JezK
Edit File: generate.cpython-39.pyc
a B�i�� � @ s� d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZ d dlZddl m Z ddl m Z ddl m Z ddl m Z ddl mZ dd l mZ dd l mZ dd l mZ dd l mZ dd l mZ ddl mZ ddl mZ ddl mZ ddl mZ ddl mZ d dlmZ d dlm Z dZ zHd dl Z i Z ej dk �r6de d< e j!e fddie �ddi��Z"e"j Z#W nJ zd dl$Z$e%e$j&d< W n& e'�y� d dl(Z(e)e(j&d< Y n0 Y n0 dd � Z*d d � Z+d d � Z,d!d"� Z-d Z.dZ/d#Z0d$Z1d%Z2d&Z3d Z4dZ5d#Z6d$Z7d'Z8d(Z9d)Z:d*Z;d+Z<d,Z=d-Z>d.Z?d/Z@i ZAe#d0�eAe4< e#d1�eAe5< e#d2�eAe6< e#d3�eAe7< e#d4�eAe8< e#d5�eAe9< e#d6�eAe:< e#d7�eAe;< e#d8�eAe<< e#d9�eAe=< e#d:�eAe>< e#d;�eAe?< e#d<�eAe@< d=d>� ZBe4e5e6e9e7gZCe<e;e=e>e?gZDd?d@� ZEG dAdB� dB�ZFdS )C� N)� get_all_types�get_all_attributes� get_all_roles� )� executable)�boolean)�etc_rw)� unit_file)� var_cache)� var_spool)�var_lib)�var_log)�var_run)�tmp)�rw)�network)�script)�spec)�userzselinux-python)� T�unicode� localedirz/usr/share/locale�fallback�_c C sF | d }| d }| d }|d |� d�d }|� d�d }|||gS )z6Given an RPM header return the package NVR as a string�name�version�release�-�.r r )�split)Zhdrr r r Zrelease_versionZ os_version� r �5/usr/lib/python3.9/site-packages/sepolicy/generate.py�get_rpm_nvr_from_headerG s r" c C s^ z<dd l }d }|�� }|�|j| �}|D ]}t|�} q:q(W n td| � d }Y n0 |S )Nr z"Failed to retrieve rpm info for %s)�rpm�tsZdbMatchZ RPMTAG_NAMEr" �print)�packager# Znvrr$ �mi�hr r r! �get_rpm_nvr_listR s r) c C s� i } t �t j�D ]j}|d dks|d dks|d dks|d dks|d dkrRq|d |�d�f| |d |d |d f< q| S ) N�typeZreserved_port_tZport_tZhi_reserved_port_tZephemeral_port_tZunreserved_port_t�rangeZlowZhigh�protocol)�sepolicy�infoZPORT�get)�dict�pr r r! � get_all_portsb s � � � �*r2 c C s6 dd� t �t j�D �} | �d� | �d� | �� | S )Nc S s g | ] }|d �qS )r r )�.0�xr r r! � <listcomp>p � z!get_all_users.<locals>.<listcomp>Zsystem_u�root)r- r. �USER�remove�sort)�usersr r r! � get_all_userso s r< � r z_admin$z_role$� � � � � � � � � zStandard Init DaemonzDBUS System DaemonzInternet Services Daemonz Web Application/Script (CGI)ZSandboxzUser ApplicationzExisting Domain Typez Minimal Terminal Login User Rolez!Minimal X Windows Login User RolezDesktop Login User Rolez Administrator Login User Rolez Confined Root Administrator Rolez!Module information for a new typec C s: t �� } | �� td�}| D ]}|d|t | f 7 }q |S )Nz Valid Types: z%2s: %s )�poltype�keysr: r )rH �msg�kr r r! �get_poltype_desc� s rK c C s� | dkr g S d}z�g }| � d�D ]�}|� d�}t|�dkr>t�t|�dkrdt|d �}t|d �}n$t|d �}t|d �}||kr�t�t||d �D ]"}|dk s�||kr�t�|�|� q�q |W S ty� ttd�| ��Y n0 d S ) N� i �,r r= r r z8Ports must be numbers or ranges of numbers from 1 to %d )r �len� ValueError�intr+ �appendr )�portsZmax_port�temp�a�r�begin�endr1 r r r! � verify_ports� s. rX c @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd � Zd�d d �Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&dJdK� Z'dLdM� Z(dNdO� Z)dPdQ� Z*dRdS� Z+dTdU� Z,dVdW� Z-dXdY� Z.dZd[� Z/d\d]� Z0d^d_� Z1d`da� Z2dbdc� Z3ddde� Z4dfdg� Z5dhdi� Z6djdk� Z7dldm� Z8dndo� Z9dpdq� Z:drds� Z;dtdu� Z<dvdw� Z=dxdy� Z>dzd{� Z?d|d}� Z@d~d� ZAd�d�� ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�� ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�� ZOd�d�� ZPd�d�� ZQd�d�� ZRd�d�� ZSd�d�� ZTd�d�� ZUd�d�� ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�� ZZd�d�� Z[d�d�� Z\d�d�� Z]d�d�� Z^d�d�� Z_d�d�� Z`d�d�� Zad�d�� Zbd�dÄ Zcd�dń Zdd�dDŽ Zed�dɄ Zfd�d˄ Zgd�d̈́ Zhd�dτ Zid�dф Zjd�dӄ Zkd�dՄ Zld�dׄ Zmd�dل Znd�dۄ Zod�d݄ Zpd�d߄ Zqd�d� Zrd�d� Zset�u� fd�d�Zvd�S )��policyc C s g | _ i | _t� | _g | _|tvr.ttd���|sFttd�t| ��z t� | _W nX ty~ } zt d� W Y d }~n6d }~0 t y� } zt d|� W Y d }~n d }~0 0 i | _ d| j d< d| j d< d| j d< d | j d < d | j d < d | j d < d| j d < d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d < d | j d < d | j d < d!| j d"< d#| j d$< d%| j d&< d'| j d(< d)| j d*< d+| j d,< d-| j d.< d/| j d0< d1| j d2< d3| j d4< d5| j d6< d7| j d8< d9| j d:< d;| j d<< d=| j d>< d?| j d@< dA| j dB< dC| j dD< dE| j dF< dG| j dH< dI| j dJ< dK| j dL< dM| j dN< dO| j dP< dQ| j dR< dS| j dT< dU| j dV< dW| j dX< dY| j dZ< d[| j d\< d]| j d^< d_| j d`< da| j db< da| j dc< da| j dd< da| j de< df| j dg< df| j dh< df| j di< df| j dj< df| j dg< dk| j dl< dm| j dn< do| j dp< dq| j dr< ds| j dt< du| j dv< dw| j dx< dy| j dz< d{| j d|< d}| j d~< d| j d�< d| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< i | _ d�g t g| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< i | _t| jd�< t| jd�< t| jd�< t| jd�< t| jd�< t| jd�< t| jd�< t| jd�< g d��| _| j| jf| j| j f| j | j f| j | j f| j!| j"f| j#| j$f| j%| j&f| j'| j(f| j)| j*f| j+| j(f| j,| j(f| j-| j.f| j/| j0ff | _1t2�3d�|��s�ttd����|t4k�r�d�| | _5n|| _5|| _6g | _7g | _8|| _9d�| _:d | _;d�d�d�g g| _<d�d�d�g g| _=d�d�d�g g| _>d�d�d�g g| _?d�| _@d�| _Ad�| _Bd�| _Cd�| _Dd�| _Ed�| _Fd�| _Gd�| _H| j9tItJfv| _K| j9tItJfv| _L| j9tItJfv| _Md�| _Nd�| _Oi | _Pi | _Qi | _Rg | _Sg | _Td�| _Ud�| _Vg | _Wg | _Xg | _Yg | _Zg | _[d S )�Nz"You must enter a valid policy typez;You must enter a name for your policy module for your '%s'.z9Can not get port types, must be root for this informationzCan not get port typeszset_use_kerberos(True)Zopenlogzset_use_kerb_rcache(True)zset_use_syslog(True)zset_use_resolve(True)Z gethostbyZ getaddrinfoZ getnameinfoZkrbz set_manage_krb5_rcache(True)Zgss_accept_sec_contextZkrb5_verify_init_credsZ krb5_rd_reqZ __syslog_chkzset_use_uid(True)�getpwnam�getpwuidzset_use_dbus(True)Zdbus_zset_use_pam(True)Zpam_zset_use_audit(True)zadd_process('fork')�forkzadd_process('transition')Z transitionzadd_process('sigchld')Zsigchldzadd_process('sigkill')Zsigkillzadd_process('sigstop')Zsigstopzadd_process('signull')Zsignullzadd_process('ptrace')Zptracezadd_process('getsched')Zgetschedzadd_process('setsched')Zsetschedzadd_process('getsession')Z getsessionzadd_process('getpgid')�getpgidzadd_process('setpgid')�setpgidzadd_process('getcap')Zgetcapzadd_process('setcap')Zsetcapzadd_process('share')Zsharezadd_process('getattr')�getattrzadd_process('setexec')Zsetexeczadd_process('setfscreate')Z setfscreatezadd_process('noatsecure')Z noatsecurezadd_process('siginh')Zsiginhzadd_process('signal_perms')�killzadd_process('setrlimit')Z setrlimitzadd_process('rlimitinh')Z rlimitinhz add_process('dyntransition')Z dyntransitionzadd_process('setcurrent')Z setcurrentzadd_process('execmem')Zexecmemzadd_process('execstack')Z execstackzadd_process('execheap')Zexecheapzadd_process('setkeycreate')Z setkeycreatez add_process('setsockcreate')Z setsockcreatezadd_capability('chown')�chownz add_capability('dac_override')Z dac_overridez!add_capability('dac_read_search')Zdac_read_searchzadd_capability('fowner')Zfownerzadd_capability('fsetid')Zfsetidzadd_capability('setgid')�setgid�setegid� setresgid�setregidzadd_capability('setuid')� setresuid�setuid�seteuid�setreuidzadd_capability('setpcap')Zsetpcapz!add_capability('linux_immutable')Zlinux_immutablez"add_capability('net_bind_service')Znet_bind_servicez add_capability('net_broadcast')Z net_broadcastzadd_capability('net_admin')Z net_adminzadd_capability('net_raw')Znet_rawzadd_capability('ipc_lock')Zipc_lockzadd_capability('ipc_owner')Z ipc_ownerz add_capability('sys_module')� sys_modulezadd_capability('sys_rawio')Z sys_rawioz add_capability('sys_chroot')�chrootZ sys_chrootz add_capability('sys_ptrace')Z sys_ptracezadd_capability('sys_pacct')Z sys_pacctzadd_capability('sys_admin')ZmountZunshareZ sys_adminzadd_capability('sys_boot')Zsys_bootzadd_capability('sys_nice')Zsys_nicez add_capability('sys_resource')Z sys_resourcezadd_capability('sys_time')Zsys_timez add_capability('sys_tty_config')Zsys_tty_configzadd_capability('mknod')�mknodzadd_capability('lease')Zleasez add_capability('audit_write')Z audit_writez add_capability('audit_control')Z audit_controlzadd_capability('setfcap')Zsetfcapr �/etcr �/tmpr r �/usr/lib/systemd/system�/lib/systemd/system�/etc/systemd/systemr � /var/cacher �/var/libr �/var/logr �/var/runr � /var/spoolZ_tmp_tZ _unit_file_tZ _var_cache_tZ _var_lib_tZ _var_log_tZ _var_run_tZ _var_spool_tZ_port_t) rm rr rt rn r rs ru rv rq ro rp z^[a-zA-Z0-9-_]+$zOName must be alphanumeric with no spaces. Consider using option "-n MODULENAME"zhttpd_%s_scriptrL F)\�rpmsrR r � all_roles�typesrG rO r r2 r% � RuntimeError�symbols� DEFAULT_DIRSr r r r r r r r r � DEFAULT_EXTr � DEFAULT_KEYS�generate_daemon_types�generate_daemon_rules�generate_dbusd_types�generate_dbusd_rules�generate_inetd_types�generate_inetd_rules�generate_cgi_types�generate_cgi_rules�generate_sandbox_types�generate_sandbox_rules�generate_userapp_types�generate_userapp_rules� generate_existing_user_types� generate_existing_user_rules� generate_min_login_user_types�generate_login_user_rules�generate_x_login_user_types�generate_x_login_user_rules�generate_login_user_types�generate_admin_user_types�generate_root_user_types�generate_root_user_rules�generate_new_types�generate_new_rules� DEFAULT_TYPES�re�match�CGIr � file_name� capabilities� processesr* � initscript�program�in_tcp�in_udp�out_tcp�out_udp� use_resolve�use_tmp�use_uid� use_syslog� use_kerberos�manage_krb5_rcache�use_pam�use_dbus� use_audit�EUSER�NEWTYPE�use_etc�use_localization�use_fd� use_terminal�use_mail�booleans�files�dirs�found_tcp_ports�found_udp_ports� need_tcp_type� need_udp_type� admin_domains�existing_domains�transition_domains�transition_users�roles)�selfr r* �er r r! �__init__� sf � zpolicy.__init__c C s( |t p&|t p&|t p&t|t �dkS �Nr )�ALL�RESERVED� UNRESERVEDrN �PORTS)r� �lr r r! Z __isnetset� s zpolicy.__isnetsetc C s || _ d S �N)r� )r� r� r r r! �set_admin_domains� s zpolicy.set_admin_domainsc C s || _ d S r� )r� )r� r� r r r! �set_existing_domains� s zpolicy.set_existing_domainsc C s || _ d S r� )r� )r� r� r r r! �set_admin_roles� s zpolicy.set_admin_rolesc C s || _ d S r� )r� )r� r� r r r! �set_transition_domains� s z policy.set_transition_domainsc C s || _ d S r� )r� )r� r� r r r! �set_transition_users� s zpolicy.set_transition_usersc C s | � | j�S r� )�_policy__isnetsetr� �r� r r r! � use_in_udp� s zpolicy.use_in_udpc C s | � | j�S r� )r� r� r� r r r! � use_out_udp� s zpolicy.use_out_udpc C s | � � p| �� S r� )r� r� r� r r r! �use_udp� s zpolicy.use_udpc C s | � | j�S r� )r� r� r� r r r! � use_in_tcp� s zpolicy.use_in_tcpc C s | � | j�S r� )r� r� r� r r r! � use_out_tcp� s zpolicy.use_out_tcpc C s | � � p| �� S r� )r� r� r� r r r! �use_tcp� s zpolicy.use_tcpc C s | � � p| �� S r� )r� r� r� r r r! � use_network� s zpolicy.use_network�tcpc C sF | j �� D ]6\}}}||kr ||kr ||kr | j |||f S q d S r� )rR rH )r� �portr, rV rW r1 r r r! � find_port� s zpolicy.find_portc C s | j tvrttd���|| _d S )Nz0User Role types can not be assigned executables.)r* � APPLICATIONSrO r r� )r� r� r r r! � set_program� s zpolicy.set_programc C s | j tkrttd���|| _d S )Nz(Only Daemon apps can use an init script.)r* �DAEMONrO r r� )r� r� r r r! �set_init_script� s zpolicy.set_init_scriptc C s |||t |�g| _d S r� )rX r� �r� �allZreservedZ unreservedrR r r r! � set_in_tcp� s zpolicy.set_in_tcpc C s |||t |�g| _d S r� )rX r� r� r r r! � set_in_udp� s zpolicy.set_in_udpc C s |ddt |�g| _d S �NF)rX r� �r� r� rR r r r! � set_out_tcp� s zpolicy.set_out_tcpc C s |ddt |�g| _d S r� )rX r� r� r r r! � set_out_udp� s zpolicy.set_out_udpc C s" t |�turttd���|| _d S )Nz$use_resolve must be a boolean value )r* �boolrO r r� �r� �valr r r! �set_use_resolve� s zpolicy.set_use_resolvec C s" t |�turttd���|| _d S )Nz#use_syslog must be a boolean value )r* r� rO r r� r� r r r! �set_use_syslog� s zpolicy.set_use_syslogc C s" t |�turttd���|| _d S )Nz%use_kerberos must be a boolean value )r* r� rO r r� r� r r r! �set_use_kerberos� s zpolicy.set_use_kerberosc C s" t |�turttd���|| _d S )Nz+manage_krb5_rcache must be a boolean value )r* r� rO r r� r� r r r! �set_manage_krb5_rcache� s z policy.set_manage_krb5_rcachec C s |du | _ d S �NT)r� r� r r r! � set_use_pam� s zpolicy.set_use_pamc C s |du | _ d S r� )r� r� r r r! � set_use_dbus� s zpolicy.set_use_dbusc C s |du | _ d S r� )r� r� r r r! � set_use_audit� s zpolicy.set_use_auditc C s |du | _ d S r� )r� r� r r r! � set_use_etc� s zpolicy.set_use_etcc C s |du | _ d S r� )r� r� r r r! �set_use_localization� s zpolicy.set_use_localizationc C s |du | _ d S r� )r� r� r r r! � set_use_fd� s zpolicy.set_use_fdc C s |du | _ d S r� )r� r� r r r! �set_use_terminal� s zpolicy.set_use_terminalc C s |du | _ d S r� )r� r� r r r! � set_use_mail� s zpolicy.set_use_mailc C sB | j tv rttd���|r0| jd d �d� ng | jd d< d S )Nz'USER Types automatically get a tmp typern r )r* �USERSrO r r| rQ r� r r r! � set_use_tmp� s zpolicy.set_use_tmpc C s |du | _ d S r� )r� r� r r r! � set_use_uid s zpolicy.set_use_uidc C s | j rt�d| jtj�S dS d S �N� TEMPLATETYPErL )r� r� �subr r Z te_uid_rulesr� r r r! �generate_uid_rules s zpolicy.generate_uid_rulesc C s | j rt�d| jtj�S dS d S r� )r� r� r� r r Zte_syslog_rulesr� r r r! �generate_syslog_rules s z policy.generate_syslog_rulesc C s | j rt�d| jtj�S dS d S r� )r� r� r� r r Zte_resolve_rulesr� r r r! �generate_resolve_rules s z policy.generate_resolve_rulesc C s | j rt�d| jtj�S dS d S r� )r� r� r� r r Zte_kerberos_rulesr� r r r! �generate_kerberos_rules s z policy.generate_kerberos_rulesc C s | j rt�d| jtj�S dS d S r� )r� r� r� r r Zte_manage_krb5_rcache_rulesr� r r r! �!generate_manage_krb5_rcache_rules s z(policy.generate_manage_krb5_rcache_rulesc C s d}| j r t�d| jtj�}|S �NrL r� )r� r� r� r r Z te_pam_rules�r� �newter r r! �generate_pam_rules& s zpolicy.generate_pam_rulesc C s d}| j r t�d| jtj�}|S r )r� r� r� r r Zte_audit_rulesr r r r! �generate_audit_rules, s zpolicy.generate_audit_rulesc C s d}| j r t�d| jtj�}|S r )r� r� r� r r Z te_etc_rulesr r r r! �generate_etc_rules2 s zpolicy.generate_etc_rulesc C s d}| j r t�d| jtj�}|S r )r� r� r� r r Z te_fd_rulesr r r r! �generate_fd_rules8 s zpolicy.generate_fd_rulesc C s d}| j r t�d| jtj�}|S r )r� r� r� r r Zte_localization_rulesr r r r! �generate_localization_rules> s z"policy.generate_localization_rulesc C s* d}| j tkr&| jr&t�d| jtj�}|S r )r* �DBUSr� r� r� r r Z te_dbus_rulesr r r r! �generate_dbus_rulesD s zpolicy.generate_dbus_rulesc C s d}| j r t�d| jtj�}|S r )r� r� r� r r Z te_mail_rulesr r r r! �generate_mail_rulesJ s zpolicy.generate_mail_rulesc C sF d}d|||f }|t �� v r.d|| jf }nd|| j|||f }|S )NrL zcorenet_%s_%s_%sz %s(%s_t) zD gen_require(` type %s_t; ') allow %s_t %s_t:%s_socket name_%s; )r- Z get_methodsr )r� r, �action� port_name�line�methodr r r! �generate_network_actionP s �z policy.generate_network_actionc C sZ | j t D ]X}| �t|�d�}|d u r.d| _q |d d d� }| �dd|�}|| jvr | j�|� q | jt D ]X}| �t|�d�}|d u r�d| _qn|d d d� }| �dd|�}|| jvrn| j�|� qn| j t D ]X}| �t|�d�}|d u r�d| _ q�|d d d� }| �dd|�}|| j vr�| j �|� q�| j du �sD| jdu �rVt � d| jtj�S d S ) Nr� Tr ���ZbindZconnect�udpr� rL )r� r� r� rP r� r r� rQ r� r� r� r� r� r� r r �te_types)r� �iZrecr r r r r! �generate_network_types^ s6 z policy.generate_network_typesc C sZ | j D ]4}|�|�dkr| j | d �|� | j | S q| j d d �|� | j d S )Nr r r )r| �findrQ )r� �file�dr r r! Z __find_path� s zpolicy.__find_pathc C s || j vr| j �|� d S r� )r� rQ )r� Z capabilityr r r! �add_capability� s zpolicy.add_capabilityc C s || _ d S r� )ry )r� ry r r r! � set_types� s zpolicy.set_typesc C s || j vr| j �|� d S r� )r� rQ )r� Zprocessr r r! � add_process� s zpolicy.add_processc C s || j |< d S r� )r� )r� r � descriptionr r r! � add_boolean� s zpolicy.add_booleanc C s | � |�| j|< d S r� )�_policy__find_pathr� �r� r r r r! �add_file� s zpolicy.add_filec C s | � |�| j|< d S r� )r r� r r r r! �add_dir� s zpolicy.add_dirc C s6 d}| j �� t| j �dkr2d| jd�| j �f }|S )NrL r z#allow %s_t self:capability { %s }; � )r� r: rN r �joinr r r r! �generate_capabilities� s z policy.generate_capabilitiesc C s6 d}| j �� t| j �dkr2d| jd�| j �f }|S )NrL r z allow %s_t self:process { %s }; r# )r� r: rN r r$ r r r r! �generate_process� s zpolicy.generate_processc C s� d}| � � �r�d}|t�d| jtj�7 }| �� �r�|d7 }|t�d| jtj�7 }| �� r�|t�d| jtj �7 }| j r�t | j t �dkr�|t�d| jtj�7 }| j r�t | jt �dkr�|t�d| jtj�7 }| j t r�|t�d| jtj�7 }| j t �r |t�d| jtj�7 }| j t �r.|t�d| jtj�7 }| jt �rP|t�d| jtj�7 }| jt �rr|t�d| jtj�7 }| jt �r�|t�d| jtj�7 }| jD ]}||7 }�q�| �� �r�|d7 }|t�d| jtj �7 }| j �r�|t�d| jtj �7 }| � � �r|t�d| jtj �7 }| j!t �r2|t�d| jtj"�7 }| j!t �rT|t�d| jtj#�7 }| j!t �rv|t�d| jtj$�7 }| j%D ]}||7 }�q||S )NrL � r� r )&r� r� r� r r Z te_networkr� Zte_tcpr� Z te_in_tcpr� rN r� r� Zte_in_need_port_tcpr� Zte_out_need_port_tcpr� Zte_in_all_ports_tcpr� Zte_in_reserved_ports_tcpr� Zte_in_unreserved_ports_tcpZte_out_all_ports_tcpZte_out_reserved_ports_tcpZte_out_unreserved_ports_tcpr� r� Zte_udpr� Zte_in_need_port_udpr� Z te_in_udpr� Zte_in_all_ports_udpZte_in_reserved_ports_udpZte_in_unreserved_ports_udpr� )r� r r r r r! �generate_network_rules� sV z policy.generate_network_rulesc C s| d}| j D ](}t�d| jtj�}|t�d||�7 }q | jtkrx| jD ]2}t�d| jt j �}|t�d|� d�d |�7 }qD|S )NrL r� � APPLICATIONr8 �_ur ) r� r� r� r r Zte_transition_rulesr* r8 r� r Z te_run_rulesr )r� r �appr �urS r r r! �generate_transition_rules� s z policy.generate_transition_rulesc C s d}| j tkrz| jD ]`}|�d�d }|d }| jD ]>}t�d|tj�}|| j vr`t�|d|�}|t�d||�7 }q4q|S | j t k�r|t�d| j tj �7 }| jD ](}t�d| j tj�}|t�d||�7 }q�| j D ]D}|�d�d }|d | j v r�t�d| j tj�}|t�d ||�7 }q�|S ) NrL �_tr �_rr� Zsystem_rr) r* r8 )r* r� r� r r� r� r� r Zte_admin_domain_rulesrx �RUSERr Zte_admin_rulesr� Zte_admin_trans_rules)r� r r r �roler+ r r, r r r! �generate_admin_rules� s, zpolicy.generate_admin_rulesc C s d}| j r t�d| jtj�}|S r )r� r� r� r r Z if_dbus_rules�r� �newifr r r! �generate_dbus_if s zpolicy.generate_dbus_ifc C s( d}| j tkr|S t�d| jtj�}|S r )r* �SANDBOXr� r� r r Zif_sandbox_rulesr3 r r r! �generate_sandbox_if s zpolicy.generate_sandbox_ifc C s� d}d}| j dkr>|t�d| jtj�7 }|t�d| jtj�7 }| jD ]Z}t| j | d �dkrD|t�d| j| j | d j �7 }|t�d| j| j | d j �7 }qD|dkr�t�d| jtj �}||7 }|t�d| jtj �7 }||7 }|t�d| jtj�7 }|S dS �NrL r� r r r= )r� r� r� r r Zif_initscript_admin_typesZif_initscript_adminr~ rN r| Zif_admin_typesZif_admin_rulesZif_begin_adminZif_middle_adminZ if_end_admin)r� r4 Znewtypesr �retr r r! �generate_admin_if s" "zpolicy.generate_admin_ifc C s t �d| jtj�S �Nr� )r� r� r� r � te_cgi_typesr� r r r! r� 5 s zpolicy.generate_cgi_typesc C s t �d| jtj�S r; )r� r� r� r �te_sandbox_typesr� r r r! r� 8 s z policy.generate_sandbox_typesc C s t �d| jtj�S r; )r� r� r r Zte_userapp_typesr� r r r! r� ; s z policy.generate_userapp_typesc C s t �d| jtj�S r; )r� r� r r Zte_inetd_typesr� r r r! r� > s zpolicy.generate_inetd_typesc C s t �d| jtj�S r; )r� r� r r Zte_dbusd_typesr� r r r! r� A s zpolicy.generate_dbusd_typesc C s t �d| jtj�S r; )r� r� r r Zte_min_login_user_typesr� r r r! r� D s z$policy.generate_min_login_user_typesc C s t �d| jtj�S r; )r� r� r r Zte_login_user_typesr� r r r! r� G s z policy.generate_login_user_typesc C s t �d| jtj�S r; )r� r� r r Zte_admin_user_typesr� r r r! r� J s z policy.generate_admin_user_typesc C s� t | j�dkr$ttd�t| j ��t�d| jt j �}|d7 }| jD ]8}|d| 7 }|� d�d d }|| j v rD|d| 7 }qD|d 7 }|S ) Nr z,'%s' policy modules require existing domainsr� z gen_require(`z type %s;r. r/ z role %s;z ') ) rN r� rO r rG r* r� r� r r Zte_existing_user_typesr rx )r� r r r1 r r r! r� M s � �z#policy.generate_existing_user_typesc C s t �d| jtj�S r; )r� r� r r Zte_x_login_user_typesr� r r r! r� _ s z"policy.generate_x_login_user_typesc C s t �d| jtj�S r; )r� r� r r Zte_root_user_typesr� r r r! r� b s z policy.generate_root_user_typesc C s� d}t | j�dkr ttd���| jD ]^}| jD ]R}|�|�r.t||d t |� � � |t�d|d t |� � | j| j �7 } q$q.q$t r�|dkr�g }| jD ]}|� |� q�ttd�d� |� ��|S )NrL r zType field requiredr� z3You need to define a new type which ends with: %sz ) rN ry rO r r} �endswithr% r� r� r r� rQ r$ )r� r �tr Z default_extr r r! r� e s ( zpolicy.generate_new_typesc C s dS )NrL r r� r r r! r� y s zpolicy.generate_new_rulesc C s6 t �d| jtj�}| jdkr2|t �d| jtj�7 }|S r� )r� r� r r Zte_daemon_typesr� Zte_initscript_typesr r r r! r | s z policy.generate_daemon_typesc C s | j rt�d| jtj�S dS d S r� )r� r� r� r r r r� r r r! �generate_tmp_types� s zpolicy.generate_tmp_typesc C s< d}| j D ],}t�d|tj�}|t�d| j | |�7 }q |S )NrL �BOOLEANZ DESCRIPTION)r� r� r� r Z te_boolean)r� r �br r r r! �generate_booleans� s zpolicy.generate_booleansc C s( d}| j D ]}|t�d|tj�7 }q |S )NrL rA )r� r� r� r �te_rules)r� r rB r r r! �generate_boolean_rules� s z policy.generate_boolean_rulesc C s t �d| jtj�S r; )r� r� r r r= r� r r r! �generate_sandbox_te� s zpolicy.generate_sandbox_tec C s t �d| jtj�S r; )r� r� r r r< r� r r r! �generate_cgi_te� s zpolicy.generate_cgi_tec C s t �d| jtj�}|S r; )r� r� r r Zte_daemon_rulesr3 r r r! r� � s z policy.generate_daemon_rulesc C sl d}| j D ]\}| jD ]P}|�|�r|d t|� � d }|t�d|d t|� � | j| j�7 } q qq |S )NrL r. r� )ry r} r> rN r� r� �if_rules)r� r4 r? r Zreqtyper r r! �generate_new_type_if� s (zpolicy.generate_new_type_ifc C s t �d| jtj�S r; )r� r� r r Zte_login_user_rulesr� r r r! r� � s z policy.generate_login_user_rulesc C s t �d| jtj�}|S r; )r� r� r r Zte_existing_user_rules)r� Znerulesr r r! r� � s z#policy.generate_existing_user_rulesc C s t �d| jtj�S r; )r� r� r r Zte_x_login_user_rulesr� r r r! r� � s z"policy.generate_x_login_user_rulesc C s t �d| jtj�}|S r; )r� r� r r Zte_root_user_rulesr r r r! r� � s z policy.generate_root_user_rulesc C s t �d| jtj�S r; )r� r� r r Zte_userapp_rulesr� r r r! r� � s z policy.generate_userapp_rulesc C s t �d| jtj�S r; )r� r� r r Zte_inetd_rulesr� r r r! r� � s zpolicy.generate_inetd_rulesc C s t �d| jtj�S r; )r� r� r r Zte_dbusd_rulesr� r r r! r� � s zpolicy.generate_dbusd_rulesc C s | j rt�d| jtj�S dS d S r� )r� r� r� r r rD r� r r r! �generate_tmp_rules� s zpolicy.generate_tmp_rulesc C s d}|t �d| jtj�7 }|S r )r� r� r r Z te_cgi_rulesr r r r! r� � s zpolicy.generate_cgi_rulesc C s d}|t �d| jtj�7 }|S r )r� r� r r Zte_sandbox_rulesr r r r! r� � s z policy.generate_sandbox_rulesc C sR d}| j s| jtkr&t�d| jtj�}| jtt t t fv rN|t�d| jtj �7 }|S r ) r� r* r8 r� r� r r Zif_user_program_rules�TUSER�XUSER�AUSER�LUSERZif_role_change_rulesr3 r r r! �generate_user_if� s zpolicy.generate_user_ifc C s> d}|t �d| jtj�7 }| jr6|t �d| jtj�7 }| jdkrV|t �d| jtj�7 }| j D ]�}t | j | d �dkr\|t �d| j| j | d j �7 }| j | d D ]J}t j�|�r�t�t �|�tj �r�|t �d| j| j | d j�7 } q\q�q\|| �� 7 }|| �� 7 }|| �� 7 }|| �� 7 }|| �� 7 }|| �� 7 }|S r8 )r� r� r r Zif_heading_rulesr� Zif_program_rulesr� Zif_initscript_rulesr~ rN r| rH �os�path�exists�stat�S_ISSOCK�ST_MODEZif_stream_rulesrO r5 r: r7 rI r� )r� r4 r r r r r! � generate_if� s( " zpolicy.generate_ifc C s | j | j d � S r� �r� r* r� r r r! �generate_default_types� s z policy.generate_default_typesc C s& | j | j d r"| j | j d � S dS )Nr rL rW r� r r r! �generate_default_rules� s z policy.generate_default_rulesc C s� d}| j ttttfv r�d}t| j�dkr�|t�d| j t j �7 }|t�d| j t j �7 }| jD ](}t�d| j t j �}|t�d||�7 }qZ|S )NrL r r� ZROLE)r* rK rL rM rN rN r� r� r� r r Z te_sudo_rulesZte_newrole_rulesZte_roles_rules)r� r r� r1 r r r r! �generate_roles_rules� s zpolicy.generate_roles_rulesc C s� | � � }| jD ]L}t| j| d �dkr| jtks:|dkr|t�d| j| j| d j �7 }q| jt krt|d| j 7 }|| � � 7 }|| � � 7 }|| � � 7 }|| �� 7 }|| �� 7 }|| �� 7 }|| �� 7 }| jD �]>}t| j| d �dkr�| jt k�rLd}| jD ]H}|t�d|d d � d | j| d j�7 }|t�d | jd |�7 }�q n |t�d| j| j| d j�7 }| j| d D ]�}tj�|��rzt�t�|�tj ��rz| jt k�r�| jD ],}|t�d|d d � | j| d j�7 }�q�n |t�d| j| j| d j�7 } qΐqzq�|| �� 7 }|| � � 7 }|| � � 7 }|| � � 7 }|| � � 7 }|| � � 7 }|| �!� 7 }|| �"� 7 }|| �#� 7 }|| �$� 7 }|| �%� 7 }|| �&� 7 }|| �'� 7 }|| �(� 7 }|| �)� 7 }|| �*� 7 }|| �+� 7 }|S ) Nr r r r� r= z@ ######################################## # # %s local policy # rL ZTEMPLATETYPE_tr r. ZTEMPLATETYPE_rw_tZ_rw_t),rX r~ rN r| r* r� r� r� r r r� r% r& r r@ rC rY rE r� rD rP rQ rR rS rT rU Zte_stream_rulesrJ r( r r r r� r r� r r� rZ r r- r2 r r r )r� r r Z newte_tmp�domainr r r r! � generate_te sb " � * & , zpolicy.generate_tec C s� d}g }| j �� D ]�}tj�|�rVt�t�|�tj �rVt� d| j | j | d j �}n t� d| j | j | d j �}t� d||�}|� t� d| j | d |�� q| j�� D ]L}t� d| j | j| d j�}t� d||�}|� t� d| j| d |�� q�| jttg v �r t|�dk�r tjS | jttttg v�rH| j�sHttd���| j�rxt� d| jtj�}|� t� d| j |�� | j dk�r�t� d| j tj �}|� t� d| j |�� |� � d � |�}|S ) NrL r� r= �FILENAMEZFILETYPEr z<You must enter the executable path for your confined processZ EXECUTABLEr' ) r� rH rP rQ rR rS rT rU r� r� r Z fc_sock_fileZfc_filerQ r� Zfc_dirr* r� r6 rN r Zfc_userr� r� r� rO r Z fc_programr� Z fc_initscriptr: r$ )r� ZnewfcZfclistr �t1�t2r r r! � generate_fcD s4 " zpolicy.generate_fcc C s� d}| j tttttfvr |S d}| jD ]}|d| 7 }q&|dkrH|d7 }t�d| j t j �}|t�d||�7 }| j tks�| j tkr�| j D ](}t�d| j t j �}|t�d||�7 }q�| j tkr�|t�d| j t j�7 }n|t�d| j t j�7 }|S )NrL z %s_rz system_rr� ZROLESr8 )r* rK rL rM rN r0 r� r� r� r r r; r� Z admin_transZ min_login_user_default_contextZ x_login_user_default_context)r� �newshr� r1 r r, r r r! �generate_user_shg s$ zpolicy.generate_user_shc C s� t �d| jtj�}t �d| j|�}| jtkrBt �dd| j |�}n&t �d| j|�}|t �d| jtj�7 }| j r�|t �d| j tj �7 }| j dkr�|t �d| j tj �7 }| j � � D ]}|t �d|tj �7 }q�| j� � D ]}|t �d|tj �7 }q�| jt | jt D ]@}| �|d�d u �r t �dd | tj�}|t �d| j|�7 }�q | jt D ]@}| �|d �d u �rLt �dd | tj�}|t �d| j|�7 }�qL|| �� 7 }|t �d| jtj�7 }|S ) Nr� Z DOMAINTYPEZ TEMPLATEFILEz%sr] rL r� ZPORTNUMz%dr )r� r� r� r �compiler r* r� Zmanpager� Z restoreconr� r� rH r� r� r� r� r� Z tcp_portsr� Z udp_portsrb r# )r� rS ra r r^ r r r! � generate_sh� s2 zpolicy.generate_shc C s� d}t d�}|d u rd}n|d }|tj7 }| jtv r�|tj7 }| jr\|t�d| jtj �7 }| j dkr||t�d| j tj �7 }| j � � D ]}|t�d|tj �7 }q�| j � � D ]}|t�d|tj �7 }q�|t�d|tj�7 }t�d| j|�}t�d| j|�}t| j�d k�r |d d �| j� 7 }|t�d| jtj�7 }t�d| j|�}t�d t�d �|�}| jtv�rpt�dd|�}| jtk�r�t�d| j d|�}| jttttt fv�r�t�d| j d|�}|S )NrL zselinux-policyz0.0.0r r] ZVERSIONZ MODULENAMEZ DOMAINNAMEr zRequires(post): %s z, Z TODAYSDATEz %a %b %e %Yz%relabel_filesz.*%s_selinux.8.*z.*%s_u.*) r) r Zheader_comment_sectionr* r� Zdefine_relabel_files_beginr� r� r� Zdefine_relabel_files_endr� r� rH r� Z base_sectionr� r rN rw r$ Z mid_section�time�strftimer� rK rL rM rN r0 )r� ZnewspecZselinux_policynvrZselinux_policyverr r r r! � generate_spec� s> zpolicy.generate_specc C s2 d|| j f }t|d�}|�| �� � |�� |S )Nz%s/%s_selinux.spec�w)r� �open�writerg �close)r� �out_dirZspecfile�fdr r r! � write_spec� s zpolicy.write_specc C s2 d|| j f }t|d�}|�| �� � |�� |S )Nz%s/%s.terh )r� ri rj r\ rk )r� rl Ztefilerm r r r! �write_te� s zpolicy.write_tec C s> d|| j f }t|d�}|�| �� � |�� t�|d� |S )Nz%s/%s.shrh i� )r� ri rj rd rk rP �chmod)r� rl Zshfilerm r r r! �write_sh� s zpolicy.write_shc C s2 d|| j f }t|d�}|�| �� � |�� |S )Nz%s/%s.ifrh )r� ri rj rV rk )r� rl Ziffilerm r r r! �write_if� s zpolicy.write_ifc C s2 d|| j f }t|d�}|�| �� � |�� |S )Nz%s/%s.fcrh )r� ri rj r` rk )r� rl Zfcfilerm r r r! �write_fc� s zpolicy.write_fcc C sB dd l }|�� ��}|�� |jdd� |j�� }|�� }|j| jd�}|D ]�}| j � |j � |j D ]F}| j D ]:}|dkr|qn|�|�rntj�|�r�| �|� qn| �|� qnqd|�� }|j|jd�}|D ]T} | j D ]H}| j D ]<}|dkr�q�|�|�r�tj�|��r | �|� q�| �|� q�q�q�qLW d � n1 �s40 Y d S )Nr T)Zload_system_repo)r rm )Zprovides)�dnfZBaseZread_all_reposZ fill_sackZsack�queryZ available�filterr� rw rQ r r� r| � startswithrP rQ �isfiler! r" Z source_name) r� rt �baseru Zpq�pkg�fnamerB �sqZbpkgr r r! Z__extract_rpms� s8 zpolicy.__extract_rpmsc C s� z | � � W n ty Y n0 tj�d| j �rB| �d| j � tj�d| j �rd| �d| j � tj�d| j �r�| �d| j � tj�d| j �r�| �d| j � tj�d| j �r�| �d| j � tj�d| j �r�| � d| j � g }| j � � D ]�}g }z| j | d d d }W n t �y4 Y q�Y n0 | j | d D ]"}|� |��rD|�|� n�qD�qDt|�d kr�|D ]>}|| j� � v �r�| j|= n || j� � v �rx| j|= n�qx�qxtt| j | d �t|� �| j | d< q�d S ) Nz/var/run/%s.pidz /var/run/%sz /var/log/%sz/var/log/%s.logz /var/lib/%sz/etc/rc.d/init.d/%sz/etc/rc\.d/init\.d/%sr r �/)�_policy__extract_rpms� ImportErrorrP rQ rx r r! �isdirr" r� r| rH � IndexErrorrw rQ rN r� r� �list�set)r� Z temp_basepathr1 Z temp_dirsr r r r! � gen_writeable sF zpolicy.gen_writeablec C s� | j tvrd S tj�| j�s2tj�d| j � d S t� d| j �}|� � � � D ],}| j D ] }|� |�rXtd| j | � qXqN|�� d S )Nzl *************************************** Warning %s does not exist *************************************** znm -D %s | grep Uzself.%s)r* r� rP rQ rR r� �sys�stderrrj �popen�readr r{ rw �execrk )r� rm �srB r r r! � gen_symbolsI s � zpolicy.gen_symbolsc C s� t d�}|d| �|�t d�f 7 }|d| �|�t d�f 7 }|d| �|�t d�f 7 }| jtkr�|d| �|�t d�f 7 }|d| �|�t d�f 7 }|S )Nz Created the following files: z%s # %s zType Enforcement filezInterface filezFile Contexts filez Spec filez Setup Script)r ro rr rs r* r� rn rq )r� rl �outr r r! �generate[ s zpolicy.generateN)r� )w�__name__� __module__� __qualname__r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r r r r r r r r r r! r" r% r& r( r- r2 r5 r7 r: r� r� r� r� r� r� r� r� r� r� r� r� r� r r@ rC rE rF rG r� rI r� r� r� r� r� r� r� rJ r� r� rO rV rX rY rZ r\ r` rb rd rg rn ro rq rr rs r~ r� r� rP �getcwdr� r r r r! rY � s� B &8 >##*$3rY )GrP r� rS r� r- r r r re Z templatesr r r r r r r r r r r r r r r Zsepolgen.interfacesZ interfacesZsepolgen.defaults�defaultsZPROGNAME�gettext�kwargs� version_info� translationr? r �builtins�str�__dict__r Z __builtin__r r" r) r2 r< r� r� r� r� ZADMIN_TRANSITION_INTERFACEZUSER_TRANSITION_INTERFACEr� r ZINETDr� r6 r8 r� rK rL rN rM r0 r� rG rK r� r� rX rY r r r r! �<module> s� ���