Current File : //lib/python3.9/site-packages/sepolicy/__pycache__/generate.cpython-39.pyc
a

�y
f���@s�ddlZddlZddlZddlZddlZddlmZmZmZddlZddl	m
Z
ddl	mZddl	mZddl	m
Z
ddl	mZdd	l	mZdd
l	mZddl	mZddl	mZdd
l	mZddl	mZddl	mZddl	mZddl	mZddl	mZddlmZddlmZdZzHddlZiZej dk�r6ded<ej!efddie�ddi��Z"e"jZ#WnJzddl$Z$e%e$j&d<Wn&e'�y�ddl(Z(e)e(j&d<Yn0Yn0dd�Z*dd�Z+dd �Z,d!d"�Z-dZ.dZ/d#Z0d$Z1d%Z2d&Z3dZ4dZ5d#Z6d$Z7d'Z8d(Z9d)Z:d*Z;d+Z<d,Z=d-Z>d.Z?d/Z@iZAe#d0�eAe4<e#d1�eAe5<e#d2�eAe6<e#d3�eAe7<e#d4�eAe8<e#d5�eAe9<e#d6�eAe:<e#d7�eAe;<e#d8�eAe<<e#d9�eAe=<e#d:�eAe><e#d;�eAe?<e#d<�eAe@<d=d>�ZBe4e5e6e9e7gZCe<e;e=e>e?gZDd?d@�ZEGdAdB�dB�ZFdS)C�N)�
get_all_types�get_all_attributes�
get_all_roles�)�
executable)�boolean)�etc_rw)�	unit_file)�	var_cache)�	var_spool)�var_lib)�var_log)�var_run)�tmp)�rw)�network)�script)�spec)�userzselinux-python)�T�unicode�	localedirz/usr/share/locale�fallback�_cCsF|d}|d}|d}|d|�d�d}|�d�d}|||gS)z6Given an RPM header return the package NVR as a string�name�version�release�-�.rr)�split)ZhdrrrrZrelease_versionZ
os_version�r �5/usr/lib/python3.9/site-packages/sepolicy/generate.py�get_rpm_nvr_from_headerGsr"cCs^z<ddl}d}|��}|�|j|�}|D]}t|�}q:q(Wntd|�d}Yn0|S)Nrz"Failed to retrieve rpm info for %s)�rpm�tsZdbMatchZRPMTAG_NAMEr"�print)�packager#Znvrr$�mi�hr r r!�get_rpm_nvr_listRs

r)cCs�i}t�tj�D]j}|ddks|ddks|ddks|ddks|ddkrRq|d|�d�f||d|d	|d
f<q|S)N�typeZreserved_port_tZport_tZhi_reserved_port_tZephemeral_port_tZunreserved_port_t�rangeZlowZhigh�protocol)�sepolicy�infoZPORT�get)�dict�pr r r!�
get_all_portsbs
�
�
�
�*r2cCs6dd�t�tj�D�}|�d�|�d�|��|S)NcSsg|]}|d�qS)rr )�.0�xr r r!�
<listcomp>p�z!get_all_users.<locals>.<listcomp>Zsystem_u�root)r-r.�USER�remove�sort)�usersr r r!�
get_all_usersos


r<�rz_admin$z_role$������	�
��zStandard Init DaemonzDBUS System DaemonzInternet Services DaemonzWeb Application/Script (CGI)ZSandboxzUser ApplicationzExisting Domain Typez Minimal Terminal Login User Rolez!Minimal X Windows Login User RolezDesktop Login User RolezAdministrator Login User Rolez Confined Root Administrator Rolez!Module information for a new typecCs:t��}|��td�}|D]}|d|t|f7}q|S)Nz
Valid Types:
z%2s: %s
)�poltype�keysr:r)rH�msg�kr r r!�get_poltype_desc�srKcCs�|dkrgSd}z�g}|�d�D]�}|�d�}t|�dkr>t�t|�dkrdt|d�}t|d�}n$t|d�}t|d�}||kr�t�t||d�D]"}|dks�||kr�t�|�|�q�q |WSty�ttd�|��Yn0dS)	N�i�,rr=rrz8Ports must be numbers or ranges of numbers from 1 to %d )r�len�
ValueError�intr+�appendr)�portsZmax_port�temp�a�r�begin�endr1r r r!�verify_ports�s.
rXc@s�eZdZdd�Zdd�Zdd�Zdd�Zd	d
�Zdd�Zd
d�Z	dd�Z
dd�Zdd�Zdd�Z
dd�Zdd�Zdd�Zd�dd�Zd d!�Zd"d#�Zd$d%�Zd&d'�Zd(d)�Zd*d+�Zd,d-�Zd.d/�Zd0d1�Zd2d3�Zd4d5�Zd6d7�Zd8d9�Zd:d;�Zd<d=�Z d>d?�Z!d@dA�Z"dBdC�Z#dDdE�Z$dFdG�Z%dHdI�Z&dJdK�Z'dLdM�Z(dNdO�Z)dPdQ�Z*dRdS�Z+dTdU�Z,dVdW�Z-dXdY�Z.dZd[�Z/d\d]�Z0d^d_�Z1d`da�Z2dbdc�Z3ddde�Z4dfdg�Z5dhdi�Z6djdk�Z7dldm�Z8dndo�Z9dpdq�Z:drds�Z;dtdu�Z<dvdw�Z=dxdy�Z>dzd{�Z?d|d}�Z@d~d�ZAd�d��ZBd�d��ZCd�d��ZDd�d��ZEd�d��ZFd�d��ZGd�d��ZHd�d��ZId�d��ZJd�d��ZKd�d��ZLd�d��ZMd�d��ZNd�d��ZOd�d��ZPd�d��ZQd�d��ZRd�d��ZSd�d��ZTd�d��ZUd�d��ZVd�d��ZWd�d��ZXd�d��ZYd�d��ZZd�d��Z[d�d��Z\d�d��Z]d�d��Z^d�d��Z_d�d��Z`d�d��Zad�d��Zbd�dÄZcd�dńZdd�dDŽZed�dɄZfd�d˄Zgd�d̈́Zhd�dτZid�dфZjd�dӄZkd�dՄZld�dׄZmd�dلZnd�dۄZod�d݄Zpd�d߄Zqd�d�Zrd�d�Zset�u�fd�d�Zvd�S)��policycCsg|_i|_t�|_g|_|tvr.ttd���|sFttd�t|��zt�|_WnXty~}zt	d�WYd}~n6d}~0t
y�}zt	d|�WYd}~n
d}~00i|_d|jd<d|jd<d|jd<d	|jd
<d	|jd<d	|jd<d|jd
<d|jd<d|jd<d|jd<d|jd<d|jd<d|jd<d|jd<d|jd<d|jd<d|jd<d|jd<d|jd <d!|jd"<d#|jd$<d%|jd&<d'|jd(<d)|jd*<d+|jd,<d-|jd.<d/|jd0<d1|jd2<d3|jd4<d5|jd6<d7|jd8<d9|jd:<d;|jd<<d=|jd><d?|jd@<dA|jdB<dC|jdD<dE|jdF<dG|jdH<dI|jdJ<dK|jdL<dM|jdN<dO|jdP<dQ|jdR<dS|jdT<dU|jdV<dW|jdX<dY|jdZ<d[|jd\<d]|jd^<d_|jd`<da|jdb<da|jdc<da|jdd<da|jde<df|jdg<df|jdh<df|jdi<df|jdj<df|jdg<dk|jdl<dm|jdn<do|jdp<dq|jdr<ds|jdt<du|jdv<dw|jdx<dy|jdz<d{|jd|<d}|jd~<d|jd�<d|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<i|_d�gt
g|jd�<d�gtg|jd�<d�gtg|jd�<d�gtg|jd�<d�gtg|jd�<d�gtg|jd�<d�gtg|jd�<d�gtg|jd�<d�gtg|jd�<d�gtg|jd�<d�gtg|jd�<i|_t|jd�<t|jd�<t|jd�<t|jd�<t|jd�<t|jd�<t|jd�<t|jd�<gd��|_|j|jf|j|jf|j|jf|j|j f|j!|j"f|j#|j$f|j%|j&f|j'|j(f|j)|j*f|j+|j(f|j,|j(f|j-|j.f|j/|j0ff
|_1t2�3d�|��s�ttd����|t4k�r�d�||_5n||_5||_6g|_7g|_8||_9d�|_:d|_;d�d�d�gg|_<d�d�d�gg|_=d�d�d�gg|_>d�d�d�gg|_?d�|_@d�|_Ad�|_Bd�|_Cd�|_Dd�|_Ed�|_Fd�|_Gd�|_H|j9tItJfv|_K|j9tItJfv|_L|j9tItJfv|_Md�|_Nd�|_Oi|_Pi|_Qi|_Rg|_Sg|_Td�|_Ud�|_Vg|_Wg|_Xg|_Yg|_Zg|_[dS)�Nz"You must enter a valid policy typez;You must enter a name for your policy module for your '%s'.z9Can not get port types, must be root for this informationzCan not get port typeszset_use_kerberos(True)Zopenlogzset_use_kerb_rcache(True)zset_use_syslog(True)zset_use_resolve(True)Z	gethostbyZgetaddrinfoZgetnameinfoZkrbzset_manage_krb5_rcache(True)Zgss_accept_sec_contextZkrb5_verify_init_credsZkrb5_rd_reqZ__syslog_chkzset_use_uid(True)�getpwnam�getpwuidzset_use_dbus(True)Zdbus_zset_use_pam(True)Zpam_zset_use_audit(True)zadd_process('fork')�forkzadd_process('transition')Z
transitionzadd_process('sigchld')Zsigchldzadd_process('sigkill')Zsigkillzadd_process('sigstop')Zsigstopzadd_process('signull')Zsignullzadd_process('ptrace')Zptracezadd_process('getsched')Zgetschedzadd_process('setsched')Zsetschedzadd_process('getsession')Z
getsessionzadd_process('getpgid')�getpgidzadd_process('setpgid')�setpgidzadd_process('getcap')Zgetcapzadd_process('setcap')Zsetcapzadd_process('share')Zsharezadd_process('getattr')�getattrzadd_process('setexec')Zsetexeczadd_process('setfscreate')Zsetfscreatezadd_process('noatsecure')Z
noatsecurezadd_process('siginh')Zsiginhzadd_process('signal_perms')�killzadd_process('setrlimit')Z	setrlimitzadd_process('rlimitinh')Z	rlimitinhzadd_process('dyntransition')Z
dyntransitionzadd_process('setcurrent')Z
setcurrentzadd_process('execmem')Zexecmemzadd_process('execstack')Z	execstackzadd_process('execheap')Zexecheapzadd_process('setkeycreate')Zsetkeycreatezadd_process('setsockcreate')Z
setsockcreatezadd_capability('chown')�chownzadd_capability('dac_override')Zdac_overridez!add_capability('dac_read_search')Zdac_read_searchzadd_capability('fowner')Zfownerzadd_capability('fsetid')Zfsetidzadd_capability('setgid')�setgid�setegid�	setresgid�setregidzadd_capability('setuid')�	setresuid�setuid�seteuid�setreuidzadd_capability('setpcap')Zsetpcapz!add_capability('linux_immutable')Zlinux_immutablez"add_capability('net_bind_service')Znet_bind_servicezadd_capability('net_broadcast')Z
net_broadcastzadd_capability('net_admin')Z	net_adminzadd_capability('net_raw')Znet_rawzadd_capability('ipc_lock')Zipc_lockzadd_capability('ipc_owner')Z	ipc_ownerzadd_capability('sys_module')�
sys_modulezadd_capability('sys_rawio')Z	sys_rawiozadd_capability('sys_chroot')�chrootZ
sys_chrootzadd_capability('sys_ptrace')Z
sys_ptracezadd_capability('sys_pacct')Z	sys_pacctzadd_capability('sys_admin')ZmountZunshareZ	sys_adminzadd_capability('sys_boot')Zsys_bootzadd_capability('sys_nice')Zsys_nicezadd_capability('sys_resource')Zsys_resourcezadd_capability('sys_time')Zsys_timez add_capability('sys_tty_config')Zsys_tty_configzadd_capability('mknod')�mknodzadd_capability('lease')Zleasezadd_capability('audit_write')Zaudit_writezadd_capability('audit_control')Z
audit_controlzadd_capability('setfcap')Zsetfcapr�/etcr�/tmprr	�/usr/lib/systemd/system�/lib/systemd/system�/etc/systemd/systemr
�
/var/cacher�/var/libr
�/var/logr�/var/runr�
/var/spoolZ_tmp_tZ_unit_file_tZ_var_cache_tZ
_var_lib_tZ
_var_log_tZ
_var_run_tZ_var_spool_tZ_port_t)rmrrrtrnrrsrurvrqrorpz^[a-zA-Z0-9-_]+$zOName must be alphanumeric with no spaces. Consider using option "-n MODULENAME"zhttpd_%s_scriptrLF)\�rpmsrRr�	all_roles�typesrGrOrr2r%�RuntimeError�symbols�DEFAULT_DIRSrrrr	r
rr
rr�DEFAULT_EXTr�DEFAULT_KEYS�generate_daemon_types�generate_daemon_rules�generate_dbusd_types�generate_dbusd_rules�generate_inetd_types�generate_inetd_rules�generate_cgi_types�generate_cgi_rules�generate_sandbox_types�generate_sandbox_rules�generate_userapp_types�generate_userapp_rules�generate_existing_user_types�generate_existing_user_rules�generate_min_login_user_types�generate_login_user_rules�generate_x_login_user_types�generate_x_login_user_rules�generate_login_user_types�generate_admin_user_types�generate_root_user_types�generate_root_user_rules�generate_new_types�generate_new_rules�
DEFAULT_TYPES�re�match�CGIr�	file_name�capabilities�	processesr*�
initscript�program�in_tcp�in_udp�out_tcp�out_udp�use_resolve�use_tmp�use_uid�
use_syslog�use_kerberos�manage_krb5_rcache�use_pam�use_dbus�	use_audit�EUSER�NEWTYPE�use_etc�use_localization�use_fd�use_terminal�use_mail�booleans�files�dirs�found_tcp_ports�found_udp_ports�
need_tcp_type�
need_udp_type�
admin_domains�existing_domains�transition_domains�transition_users�roles)�selfrr*�er r r!�__init__�sf 












































































































�
zpolicy.__init__cCs(|tp&|tp&|tp&t|t�dkS�Nr)�ALL�RESERVED�
UNRESERVEDrN�PORTS)r��lr r r!Z
__isnetset�szpolicy.__isnetsetcCs
||_dS�N)r�)r�r�r r r!�set_admin_domains�szpolicy.set_admin_domainscCs
||_dSr�)r�)r�r�r r r!�set_existing_domains�szpolicy.set_existing_domainscCs
||_dSr�)r�)r�r�r r r!�set_admin_roles�szpolicy.set_admin_rolescCs
||_dSr�)r�)r�r�r r r!�set_transition_domains�szpolicy.set_transition_domainscCs
||_dSr�)r�)r�r�r r r!�set_transition_users�szpolicy.set_transition_userscCs|�|j�Sr�)�_policy__isnetsetr��r�r r r!�
use_in_udp�szpolicy.use_in_udpcCs|�|j�Sr�)r�r�r�r r r!�use_out_udp�szpolicy.use_out_udpcCs|��p|��Sr�)r�r�r�r r r!�use_udp�szpolicy.use_udpcCs|�|j�Sr�)r�r�r�r r r!�
use_in_tcp�szpolicy.use_in_tcpcCs|�|j�Sr�)r�r�r�r r r!�use_out_tcp�szpolicy.use_out_tcpcCs|��p|��Sr�)r�r�r�r r r!�use_tcp�szpolicy.use_tcpcCs|��p|��Sr�)r�r�r�r r r!�use_network�szpolicy.use_network�tcpcCsF|j��D]6\}}}||kr
||kr
||kr
|j|||fSq
dSr�)rRrH)r��portr,rVrWr1r r r!�	find_port�szpolicy.find_portcCs |jtvrttd���||_dS)Nz0User Role types can not be assigned executables.)r*�APPLICATIONSrOrr�)r�r�r r r!�set_program�s
zpolicy.set_programcCs |jtkrttd���||_dS)Nz(Only Daemon apps can use an init script.)r*�DAEMONrOrr�)r�r�r r r!�set_init_script�s
zpolicy.set_init_scriptcCs|||t|�g|_dSr�)rXr��r��allZreservedZ
unreservedrRr r r!�
set_in_tcp�szpolicy.set_in_tcpcCs|||t|�g|_dSr�)rXr�r�r r r!�
set_in_udp�szpolicy.set_in_udpcCs|ddt|�g|_dS�NF)rXr��r�r�rRr r r!�set_out_tcp�szpolicy.set_out_tcpcCs|ddt|�g|_dSr�)rXr�r�r r r!�set_out_udp�szpolicy.set_out_udpcCs"t|�turttd���||_dS)Nz$use_resolve must be a boolean value )r*�boolrOrr��r��valr r r!�set_use_resolve�szpolicy.set_use_resolvecCs"t|�turttd���||_dS)Nz#use_syslog must be a boolean value )r*r�rOrr�r�r r r!�set_use_syslog�szpolicy.set_use_syslogcCs"t|�turttd���||_dS)Nz%use_kerberos must be a boolean value )r*r�rOrr�r�r r r!�set_use_kerberos�szpolicy.set_use_kerberoscCs"t|�turttd���||_dS)Nz+manage_krb5_rcache must be a boolean value )r*r�rOrr�r�r r r!�set_manage_krb5_rcache�szpolicy.set_manage_krb5_rcachecCs|du|_dS�NT)r�r�r r r!�set_use_pam�szpolicy.set_use_pamcCs|du|_dSr�)r�r�r r r!�set_use_dbus�szpolicy.set_use_dbuscCs|du|_dSr�)r�r�r r r!�
set_use_audit�szpolicy.set_use_auditcCs|du|_dSr�)r�r�r r r!�set_use_etc�szpolicy.set_use_etccCs|du|_dSr�)r�r�r r r!�set_use_localization�szpolicy.set_use_localizationcCs|du|_dSr�)r�r�r r r!�
set_use_fd�szpolicy.set_use_fdcCs|du|_dSr�)r�r�r r r!�set_use_terminal�szpolicy.set_use_terminalcCs|du|_dSr�)r�r�r r r!�set_use_mail�szpolicy.set_use_mailcCsB|jtvrttd���|r0|jdd�d�ng|jdd<dS)Nz'USER Types automatically get a tmp typernr)r*�USERSrOrr|rQr�r r r!�set_use_tmp�s

zpolicy.set_use_tmpcCs|du|_dSr�)r�r�r r r!�set_use_uidszpolicy.set_use_uidcCs |jrt�d|jtj�SdSdS�N�TEMPLATETYPErL)r�r��subrrZte_uid_rulesr�r r r!�generate_uid_rulesszpolicy.generate_uid_rulescCs |jrt�d|jtj�SdSdSr�)r�r�r�rrZte_syslog_rulesr�r r r!�generate_syslog_rulesszpolicy.generate_syslog_rulescCs |jrt�d|jtj�SdSdSr�)r�r�r�rrZte_resolve_rulesr�r r r!�generate_resolve_rulesszpolicy.generate_resolve_rulescCs |jrt�d|jtj�SdSdSr�)r�r�r�rrZte_kerberos_rulesr�r r r!�generate_kerberos_rulesszpolicy.generate_kerberos_rulescCs |jrt�d|jtj�SdSdSr�)r�r�r�rrZte_manage_krb5_rcache_rulesr�r r r!�!generate_manage_krb5_rcache_rules sz(policy.generate_manage_krb5_rcache_rulescCs d}|jrt�d|jtj�}|S�NrLr�)r�r�r�rrZte_pam_rules�r��newter r r!�generate_pam_rules&szpolicy.generate_pam_rulescCs d}|jrt�d|jtj�}|Sr)r�r�r�rrZte_audit_rulesrr r r!�generate_audit_rules,szpolicy.generate_audit_rulescCs d}|jrt�d|jtj�}|Sr)r�r�r�rrZte_etc_rulesrr r r!�generate_etc_rules2szpolicy.generate_etc_rulescCs d}|jrt�d|jtj�}|Sr)r�r�r�rrZte_fd_rulesrr r r!�generate_fd_rules8szpolicy.generate_fd_rulescCs d}|jrt�d|jtj�}|Sr)r�r�r�rrZte_localization_rulesrr r r!�generate_localization_rules>sz"policy.generate_localization_rulescCs*d}|jtkr&|jr&t�d|jtj�}|Sr)r*�DBUSr�r�r�rrZ
te_dbus_rulesrr r r!�generate_dbus_rulesDszpolicy.generate_dbus_rulescCs d}|jrt�d|jtj�}|Sr)r�r�r�rrZ
te_mail_rulesrr r r!�generate_mail_rulesJszpolicy.generate_mail_rulescCsFd}d|||f}|t��vr.d||jf}nd||j|||f}|S)NrLzcorenet_%s_%s_%sz	%s(%s_t)
zD
gen_require(`
    type %s_t;
')
allow %s_t %s_t:%s_socket name_%s;
)r-Zget_methodsr)r�r,�action�	port_name�line�methodr r r!�generate_network_actionPs�zpolicy.generate_network_actioncCsZ|jtD]X}|�t|�d�}|dur.d|_q
|ddd�}|�dd|�}||jvr
|j�|�q
|jtD]X}|�t|�d�}|dur�d|_qn|ddd�}|�dd|�}||jvrn|j�|�qn|j	tD]X}|�t|�d�}|dur�d|_
q�|ddd�}|�dd|�}||jvr�|j�|�q�|j
du�sD|jdu�rVt�
d|jtj�Sd	S)
Nr�Tr���ZbindZconnect�udpr�rL)r�r�r�rPr�rr�rQr�r�r�r�r�r�rr�te_types)r��iZrecrrr r r!�generate_network_types^s6


zpolicy.generate_network_typescCsZ|jD]4}|�|�dkr|j|d�|�|j|Sq|jdd�|�|jdS)Nrrr)r|�findrQ)r��file�dr r r!Z__find_path�s
zpolicy.__find_pathcCs||jvr|j�|�dSr�)r�rQ)r�Z
capabilityr r r!�add_capability�s
zpolicy.add_capabilitycCs
||_dSr�)ry)r�ryr r r!�	set_types�szpolicy.set_typescCs||jvr|j�|�dSr�)r�rQ)r�Zprocessr r r!�add_process�s
zpolicy.add_processcCs||j|<dSr�)r�)r�r�descriptionr r r!�add_boolean�szpolicy.add_booleancCs|�|�|j|<dSr�)�_policy__find_pathr��r�rr r r!�add_file�szpolicy.add_filecCs|�|�|j|<dSr�)rr�r r r r!�add_dir�szpolicy.add_dircCs6d}|j��t|j�dkr2d|jd�|j�f}|S)NrLrz#allow %s_t self:capability { %s };
� )r�r:rNr�joinrr r r!�generate_capabilities�s

zpolicy.generate_capabilitiescCs6d}|j��t|j�dkr2d|jd�|j�f}|S)NrLrz allow %s_t self:process { %s };
r#)r�r:rNrr$rr r r!�generate_process�s

zpolicy.generate_processcCs�d}|���r�d}|t�d|jtj�7}|���r�|d7}|t�d|jtj�7}|��r�|t�d|jtj	�7}|j
r�t|jt
�dkr�|t�d|jtj�7}|j
r�t|jt
�dkr�|t�d|jtj�7}|jtr�|t�d|jtj�7}|jt�r|t�d|jtj�7}|jt�r.|t�d|jtj�7}|jt�rP|t�d|jtj�7}|jt�rr|t�d|jtj�7}|jt�r�|t�d|jtj�7}|jD]}||7}�q�|���r�|d7}|t�d|jtj�7}|j�r�|t�d|jtj�7}|���r|t�d|jtj �7}|j!t�r2|t�d|jtj"�7}|j!t�rT|t�d|jtj#�7}|j!t�rv|t�d|jtj$�7}|j%D]}||7}�q||S)NrL�
r�r)&r�r�r�rrZ
te_networkr�Zte_tcpr�Z	te_in_tcpr�rNr�r�Zte_in_need_port_tcpr�Zte_out_need_port_tcpr�Zte_in_all_ports_tcpr�Zte_in_reserved_ports_tcpr�Zte_in_unreserved_ports_tcpZte_out_all_ports_tcpZte_out_reserved_ports_tcpZte_out_unreserved_ports_tcpr�r�Zte_udpr�Zte_in_need_port_udpr�Z	te_in_udpr�Zte_in_all_ports_udpZte_in_reserved_ports_udpZte_in_unreserved_ports_udpr�)r�rrr r r!�generate_network_rules�sV






zpolicy.generate_network_rulescCs|d}|jD](}t�d|jtj�}|t�d||�7}q
|jtkrx|jD]2}t�d|jt	j
�}|t�d|�d�d|�7}qD|S)NrLr��APPLICATIONr8�_ur)r�r�r�rrZte_transition_rulesr*r8r�rZte_run_rulesr)r�r�appr�urSr r r!�generate_transition_rules�s


z policy.generate_transition_rulescCsd}|jtkrz|jD]`}|�d�d}|d}|jD]>}t�d|tj�}||j	vr`t�|d|�}|t�d||�7}q4q|S|jt
k�r|t�d|jtj�7}|jD](}t�d|jtj�}|t�d||�7}q�|j
D]D}|�d�d}|d|j	vr�t�d|jtj�}|t�d	||�7}q�|S)
NrL�_tr�_rr�Zsystem_rr)r*r8)r*r�r�rr�r�r�rZte_admin_domain_rulesrx�RUSERrZte_admin_rulesr�Zte_admin_trans_rules)r�rrr�roler+rr,r r r!�generate_admin_rules�s,





zpolicy.generate_admin_rulescCs d}|jrt�d|jtj�}|Sr)r�r�r�rrZ
if_dbus_rules�r��newifr r r!�generate_dbus_ifszpolicy.generate_dbus_ifcCs(d}|jtkr|St�d|jtj�}|Sr)r*�SANDBOXr�r�rrZif_sandbox_rulesr3r r r!�generate_sandbox_ifs

zpolicy.generate_sandbox_ifcCs�d}d}|jdkr>|t�d|jtj�7}|t�d|jtj�7}|jD]Z}t|j	|d�dkrD|t�d|j|j	|dj
�7}|t�d|j|j	|dj�7}qD|dkr�t�d|jtj�}||7}|t�d|jtj
�7}||7}|t�d|jtj�7}|SdS�NrLr�rrr=)r�r�r�rrZif_initscript_admin_typesZif_initscript_adminr~rNr|Zif_admin_typesZif_admin_rulesZif_begin_adminZif_middle_adminZif_end_admin)r�r4Znewtypesr�retr r r!�generate_admin_ifs"

 "zpolicy.generate_admin_ifcCst�d|jtj�S�Nr�)r�r�r�r�te_cgi_typesr�r r r!r�5szpolicy.generate_cgi_typescCst�d|jtj�Sr;)r�r�r�r�te_sandbox_typesr�r r r!r�8szpolicy.generate_sandbox_typescCst�d|jtj�Sr;)r�r�rrZte_userapp_typesr�r r r!r�;szpolicy.generate_userapp_typescCst�d|jtj�Sr;)r�r�rrZte_inetd_typesr�r r r!r�>szpolicy.generate_inetd_typescCst�d|jtj�Sr;)r�r�rrZte_dbusd_typesr�r r r!r�Aszpolicy.generate_dbusd_typescCst�d|jtj�Sr;)r�r�rrZte_min_login_user_typesr�r r r!r�Dsz$policy.generate_min_login_user_typescCst�d|jtj�Sr;)r�r�rrZte_login_user_typesr�r r r!r�Gsz policy.generate_login_user_typescCst�d|jtj�Sr;)r�r�rrZte_admin_user_typesr�r r r!r�Jsz policy.generate_admin_user_typescCs�t|j�dkr$ttd�t|j��t�d|jt	j
�}|d7}|jD]8}|d|7}|�d�dd}||jvrD|d|7}qD|d	7}|S)
Nrz,'%s' policy modules require existing domainsr�z
gen_require(`z
        type %s;r.r/z

	role %s;z
')
)
rNr�rOrrGr*r�r�rrZte_existing_user_typesrrx)r�rrr1r r r!r�Ms
�
�z#policy.generate_existing_user_typescCst�d|jtj�Sr;)r�r�rrZte_x_login_user_typesr�r r r!r�_sz"policy.generate_x_login_user_typescCst�d|jtj�Sr;)r�r�rrZte_root_user_typesr�r r r!r�bszpolicy.generate_root_user_typesc
Cs�d}t|j�dkrttd���|jD]^}|jD]R}|�|�r.t||dt|���|t�d|dt|��|j|j	�7}q$q.q$t
r�|dkr�g}|jD]}|�|�q�ttd�d�|���|S)NrLrzType field requiredr�z3You need to define a new type which ends with: 
 %sz
 )
rNryrOrr}�endswithr%r�r�rr�rQr$)r�r�trZdefault_extr r r!r�es


(
zpolicy.generate_new_typescCsdS)NrLr r�r r r!r�yszpolicy.generate_new_rulescCs6t�d|jtj�}|jdkr2|t�d|jtj�7}|Sr�)r�r�rrZte_daemon_typesr�Zte_initscript_typesrr r r!r|s
zpolicy.generate_daemon_typescCs |jrt�d|jtj�SdSdSr�)r�r�r�rrrr�r r r!�generate_tmp_types�szpolicy.generate_tmp_typescCs<d}|jD],}t�d|tj�}|t�d|j||�7}q
|S)NrL�BOOLEANZDESCRIPTION)r�r�r�rZ
te_boolean)r�r�brr r r!�generate_booleans�s

zpolicy.generate_booleanscCs(d}|jD]}|t�d|tj�7}q
|S)NrLrA)r�r�r�r�te_rules)r�rrBr r r!�generate_boolean_rules�s
zpolicy.generate_boolean_rulescCst�d|jtj�Sr;)r�r�rrr=r�r r r!�generate_sandbox_te�szpolicy.generate_sandbox_tecCst�d|jtj�Sr;)r�r�rrr<r�r r r!�generate_cgi_te�szpolicy.generate_cgi_tecCst�d|jtj�}|Sr;)r�r�rrZte_daemon_rulesr3r r r!r��szpolicy.generate_daemon_rulesc
Csld}|jD]\}|jD]P}|�|�r|dt|��d}|t�d|dt|��|j|j�7}q
qq
|S)NrLr.r�)ryr}r>rNr�r��if_rules)r�r4r?rZreqtyper r r!�generate_new_type_if�s


(zpolicy.generate_new_type_ifcCst�d|jtj�Sr;)r�r�rrZte_login_user_rulesr�r r r!r��sz policy.generate_login_user_rulescCst�d|jtj�}|Sr;)r�r�rrZte_existing_user_rules)r�Znerulesr r r!r��sz#policy.generate_existing_user_rulescCst�d|jtj�Sr;)r�r�rrZte_x_login_user_rulesr�r r r!r��sz"policy.generate_x_login_user_rulescCst�d|jtj�}|Sr;)r�r�rrZte_root_user_rulesrr r r!r��szpolicy.generate_root_user_rulescCst�d|jtj�Sr;)r�r�rrZte_userapp_rulesr�r r r!r��szpolicy.generate_userapp_rulescCst�d|jtj�Sr;)r�r�rrZte_inetd_rulesr�r r r!r��szpolicy.generate_inetd_rulescCst�d|jtj�Sr;)r�r�rrZte_dbusd_rulesr�r r r!r��szpolicy.generate_dbusd_rulescCs |jrt�d|jtj�SdSdSr�)r�r�r�rrrDr�r r r!�generate_tmp_rules�szpolicy.generate_tmp_rulescCsd}|t�d|jtj�7}|Sr)r�r�rrZte_cgi_rulesrr r r!r��szpolicy.generate_cgi_rulescCsd}|t�d|jtj�7}|Sr)r�r�rrZte_sandbox_rulesrr r r!r��szpolicy.generate_sandbox_rulescCsRd}|js|jtkr&t�d|jtj�}|jtt	t
tfvrN|t�d|jtj�7}|Sr)
r�r*r8r�r�rrZif_user_program_rules�TUSER�XUSER�AUSER�LUSERZif_role_change_rulesr3r r r!�generate_user_if�szpolicy.generate_user_ifc	Cs>d}|t�d|jtj�7}|jr6|t�d|jtj�7}|jdkrV|t�d|jtj�7}|j	D]�}t
|j|d�dkr\|t�d|j|j|dj�7}|j|dD]J}t
j�|�r�t�t
�|�tj�r�|t�d|j|j|dj�7}q\q�q\||��7}||��7}||��7}||��7}||��7}||��7}|Sr8)r�r�rrZif_heading_rulesr�Zif_program_rulesr�Zif_initscript_rulesr~rNr|rH�os�path�exists�stat�S_ISSOCK�ST_MODEZif_stream_rulesrOr5r:r7rIr�)r�r4rrr r r!�generate_if�s(

 " zpolicy.generate_ifcCs|j|jd�Sr��r�r*r�r r r!�generate_default_types�szpolicy.generate_default_typescCs&|j|jdr"|j|jd�SdS)NrrLrWr�r r r!�generate_default_rules�szpolicy.generate_default_rulescCs�d}|jttttfvr�d}t|j�dkr�|t�d|j	t
j�7}|t�d|j	t
j�7}|jD](}t�d|j	t
j
�}|t�d||�7}qZ|S)NrLrr�ZROLE)r*rKrLrMrNrNr�r�r�rrZ
te_sudo_rulesZte_newrole_rulesZte_roles_rules)r�rr�r1rr r r!�generate_roles_rules�s
zpolicy.generate_roles_rulesc
Cs�|��}|jD]L}t|j|d�dkr|jtks:|dkr|t�d|j|j|dj	�7}q|jt
krt|d|j7}||��7}||��7}||�
�7}||��7}||��7}||��7}||��7}|jD�]>}t|j|d�dkr�|jt
k�rLd}|jD]H}|t�d|dd	�d
|j|dj�7}|t�d|jd|�7}�qn |t�d|j|j|dj�7}|j|dD]�}tj�|��rzt�t�|�tj��rz|jt
k�r�|jD],}|t�d|dd	�|j|dj�7}�q�n |t�d|j|j|dj�7}qΐqzq�||��7}||��7}||��7}||��7}||��7}||� �7}||�!�7}||�"�7}||�#�7}||�$�7}||�%�7}||�&�7}||�'�7}||�(�7}||�)�7}||�*�7}||�+�7}|S)
Nrrrr�r=z@
########################################
#
# %s local policy
#
rLZTEMPLATETYPE_trr.ZTEMPLATETYPE_rw_tZ_rw_t),rXr~rNr|r*r�r�r�rrr�r%r&rr@rCrYrEr�rDrPrQrRrSrTrUZte_stream_rulesrJr(rrrr�rr�r	r�rZrr-r2rrr)r�rrZ	newte_tmp�domainrr r r!�generate_tesb
"
�
* &
, 
zpolicy.generate_tecCs�d}g}|j��D]�}tj�|�rVt�t�|�tj�rVt�	d|j
|j|dj�}nt�	d|j
|j|dj�}t�	d||�}|�
t�	d|j|d|��q|j��D]L}t�	d|j
|j|dj�}t�	d||�}|�
t�	d|j|d|��q�|jttgv�rt|�dk�rtjS|jttttgv�rH|j�sHttd���|j�rxt�	d|jtj�}|�
t�	d|j
|��|jdk�r�t�	d|jtj�}|�
t�	d|j
|��|��d	�|�}|S)
NrLr�r=�FILENAMEZFILETYPErz<You must enter the executable path for your confined processZ
EXECUTABLEr') r�rHrPrQrRrSrTrUr�r�rZfc_sock_fileZfc_filerQr�Zfc_dirr*r�r6rNrZfc_userr�r�r�rOrZ
fc_programr�Z
fc_initscriptr:r$)r�ZnewfcZfclistr�t1�t2r r r!�generate_fcDs4"  
zpolicy.generate_fccCs�d}|jtttttfvr|Sd}|jD]}|d|7}q&|dkrH|d7}t�d|j	t
j�}|t�d||�7}|jtks�|jtkr�|jD](}t�d|j	t
j
�}|t�d||�7}q�|jtkr�|t�d|j	t
j�7}n|t�d|j	t
j�7}|S)NrLz %s_rz	 system_rr�ZROLESr8)r*rKrLrMrNr0r�r�r�rrr;r�Zadmin_transZmin_login_user_default_contextZx_login_user_default_context)r��newshr�r1rr,r r r!�generate_user_shgs$


zpolicy.generate_user_shcCs�t�d|jtj�}t�d|j|�}|jtkrBt�dd|j|�}n&t�d|j|�}|t�d|jtj�7}|j	r�|t�d|j	tj
�7}|jdkr�|t�d|jtj
�7}|j�
�D]}|t�d|tj
�7}q�|j�
�D]}|t�d|tj
�7}q�|jt|jtD]@}|�|d�du�rt�dd	|tj�}|t�d|j|�7}�q|jtD]@}|�|d
�du�rLt�dd	|tj�}|t�d|j|�7}�qL||��7}|t�d|jtj�7}|S)Nr�Z
DOMAINTYPEZTEMPLATEFILEz%sr]rLr�ZPORTNUMz%dr)r�r�r�r�compilerr*r�Zmanpager�Z
restoreconr�r�rHr�r�r�r�r�Z	tcp_portsr�Z	udp_portsrbr#)r�rSrarr^r r r!�generate_sh�s2

zpolicy.generate_shcCs�d}td�}|durd}n|d}|tj7}|jtvr�|tj7}|jr\|t�d|jtj	�7}|j
dkr||t�d|j
tj	�7}|j��D]}|t�d|tj	�7}q�|j
��D]}|t�d|tj	�7}q�|t�d|tj�7}t�d|j|�}t�d|j|�}t|j�d	k�r|d
d�|j�7}|t�d|jtj�7}t�d|j|�}t�dt�d
�|�}|jtv�rpt�dd|�}|jtk�r�t�d|jd|�}|jtttttfv�r�t�d|jd|�}|S)NrLzselinux-policyz0.0.0rr]ZVERSIONZ
MODULENAMEZ
DOMAINNAMErzRequires(post): %s
z, Z
TODAYSDATEz%a %b %e %Yz%relabel_filesz.*%s_selinux.8.*z.*%s_u.*)r)rZheader_comment_sectionr*r�Zdefine_relabel_files_beginr�r�r�Zdefine_relabel_files_endr�r�rHr�Zbase_sectionr�rrNrwr$Zmid_section�time�strftimer�rKrLrMrNr0)r�ZnewspecZselinux_policynvrZselinux_policyverrr r r!�
generate_spec�s>



zpolicy.generate_speccCs2d||jf}t|d�}|�|���|��|S)Nz%s/%s_selinux.spec�w)r��open�writerg�close)r��out_dirZspecfile�fdr r r!�
write_spec�s

zpolicy.write_speccCs2d||jf}t|d�}|�|���|��|S)Nz%s/%s.terh)r�rirjr\rk)r�rlZtefilermr r r!�write_te�s

zpolicy.write_tecCs>d||jf}t|d�}|�|���|��t�|d�|S)Nz%s/%s.shrhi�)r�rirjrdrkrP�chmod)r�rlZshfilermr r r!�write_sh�s
zpolicy.write_shcCs2d||jf}t|d�}|�|���|��|S)Nz%s/%s.ifrh)r�rirjrVrk)r�rlZiffilermr r r!�write_if�s

zpolicy.write_ifcCs2d||jf}t|d�}|�|���|��|S)Nz%s/%s.fcrh)r�rirjr`rk)r�rlZfcfilermr r r!�write_fc�s

zpolicy.write_fcc
CsBddl}|����}|��|jdd�|j��}|��}|j|jd�}|D]�}|j	�
|j�|jD]F}|j
D]:}|dkr|qn|�|�rntj�|�r�|�|�qn|�|�qnqd|��}|j|jd�}|D]T}	|	jD]H}|j
D]<}|dkr�q�|�|�r�tj�|��r|�|�q�|�|�q�q�q�qLWd�n1�s40YdS)NrT)Zload_system_repo)rrm)Zprovides)�dnfZBaseZread_all_reposZ	fill_sackZsack�queryZ	available�filterr�rwrQrr�r|�
startswithrPrQ�isfiler!r"Zsource_name)
r�rt�baseruZpq�pkg�fnamerB�sqZbpkgr r r!Z__extract_rpms�s8






zpolicy.__extract_rpmsc	Cs�z|��WntyYn0tj�d|j�rB|�d|j�tj�d|j�rd|�d|j�tj�d|j�r�|�d|j�tj�d|j�r�|�d|j�tj�d|j�r�|�d|j�tj�d|j�r�|�	d|j�g}|j
��D]�}g}z|j
|dd	d
}Wnt�y4Yq�Yn0|j
|dD]"}|�
|��rD|�|�n�qD�qDt|�d	kr�|D]>}||j��v�r�|j|=n||j��v�rx|j|=n�qx�qxtt|j
|d�t|��|j
|d<q�dS)Nz/var/run/%s.pidz/var/run/%sz/var/log/%sz/var/log/%s.logz/var/lib/%sz/etc/rc.d/init.d/%sz/etc/rc\.d/init\.d/%srr�/)�_policy__extract_rpms�ImportErrorrPrQrxrr!�isdirr"r�r|rH�
IndexErrorrwrQrNr�r��list�set)r�Z
temp_basepathr1Z	temp_dirsrr r r!�
gen_writeablesF


zpolicy.gen_writeablecCs�|jtvrdStj�|j�s2tj�d|j�dSt�	d|j�}|�
���D],}|jD] }|�
|�rXtd|j|�qXqN|��dS)Nzl
***************************************
Warning %s does not exist
***************************************

znm -D %s | grep Uzself.%s)r*r�rPrQrRr��sys�stderrrj�popen�readrr{rw�execrk)r�rm�srBr r r!�gen_symbolsIs
�

zpolicy.gen_symbolscCs�td�}|d|�|�td�f7}|d|�|�td�f7}|d|�|�td�f7}|jtkr�|d|�|�td�f7}|d|�|�td�f7}|S)NzCreated the following files:
z%s # %s
zType Enforcement filezInterface filezFile Contexts filez	Spec filezSetup Script)rrorrrsr*r�rnrq)r�rl�outr r r!�generate[s
zpolicy.generateN)r�)w�__name__�
__module__�__qualname__r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�rrrrrrr	rrrrrrrrrr!r"r%r&r(r-r2r5r7r:r�r�r�r�r�r�r�r�r�r�r�r�r�rr@rCrErFrGr�rIr�r�r�r�r�r�r�rJr�r�rOrVrXrYrZr\r`rbrdrgrnrorqrrrsr~r�r�rP�getcwdr�r r r r!rY�s�B
	&8

	>##*$3rY)GrPr�rSr�r-rrrreZ	templatesrrrr	r
rrr
rrrrrrrZsepolgen.interfacesZ
interfacesZsepolgen.defaults�defaultsZPROGNAME�gettext�kwargs�version_info�translationr?r�builtins�str�__dict__rZ__builtin__rr"r)r2r<r�r�r�r�ZADMIN_TRANSITION_INTERFACEZUSER_TRANSITION_INTERFACEr�r
ZINETDr�r6r8r�rKrLrNrMr0r�rGrKr�r�rXrYr r r r!�<module>s�
���