3
Flf @ s d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZ d dlZd dl Z ddl
m Z ddl
m Z ddl
m
Z
ddl
mZ ddl
mZ dd l
mZ dd
l
mZ dd l
mZ dd l
mZ dd
l
mZ ddl
mZ ddl
mZ ddl
mZ ddl
mZ ddl
mZ d dljZd dl j Z dZ yd.Z?i Z@eAd/e@e3< eAd0e@e4< eAd1e@e5< eAd2e@e6< eAd3e@e7< eAd4e@e8< eAd5e@e9< eAd6e@e:< eAd7e@e;< eAd8e@e<< eAd9e@e=< eAd:e@e>< eAd;e@e?< dgZDd>d? ZEG d@dA dAZFdS )C N)
get_all_typesget_all_attributes
get_all_roles )
executable)boolean)etc_rw) unit_file) var_cache) var_spool)var_lib)var_log)var_run)tmp)rw)network)script)spec)userzselinux-python Tunicodez/usr/share/localezutf-8)Z localedirZcodeset_c C sF | d }| d }| d }|d |j dd }|j dd }|||gS )z6Given an RPM header return the package NVR as a stringnameversionrelease-.r r )split)Zhdrr r r Zrelease_versionZ
os_version r /usr/lib/python3.6/generate.pyget_rpm_nvr_from_headerG s r c C s` y>dd l }d }|j }|j|j| }x|D ]}t|}P q*W W n td| d }Y nX |S )Nr z"Failed to retrieve rpm info for %s)rpmtsZdbMatchZ RPMTAG_NAMEr print)packager! Znvrr" Zmihr r r get_rpm_nvr_listR s
r& c C s i } xzt jt jD ]j}|d dks|d dks|d dks|d dks|d dkrTq|d |jdf| |d |d |d
f< qW | S ) NtypeZreserved_port_tZport_tZhi_reserved_port_tZephemeral_port_tZunreserved_port_trangeZlowZhighprotocol)sepolicyinfoZPORTget)dictpr r r
get_all_portsb s ,r/ c C s6 dd t jt jD } | jd | jd | j | S )Nc S s g | ] }|d qS )r r ).0xr r r
p s z!get_all_users..Zsystem_uroot)r* r+ USERremovesort)usersr r r
get_all_userso s
r8 z_admin$z_role$
zStandard Init DaemonzDBUS System DaemonzInternet Services Daemonz Web Application/Script (CGI)ZSandboxzUser ApplicationzExisting Domain Typez Minimal Terminal Login User Rolez!Minimal X Windows Login User RolezDesktop Login User Rolez Administrator Login User Rolez Confined Root Administrator Rolez!Module information for a new typec C s> t j } | j td}x | D ]}|d|t | f 7 }q W |S )Nz
Valid Types:
z%2s: %s
)poltypekeysr6 r )rD msgkr r r get_poltype_desc s
rG c C s | dkr g S d }yg }x| j dD ]}|j d}t|dkr@tt|dkrft|d }t|d }n$t|d }t|d }||krtx4t||d D ]"}|dk s||krt|j| qW q"W |S tk
r ttd| Y nX d S )
N r9 ,r r r z8Ports must be numbers or ranges of numbers from 1 to %d i )r len
ValueErrorintr( appendr )portsZmax_porttemparbeginendr. r r r verify_ports s.
rU c @ s e Zd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
d Z dd Z
dd Z dd Z dd Z
dd Zdd Zdd Zdd d Zd d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ Zd0d1 Zd2d3 Zd4d5 Z d6d7 Z d8d9 Z d:d; Z dd? Z!d@dA Z"dBdC Z#dDdE Z$dFdG Z%dHdI Z&dJdK Z'dLdM Z(dNdO Z)dPdQ Z*dRdS Z+dTdU Z,dVdW Z-dXdY Z.dZd[ Z/d\d] Z0d^d_ Z1d`da Z2dbdc Z3ddde Z4dfdg Z5dhdi Z6djdk Z7dldm Z8dndo Z9dpdq Z:drds Z;dtdu Zdzd{ Z?d|d} Z@d~d ZAdd ZBdd ZCdd ZDdd ZEdd ZFdd ZGdd ZHdd ZIdd ZJdd ZKdd ZLdd ZMdd ZNdd ZOdd ZPdd ZQdd ZRdd ZSdd ZTdd ZUdd ZVdd ZWdd ZXdd ZYdd ZZdd Z[dd Z\dd Z]dd Z^dd Z_dd Z`dd Zadd ZbddÄ Zcddń ZdddDŽ ZeddɄ Zfdd˄ Zgdd̈́ Zhddτ Ziddф Zjddӄ ZkddՄ Zlddׄ Zmddل Znddۄ Zodd݄ Zpdd߄ Zqdd Zrdd Zsetju fddZvdS )policyc C s g | _ i | _t | _g | _|tkr.ttd|sFttdt| y t | _W nT tk
r| } zt d W Y d d }~X n, t
k
r } zt d| W Y d d }~X nX i | _ d| j d< d| j d< d| j d< d | j d
< d | j d < d | j d < d| j d
< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d < d | j d < d | j d < d!| j d"< d#| j d$< d%| j d&< d'| j d(< d)| j d*< d+| j d,< d-| j d.< d/| j d0< d1| j d2< d3| j d4< d5| j d6< d7| j d8< d9| j d:< d;| j d<< d=| j d>< d?| j d@< dA| j dB< dC| j dD< dE| j dF< dG| j dH< dI| j dJ< dK| j dL< dM| j dN< dO| j dP< dQ| j dR< dS| j dT< dU| j dV< dW| j dX< dY| j dZ< d[| j d\< d]| j d^< d_| j d`< da| j db< da| j dc< da| j dd< da| j de< df| j dg< df| j dh< df| j di< df| j dj< df| j dg< dk| j dl< dm| j dn< do| j dp< dq| j dr< ds| j dt< du| j dv< dw| j dx< dy| j dz< d{| j d|< d}| j d~< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< i | _ dg t
g| j d< dg tg| j d< dg tg| j d< dg tg| j d< dg tg| j d< dg tg| j d< dg tg| j d< dg tg| j d< dg tg| j d< dg tg| j d< dg tg| j d< i | _t| jd< t| jd< t| jd< t| jd< t| jd< t| jd< t| jd< t| jd< dddddddddddg | _| j| jf| j| j f| j | j f| j | j f| j!| j"f| j#| j$f| j%| j&f| j'| j(f| j)| j*f| j+| j(f| j,| j(f| j-| j.f| j/| j0ff
| _1t2j3d|sttd|t4krd| | _5n|| _5|| _6g | _7g | _8|| _9d| _:d | _;dddg g| _dddg g| _?d| _@d| _Ad| _Bd| _Cd| _Dd| _Ed| _Fd| _Gd| _H| j9tItJgk| _K| j9tItJgk| _L| j9tItJgk| _Md| _Nd| _Oi | _Pi | _Qi | _Rg | _Sg | _Td| _Ud| _Vg | _Wg | _Xg | _Yg | _Zg | _[d S )Nz"You must enter a valid policy typez;You must enter a name for your policy module for your '%s'.z9Can not get port types, must be root for this informationzCan not get port typeszset_use_kerberos(True)Zopenlogzset_use_kerb_rcache(True)zset_use_syslog(True)zset_use_resolve(True)Z gethostbyZ getaddrinfoZ getnameinfoZkrbz set_manage_krb5_rcache(True)Zgss_accept_sec_contextZkrb5_verify_init_credsZ krb5_rd_reqZ __syslog_chkzset_use_uid(True)getpwnamgetpwuidzset_use_dbus(True)Zdbus_zset_use_pam(True)Zpam_zset_use_audit(True)zadd_process('fork')forkzadd_process('transition')Z
transitionzadd_process('sigchld')Zsigchldzadd_process('sigkill')Zsigkillzadd_process('sigstop')Zsigstopzadd_process('signull')Zsignullzadd_process('ptrace')Zptracezadd_process('getsched')Zgetschedzadd_process('setsched')Zsetschedzadd_process('getsession')Z
getsessionzadd_process('getpgid')getpgidzadd_process('setpgid')setpgidzadd_process('getcap')Zgetcapzadd_process('setcap')Zsetcapzadd_process('share')Zsharezadd_process('getattr')getattrzadd_process('setexec')Zsetexeczadd_process('setfscreate')Z setfscreatezadd_process('noatsecure')Z
noatsecurezadd_process('siginh')Zsiginhzadd_process('signal_perms')killzadd_process('setrlimit')Z setrlimitzadd_process('rlimitinh')Z rlimitinhz add_process('dyntransition')Z
dyntransitionzadd_process('setcurrent')Z
setcurrentzadd_process('execmem')Zexecmemzadd_process('execstack')Z execstackzadd_process('execheap')Zexecheapzadd_process('setkeycreate')Z setkeycreatez add_process('setsockcreate')Z
setsockcreatezadd_capability('chown')chownz add_capability('dac_override')Z dac_overridez!add_capability('dac_read_search')Zdac_read_searchzadd_capability('fowner')Zfownerzadd_capability('fsetid')Zfsetidzadd_capability('setgid')setgidsetegid setresgidsetregidzadd_capability('setuid') setresuidsetuidseteuidsetreuidzadd_capability('setpcap')Zsetpcapz!add_capability('linux_immutable')Zlinux_immutablez"add_capability('net_bind_service')Znet_bind_servicez add_capability('net_broadcast')Z
net_broadcastzadd_capability('net_admin')Z net_adminzadd_capability('net_raw')Znet_rawzadd_capability('ipc_lock')Zipc_lockzadd_capability('ipc_owner')Z ipc_ownerz add_capability('sys_module')
sys_modulezadd_capability('sys_rawio')Z sys_rawioz add_capability('sys_chroot')chrootZ
sys_chrootz add_capability('sys_ptrace')Z
sys_ptracezadd_capability('sys_pacct')Z sys_pacctzadd_capability('sys_admin')ZmountZunshareZ sys_adminzadd_capability('sys_boot')Zsys_bootzadd_capability('sys_nice')Zsys_nicez add_capability('sys_resource')Z sys_resourcezadd_capability('sys_time')Zsys_timez add_capability('sys_tty_config')Zsys_tty_configzadd_capability('mknod')mknodzadd_capability('lease')Zleasez add_capability('audit_write')Z audit_writez add_capability('audit_control')Z
audit_controlzadd_capability('setfcap')Zsetfcapr z/etcr z/tmpr r z/usr/lib/systemd/systemz/lib/systemd/systemz/etc/systemd/systemr
z
/var/cacher z/var/libr
z/var/logr z/var/runr z
/var/spoolZ_tmp_tZ _unit_file_tZ _var_cache_tZ
_var_lib_tZ
_var_log_tZ
_var_run_tZ _var_spool_tZ_port_tz^[a-zA-Z0-9-_]+$zQName must be alpha numberic with no spaces. Consider using option "-n MODULENAME"zhttpd_%s_scriptrH F)\rpmsrO r all_rolestypesrC rL r r/ r# RuntimeErrorsymbols DEFAULT_DIRSr r r r r
r r
r r DEFAULT_EXTr DEFAULT_KEYSgenerate_daemon_typesgenerate_daemon_rulesgenerate_dbusd_typesgenerate_dbusd_rulesgenerate_inetd_typesgenerate_inetd_rulesgenerate_cgi_typesgenerate_cgi_rulesgenerate_sandbox_typesgenerate_sandbox_rulesgenerate_userapp_typesgenerate_userapp_rules generate_existing_user_types generate_existing_user_rules generate_min_login_user_typesgenerate_login_user_rulesgenerate_x_login_user_typesgenerate_x_login_user_rulesgenerate_login_user_typesgenerate_admin_user_typesgenerate_root_user_typesgenerate_root_user_rulesgenerate_new_typesgenerate_new_rules
DEFAULT_TYPESrematchCGIr file_name capabilities processesr'
initscriptprogramin_tcpin_udpout_tcpout_udp use_resolveuse_tmpuse_uid
use_syslog use_kerberosmanage_krb5_rcacheuse_pamuse_dbus use_auditEUSERNEWTYPEuse_etcuse_localizationuse_fd use_terminaluse_mailbooleansfilesdirsfound_tcp_portsfound_udp_ports
need_tcp_type
need_udp_type
admin_domainsexisting_domainstransition_domainstransition_usersroles)selfr r' er r r __init__ sd
zpolicy.__init__c C s( |t p&|t p&|t p&t|t dkS )Nr )ALLRESERVED
UNRESERVEDrK PORTS)r lr r r Z
__isnetset s zpolicy.__isnetsetc C s
|| _ d S )N)r )r r r r r set_admin_domains s zpolicy.set_admin_domainsc C s
|| _ d S )N)r )r r r r r set_existing_domains s zpolicy.set_existing_domainsc C s
|| _ d S )N)r )r r r r r set_admin_roles s zpolicy.set_admin_rolesc C s
|| _ d S )N)r )r r r r r set_transition_domains s z policy.set_transition_domainsc C s
|| _ d S )N)r )r r r r r set_transition_users s zpolicy.set_transition_usersc C s | j | jS )N)_policy__isnetsetr )r r r r
use_in_udp s zpolicy.use_in_udpc C s | j | jS )N)r r )r r r r use_out_udp s zpolicy.use_out_udpc C s | j p| j S )N)r r )r r r r use_udp s zpolicy.use_udpc C s | j | jS )N)r r )r r r r
use_in_tcp s zpolicy.use_in_tcpc C s | j | jS )N)r r )r r r r use_out_tcp s zpolicy.use_out_tcpc C s | j p| j S )N)r r )r r r r use_tcp s zpolicy.use_tcpc C s | j p| j S )N)r r )r r r r use_network s zpolicy.use_networktcpc C sF x@| j j D ]2\}}}||kr ||kr ||kr | j |||f S q W d S )N)rO rD )r Zportr) rS rT r. r r r find_port s zpolicy.find_portc C s | j tkrttd|| _d S )Nz0User Role types can not be assigned executables.)r' APPLICATIONSrL r r )r r r r r set_program s
zpolicy.set_programc C s | j tkrttd|| _d S )Nz)Only Daemon apps can use an init script..)r' DAEMONrL r r )r r r r r set_init_script s
zpolicy.set_init_scriptc C s |||t |g| _d S )N)rU r )r allreserved
unreservedrO r r r
set_in_tcp s zpolicy.set_in_tcpc C s |||t |g| _d S )N)rU r )r r r r rO r r r
set_in_udp s zpolicy.set_in_udpc C s |ddt |g| _d S )NF)rU r )r r rO r r r set_out_tcp s zpolicy.set_out_tcpc C s |ddt |g| _d S )NF)rU r )r r rO r r r set_out_udp s zpolicy.set_out_udpc C s" t |tk rttd|| _d S )Nz$use_resolve must be a boolean value )r' boolrL r r )r valr r r set_use_resolve s zpolicy.set_use_resolvec C s" t |tk rttd|| _d S )Nz#use_syslog must be a boolean value )r' r rL r r )r r r r r set_use_syslog s zpolicy.set_use_syslogc C s" t |tk rttd|| _d S )Nz%use_kerberos must be a boolean value )r' r rL r r )r r r r r set_use_kerberos s zpolicy.set_use_kerberosc C s" t |tk rttd|| _d S )Nz+manage_krb5_rcache must be a boolean value )r' r rL r r )r r r r r set_manage_krb5_rcache s z policy.set_manage_krb5_rcachec C s |dk| _ d S )NT)r )r r r r r set_use_pam s zpolicy.set_use_pamc C s |dk| _ d S )NT)r )r r r r r set_use_dbus s zpolicy.set_use_dbusc C s |dk| _ d S )NT)r )r r r r r
set_use_audit s zpolicy.set_use_auditc C s |dk| _ d S )NT)r )r r r r r set_use_etc s zpolicy.set_use_etcc C s |dk| _ d S )NT)r )r r r r r set_use_localization s zpolicy.set_use_localizationc C s |dk| _ d S )NT)r )r r r r r
set_use_fd s zpolicy.set_use_fdc C s |dk| _ d S )NT)r )r r r r r set_use_terminal s zpolicy.set_use_terminalc C s |dk| _ d S )NT)r )r r r r r set_use_mail s zpolicy.set_use_mailc C sB | j tkrttd|r0| jd d jd ng | jd d< d S )Nz'USER Types automatically get a tmp typez/tmpr )r' USERSrL r ro rN )r r r r r set_use_tmp s
zpolicy.set_use_tmpc C s |dk| _ d S )NT)r )r r r r r set_use_uid s zpolicy.set_use_uidc C s | j rtjd| jtjS dS d S )N TEMPLATETYPErH )r r subr r Z te_uid_rules)r r r r generate_uid_rules s zpolicy.generate_uid_rulesc C s | j rtjd| jtjS dS d S )Nr rH )r r r r r Zte_syslog_rules)r r r r generate_syslog_rules s z policy.generate_syslog_rulesc C s | j rtjd| jtjS dS d S )Nr rH )r r r r r Zte_resolve_rules)r r r r generate_resolve_rules s z policy.generate_resolve_rulesc C s | j rtjd| jtjS dS d S )Nr rH )r r r r r Zte_kerberos_rules)r r r r generate_kerberos_rules s z policy.generate_kerberos_rulesc C s | j rtjd| jtjS dS d S )Nr rH )r r r r r Zte_manage_krb5_rcache_rules)r r r r !generate_manage_krb5_rcache_rules s z(policy.generate_manage_krb5_rcache_rulesc C s d}| j r tjd| jtj}|S )NrH r )r r r r r Z te_pam_rules)r newter r r generate_pam_rules& s zpolicy.generate_pam_rulesc C s d}| j r tjd| jtj}|S )NrH r )r r r r r Zte_audit_rules)r r r r r generate_audit_rules, s zpolicy.generate_audit_rulesc C s d}| j r tjd| jtj}|S )NrH r )r r r r r Z te_etc_rules)r r r r r generate_etc_rules2 s zpolicy.generate_etc_rulesc C s d}| j r tjd| jtj}|S )NrH r )r r r r r Z te_fd_rules)r r r r r generate_fd_rules8 s zpolicy.generate_fd_rulesc C s d}| j r tjd| jtj}|S )NrH r )r r r r r Zte_localization_rules)r r r r r generate_localization_rules> s z"policy.generate_localization_rulesc C s* d}| j tkr&| jr&tjd| jtj}|S )NrH r )r' DBUSr r r r r Z
te_dbus_rules)r r r r r generate_dbus_rulesD s zpolicy.generate_dbus_rulesc C s d}| j r tjd| jtj}|S )NrH r )r r r r r Z
te_mail_rules)r r r r r generate_mail_rulesJ s zpolicy.generate_mail_rulesc C sF d}d|||f }|t j kr.d|| jf }nd|| j|||f }|S )NrH zcorenet_%s_%s_%sz %s(%s_t)
zD
gen_require(`
type %s_t;
')
allow %s_t %s_t:%s_socket name_%s;
)r* Z get_methodsr )r r) action port_namelinemethodr r r generate_network_actionP s z policy.generate_network_actionc C sh xf| j t D ]X}| jt|d}|d kr0d| _q |d d d
}| jdd|}|| jkr | jj| q W xf| jt D ]X}| jt|d}|d krd| _qt|d d d }| jdd|}|| jkrt| jj| qtW xh| j t D ]Z}| jt|d}|d krd| _
q|d d d }| jdd|}|| j kr| j j| qW | j
dksR| jdkrdt j
d| jtjS d S )
Nr Tr r9 ZbindZconnectudpr rH r r )r r r rM r r r rN r r r r r r r r te_types)r iZrecr r r r r generate_network_types^ s6
z policy.generate_network_typesc C sZ x:| j D ]0}|j|dkr| j | d j| | j | S qW | j d d j| | j d S )Nr r r )ro findrN )r filedr r r Z __find_path s zpolicy.__find_pathc C s || j kr| j j| d S )N)r rN )r Z
capabilityr r r add_capability s
zpolicy.add_capabilityc C s
|| _ d S )N)rl )r rl r r r set_types s zpolicy.set_typesc C s || j kr| j j| d S )N)r rN )r Zprocessr r r add_process s
zpolicy.add_processc C s || j |< d S )N)r )r r descriptionr r r add_boolean s zpolicy.add_booleanc C s | j || j|< d S )N)_policy__find_pathr )r r r r r add_file s zpolicy.add_filec C s | j || j|< d S )N)r r )r r r r r add_dir s zpolicy.add_dirc C s6 d}| j j t| j dkr2d| jdj| j f }|S )NrH r z#allow %s_t self:capability { %s };
)r r6 rK r join)r r r r r generate_capabilities s
z policy.generate_capabilitiesc C s6 d}| j j t| j dkr2d| jdj| j f }|S )NrH r z allow %s_t self:process { %s };
r )r r6 rK r r )r r r r r generate_process s
zpolicy.generate_processc C s d}| j rd}|tjd| jtj7 }| j r|d7 }|tjd| jtj7 }| j r|tjd| jtj 7 }| j
rt | j t
dkr|tjd| jtj7 }| j
rt | jt
dkr|tjd| jtj7 }| j t r|tjd| jtj7 }| j t r |tjd| jtj7 }| j t r.|tjd| jtj7 }| jt rP|tjd| jtj7 }| jt rr|tjd| jtj7 }| jt r|tjd| jtj7 }x| jD ]}||7 }qW | j r|d7 }|tjd| jtj 7 }| j r|tjd| jtj 7 }| j r|tjd| jtj 7 }| j!t r6|tjd| jtj"7 }| j!t rX|tjd| jtj#7 }| j!t rz|tjd| jtj$7 }x| j%D ]}||7 }qW |S )NrH
r r )&r r r r r Z
te_networkr Zte_tcpr Z te_in_tcpr rK r r Zte_in_need_port_tcpr Zte_out_need_port_tcpr Zte_in_all_ports_tcpr Zte_in_reserved_ports_tcpr Zte_in_unreserved_ports_tcpZte_out_all_ports_tcpZte_out_reserved_ports_tcpZte_out_unreserved_ports_tcpr r Zte_udpr Zte_in_need_port_udpr Z te_in_udpr Zte_in_all_ports_udpZte_in_reserved_ports_udpZte_in_unreserved_ports_udpr )r r r r r r generate_network_rules sV
z policy.generate_network_rulesc C s d}x2| j D ](}tjd| jtj}|tjd||7 }q W | jtkrx<| jD ]2}tjd| jt j
}|tjd|j dd |7 }qJW |S )NrH r APPLICATIONr4 _ur ) r r r r r Zte_transition_rulesr' r4 r r Z te_run_rulesr )r r appr urP r r r generate_transition_rules s
z policy.generate_transition_rulesc C s, d}| j tkrxn| jD ]d}|jdd }|d }xH| jD ]>}tjd|tj}|| j krdtj|d|}|tjd||7 }q8W qW |S | j t
kr(|tjd| j tj 7 }x2| jD ](}tjd| j tj}|tjd||7 }qW xN| j
D ]D}|jdd }|d | j krtjd| j tj}|tjd ||7 }qW |S )
NrH _tr _rr Zsystem_rr r r4 )r' r r r r r r r Zte_admin_domain_rulesrk RUSERr Zte_admin_rulesr Zte_admin_trans_rules)r r r r roler r r r r r generate_admin_rules s,
zpolicy.generate_admin_rulesc C s d}| j r tjd| jtj}|S )NrH r )r r r r r Z
if_dbus_rules)r newifr r r generate_dbus_if s zpolicy.generate_dbus_ifc C s( d}| j tkr|S tjd| jtj}|S )NrH r )r' SANDBOXr r r r Zif_sandbox_rules)r r r r r generate_sandbox_if s
zpolicy.generate_sandbox_ifc C s d}d}| j dkr>|tjd| jtj7 }|tjd| jtj7 }xd| jD ]Z}t| j | d dkrF|tjd| j| j | d j
7 }|tjd| j| j | d j 7 }qFW |dkrtjd| jtj }||7 }|tjd| jtj
7 }||7 }|tjd| jtj7 }|S dS )NrH r r r r9 )r r r r r Zif_initscript_admin_typesZif_initscript_adminrq rK ro Zif_admin_typesZif_admin_rulesZif_begin_adminZif_middle_adminZ if_end_admin)r r Znewtypesr retr r r generate_admin_if s"
$zpolicy.generate_admin_ifc C s t jd| jtjS )Nr )r r r r te_cgi_types)r r r r rx 5 s zpolicy.generate_cgi_typesc C s t jd| jtjS )Nr )r r r r te_sandbox_types)r r r r rz 8 s z policy.generate_sandbox_typesc C s t jd| jtjS )Nr )r r r r Zte_userapp_types)r r r r r| ; s z policy.generate_userapp_typesc C s t jd| jtjS )Nr )r r r r Zte_inetd_types)r r r r rv > s zpolicy.generate_inetd_typesc C s t jd| jtjS )Nr )r r r r Zte_dbusd_types)r r r r rt A s zpolicy.generate_dbusd_typesc C s t jd| jtjS )Nr )r r r r Zte_min_login_user_types)r r r r r D s z$policy.generate_min_login_user_typesc C s t jd| jtjS )Nr )r r r r Zte_login_user_types)r r r r r G s z policy.generate_login_user_typesc C s t jd| jtjS )Nr )r r r r Zte_admin_user_types)r r r r r J s z policy.generate_admin_user_typesc C s t | jdkr$ttdt| j tjd| jt j
}|d7 }xB| jD ]8}|d| 7 }|j dd d }|| j krF|d| 7 }qFW |d 7 }|S )
Nr z,'%s' policy modules require existing domainsr z
gen_require(`z
type %s;r r z
role %s;z
')
)
rK r rL r rC r' r r r r Zte_existing_user_typesr rk )r r r r r r r r~ M s
z#policy.generate_existing_user_typesc C s t jd| jtjS )Nr )r r r r Zte_x_login_user_types)r r r r r _ s z"policy.generate_x_login_user_typesc C s t jd| jtjS )Nr )r r r r Zte_root_user_types)r r r r r b s z policy.generate_root_user_typesc C s d}t | jdkr ttdxj| jD ]`}xZ| jD ]P}|j|r2t||d t | |tjd|d t | | j| j 7 }P q2W q&W t
r|dkrg }x| jD ]}|j | qW ttddj | |S )NrH r zType field requiredr z3You need to define a new type which ends with:
%sz
)
rK rl rL r rp endswithr# r r r r rN r )r r tr Z default_extr r r r e s
(
zpolicy.generate_new_typesc C s dS )NrH r )r r r r r y s zpolicy.generate_new_rulesc C s6 t jd| jtj}| jdkr2|t jd| jtj7 }|S )Nr rH )r r r r Zte_daemon_typesr Zte_initscript_types)r r r r r rr | s
z policy.generate_daemon_typesc C s | j rtjd| jtjS dS d S )Nr rH )r r r r r r )r r r r generate_tmp_types s zpolicy.generate_tmp_typesc C s@ d}x6| j D ],}tjd|tj}|tjd| j | |7 }q W |S )NrH BOOLEANZ DESCRIPTION)r r r r Z
te_boolean)r r br r r r generate_booleans s
zpolicy.generate_booleansc C s, d}x"| j D ]}|tjd|tj7 }q W |S )NrH r& )r r r r te_rules)r r r' r r r generate_boolean_rules s z policy.generate_boolean_rulesc C s t jd| jtjS )Nr )r r r r r" )r r r r generate_sandbox_te s zpolicy.generate_sandbox_tec C s t jd| jtjS )Nr )r r r r r! )r r r r generate_cgi_te s zpolicy.generate_cgi_tec C s t jd| jtj}|S )Nr )r r r r Zte_daemon_rules)r r r r r rs s z policy.generate_daemon_rulesc C sr d}xh| j D ]^}xX| jD ]N}|j|r|d t| d }|tjd|d t| | j| j7 }P qW q W |S )NrH r r )rl rp r# rK r r if_rules)r r r$ r Zreqtyper r r generate_new_type_if s
(
zpolicy.generate_new_type_ifc C s t jd| jtjS )Nr )r r r r Zte_login_user_rules)r r r r r s z policy.generate_login_user_rulesc C s t jd| jtj}|S )Nr )r r r r Zte_existing_user_rules)r Znerulesr r r r s z#policy.generate_existing_user_rulesc C s t jd| jtjS )Nr )r r r r Zte_x_login_user_rules)r r r r r s z"policy.generate_x_login_user_rulesc C s t jd| jtj}|S )Nr )r r r r Zte_root_user_rules)r r r r r r s z policy.generate_root_user_rulesc C s t jd| jtjS )Nr )r r r r Zte_userapp_rules)r r r r r} s z policy.generate_userapp_rulesc C s t jd| jtjS )Nr )r r r r Zte_inetd_rules)r r r r rw s zpolicy.generate_inetd_rulesc C s t jd| jtjS )Nr )r r r r Zte_dbusd_rules)r r r r ru s zpolicy.generate_dbusd_rulesc C s | j rtjd| jtjS dS d S )Nr rH )r r r r r r) )r r r r generate_tmp_rules s zpolicy.generate_tmp_rulesc C s d}|t jd| jtj7 }|S )NrH r )r r r r Z te_cgi_rules)r r r r r ry s zpolicy.generate_cgi_rulesc C s d}|t jd| jtj7 }|S )NrH r )r r r r Zte_sandbox_rules)r r r r r r{ s z policy.generate_sandbox_rulesc C sR d}| j s| jtkr&tjd| jtj}| jtt t
t fkrN|tjd| jtj 7 }|S )NrH r )
r r' r4 r r r r Zif_user_program_rulesTUSERXUSERAUSERLUSERZif_role_change_rules)r r r r r generate_user_if s zpolicy.generate_user_ifc C sD d}|t jd| jtj7 }| jr6|t jd| jtj7 }| jdkrV|t jd| jtj7 }x| j D ]}t
| j | d dkr^|t jd| j| j | d j 7 }xZ| j | d D ]H}t
jj|rtjt
j|tj r|t jd| j| j | d j7 }P qW q^W || j 7 }|| j 7 }|| j 7 }|| j 7 }|| j 7 }|| j 7 }|S )NrH r r r r9 )r r r r Zif_heading_rulesr Zif_program_rulesr Zif_initscript_rulesrq rK ro r- ospathexistsstatS_ISSOCKST_MODEZif_stream_rulesr4 r r r r. r )r r r r r r r generate_if s(
"
zpolicy.generate_ifc C s | j | j d S )Nr )r r' )r r r r generate_default_types s z policy.generate_default_typesc C s& | j | j d r"| j | j d S dS )Nr rH )r r' )r r r r generate_default_rules s z policy.generate_default_rulesc C s d}| j ttttfkrd}t| jdkr|tjd| j t
j 7 }|tjd| j t
j 7 }x2| jD ](}tjd| j t
j
}|tjd||7 }q\W |S )NrH r r ZROLE)r' r0 r1 r2 r3 rK r r r r r Z
te_sudo_rulesZte_newrole_rulesZte_roles_rules)r r r r r r r r generate_roles_rules s zpolicy.generate_roles_rulesc C s | j }xV| jD ]L}t| j| d dkr| jtks<|dkr|tjd| j| j| d j 7 }qW | jt
krx|d| j 7 }|| j 7 }|| j 7 }|| j
7 }|| j 7 }|| j 7 }|| j 7 }|| j 7 }xT| jD ]H}t| j| d dkr| jt
krXd}xt| jD ]H}|tjd|d d d | j| d j7 }|tjd
| jd |7 }q
W n |tjd| j| j| d j7 }x| j| d D ]}tjj|rtjtj|tj r| jt
krxX| jD ],}|tjd|d d
| j| d j7 }qW n |tjd| j| j| d j7 }P qW qW || j 7 }|| j 7 }|| j 7 }|| j 7 }|| j 7 }|| j 7 }|| j! 7 }|| j" 7 }|| j# 7 }|| j$ 7 }|| j% 7 }|| j& 7 }|| j' 7 }|| j( 7 }|| j) 7 }|| j* 7 }|| j+ 7 }|S )Nr r r r r9 z@
########################################
#
# %s local policy
#
rH ZTEMPLATETYPE_tr ZTEMPLATETYPE_rw_tZ_rw_tr r ),r< rq rK ro r' r r r r r r r
r r r% r( r= r* r r) r5 r6 r7 r8 r9 r: Zte_stream_rulesr/ r r r r r r r r r r> r r r r r r )r r r Z newte_tmpZdomainr r r r generate_te s` $
* & . zpolicy.generate_tec C s d}g }x| j j D ]}tjj|rXtjtj|tj rXtj d| j
| j | d j }n tj d| j
| j | d j }tj d||}|j
tj d| j | d | qW xZ| jj D ]L}tj d| j
| j| d j}tj d||}|j
tj d| j| d | qW | jttg kr&t|dkr&tjS | jttttg krR| j rRttd| jrtj d| jtj}|j
tj d| j
| | j dkrtj d| j tj }|j
tj d| j
| |j d j |}|S )
NrH r r9 FILENAMEZFILETYPEr z
zpolicy.generate_specc C s2 d|| j f }t|d}|j| j |j |S )Nz%s/%s_selinux.specw)r openwriterR close)r out_dirZspecfilefdr r r
write_spec s
zpolicy.write_specc C s2 d|| j f }t|d}|j| j |j |S )Nz%s/%s.terS )r rT rU r? rV )r rW ZtefilerX r r r write_te s
zpolicy.write_tec C s> d|| j f }t|d}|j| j |j tj|d |S )Nz%s/%s.shrS i )r rT rU rO rV r5 chmod)r rW ZshfilerX r r r write_sh s
zpolicy.write_shc C s2 d|| j f }t|d}|j| j |j |S )Nz%s/%s.ifrS )r rT rU r; rV )r rW ZiffilerX r r r write_if s
zpolicy.write_ifc C s2 d|| j f }t|d}|j| j |j |S )Nz%s/%s.fcrS )r rT rU rB rV )r rW ZfcfilerX r r r write_fc s
zpolicy.write_fcc
C sD dd l }|j (}|j |jdd |jj }|j }|j| jd}x|D ]}| j j
|j xT|j D ]J}xD| j
D ]:}|dkrqt|j|rttjj|r| j| qt| j| qtW qhW |j }|j|jd}xd|D ]\} xV| j D ]L}xF| j
D ]<}|dkrq|j|rtjj|r | j| q| j| qW qW qW qNW W d Q R X d S )Nr T)Zload_system_repo)r z/etc)Zprovides)dnfZBaseZread_all_reposZ fill_sackZsackqueryZ availablefilterr rj rN r r ro
startswithr5 r6 isfiler r
Z source_name)
r r_ baser` ZpqZpkgZfnamer' ZsqZbpkgr r r Z__extract_rpms s8
zpolicy.__extract_rpmsc C s y | j W n tk
r Y nX tjjd| j rD| jd| j tjjd| j rf| jd| j tjjd| j r| jd| j tjjd| j r| jd| j tjjd| j r| jd| j tjjd| j r| j d| j g }x| j
j D ]}g }y| j
| d d d
}W n t k
r8 wY nX x4| j
| d D ]"}|j
|rJ|j| nqJqJW t|d krxF|D ]>}|| jj kr| j|= n || jj kr| j|= nqqW tt| j
| d t| | j
| d< qW d S ) Nz/var/run/%s.pidz /var/run/%sz /var/log/%sz/var/log/%s.logz /var/lib/%sz/etc/rc.d/init.d/%sz/etc/rc\.d/init\.d/%sr r /)_policy__extract_rpms ImportErrorr5 r6 rc r r isdirr
r ro rD
IndexErrorrb rN rK r r listset)r Z
temp_basepathr. Z temp_dirsr r r r
gen_writeable sF
zpolicy.gen_writeablec C s | j tkrd S tjj| js2tjjd| j d S tj d| j }x@|j
j D ]0}x*| j D ] }|j
|r\td| j | q\W qPW |j d S )Nzl
***************************************
Warning %s does not exist
***************************************
znm -D %s | grep Uzself.%s)r' r r5 r6 r7 r sysstderrrU popenreadr rn rb execrV )r rX sr' r r r gen_symbolsJ s
zpolicy.gen_symbolsc C s d}|d| j |tdf 7 }|d| j|tdf 7 }|d| j|tdf 7 }| jtkrtjddd dkr|d| j|tdf 7 }|d| j |tdf 7 }|S )Nz Created the following files:
z%s # %s
zType Enforcement filezInterface filezFile Contexts filer )rE rF rG rH rI rJ rK z Spec filez Setup Script)rF rG rH rI rJ rK )
rZ r r] r^ r' r rM rN rY r\ )r rW outr r r generate\ s
zpolicy.generateN)r )w__name__
__module__ __qualname__r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r
r
r r r r r r r rx rz r| rv rt r r r r~ r r r r rr r% r( r* r+ r, rs r. r r r r r} rw ru r/ ry r{ r4 r; r< r= r> r? rB rD rO rR rY rZ r\ r] r^ rf rl rs r5 getcwdru r r r r rV s B
&8
>#$*$3rV )r )Gr5 rm r8 r r* r r r rQ rM Z templatesr r r r r
r r r
r r r r r r r Zsepolgen.interfacesZ
interfacesZsepolgen.defaultsZdefaultsZPROGNAMEgettextkwargs version_infoZinstallbuiltinsstr__dict__rg Z __builtin__r r r& r/ r8 r r r r ZADMIN_TRANSITION_INTERFACEZUSER_TRANSITION_INTERFACEr r ZINETDr r r4 r r0 r1 r3 r2 r r rC r rG r r rU rV r r r r s