r� )r� r� r r r � set_use_pam� s zpolicy.set_use_pamc C s |dk| _ d S )NT)r� )r� r� r r r � set_use_dbus� s zpolicy.set_use_dbusc C s |dk| _ d S )NT)r� )r� r� r r r �
set_use_audit� s zpolicy.set_use_auditc C s |dk| _ d S )NT)r� )r� r� r r r � set_use_etc� s zpolicy.set_use_etcc C s |dk| _ d S )NT)r� )r� r� r r r �set_use_localization� s zpolicy.set_use_localizationc C s |dk| _ d S )NT)r� )r� r� r r r �
set_use_fd� s zpolicy.set_use_fdc C s |dk| _ d S )NT)r� )r� r� r r r �set_use_terminal� s zpolicy.set_use_terminalc C s |dk| _ d S )NT)r� )r� r� r r r � set_use_mail� s zpolicy.set_use_mailc C sB | j tkrttd���|r0| jd d jd� ng | jd d< d S )Nz'USER Types automatically get a tmp typez/tmpr )r' �USERSrL r ro rN )r� r� r r r � set_use_tmp� s
zpolicy.set_use_tmpc C s |dk| _ d S )NT)r� )r� r� r r r � set_use_uid s zpolicy.set_use_uidc C s | j rtjd| jtj�S dS d S )N� TEMPLATETYPErH )r� r� �subr r Z te_uid_rules)r� r r r �generate_uid_rules s zpolicy.generate_uid_rulesc C s | j rtjd| jtj�S dS d S )Nr� rH )r� r� r� r r Zte_syslog_rules)r� r r r �generate_syslog_rules s z policy.generate_syslog_rulesc C s | j rtjd| jtj�S dS d S )Nr� rH )r� r� r� r r Zte_resolve_rules)r� r r r �generate_resolve_rules s z policy.generate_resolve_rulesc C s | j rtjd| jtj�S dS d S )Nr� rH )r� r� r� r r Zte_kerberos_rules)r� r r r �generate_kerberos_rules s z policy.generate_kerberos_rulesc C s | j rtjd| jtj�S dS d S )Nr� rH )r� r� r� r r Zte_manage_krb5_rcache_rules)r� r r r �!generate_manage_krb5_rcache_rules s z(policy.generate_manage_krb5_rcache_rulesc C s d}| j r tjd| jtj�}|S )NrH r� )r� r� r� r r Z te_pam_rules)r� �newter r r �generate_pam_rules& s zpolicy.generate_pam_rulesc C s d}| j r tjd| jtj�}|S )NrH r� )r� r� r� r r Zte_audit_rules)r� r� r r r �generate_audit_rules, s zpolicy.generate_audit_rulesc C s d}| j r tjd| jtj�}|S )NrH r� )r� r� r� r r Z te_etc_rules)r� r� r r r �generate_etc_rules2 s zpolicy.generate_etc_rulesc C s d}| j r tjd| jtj�}|S )NrH r� )r� r� r� r r Z te_fd_rules)r� r� r r r �generate_fd_rules8 s zpolicy.generate_fd_rulesc C s d}| j r tjd| jtj�}|S )NrH r� )r� r� r� r r Zte_localization_rules)r� r� r r r �generate_localization_rules> s z"policy.generate_localization_rulesc C s* d}| j tkr&| jr&tjd| jtj�}|S )NrH r� )r' �DBUSr� r� r� r r Z
te_dbus_rules)r� r� r r r �generate_dbus_rulesD s zpolicy.generate_dbus_rulesc C s d}| j r tjd| jtj�}|S )NrH r� )r� r� r� r r Z
te_mail_rules)r� r� r r r �generate_mail_rulesJ s zpolicy.generate_mail_rulesc C sF d}d|||f }|t j� kr.d|| jf }nd|| j|||f }|S )NrH zcorenet_%s_%s_%sz %s(%s_t)
zD
gen_require(`
type %s_t;
')
allow %s_t %s_t:%s_socket name_%s;
)r* Z get_methodsr )r� r) �action� port_name�line�methodr r r �generate_network_actionP s z policy.generate_network_actionc C sh xf| j t D ]X}| jt|�d�}|d kr0d| _q |d d d
� }| jdd|�}|| jkr | jj|� q W xf| jt D ]X}| jt|�d�}|d kr�d| _qt|d d d � }| jdd|�}|| jkrt| jj|� qtW xh| j t D ]Z}| jt|�d�}|d k�rd| _
q�|d d d � }| jdd|�}|| j kr�| j j|� q�W | j
dk�sR| jdk�rdt j
d| jtj�S d S )
Nr� Tr r9 ZbindZconnect�udpr� rH ���r� r� )r� r� r� rM r� r� r� rN r� r� r� r� r� r� r r �te_types)r� �iZrecr� r� r r r �generate_network_types^ s6
z policy.generate_network_typesc C sZ x:| j D ]0}|j|�dkr| j | d j|� | j | S qW | j d d j|� | j d S )Nr r r )ro �findrN )r� �file�dr r r Z __find_path� s zpolicy.__find_pathc C s || j kr| j j|� d S )N)r� rN )r� Z
capabilityr r r �add_capability� s
zpolicy.add_capabilityc C s
|| _ d S )N)rl )r� rl r r r � set_types� s zpolicy.set_typesc C s || j kr| j j|� d S )N)r� rN )r� Zprocessr r r � add_process� s
zpolicy.add_processc C s || j |< d S )N)r� )r� r � descriptionr r r � add_boolean� s zpolicy.add_booleanc C s | j |�| j|< d S )N)�_policy__find_pathr� )r� r r r r �add_file� s zpolicy.add_filec C s | j |�| j|< d S )N)r r� )r� r r r r �add_dir� s zpolicy.add_dirc C s6 d}| j j� t| j �dkr2d| jdj| j �f }|S )NrH r z#allow %s_t self:capability { %s };
� )r� r6 rK r �join)r� r� r r r �generate_capabilities� s
z policy.generate_capabilitiesc C s6 d}| j j� t| j �dkr2d| jdj| j �f }|S )NrH r z allow %s_t self:process { %s };
r )r� r6 rK r r )r� r� r r r �generate_process� s
zpolicy.generate_processc C s� d}| j � �r�d}|tjd| jtj�7 }| j� �r�|d7 }|tjd| jtj�7 }| j� r�|tjd| jtj �7 }| j
r�t | j t
�dkr�|tjd| jtj�7 }| j
r�t | jt
�dkr�|tjd| jtj�7 }| j t r�|tjd| jtj�7 }| j t �r |tjd| jtj�7 }| j t �r.|tjd| jtj�7 }| jt �rP|tjd| jtj�7 }| jt �rr|tjd| jtj�7 }| jt �r�|tjd| jtj�7 }x| jD ]}||7 }�q�W | j� �r�|d7 }|tjd| jtj �7 }| j �r�|tjd| jtj �7 }| j � �r|tjd| jtj �7 }| j!t �r6|tjd| jtj"�7 }| j!t �rX|tjd| jtj#�7 }| j!t �rz|tjd| jtj$�7 }x| j%D ]}||7 }�q�W |S )NrH �
r� r )&r� r� r� r r Z
te_networkr� Zte_tcpr� Z te_in_tcpr� rK r� r� Zte_in_need_port_tcpr� Zte_out_need_port_tcpr� Zte_in_all_ports_tcpr� Zte_in_reserved_ports_tcpr� Zte_in_unreserved_ports_tcpZte_out_all_ports_tcpZte_out_reserved_ports_tcpZte_out_unreserved_ports_tcpr� r� Zte_udpr� Zte_in_need_port_udpr� Z te_in_udpr� Zte_in_all_ports_udpZte_in_reserved_ports_udpZte_in_unreserved_ports_udpr� )r� r� r� r r r �generate_network_rules� sV
z policy.generate_network_rulesc C s� d}x2| j D ](}tjd| jtj�}|tjd||�7 }q W | jtkr�x<| jD ]2}tjd| jt j
�}|tjd|j d�d |�7 }qJW |S )NrH r� � APPLICATIONr4 �_ur ) r� r� r� r r Zte_transition_rulesr' r4 r� r Z te_run_rulesr )r� r� �appr �urP r r r �generate_transition_rules� s
z policy.generate_transition_rulesc C s, d}| j tkr�xn| jD ]d}|jd�d }|d }xH| jD ]>}tjd|tj�}|| j krdtj|d|�}|tjd||�7 }q8W qW |S | j t
k�r(|tjd| j tj �7 }x2| jD ](}tjd| j tj�}|tjd||�7 }q�W xN| j
D ]D}|jd�d }|d | j kr�tjd| j tj�}|tjd ||�7 }q�W |S )
NrH �_tr �_rr� Zsystem_rr r r4 )r' r� r� r r� r� r� r Zte_admin_domain_rulesrk �RUSERr Zte_admin_rulesr� Zte_admin_trans_rules)r� r� r r �roler r r r r r �generate_admin_rules� s,
zpolicy.generate_admin_rulesc C s d}| j r tjd| jtj�}|S )NrH r� )r� r� r� r r Z
if_dbus_rules)r� �newifr r r �generate_dbus_if s zpolicy.generate_dbus_ifc C s( d}| j tkr|S tjd| jtj�}|S )NrH r� )r' �SANDBOXr� r� r r Zif_sandbox_rules)r� r r r r �generate_sandbox_if s
zpolicy.generate_sandbox_ifc C s d}d}| j dkr>|tjd| jtj�7 }|tjd| jtj�7 }xd| jD ]Z}t| j | d �dkrF|tjd| j| j | d j
�7 }|tjd| j| j | d j �7 }qFW |dkr�tjd| jtj �}||7 }|tjd| jtj
�7 }||7 }|tjd| jtj�7 }|S dS )NrH r� r r r9 )r� r� r� r r Zif_initscript_admin_typesZif_initscript_adminrq rK ro Zif_admin_typesZif_admin_rulesZif_begin_adminZif_middle_adminZ if_end_admin)r� r Znewtypesr �retr r r �generate_admin_if s"
$zpolicy.generate_admin_ifc C s t jd| jtj�S )Nr� )r� r� r� r � te_cgi_types)r� r r r rx 5 s zpolicy.generate_cgi_typesc C s t jd| jtj�S )Nr� )r� r� r� r �te_sandbox_types)r� r r r rz 8 s z policy.generate_sandbox_typesc C s t jd| jtj�S )Nr� )r� r� r r Zte_userapp_types)r� r r r r| ; s z policy.generate_userapp_typesc C s t jd| jtj�S )Nr� )r� r� r r Zte_inetd_types)r� r r r rv > s zpolicy.generate_inetd_typesc C s t jd| jtj�S )Nr� )r� r� r r Zte_dbusd_types)r� r r r rt A s zpolicy.generate_dbusd_typesc C s t jd| jtj�S )Nr� )r� r� r r Zte_min_login_user_types)r� r r r r� D s z$policy.generate_min_login_user_typesc C s t jd| jtj�S )Nr� )r� r� r r Zte_login_user_types)r� r r r r� G s z policy.generate_login_user_typesc C s t jd| jtj�S )Nr� )r� r� r r Zte_admin_user_types)r� r r r r� J s z policy.generate_admin_user_typesc C s� t | j�dkr$ttd�t| j ��tjd| jt j
�}|d7 }xB| jD ]8}|d| 7 }|j d�d d }|| j krF|d| 7 }qFW |d 7 }|S )
Nr z,'%s' policy modules require existing domainsr� z
gen_require(`z
type %s;r r z
role %s;z
')
)
rK r� rL r rC r' r� r� r r Zte_existing_user_typesr rk )r� r� r r r r r r~ M s
z#policy.generate_existing_user_typesc C s t jd| jtj�S )Nr� )r� r� r r Zte_x_login_user_types)r� r r r r� _ s z"policy.generate_x_login_user_typesc C s t jd| jtj�S )Nr� )r� r� r r Zte_root_user_types)r� r r r r� b s z policy.generate_root_user_typesc C s� d}t | j�dkr ttd���xj| jD ]`}xZ| jD ]P}|j|�r2t||d t |� � � |tjd|d t |� � | j| j �7 }P q2W q&W t
r�|dkr�g }x| jD ]}|j |� q�W ttd�dj |� ��|S )NrH r zType field requiredr� z3You need to define a new type which ends with:
%sz
)
rK rl rL r rp �endswithr# r� r� r� r� rN r )r� r� �tr� Z default_extr r r r� e s
(
zpolicy.generate_new_typesc C s dS )NrH r )r� r r r r� y s zpolicy.generate_new_rulesc C s6 t jd| jtj�}| jdkr2|t jd| jtj�7 }|S )Nr� rH )r� r� r r Zte_daemon_typesr� Zte_initscript_types)r� r� r r r rr | s
z policy.generate_daemon_typesc C s | j rtjd| jtj�S dS d S )Nr� rH )r� r� r� r r r� )r� r r r �generate_tmp_types� s zpolicy.generate_tmp_typesc C s@ d}x6| j D ],}tjd|tj�}|tjd| j | |�7 }q W |S )NrH �BOOLEANZ DESCRIPTION)r� r� r� r Z
te_boolean)r� r� �br r r r �generate_booleans� s
zpolicy.generate_booleansc C s, d}x"| j D ]}|tjd|tj�7 }q W |S )NrH r& )r� r� r� r �te_rules)r� r� r' r r r �generate_boolean_rules� s z policy.generate_boolean_rulesc C s t jd| jtj�S )Nr� )r� r� r r r" )r� r r r �generate_sandbox_te� s zpolicy.generate_sandbox_tec C s t jd| jtj�S )Nr� )r� r� r r r! )r� r r r �generate_cgi_te� s zpolicy.generate_cgi_tec C s t jd| jtj�}|S )Nr� )r� r� r r Zte_daemon_rules)r� r r r r rs � s z policy.generate_daemon_rulesc C sr d}xh| j D ]^}xX| jD ]N}|j|�r|d t|� � d }|tjd|d t|� � | j| j�7 }P qW q W |S )NrH r r� )rl rp r# rK r� r� �if_rules)r� r r$ r� Zreqtyper r r �generate_new_type_if� s
(
zpolicy.generate_new_type_ifc C s t jd| jtj�S )Nr� )r� r� r r Zte_login_user_rules)r� r r r r� � s z policy.generate_login_user_rulesc C s t jd| jtj�}|S )Nr� )r� r� r r Zte_existing_user_rules)r� Znerulesr r r r � s z#policy.generate_existing_user_rulesc C s t jd| jtj�S )Nr� )r� r� r r Zte_x_login_user_rules)r� r r r r� � s z"policy.generate_x_login_user_rulesc C s t jd| jtj�}|S )Nr� )r� r� r r Zte_root_user_rules)r� r� r r r r� � s z policy.generate_root_user_rulesc C s t jd| jtj�S )Nr� )r� r� r r Zte_userapp_rules)r� r r r r} � s z policy.generate_userapp_rulesc C s t jd| jtj�S )Nr� )r� r� r r Zte_inetd_rules)r� r r r rw � s zpolicy.generate_inetd_rulesc C s t jd| jtj�S )Nr� )r� r� r r Zte_dbusd_rules)r� r r r ru � s zpolicy.generate_dbusd_rulesc C s | j rtjd| jtj�S dS d S )Nr� rH )r� r� r� r r r) )r� r r r �generate_tmp_rules� s zpolicy.generate_tmp_rulesc C s d}|t jd| jtj�7 }|S )NrH r� )r� r� r r Z te_cgi_rules)r� r� r r r ry � s zpolicy.generate_cgi_rulesc C s d}|t jd| jtj�7 }|S )NrH r� )r� r� r r Zte_sandbox_rules)r� r� r r r r{ � s z policy.generate_sandbox_rulesc C sR d}| j s| jtkr&tjd| jtj�}| jtt t
t fkrN|tjd| jtj �7 }|S )NrH r� )
r� r' r4 r� r� r r Zif_user_program_rules�TUSER�XUSER�AUSER�LUSERZif_role_change_rules)r� r r r r �generate_user_if� s zpolicy.generate_user_ifc C sD d}|t jd| jtj�7 }| jr6|t jd| jtj�7 }| jdkrV|t jd| jtj�7 }x�| j D ]�}t
| j | d �dkr^|t jd| j| j | d j �7 }xZ| j | d D ]H}t
jj|�r�tjt
j|�tj �r�|t jd| j| j | d j�7 }P q�W q^W || j� 7 }|| j� 7 }|| j� 7 }|| j� 7 }|| j� 7 }|| j� 7 }|S )NrH r� r r r9 )r� r� r r Zif_heading_rulesr� Zif_program_rulesr� Zif_initscript_rulesrq rK ro r- �os�path�exists�stat�S_ISSOCK�ST_MODEZif_stream_rulesr4 r r r r. r� )r� r r r� r r r � generate_if� s(
"
zpolicy.generate_ifc C s | j | j d � S )Nr )r� r' )r� r r r �generate_default_types� s z policy.generate_default_typesc C s& | j | j d r"| j | j d � S dS )Nr rH )r� r' )r� r r r �generate_default_rules� s z policy.generate_default_rulesc C s� d}| j ttttfkr�d}t| j�dkr�|tjd| j t
j �7 }|tjd| j t
j �7 }x2| jD ](}tjd| j t
j
�}|tjd||�7 }q\W |S )NrH r r� ZROLE)r' r0 r1 r2 r3 rK r� r� r� r r Z
te_sudo_rulesZte_newrole_rulesZte_roles_rules)r� r� r� r r r r r �generate_roles_rules� s zpolicy.generate_roles_rulesc C s� | j � }xV| jD ]L}t| j| d �dkr| jtks<|dkr|tjd| j| j| d j �7 }qW | jt
krx|d| j 7 }|| j � 7 }|| j � 7 }|| j
� 7 }|| j� 7 }|| j� 7 }|| j� 7 }|| j� 7 }�xT| jD �]H}t| j| d �dkr�| jt
k�rXd}xt| jD ]H}|tjd|d d � d | j| d j�7 }|tjd
| jd |�7 }�q
W n |tjd| j| j| d j�7 }x�| j| d D ]�}tjj|��r�tjtj|�tj ��r�| jt
k�r�xX| jD ],}|tjd|d d
� | j| d j�7 }�q�W n |tjd| j| j| d j�7 }P �q�W q�W || j� 7 }|| j � 7 }|| j � 7 }|| j � 7 }|| j � 7 }|| j � 7 }|| j!� 7 }|| j"� 7 }|| j#� 7 }|| j$� 7 }|| j%� 7 }|| j&� 7 }|| j'� 7 }|| j(� 7 }|| j)� 7 }|| j*� 7 }|| j+� 7 }|S )Nr r r r� r9 z@
########################################
#
# %s local policy
#
rH ZTEMPLATETYPE_tr ZTEMPLATETYPE_rw_tZ_rw_tr� r� ),r< rq rK ro r' r� r� r� r r� r� r
r r� r% r( r= r* r� r) r5 r6 r7 r8 r9 r: Zte_stream_rulesr/ r r� r� r� r� r� r� r� r� r> r� r r r� r� r� )r� r� r Z newte_tmpZdomainr� r r r � generate_te s` $
* & . zpolicy.generate_tec C s� d}g }x�| j j� D ]�}tjj|�rXtjtj|�tj �rXtj d| j
| j | d j �}n tj d| j
| j | d j �}tj d||�}|j
tj d| j | d |�� qW xZ| jj� D ]L}tj d| j
| j| d j�}tj d||�}|j
tj d| j| d |�� q�W | jttg k�r&t|�dk�r&tjS | jttttg k�rR| j �rRttd���| j�r�tj d| jtj�}|j
tj d| j
|�� | j dk�r�tj d| j tj �}|j
tj d| j
|�� |j � d j |�}|S )
NrH r� r9 �FILENAMEZFILETYPEr z<You must enter the executable path for your confined processZ
EXECUTABLEr ) r� rD r5 r6 r7 r8 r9 r: r� r� r Z fc_sock_fileZfc_filerN r� Zfc_dirr' r� r rK r Zfc_userr� r� r� rL r Z
fc_programr� Z
fc_initscriptr6 r )r� ZnewfcZfclistr� �t1Zt2r r r � generate_fcD s4 " " "
zpolicy.generate_fcc C s� d}| j tttttfkr |S d}x| jD ]}|d| 7 }q(W |dkrL|d7 }tjd| j t
j �}|tjd||�7 }| j tks�| j tkr�x2| j D ](}tjd| j t
j
�}|tjd||�7 }q�W | j tkr�|tjd| j t
j�7 }n|tjd| j t
j�7 }|S )NrH z %s_rz system_rr� ZROLESr4 )r' r0 r1 r2 r3 r r� r� r� r r r7 r� Z admin_transZ min_login_user_default_contextZ x_login_user_default_context)r� �newshr� r r r r r r �generate_user_shg s$
zpolicy.generate_user_shc C s� t jd| jtj�}t jd| j|�}| jtkrBt jdd| j |�}n&t jd| j|�}|t jd| jtj�7 }| j r�|t jd| j tj
�7 }| j dkr�|t jd| j tj
�7 }x&| j j
� D ]}|t jd|tj
�7 }q�W x&| jj
� D ]}|t jd|tj
�7 }q�W xX| jt | jt D ]@}| j|d�d k�r
t jdd | tj�}|t jd| j|�7 }�q
W xN| jt D ]@}| j|d
�d k�rZt jdd | tj�}|t jd| j|�7 }�qZW || j� 7 }tjd d �d dk�r�|t jd| jtj�7 }|S )Nr� Z
DOMAINTYPEZ TEMPLATEFILEz%sr@ rH r� ZPORTNUMz%dr� r )�full_distribution_name�redhat�centos�SuSE�fedora�mandrake�mandriva)rF rG rH rI rJ rK )r� r� r� r �compiler r' r� Zmanpager� Z
restoreconr� r� rD r� r� r� r� r� Z tcp_portsr� Z udp_portsrD �platform�linux_distributionr! )r� rP rC r� rA r r r � generate_sh� s4
zpolicy.generate_shc C s� d}t d�}|d krd}n|d }|tj7 }| jtkr�|tj7 }| jr\|tjd| jtj �7 }| j
dkr||tjd| j
tj �7 }x&| j j � D ]}|tjd|tj �7 }q�W x&| j
j � D ]}|tjd|tj �7 }q�W |tjd|tj�7 }tjd| j|�}tjd| j|�}t| j�d k�r$|d
d j| j� 7 }|tjd| jtj�7 }tjd| j|�}tjd tjd
�|�}| jtk�rxtjdd|�}| jtk�r�tjd| j d|�}| jttttt fk�r�tjd| j d|�}|S )NrH zselinux-policyz0.0.0r r@ �VERSIONZ
MODULENAMEZ
DOMAINNAMEr zRequires(post): %s
z, Z
TODAYSDATEz %a %b %e %Yz%relabel_filesz.*%s_selinux.8.*z.*%s_u.*) r& r Zheader_comment_sectionr' r� Zdefine_relabel_files_beginr� r� r� Zdefine_relabel_files_endr� r� rD r� Z base_sectionr� r rK rj r Z mid_section�timeZstrftimer� r0 r1 r2 r3 r )r� ZnewspecZselinux_policynvrZselinux_policyverr� r r r �
generate_spec� s>
zpolicy.generate_specc C s2 d|| j f }t|d�}|j| j� � |j� |S )Nz%s/%s_selinux.spec�w)r� �open�writerR �close)r� �out_dirZspecfile�fdr r r �
write_spec� s
zpolicy.write_specc C s2 d|| j f }t|d�}|j| j� � |j� |S )Nz%s/%s.terS )r� rT rU r? rV )r� rW ZtefilerX r r r �write_te� s
zpolicy.write_tec C s> d|| j f }t|d�}|j| j� � |j� tj|d� |S )Nz%s/%s.shrS i� )r� rT rU rO rV r5 �chmod)r� rW ZshfilerX r r r �write_sh� s
zpolicy.write_shc C s2 d|| j f }t|d�}|j| j� � |j� |S )Nz%s/%s.ifrS )r� rT rU r; rV )r� rW ZiffilerX r r r �write_if� s
zpolicy.write_ifc C s2 d|| j f }t|d�}|j| j� � |j� |S )Nz%s/%s.fcrS )r� rT rU rB rV )r� rW ZfcfilerX r r r �write_fc� s
zpolicy.write_fcc
C sD dd l }|j� ��(}|j� |jdd� |jj� }|j� }|j| jd�}x�|D ]�}| j j
|j � xT|j D ]J}xD| j
D ]:}|dkr�qt|j|�rttjj|�r�| j|� qt| j|� qtW qhW |j� }|j|jd�}xd|D ]\} xV| j D ]L}xF| j
D ]<}|dkr�q�|j|�r�tjj|��r | j|� q�| j|� q�W q�W q�W qNW W d Q R X d S )Nr T)Zload_system_repo)r z/etc)Zprovides)�dnfZBaseZread_all_reposZ fill_sackZsack�queryZ available�filterr� rj rN r r� ro �
startswithr5 r6 �isfiler r
Z source_name)
r� r_ �baser` ZpqZpkgZfnamer' ZsqZbpkgr r r Z__extract_rpms� s8
zpolicy.__extract_rpmsc C s� y | j � W n tk
r Y nX tjjd| j �rD| jd| j � tjjd| j �rf| jd| j � tjjd| j �r�| jd| j � tjjd| j �r�| jd| j � tjjd| j �r�| jd| j � tjjd| j �r�| j d| j � g }x�| j
j � D ]�}g }y| j
| d d d
}W n t k
�r8 w�Y nX x4| j
| d D ]"}|j
|��rJ|j|� n�qJ�qJW t|�d kr�xF|D ]>}|| jj � k�r�| j|= n || jj � k�r�| j|= n�q��q�W tt| j
| d �t|� �| j
| d< q�W d S ) Nz/var/run/%s.pidz /var/run/%sz /var/log/%sz/var/log/%s.logz /var/lib/%sz/etc/rc.d/init.d/%sz/etc/rc\.d/init\.d/%sr r �/)�_policy__extract_rpms� ImportErrorr5 r6 rc r r �isdirr
r� ro rD �
IndexErrorrb rN rK r� r� �list�set)r� Z
temp_basepathr. Z temp_dirsr� r r r �
gen_writeable sF
zpolicy.gen_writeablec C s� | j tkrd S tjj| j�s2tjjd| j � d S tj d| j �}x@|j
� j � D ]0}x*| j D ] }|j
|�r\td| j | � q\W qPW |j� d S )Nzl
***************************************
Warning %s does not exist
***************************************
znm -D %s | grep Uzself.%s)r' r� r5 r6 r7 r� �sys�stderrrU �popen�readr rn rb �execrV )r� rX �sr' r r r � gen_symbolsJ s
zpolicy.gen_symbolsc C s� d}|d| j |�td�f 7 }|d| j|�td�f 7 }|d| j|�td�f 7 }| jtkr�tjdd�d dkr�|d| j|�td�f 7 }|d| j |�td�f 7 }|S )Nz Created the following files:
z%s # %s
zType Enforcement filezInterface filezFile Contexts filer )rE rF rG rH rI rJ rK z Spec filez Setup Script)rF rG rH rI rJ rK )
rZ r r] r^ r' r� rM rN rY r\ )r� rW �outr r r �generate\ s
zpolicy.generateN)r� )w�__name__�
__module__� __qualname__r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r
r
r r r r r r r rx rz r| rv rt r� r� r� r~ r� r� r� r� rr r% r( r* r+ r, rs r. r� r r� r� r} rw ru r/ ry r{ r4 r; r< r= r> r? rB rD rO rR rY rZ r\ r] r^ rf rl rs r5 �getcwdru r r r r rV � s� B
&8
>#$*$3rV )r )Gr5 rm r8 r� r* r r r rQ rM Z templatesr r r r r
r r r
r r r r r r r Zsepolgen.interfacesZ
interfacesZsepolgen.defaultsZdefaultsZPROGNAME�gettext�kwargs� version_infoZinstall�builtins�str�__dict__rg Z __builtin__r r r& r/ r8 r� r� r� r� ZADMIN_TRANSITION_INTERFACEZUSER_TRANSITION_INTERFACEr� r� ZINETDr� r r4 r� r0 r1 r3 r2 r r� rC r rG r� r� rU rV r r r r �<module> s�