a BÒiezã6@sÊddlZddlZddlZddlZddlmZddlmZddlmZddlmZddlm Z dZ d d ddd ddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;dœ5Zd?Zd@Z dAZdBZdCZdDZdEZdFZdGZdHZdIZdJZdKZdLZdMZdNZdOZdPZdQZdRdS„ZdTdU„Z dVdW„Z!dXdY„Z"dZd[„Z#d\d]„Z$d^d_„Z%d`da„Z&dbdc„Z'da(da)dda*da+dea,d÷dfdg„Z-dhdi„Z.djdk„Z/dldm„Z0dndo„Z1dpdq„Z2drds„Z3dtdu„Z4dvdw„Z5dxdy„Z6dzd{„Z7d|d}„Z8d~d„Z9d€d„Z:d‚dƒ„Z;d„d…„ZdŠd‹„Z?dŒd„Z@dŽd„ZAdd‘„ZBd’d“„ZCd”d•„ZDd–d—„ZEd˜d™„ZFdšd›„ZGdœd„ZHdždŸ„ZId d¡„ZJd¢d£„ZKd¤d¥„ZLd¦d§„ZMd¨d©„ZNdªd«„ZOd¬d„ZPd®d¯„ZQd°d±„ZRd²d³„ZSd´dµ„ZTd¶d·„ZUd¸d¹„ZVdºd»„ZWd¼d½„ZXd¾d¿„ZYdÀdÁ„ZZdÂdÃ„Z[dÄdÅ„Z\dÆdÇ„Z]dÈdÉ„Z^dÊdË„Z_dÌdÍ„Z`dÎdÏ„ZadÐdÑ„ZbdÒdÓ„ZcdÔdÕ„ZddÖd×„ZedØdÙ„ZfdÚdÛ„ZgdÜdÝ„ZhdÞdß„Zidàdá„Zjdâdã„Zkdädå„Zldædç„Zmdèdé„Zndêdë„Zodìdí„Zpdaqdardîdï„Zsdødñdò„Ztdódô„Zudùdõdö„ZvdS)úéNé)Úaccess)Údefaults)Úlex)Ú refpolicy)Úyacc)JZTICKZSQUOTEZOBRACEZCBRACEÚSEMIÚCOLONZOPARENZCPARENÚCOMMAÚMINUSÚTILDEZASTERISKZAMPZBARZEXPLÚEQUALÚFILENAMEÚ IDENTIFIERÚNUMBERÚPATHZ IPV6_ADDRÚMODULEÚ POLICY_MODULEÚREQUIREÚSIDÚGENFSCONÚFS_USE_XATTRÚFS_USE_TRANSÚFS_USE_TASKÚPORTCONÚNODECONÚNETIFCONÚPIRQCONÚIOMEMCONÚ IOPORTCONÚPCIDEVICECONÚ DEVICETREECONÚCLASSÚ TYPEATTRIBUTEÚ ROLEATTRIBUTEÚTYPEÚ ATTRIBUTEÚATTRIBUTE_ROLEÚALIASÚ TYPEALIASÚBOOLÚTRUEÚFALSEÚIFÚELSEÚROLEÚTYPESÚALLOWÚ DONTAUDITÚ AUDITALLOWÚ NEVERALLOWÚ PERMISSIVEÚ TYPEBOUNDSÚTYPE_TRANSITIONÚTYPE_CHANGEÚTYPE_MEMBERÚRANGE_TRANSITIONÚROLE_TRANSITIONÚ OPT_POLICYÚ INTERFACEÚTUNABLE_POLICYÚGEN_REQÚTEMPLATEÚGEN_CONTEXTÚGEN_TUNABLEÚIFELSEÚIFDEFÚIFNDEFÚDEFINErrrrrrrrrrrrrrr r!r"r#r$r%r&r'r(r)r*r+r,r-r.r/r0r1r2r3r4r5r6r7r8r9r:r;r<r=r>r?r@rArBrCrErDrF)5ÚmoduleZ policy_moduleZrequireZsidZgenfsconÚfs_use_xattrÚfs_use_transÚfs_use_taskZportconZnodeconZnetifconZpirqconZiomemconZ ioportconZpcideviceconZ devicetreeconÚclassZ typeattributeZ roleattributeÚtypeZ attributeZattribute_roleÚaliasZ typealiasÚboolÚtrueZfalseÚifÚelseÚroleÚtypesZallowÚ dontauditÚ auditallowÚ neverallowZ permissiveZ typeboundsZtype_transitionÚtype_changeÚtype_memberZrange_transitionZrole_transitionZoptional_policyÚ interfaceZtunable_policyZgen_requireÚtemplateZgen_contextZgen_tunableZifelseZifndefÚifdefZdefinez\`z\'z\{z\}z\;+z\:z$z$z\,z\-z\~z\*z\&z\|z\!z\=z[0-9\.]+z/[a-zA-Z0-9)_\.\*/\$]*z cCs|S)z2[a-fA-F0-9]{0,4}:[a-fA-F0-9]{0,4}:([a-fA-F0-9]|:)*©©Útr\r\ú6/usr/lib/python3.9/site-packages/sepolgen/refparser.pyÚt_IPV6_ADDRêsr`cCs|jjd7_dS)zdnl.*\nrN©ÚlexerÚlinenor]r\r\r_Út_m4commentðsrdcCs| d¡dS)zdefine.*refpolicywarn\(.*\nrN)Úskipr]r\r\r_Út_refpolicywarn1õsrfcCs|jjd7_dS)zrefpolicywarn\(.*\nrNrar]r\r\r_Út_refpolicywarnûsrgcCst |jd¡|_|S)z#[a-zA-Z_\$][a-zA-Z0-9_\-\+\.\$\*~]*r©ÚreservedÚgetÚvaluerLr]r\r\r_Út_IDENTIFIERsrlcCst |jd¡|_|S)z"\"[a-zA-Z0-9_\-\+\.\$\*~ :\[\]]+\"rrhr]r\r\r_Ú t_FILENAMEsrmcCs|jjd7_dS)z\#.*\nrNrar]r\r\r_Ú t_comment srncCs td|jdƒ| d¡dS)NzIllegal character '%s'rr)Úprintrkrer]r\r\r_Út_errorsrpcCs|jjt|jƒ7_dS)z\n+N)rbrcÚlenrkr]r\r\r_Ú t_newlinesrrÚTcCsT|durdS|D]>}|durq||_|dur@|j d||f¡q|j d|¡qdS)Nr)ÚparentÚchildrenÚinsert)ZstmtsrtÚvalÚsr\r\r_Úcollect/srycCs4|D]*}t |¡r$| t |¡¡q| |¡qdS©N)ÚsptZhas_keyÚupdateZby_nameÚadd)ZidsrxÚidr\r\r_Úexpand;s rcCsNt|ƒdkr&|dr&tj |d¡n$t|ƒdkrJ|drJtj |d¡dS)z^statements : statement | statements statement | empty érN)rqÚmruÚappend©Úpr\r\r_Úp_statementsCsr…cCs|d|d<dS)zµstatement : interface | template | obj_perm_set | policy | policy_module_stmt | module_stmt rrNr\rƒr\r\r_Úp_statementMsr†cCsdS)zempty :Nr\rƒr\r\r_Úp_emptyWsr‡cCs.t ¡}|d|_|d|_d|_||d<dS)zHpolicy_module_stmt : POLICY_MODULE OPAREN IDENTIFIER COMMA NUMBER CPARENééTrN©rZModuleDeclarationÚnameÚversion©r„rr\r\r_Úp_policy_module_stmtbs rŽcCs(t |d¡}t|d|ƒ||d<dS)zainterface : INTERFACE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN éérN)rÚ Interfacery©r„Úxr\r\r_Úp_interfacejsr”cCs(t |d¡}t|d|ƒ||d<dS)z¿template : TEMPLATE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN | DEFINE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN rrrN)rZTemplateryr’r\r\r_Ú p_templateqsr•cCsd|d<dS)z4define : DEFINE OPAREN TICK IDENTIFIER SQUOTE CPARENNrr\rƒr\r\r_Úp_defineysr–cCszt|ƒdkr"|dr"|d|d<nTt|ƒdkrv|dsL|drv|d|d<n*|dsb|d|d<n|d|d|d<dS)zlinterface_stmts : policy | interface_stmts policy | empty r€rrN©rqrƒr\r\r_Úp_interface_stmts€sr˜cCsFt ¡}t|d|ddt|ƒdkr8t|d|dd|g|d<dS) z»optional_policy : OPT_POLICY OPAREN TICK interface_stmts SQUOTE CPAREN | OPT_POLICY OPAREN TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN rT©rwérFrN)rZOptionalPolicyryrq)r„Úor\r\r_Úp_optional_policys rœcCsPt ¡}|d|_t|d|ddt|ƒdkrBt|d|dd|g|d<d S) zùtunable_policy : TUNABLE_POLICY OPAREN TICK cond_expr SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN | TUNABLE_POLICY OPAREN TICK cond_expr SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN rrTr™ééFrN)rZ TunablePolicyÚ cond_exprryrqr’r\r\r_Úp_tunable_policyšs r cCsdS)a×ifelse : IFELSE OPAREN TICK IDENTIFIER SQUOTE COMMA COMMA TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi | IFELSE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi | IFELSE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi Nr\rƒr\r\r_Úp_ifelse¥sr¡cCsbt |d¡}|ddkr d}nd}t|d||dt|ƒdkrTt|d|dd|g|d <d S)aJifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi rrr[TFrr™ržrN)rZIfDefryrq)r„r“Úvr\r\r_Úp_ifdef³sr£cCs8tj|dd}t|ƒdkr,|j |d¡||d<dS)zÄinterface_call : IDENTIFIER OPAREN interface_call_param_list CPAREN | IDENTIFIER OPAREN CPAREN | IDENTIFIER OPAREN interface_call_param_list CPAREN SEMIr)ZifnamerrˆrN)rZ InterfaceCallrqÚargsÚextend)r„Úir\r\r_Úp_interface_callÂsr§cCs6t|ƒdkr|d|d<n|dd|dg|d<dS)zúinterface_call_param : IDENTIFIER | IDENTIFIER MINUS IDENTIFIER | nested_id_set | TRUE | FALSE | FILENAME r€rrú-rˆNr—rƒr\r\r_Úp_interface_call_paramÌs r©cCs6t|ƒdkr|dg|d<n|d|dg|d<dS)zinterface_call_param_list : interface_call_param | interface_call_param_list COMMA interface_call_param r€rrrˆNr—rƒr\r\r_Úp_interface_call_param_listÛsrªcCs$t |d¡}|d|_||d<dS)zRobj_perm_set : DEFINE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK names SQUOTE CPARENrrrN)rZ ObjPermSetÚperms©r„rxr\r\r_Úp_obj_perm_setås rcCs|d|d<dS)z¡policy : policy_stmt | optional_policy | tunable_policy | ifdef | ifelse | conditional rrNr\rƒr\r\r_Úp_policyïsr®cCs|dr|dg|d<dS)aÛpolicy_stmt : gen_require | avrule_def | typerule_def | typebound_def | typeattribute_def | roleattribute_def | interface_call | role_def | role_allow | permissive | type_def | typealias_def | attribute_def | attribute_role_def | range_transition_def | role_transition_def | bool | gen_tunable | define | initial_sid | genfscon | fs_use | portcon | nodecon | netifcon | pirqcon | iomemcon | ioportcon | pcidevicecon | devicetreecon rrNr\rƒr\r\r_Ú p_policy_stmtùs r¯cCs.t ¡}|d|_|d|_d|_||d<dS)z+module_stmt : MODULE IDENTIFIER NUMBER SEMIr€rˆFrNrŠrr\r\r_Ú p_module_stmts r°cCsdS)zlgen_require : GEN_REQ OPAREN TICK requires SQUOTE CPAREN | REQUIRE OBRACE requires CBRACENr\rƒr\r\r_Ú p_gen_require$sr±cCsdS)zsrequires : require | requires require | ifdef | requires ifdef Nr\rƒr\r\r_Ú p_requires,sr²cCsdS)zñrequire : TYPE comma_list SEMI | ROLE comma_list SEMI | ATTRIBUTE comma_list SEMI | ATTRIBUTE_ROLE comma_list SEMI | CLASS comma_list SEMI | BOOL comma_list SEMI Nr\rƒr\r\r_Ú p_require4sr³cCsHt ¡}|d|_|d|_|d|_t|ƒdkr<|d|_||d<dS)zšsecurity_context : IDENTIFIER COLON IDENTIFIER COLON IDENTIFIER | IDENTIFIER COLON IDENTIFIER COLON IDENTIFIER COLON mls_range_defrrˆr‰éršrN)rZSecurityContextÚuserrRrLrqÚlevelr¬r\r\r_Úp_security_context>s r·cCs|d}|d|_||d<dS)zQgen_context : GEN_CONTEXT OPAREN security_context COMMA mls_range_def CPAREN rˆr‰rN)r¶r¬r\r\r_Ú p_gen_contextKs r¸cCs|d|d<dS)z.oc s ˆrˆd|ƒz.t|ƒ}| ¡}| ¡|at|||ˆƒWn\tyd}zWYd}~dSd}~0tyš}z td|t|ƒfƒ‚WYd}~n d}~00dS)Nzparsing file %s zerror parsing file %s: %s)ÚopenÚreadÚcloserrÚIOErrorrr)rÀrGr{ÚfdZtxtr)rr›r\r_rEsz!parse_headers..parse_filezParsing support macros (%s): Úcan_exec) z$1z$2ÚfileZexecute_no_transr-r.ÚgetattrÚlockZexecuteZioctlzdone. )ZstepszParsing interface filesrz!failed to parse some headers: %s z, )N)rsr*rZHeadersrr½ÚisfileÚsplitrrr‚r)rÚheadersrrur‘rZAccessVectorräZConsoleProgressBarÚsysÚstdoutrqrÅrr‹rÚsteprÓ)r!r,rrr*r8r"r#r‹r'Zall_modulesrr{r2ÚavÚstatusZfailuresr“rrr\)rr›r,r_Ú parse_headers,s` $ r>)N)NNF)NTF)wr9rrrrsrrrrrÚtokensriZt_TICKZt_SQUOTEZt_OBRACEZt_CBRACEZt_SEMIZt_COLONZt_OPARENZt_CPARENZt_COMMAZt_MINUSZt_TILDEZ t_ASTERISKZt_AMPZt_BARZt_EXPLZt_EQUALZt_NUMBERZt_PATHZt_ignorer`rdrfrgrlrmrnrprrrrrr{rryrr…r†r‡rŽr”r•r–r˜rœr r¡r£r§r©rªrr®r¯r°r±r²r³r·r¸r¹r»r¿rÁrÄrÉrÊrËrÌrÍrÎrÏrÐrÔrÙrÜrÝrÞrárârãrérërìrñròrôrõrör÷rørúrûrürýrþrÿrrrrr r rbrrr)r>r\r\r\r_Ú sT\ÂE #