a
Bi @ s d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZ d dlZddl m
Z
ddl m Z ddl m Z ddl m
Z
ddl mZ dd l mZ dd
l mZ dd l mZ dd l mZ dd
l mZ ddl mZ ddl mZ ddl mZ ddl mZ ddl mZ d dlmZ d dlm Z dZ zHd dl Z i Z ej dk r6de d< e j!e fddie ddiZ"e"j Z#W nJ zd dl$Z$e%e$j&d< W n& e'y d dl(Z(e)e(j&d< Y n0 Y n0 dd Z*d d Z+d d Z,d!d" Z-d Z.dZ/d#Z0d$Z1d%Z2d&Z3d Z4dZ5d#Z6d$Z7d'Z8d(Z9d)Z:d*Z;d+Zd.Z?d/Z@i ZAe#d0eAe4< e#d1eAe5< e#d2eAe6< e#d3eAe7< e#d4eAe8< e#d5eAe9< e#d6eAe:< e#d7eAe;< e#d8eAe<< e#d9eAe=< e#d:eAe>< e#d;eAe?< e#d<eAe@< d=d> ZBe4e5e6e9e7gZCee?gZDd?d@ ZEG dAdB dBZFdS )C N)
get_all_typesget_all_attributes
get_all_roles )
executable)boolean)etc_rw) unit_file) var_cache) var_spool)var_lib)var_log)var_run)tmp)rw)network)script)spec)userzselinux-python) Tunicode localedirz/usr/share/localefallback_c C sF | d }| d }| d }|d | dd }| dd }|||gS )z6Given an RPM header return the package NVR as a stringnameversionrelease-.r r )split)Zhdrr r r Zrelease_versionZ
os_version r 5/usr/lib/python3.9/site-packages/sepolicy/generate.pyget_rpm_nvr_from_headerG s r" c C s^ zp z!get_all_users..Zsystem_uroot)r- r. USERremovesort)usersr r r!
get_all_userso s
r< r z_admin$z_role$
zStandard Init DaemonzDBUS System DaemonzInternet Services Daemonz Web Application/Script (CGI)ZSandboxzUser ApplicationzExisting Domain Typez Minimal Terminal Login User Rolez!Minimal X Windows Login User RolezDesktop Login User Rolez Administrator Login User Rolez Confined Root Administrator Rolez!Module information for a new typec C s: t } | td}| D ]}|d|t | f 7 }q |S )Nz
Valid Types:
z%2s: %s
)poltypekeysr: r )rH msgkr r r! get_poltype_desc s rK c C s | dkr g S d}zg }| dD ]}| d}t|dkr>tt|dkrdt|d }t|d }n$t|d }t|d }||krtt||d D ]"}|dk s||krt|| qq |W S ty ttd| Y n0 d S ) N i ,r r= r r z8Ports must be numbers or ranges of numbers from 1 to %d )r len
ValueErrorintr+ appendr )portsZmax_porttemparbeginendr1 r r r! verify_ports s.
rX c @ s e Zd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
d Z dd Z
dd Z dd Z dd Z
dd Zdd Zdd Zdd d Zd d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ Zd0d1 Zd2d3 Zd4d5 Z d6d7 Z d8d9 Z d:d; Z dd? Z!d@dA Z"dBdC Z#dDdE Z$dFdG Z%dHdI Z&dJdK Z'dLdM Z(dNdO Z)dPdQ Z*dRdS Z+dTdU Z,dVdW Z-dXdY Z.dZd[ Z/d\d] Z0d^d_ Z1d`da Z2dbdc Z3ddde Z4dfdg Z5dhdi Z6djdk Z7dldm Z8dndo Z9dpdq Z:drds Z;dtdu Zdzd{ Z?d|d} Z@d~d ZAdd ZBdd ZCdd ZDdd ZEdd ZFdd ZGdd ZHdd ZIdd ZJdd ZKdd ZLdd ZMdd ZNdd ZOdd ZPdd ZQdd ZRdd ZSdd ZTdd ZUdd ZVdd ZWdd ZXdd ZYdd ZZdd Z[dd Z\dd Z]dd Z^dd Z_dd Z`dd Zadd ZbddÄ Zcddń ZdddDŽ ZeddɄ Zfdd˄ Zgdd̈́ Zhddτ Ziddф Zjddӄ ZkddՄ Zlddׄ Zmddل Znddۄ Zodd݄ Zpdd߄ Zqdd Zrdd Zsetu fddZvdS )policyc C s g | _ i | _t | _g | _|tvr.ttd|sFttdt| z t | _W nX ty~ } zt d W Y d }~n6d }~0 t
y } zt d| W Y d }~n
d }~0 0 i | _ d| j d< d| j d< d| j d< d | j d
< d | j d < d | j d < d| j d
< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d < d | j d < d | j d < d!| j d"< d#| j d$< d%| j d&< d'| j d(< d)| j d*< d+| j d,< d-| j d.< d/| j d0< d1| j d2< d3| j d4< d5| j d6< d7| j d8< d9| j d:< d;| j d<< d=| j d>< d?| j d@< dA| j dB< dC| j dD< dE| j dF< dG| j dH< dI| j dJ< dK| j dL< dM| j dN< dO| j dP< dQ| j dR< dS| j dT< dU| j dV< dW| j dX< dY| j dZ< d[| j d\< d]| j d^< d_| j d`< da| j db< da| j dc< da| j dd< da| j de< df| j dg< df| j dh< df| j di< df| j dj< df| j dg< dk| j dl< dm| j dn< do| j dp< dq| j dr< ds| j dt< du| j dv< dw| j dx< dy| j dz< d{| j d|< d}| j d~< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< i | _ dg t
g| j d< dg tg| j d< dg tg| j d< dg tg| j d< dg tg| j d< dg tg| j d< dg tg| j d< dg tg| j d< dg tg| j d< dg tg| j d< dg tg| j d< i | _t| jd< t| jd< t| jd< t| jd< t| jd< t| jd< t| jd< t| jd< g d| _| j| jf| j| j f| j | j f| j | j f| j!| j"f| j#| j$f| j%| j&f| j'| j(f| j)| j*f| j+| j(f| j,| j(f| j-| j.f| j/| j0ff
| _1t23d|sttd|t4krd| | _5n|| _5|| _6g | _7g | _8|| _9d| _:d | _;dddg g| _dddg g| _?d| _@d| _Ad| _Bd| _Cd| _Dd| _Ed| _Fd| _Gd| _H| j9tItJfv| _K| j9tItJfv| _L| j9tItJfv| _Md| _Nd| _Oi | _Pi | _Qi | _Rg | _Sg | _Td| _Ud| _Vg | _Wg | _Xg | _Yg | _Zg | _[d S )Nz"You must enter a valid policy typez;You must enter a name for your policy module for your '%s'.z9Can not get port types, must be root for this informationzCan not get port typeszset_use_kerberos(True)Zopenlogzset_use_kerb_rcache(True)zset_use_syslog(True)zset_use_resolve(True)Z gethostbyZ getaddrinfoZ getnameinfoZkrbz set_manage_krb5_rcache(True)Zgss_accept_sec_contextZkrb5_verify_init_credsZ krb5_rd_reqZ __syslog_chkzset_use_uid(True)getpwnamgetpwuidzset_use_dbus(True)Zdbus_zset_use_pam(True)Zpam_zset_use_audit(True)zadd_process('fork')forkzadd_process('transition')Z
transitionzadd_process('sigchld')Zsigchldzadd_process('sigkill')Zsigkillzadd_process('sigstop')Zsigstopzadd_process('signull')Zsignullzadd_process('ptrace')Zptracezadd_process('getsched')Zgetschedzadd_process('setsched')Zsetschedzadd_process('getsession')Z
getsessionzadd_process('getpgid')getpgidzadd_process('setpgid')setpgidzadd_process('getcap')Zgetcapzadd_process('setcap')Zsetcapzadd_process('share')Zsharezadd_process('getattr')getattrzadd_process('setexec')Zsetexeczadd_process('setfscreate')Z setfscreatezadd_process('noatsecure')Z
noatsecurezadd_process('siginh')Zsiginhzadd_process('signal_perms')killzadd_process('setrlimit')Z setrlimitzadd_process('rlimitinh')Z rlimitinhz add_process('dyntransition')Z
dyntransitionzadd_process('setcurrent')Z
setcurrentzadd_process('execmem')Zexecmemzadd_process('execstack')Z execstackzadd_process('execheap')Zexecheapzadd_process('setkeycreate')Z setkeycreatez add_process('setsockcreate')Z
setsockcreatezadd_capability('chown')chownz add_capability('dac_override')Z dac_overridez!add_capability('dac_read_search')Zdac_read_searchzadd_capability('fowner')Zfownerzadd_capability('fsetid')Zfsetidzadd_capability('setgid')setgidsetegid setresgidsetregidzadd_capability('setuid') setresuidsetuidseteuidsetreuidzadd_capability('setpcap')Zsetpcapz!add_capability('linux_immutable')Zlinux_immutablez"add_capability('net_bind_service')Znet_bind_servicez add_capability('net_broadcast')Z
net_broadcastzadd_capability('net_admin')Z net_adminzadd_capability('net_raw')Znet_rawzadd_capability('ipc_lock')Zipc_lockzadd_capability('ipc_owner')Z ipc_ownerz add_capability('sys_module')
sys_modulezadd_capability('sys_rawio')Z sys_rawioz add_capability('sys_chroot')chrootZ
sys_chrootz add_capability('sys_ptrace')Z
sys_ptracezadd_capability('sys_pacct')Z sys_pacctzadd_capability('sys_admin')ZmountZunshareZ sys_adminzadd_capability('sys_boot')Zsys_bootzadd_capability('sys_nice')Zsys_nicez add_capability('sys_resource')Z sys_resourcezadd_capability('sys_time')Zsys_timez add_capability('sys_tty_config')Zsys_tty_configzadd_capability('mknod')mknodzadd_capability('lease')Zleasez add_capability('audit_write')Z audit_writez add_capability('audit_control')Z
audit_controlzadd_capability('setfcap')Zsetfcapr /etcr /tmpr r /usr/lib/systemd/system/lib/systemd/system/etc/systemd/systemr
/var/cacher /var/libr
/var/logr /var/runr
/var/spoolZ_tmp_tZ _unit_file_tZ _var_cache_tZ
_var_lib_tZ
_var_log_tZ
_var_run_tZ _var_spool_tZ_port_t) rm rr rt rn r rs ru rv rq ro rp z^[a-zA-Z0-9-_]+$zOName must be alphanumeric with no spaces. Consider using option "-n MODULENAME"zhttpd_%s_scriptrL F)\rpmsrR r all_rolestypesrG rO r r2 r% RuntimeErrorsymbols DEFAULT_DIRSr r r r r
r r
r r DEFAULT_EXTr DEFAULT_KEYSgenerate_daemon_typesgenerate_daemon_rulesgenerate_dbusd_typesgenerate_dbusd_rulesgenerate_inetd_typesgenerate_inetd_rulesgenerate_cgi_typesgenerate_cgi_rulesgenerate_sandbox_typesgenerate_sandbox_rulesgenerate_userapp_typesgenerate_userapp_rules generate_existing_user_types generate_existing_user_rules generate_min_login_user_typesgenerate_login_user_rulesgenerate_x_login_user_typesgenerate_x_login_user_rulesgenerate_login_user_typesgenerate_admin_user_typesgenerate_root_user_typesgenerate_root_user_rulesgenerate_new_typesgenerate_new_rules
DEFAULT_TYPESrematchCGIr file_name capabilities processesr*
initscriptprogramin_tcpin_udpout_tcpout_udp use_resolveuse_tmpuse_uid
use_syslog use_kerberosmanage_krb5_rcacheuse_pamuse_dbus use_auditEUSERNEWTYPEuse_etcuse_localizationuse_fd use_terminaluse_mailbooleansfilesdirsfound_tcp_portsfound_udp_ports
need_tcp_type
need_udp_type
admin_domainsexisting_domainstransition_domainstransition_usersroles)selfr r* er r r! __init__ sf
zpolicy.__init__c C s( |t p&|t p&|t p&t|t dkS Nr )ALLRESERVED
UNRESERVEDrN PORTS)r lr r r! Z
__isnetset s zpolicy.__isnetsetc C s
|| _ d S N)r )r r r r r! set_admin_domains s zpolicy.set_admin_domainsc C s
|| _ d S r )r )r r r r r! set_existing_domains s zpolicy.set_existing_domainsc C s
|| _ d S r )r )r r r r r! set_admin_roles s zpolicy.set_admin_rolesc C s
|| _ d S r )r )r r r r r! set_transition_domains s z policy.set_transition_domainsc C s
|| _ d S r )r )r r r r r! set_transition_users s zpolicy.set_transition_usersc C s | | jS r )_policy__isnetsetr r r r r!
use_in_udp s zpolicy.use_in_udpc C s | | jS r )r r r r r r! use_out_udp s zpolicy.use_out_udpc C s | p| S r )r r r r r r! use_udp s zpolicy.use_udpc C s | | jS r )r r r r r r!
use_in_tcp s zpolicy.use_in_tcpc C s | | jS r )r r r r r r! use_out_tcp s zpolicy.use_out_tcpc C s | p| S r )r r r r r r! use_tcp s zpolicy.use_tcpc C s | p| S r )r r r r r r! use_network s zpolicy.use_networktcpc C sF | j D ]6\}}}||kr
||kr
||kr
| j |||f S q
d S r )rR rH )r portr, rV rW r1 r r r! find_port s zpolicy.find_portc C s | j tvrttd|| _d S )Nz0User Role types can not be assigned executables.)r* APPLICATIONSrO r r )r r r r r! set_program s
zpolicy.set_programc C s | j tkrttd|| _d S )Nz(Only Daemon apps can use an init script.)r* DAEMONrO r r )r r r r r! set_init_script s
zpolicy.set_init_scriptc C s |||t |g| _d S r )rX r r allZreservedZ
unreservedrR r r r!
set_in_tcp s zpolicy.set_in_tcpc C s |||t |g| _d S r )rX r r r r r!
set_in_udp s zpolicy.set_in_udpc C s |ddt |g| _d S NF)rX r r r rR r r r! set_out_tcp s zpolicy.set_out_tcpc C s |ddt |g| _d S r )rX r r r r r! set_out_udp s zpolicy.set_out_udpc C s" t |turttd|| _d S )Nz$use_resolve must be a boolean value )r* boolrO r r r valr r r! set_use_resolve s zpolicy.set_use_resolvec C s" t |turttd|| _d S )Nz#use_syslog must be a boolean value )r* r rO r r r r r r! set_use_syslog s zpolicy.set_use_syslogc C s" t |turttd|| _d S )Nz%use_kerberos must be a boolean value )r* r rO r r r r r r! set_use_kerberos s zpolicy.set_use_kerberosc C s" t |turttd|| _d S )Nz+manage_krb5_rcache must be a boolean value )r* r rO r r r r r r! set_manage_krb5_rcache s z policy.set_manage_krb5_rcachec C s |du | _ d S NT)r r r r r! set_use_pam s zpolicy.set_use_pamc C s |du | _ d S r )r r r r r! set_use_dbus s zpolicy.set_use_dbusc C s |du | _ d S r )r r r r r!
set_use_audit s zpolicy.set_use_auditc C s |du | _ d S r )r r r r r! set_use_etc s zpolicy.set_use_etcc C s |du | _ d S r )r r r r r! set_use_localization s zpolicy.set_use_localizationc C s |du | _ d S r )r r r r r!
set_use_fd s zpolicy.set_use_fdc C s |du | _ d S r )r r r r r! set_use_terminal s zpolicy.set_use_terminalc C s |du | _ d S r )r r r r r! set_use_mail s zpolicy.set_use_mailc C sB | j tv rttd|r0| jd d d ng | jd d< d S )Nz'USER Types automatically get a tmp typern r )r* USERSrO r r| rQ r r r r! set_use_tmp s
zpolicy.set_use_tmpc C s |du | _ d S r )r r r r r! set_use_uid s zpolicy.set_use_uidc C s | j rtd| jtjS dS d S N TEMPLATETYPErL )r r subr r Z te_uid_rulesr r r r! generate_uid_rules s zpolicy.generate_uid_rulesc C s | j rtd| jtjS dS d S r )r r r r r Zte_syslog_rulesr r r r! generate_syslog_rules s z policy.generate_syslog_rulesc C s | j rtd| jtjS dS d S r )r r r r r Zte_resolve_rulesr r r r! generate_resolve_rules s z policy.generate_resolve_rulesc C s | j rtd| jtjS dS d S r )r r r r r Zte_kerberos_rulesr r r r! generate_kerberos_rules s z policy.generate_kerberos_rulesc C s | j rtd| jtjS dS d S r )r r r r r Zte_manage_krb5_rcache_rulesr r r r! !generate_manage_krb5_rcache_rules s z(policy.generate_manage_krb5_rcache_rulesc C s d}| j r td| jtj}|S NrL r )r r r r r Z te_pam_rulesr newter r r! generate_pam_rules& s zpolicy.generate_pam_rulesc C s d}| j r td| jtj}|S r )r r r r r Zte_audit_rulesr r r r! generate_audit_rules, s zpolicy.generate_audit_rulesc C s d}| j r td| jtj}|S r )r r r r r Z te_etc_rulesr r r r! generate_etc_rules2 s zpolicy.generate_etc_rulesc C s d}| j r td| jtj}|S r )r r r r r Z te_fd_rulesr r r r! generate_fd_rules8 s zpolicy.generate_fd_rulesc C s d}| j r td| jtj}|S r )r r r r r Zte_localization_rulesr r r r! generate_localization_rules> s z"policy.generate_localization_rulesc C s* d}| j tkr&| jr&td| jtj}|S r )r* DBUSr r r r r Z
te_dbus_rulesr r r r! generate_dbus_rulesD s zpolicy.generate_dbus_rulesc C s d}| j r td| jtj}|S r )r r r r r Z
te_mail_rulesr r r r! generate_mail_rulesJ s zpolicy.generate_mail_rulesc C sF d}d|||f }|t v r.d|| jf }nd|| j|||f }|S )NrL zcorenet_%s_%s_%sz %s(%s_t)
zD
gen_require(`
type %s_t;
')
allow %s_t %s_t:%s_socket name_%s;
)r- Z get_methodsr )r r, action port_namelinemethodr r r! generate_network_actionP s z policy.generate_network_actionc C sZ | j t D ]X}| t|d}|d u r.d| _q
|d d d }| dd|}|| jvr
| j| q
| jt D ]X}| t|d}|d u rd| _qn|d d d }| dd|}|| jvrn| j| qn| j t D ]X}| t|d}|d u rd| _
q|d d d }| dd|}|| j vr| j | q| j
du sD| jdu rVt
d| jtjS d S )
Nr Tr ZbindZconnectudpr rL )r r r rP r r r rQ r r r r r r r r te_types)r iZrecr r r r r! generate_network_types^ s6
z policy.generate_network_typesc C sZ | j D ]4}||dkr| j | d | | j | S q| j d d | | j d S )Nr r r )r| findrQ )r filedr r r! Z __find_path s
zpolicy.__find_pathc C s || j vr| j | d S r )r rQ )r Z
capabilityr r r! add_capability s
zpolicy.add_capabilityc C s
|| _ d S r )ry )r ry r r r! set_types s zpolicy.set_typesc C s || j vr| j | d S r )r rQ )r Zprocessr r r! add_process s
zpolicy.add_processc C s || j |< d S r )r )r r descriptionr r r! add_boolean s zpolicy.add_booleanc C s | || j|< d S r )_policy__find_pathr r r r r r! add_file s zpolicy.add_filec C s | || j|< d S r )r r r r r r! add_dir s zpolicy.add_dirc C s6 d}| j t| j dkr2d| jd| j f }|S )NrL r z#allow %s_t self:capability { %s };
)r r: rN r joinr r r r! generate_capabilities s
z policy.generate_capabilitiesc C s6 d}| j t| j dkr2d| jd| j f }|S )NrL r z allow %s_t self:process { %s };
r# )r r: rN r r$ r r r r! generate_process s
zpolicy.generate_processc C s d}| rd}|td| jtj7 }| r|d7 }|td| jtj7 }| r|td| jtj 7 }| j
rt | j t
dkr|td| jtj7 }| j
rt | jt
dkr|td| jtj7 }| j t r|td| jtj7 }| j t r |td| jtj7 }| j t r.|td| jtj7 }| jt rP|td| jtj7 }| jt rr|td| jtj7 }| jt r|td| jtj7 }| jD ]}||7 }q| r|d7 }|td| jtj 7 }| j r|td| jtj 7 }| r|td| jtj 7 }| j!t r2|td| jtj"7 }| j!t rT|td| jtj#7 }| j!t rv|td| jtj$7 }| j%D ]}||7 }q||S )NrL
r r )&r r r r r Z
te_networkr Zte_tcpr Z te_in_tcpr rN r r Zte_in_need_port_tcpr Zte_out_need_port_tcpr Zte_in_all_ports_tcpr Zte_in_reserved_ports_tcpr Zte_in_unreserved_ports_tcpZte_out_all_ports_tcpZte_out_reserved_ports_tcpZte_out_unreserved_ports_tcpr r Zte_udpr Zte_in_need_port_udpr Z te_in_udpr Zte_in_all_ports_udpZte_in_reserved_ports_udpZte_in_unreserved_ports_udpr )r r r r r r! generate_network_rules sV
z policy.generate_network_rulesc C s| d}| j D ](}td| jtj}|td||7 }q
| jtkrx| jD ]2}td| jt j
}|td| dd |7 }qD|S )NrL r APPLICATIONr8 _ur ) r r r r r Zte_transition_rulesr* r8 r r Z te_run_rulesr )r r appr urS r r r! generate_transition_rules s
z policy.generate_transition_rulesc C s d}| j tkrz| jD ]`}|dd }|d }| jD ]>}td|tj}|| j vr`t|d|}|td||7 }q4q|S | j t
kr|td| j tj 7 }| jD ](}td| j tj}|td||7 }q| j
D ]D}|dd }|d | j v rtd| j tj}|td ||7 }q|S )
NrL _tr _rr Zsystem_rr) r* r8 )r* r r r r r r r Zte_admin_domain_rulesrx RUSERr Zte_admin_rulesr Zte_admin_trans_rules)r r r r roler+ r r, r r r! generate_admin_rules s,
zpolicy.generate_admin_rulesc C s d}| j r td| jtj}|S r )r r r r r Z
if_dbus_rulesr newifr r r! generate_dbus_if s zpolicy.generate_dbus_ifc C s( d}| j tkr|S td| jtj}|S r )r* SANDBOXr r r r Zif_sandbox_rulesr3 r r r! generate_sandbox_if s
zpolicy.generate_sandbox_ifc C s d}d}| j dkr>|td| jtj7 }|td| jtj7 }| jD ]Z}t| j | d dkrD|td| j| j | d j
7 }|td| j| j | d j 7 }qD|dkrtd| jtj }||7 }|td| jtj
7 }||7 }|td| jtj7 }|S dS NrL r r r r= )r r r r r Zif_initscript_admin_typesZif_initscript_adminr~ rN r| Zif_admin_typesZif_admin_rulesZif_begin_adminZif_middle_adminZ if_end_admin)r r4 Znewtypesr retr r r! generate_admin_if s"
"zpolicy.generate_admin_ifc C s t d| jtjS Nr )r r r r te_cgi_typesr r r r! r 5 s zpolicy.generate_cgi_typesc C s t d| jtjS r; )r r r r te_sandbox_typesr r r r! r 8 s z policy.generate_sandbox_typesc C s t d| jtjS r; )r r r r Zte_userapp_typesr r r r! r ; s z policy.generate_userapp_typesc C s t d| jtjS r; )r r r r Zte_inetd_typesr r r r! r > s zpolicy.generate_inetd_typesc C s t d| jtjS r; )r r r r Zte_dbusd_typesr r r r! r A s zpolicy.generate_dbusd_typesc C s t d| jtjS r; )r r r r Zte_min_login_user_typesr r r r! r D s z$policy.generate_min_login_user_typesc C s t d| jtjS r; )r r r r Zte_login_user_typesr r r r! r G s z policy.generate_login_user_typesc C s t d| jtjS r; )r r r r Zte_admin_user_typesr r r r! r J s z policy.generate_admin_user_typesc C s t | jdkr$ttdt| j td| jt j
}|d7 }| jD ]8}|d| 7 }| dd d }|| j v rD|d| 7 }qD|d 7 }|S )
Nr z,'%s' policy modules require existing domainsr z
gen_require(`z
type %s;r. r/ z
role %s;z
')
)
rN r rO r rG r* r r r r Zte_existing_user_typesr rx )r r r r1 r r r! r M s
z#policy.generate_existing_user_typesc C s t d| jtjS r; )r r r r Zte_x_login_user_typesr r r r! r _ s z"policy.generate_x_login_user_typesc C s t d| jtjS r; )r r r r Zte_root_user_typesr r r r! r b s z policy.generate_root_user_typesc
C s d}t | jdkr ttd| jD ]^}| jD ]R}||r.t||d t | |td|d t | | j| j 7 } q$q.q$t
r|dkrg }| jD ]}| | qttdd | |S )NrL r zType field requiredr z3You need to define a new type which ends with:
%sz
)
rN ry rO r r} endswithr% r r r r rQ r$ )r r tr Z default_extr r r! r e s
(
zpolicy.generate_new_typesc C s dS )NrL r r r r r! r y s zpolicy.generate_new_rulesc C s6 t d| jtj}| jdkr2|t d| jtj7 }|S r )r r r r Zte_daemon_typesr Zte_initscript_typesr r r r! r | s
z policy.generate_daemon_typesc C s | j rtd| jtjS dS d S r )r r r r r r r r r r! generate_tmp_types s zpolicy.generate_tmp_typesc C s< d}| j D ],}td|tj}|td| j | |7 }q
|S )NrL BOOLEANZ DESCRIPTION)r r r r Z
te_boolean)r r br r r r! generate_booleans s
zpolicy.generate_booleansc C s( d}| j D ]}|td|tj7 }q
|S )NrL rA )r r r r te_rules)r r rB r r r! generate_boolean_rules s
z policy.generate_boolean_rulesc C s t d| jtjS r; )r r r r r= r r r r! generate_sandbox_te s zpolicy.generate_sandbox_tec C s t d| jtjS r; )r r r r r< r r r r! generate_cgi_te s zpolicy.generate_cgi_tec C s t d| jtj}|S r; )r r r r Zte_daemon_rulesr3 r r r! r s z policy.generate_daemon_rulesc
C sl d}| j D ]\}| jD ]P}||r|d t| d }|td|d t| | j| j7 } q
qq
|S )NrL r. r )ry r} r> rN r r if_rules)r r4 r? r Zreqtyper r r! generate_new_type_if s
(zpolicy.generate_new_type_ifc C s t d| jtjS r; )r r r r Zte_login_user_rulesr r r r! r s z policy.generate_login_user_rulesc C s t d| jtj}|S r; )r r r r Zte_existing_user_rules)r Znerulesr r r! r s z#policy.generate_existing_user_rulesc C s t d| jtjS r; )r r r r Zte_x_login_user_rulesr r r r! r s z"policy.generate_x_login_user_rulesc C s t d| jtj}|S r; )r r r r Zte_root_user_rulesr r r r! r s z policy.generate_root_user_rulesc C s t d| jtjS r; )r r r r Zte_userapp_rulesr r r r! r s z policy.generate_userapp_rulesc C s t d| jtjS r; )r r r r Zte_inetd_rulesr r r r! r s zpolicy.generate_inetd_rulesc C s t d| jtjS r; )r r r r Zte_dbusd_rulesr r r r! r s zpolicy.generate_dbusd_rulesc C s | j rtd| jtjS dS d S r )r r r r r rD r r r r! generate_tmp_rules s zpolicy.generate_tmp_rulesc C s d}|t d| jtj7 }|S r )r r r r Z te_cgi_rulesr r r r! r s zpolicy.generate_cgi_rulesc C s d}|t d| jtj7 }|S r )r r r r Zte_sandbox_rulesr r r r! r s z policy.generate_sandbox_rulesc C sR d}| j s| jtkr&td| jtj}| jtt t
t fv rN|td| jtj 7 }|S r )
r r* r8 r r r r Zif_user_program_rulesTUSERXUSERAUSERLUSERZif_role_change_rulesr3 r r r! generate_user_if s zpolicy.generate_user_ifc C s> d}|t d| jtj7 }| jr6|t d| jtj7 }| jdkrV|t d| jtj7 }| j D ]}t
| j | d dkr\|t d| j| j | d j 7 }| j | d D ]J}t
j|rtt
|tj r|t d| j| j | d j7 } q\qq\|| 7 }|| 7 }|| 7 }|| 7 }|| 7 }|| 7 }|S r8 )r r r r Zif_heading_rulesr Zif_program_rulesr Zif_initscript_rulesr~ rN r| rH ospathexistsstatS_ISSOCKST_MODEZif_stream_rulesrO r5 r: r7 rI r )r r4 r r r r r! generate_if s(
" zpolicy.generate_ifc C s | j | j d S r r r* r r r r! generate_default_types s z policy.generate_default_typesc C s& | j | j d r"| j | j d S dS )Nr rL rW r r r r! generate_default_rules s z policy.generate_default_rulesc C s d}| j ttttfv rd}t| jdkr|td| j t
j 7 }|td| j t
j 7 }| jD ](}td| j t
j
}|td||7 }qZ|S )NrL r r ZROLE)r* rK rL rM rN rN r r r r r Z
te_sudo_rulesZte_newrole_rulesZte_roles_rules)r r r r1 r r r r! generate_roles_rules s
zpolicy.generate_roles_rulesc
C s | }| jD ]L}t| j| d dkr| jtks:|dkr|td| j| j| d j 7 }q| jt
krt|d| j 7 }|| 7 }|| 7 }||
7 }|| 7 }|| 7 }|| 7 }|| 7 }| jD ]>}t| j| d dkr| jt
krLd}| jD ]H}|td|d d d
| j| d j7 }|td | jd |7 }q n |td| j| j| d j7 }| j| d D ]}tj|rztt|tj rz| jt
kr| jD ],}|td|d d | j| d j7 }qn |td| j| j| d j7 } qΐqzq|| 7 }|| 7 }|| 7 }|| 7 }|| 7 }|| 7 }|| ! 7 }|| " 7 }|| # 7 }|| $ 7 }|| % 7 }|| & 7 }|| ' 7 }|| ( 7 }|| ) 7 }|| * 7 }|| + 7 }|S )
Nr r r r r= z@
########################################
#
# %s local policy
#
rL ZTEMPLATETYPE_tr r. ZTEMPLATETYPE_rw_tZ_rw_t),rX r~ rN r| r* r r r r r r r% r& r r@ rC rY rE r rD rP rQ rR rS rT rU Zte_stream_rulesrJ r( r r r r r r r r rZ r r- r2 r r r )r r r Z newte_tmpdomainr r r r! generate_te sb
"
* &
,
zpolicy.generate_tec C s d}g }| j D ]}tj|rVtt|tj rVt d| j
| j | d j }n t d| j
| j | d j }t d||}|
t d| j | d | q| j D ]L}t d| j
| j| d j}t d||}|
t d| j| d | q| jttg v r t|dkr tjS | jttttg vrH| jsHttd| jrxt d| jtj}|
t d| j
| | j dkrt d| j tj }|
t d| j
| | d |}|S )
NrL r r= FILENAMEZFILETYPEr z
zpolicy.generate_specc C s2 d|| j f }t|d}|| | |S )Nz%s/%s_selinux.specw)r openwriterg close)r out_dirZspecfilefdr r r!
write_spec s
zpolicy.write_specc C s2 d|| j f }t|d}|| | |S )Nz%s/%s.terh )r ri rj r\ rk )r rl Ztefilerm r r r! write_te s
zpolicy.write_tec C s> d|| j f }t|d}|| | t|d |S )Nz%s/%s.shrh i )r ri rj rd rk rP chmod)r rl Zshfilerm r r r! write_sh s
zpolicy.write_shc C s2 d|| j f }t|d}|| | |S )Nz%s/%s.ifrh )r ri rj rV rk )r rl Ziffilerm r r r! write_if s
zpolicy.write_ifc C s2 d|| j f }t|d}|| | |S )Nz%s/%s.fcrh )r ri rj r` rk )r rl Zfcfilerm r r r! write_fc s
zpolicy.write_fcc
C sB dd l }| }| |jdd |j }| }|j| jd}|D ]}| j
|j |j D ]F}| j
D ]:}|dkr|qn||rntj|r| | qn| | qnqd| }|j|jd}|D ]T} | j D ]H}| j
D ]<}|dkrq||rtj|r | | q| | qqqqLW d n1 s40 Y d S )Nr T)Zload_system_repo)r rm )Zprovides)dnfZBaseZread_all_reposZ fill_sackZsackqueryZ availablefilterr rw rQ r r r|
startswithrP rQ isfiler! r" Z source_name)
r rt baseru ZpqpkgfnamerB sqZbpkgr r r! Z__extract_rpms s8
zpolicy.__extract_rpmsc C s z | W n ty Y n0 tjd| j rB| d| j tjd| j rd| d| j tjd| j r| d| j tjd| j r| d| j tjd| j r| d| j tjd| j r| d| j g }| j
D ]}g }z| j
| d d d
}W n t y4 Y qY n0 | j
| d D ]"}|
|rD|| nqDqDt|d kr|D ]>}|| j v r| j|= n || j v rx| j|= nqxqxtt| j
| d t| | j
| d< qd S ) Nz/var/run/%s.pidz /var/run/%sz /var/log/%sz/var/log/%s.logz /var/lib/%sz/etc/rc.d/init.d/%sz/etc/rc\.d/init\.d/%sr r /)_policy__extract_rpms ImportErrorrP rQ rx r r! isdirr" r r| rH
IndexErrorrw rQ rN r r listset)r Z
temp_basepathr1 Z temp_dirsr r r r!
gen_writeable sF
zpolicy.gen_writeablec C s | j tvrd S tj| js2tjd| j d S t d| j }|
D ],}| j D ] }|
|rXtd| j | qXqN| d S )Nzl
***************************************
Warning %s does not exist
***************************************
znm -D %s | grep Uzself.%s)r* r rP rQ rR r sysstderrrj popenreadr r{ rw execrk )r rm srB r r r! gen_symbolsI s
zpolicy.gen_symbolsc C s t d}|d| |t df 7 }|d| |t df 7 }|d| |t df 7 }| jtkr|d| |t df 7 }|d| |t df 7 }|S )Nz Created the following files:
z%s # %s
zType Enforcement filezInterface filezFile Contexts filez Spec filez Setup Script)r ro rr rs r* r rn rq )r rl outr r r! generate[ s
zpolicy.generateN)r )w__name__
__module__ __qualname__r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r! r" r% r& r( r- r2 r5 r7 r: r r r r r r r r r r r r r r r@ rC rE rF rG r rI r r r r r r r rJ r r rO rV rX rY rZ r\ r` rb rd rg rn ro rq rr rs r~ r r rP getcwdr r r r r! rY s B
&8
>##*$3rY )GrP r rS r r- r r r re Z templatesr r r r r
r r r
r r r r r r r Zsepolgen.interfacesZ
interfacesZsepolgen.defaultsdefaultsZPROGNAMEgettextkwargs version_info translationr? r builtinsstr__dict__r Z __builtin__r r" r) r2 r< r r r r ZADMIN_TRANSITION_INTERFACEZUSER_TRANSITION_INTERFACEr r
ZINETDr r6 r8 r rK rL rN rM r0 r rG rK r r rX rY r r r r! s