| #!/usr/bin/python |
| |
| # Author: Dan Walsh <dwalsh@redhat.com> |
| # Author: Ryan Hallisey <rhallise@redhat.com> |
| |
| import _policy |
| import selinux |
| import glob |
| PROGNAME = "policycoreutils" |
| import gettext |
| import sepolgen.defaults as defaults |
| import sepolgen.interfaces as interfaces |
| import sys |
| gettext.bindtextdomain(PROGNAME, "/usr/share/locale") |
| gettext.textdomain(PROGNAME) |
| try: |
| gettext.install(PROGNAME, |
| localedir="/usr/share/locale", |
| unicode=False, |
| codeset='utf-8') |
| except IOError: |
| import __builtin__ |
| __builtin__.__dict__['_'] = unicode |
| |
| TYPE = _policy.TYPE |
| ROLE = _policy.ROLE |
| ATTRIBUTE = _policy.ATTRIBUTE |
| PORT = _policy.PORT |
| USER = _policy.USER |
| BOOLEAN = _policy.BOOLEAN |
| TCLASS = _policy.CLASS |
| |
| ALLOW = 'allow' |
| AUDITALLOW = 'auditallow' |
| NEVERALLOW = 'neverallow' |
| DONTAUDIT = 'dontaudit' |
| SOURCE = 'source' |
| TARGET = 'target' |
| PERMS = 'permlist' |
| CLASS = 'class' |
| TRANSITION = 'transition' |
| ROLE_ALLOW = 'role_allow' |
| |
| |
| def info(setype, name=None): |
| dict_list = _policy.info(setype, name) |
| return dict_list |
| |
| |
| def search(types, info={}): |
| seinfo = info |
| valid_types = [ALLOW, AUDITALLOW, NEVERALLOW, DONTAUDIT, TRANSITION, ROLE_ALLOW] |
| for setype in types: |
| if setype not in valid_types: |
| raise ValueError("Type has to be in %s" % valid_types) |
| seinfo[setype] = True |
| |
| perms = [] |
| if PERMS in seinfo: |
| perms = info[PERMS] |
| seinfo[PERMS] = ",".join(seinfo[PERMS]) |
| |
| dict_list = _policy.search(seinfo) |
| if dict_list and len(perms) != 0: |
| dict_list = filter(lambda x: _dict_has_perms(x, perms), dict_list) |
| return dict_list |
| |
| |
| def get_conditionals(src, dest, tclass, perm): |
| tdict = {} |
| tlist = [] |
| if dest.endswith("_t"): |
| allows = search([ALLOW], {SOURCE: src, TARGET: dest, CLASS: tclass, PERMS: perm}) |
| else: |
| # to include attribute |
| allows = search([ALLOW], {SOURCE: src, CLASS: tclass, PERMS: perm}) |
| for i in allows: |
| if i['target'] == dest: |
| allows = [] |
| allows.append(i) |
| try: |
| for i in map(lambda y: (y), filter(lambda x: set(perm).issubset(x[PERMS]) and x['boolean'], allows)): |
| tdict.update({'source': i['source'], 'boolean': i['boolean']}) |
| if tdict not in tlist: |
| tlist.append(tdict) |
| tdict = {} |
| except KeyError: |
| return(tlist) |
| |
| return (tlist) |
| |
| |
| def get_conditionals_format_text(cond): |
| enabled = len(filter(lambda x: x['boolean'][0][1], cond)) > 0 |
| return _("-- Allowed %s [ %s ]") % (enabled, " || ".join(set(map(lambda x: "%s=%d" % (x['boolean'][0][0], x['boolean'][0][1]), cond)))) |
| |
| |
| def get_types_from_attribute(attribute): |
| return info(ATTRIBUTE, attribute)[0]["types"] |
| |
| file_type_str = {} |
| file_type_str["a"] = _("all files") |
| file_type_str["f"] = _("regular file") |
| file_type_str["d"] = _("directory") |
| file_type_str["c"] = _("character device") |
| file_type_str["b"] = _("block device") |
| file_type_str["s"] = _("socket file") |
| file_type_str["l"] = _("symbolic link") |
| file_type_str["p"] = _("named pipe") |
| |
| trans_file_type_str = {} |
| trans_file_type_str[""] = "a" |
| trans_file_type_str["--"] = "f" |
| trans_file_type_str["-d"] = "d" |
| trans_file_type_str["-c"] = "c" |
| trans_file_type_str["-b"] = "b" |
| trans_file_type_str["-s"] = "s" |
| trans_file_type_str["-l"] = "l" |
| trans_file_type_str["-p"] = "p" |
| |
| |
| def get_file_types(setype): |
| flist = [] |
| mpaths = {} |
| for f in get_all_file_types(): |
| if f.startswith(gen_short_name(setype)): |
| flist.append(f) |
| fcdict = get_fcdict() |
| for f in flist: |
| try: |
| mpaths[f] = (fcdict[f]["regex"], file_type_str[fcdict[f]["ftype"]]) |
| except KeyError: |
| mpaths[f] = [] |
| return mpaths |
| |
| |
| def get_writable_files(setype): |
| all_attributes = get_all_attributes() |
| file_types = get_all_file_types() |
| all_writes = [] |
| mpaths = {} |
| permlist = search([ALLOW], {'source': setype, 'permlist': ['open', 'write'], 'class': 'file'}) |
| if permlist == None or len(permlist) == 0: |
| return mpaths |
| |
| fcdict = get_fcdict() |
| |
| attributes = ["proc_type", "sysctl_type"] |
| for i in permlist: |
| if i['target'] in attributes: |
| continue |
| if "enabled" in i: |
| if not i["enabled"]: |
| continue |
| if i['target'].endswith("_t"): |
| if i['target'] not in file_types: |
| continue |
| if i['target'] not in all_writes: |
| if i['target'] != setype: |
| all_writes.append(i['target']) |
| else: |
| for t in get_types_from_attribute(i['target']): |
| if t not in all_writes: |
| all_writes.append(t) |
| |
| for f in all_writes: |
| try: |
| mpaths[f] = (fcdict[f]["regex"], file_type_str[fcdict[f]["ftype"]]) |
| except KeyError: |
| mpaths[f] = [] # {"regex":[],"paths":[]} |
| return mpaths |
| |
| import os |
| import re |
| import sys |
| |
| |
| def find_file(reg): |
| if os.path.exists(reg): |
| return [reg] |
| try: |
| pat = re.compile(r"%s$" % reg) |
| except: |
| print "bad reg:", reg |
| return [] |
| p = reg |
| if p.endswith("(/.*)?"): |
| p = p[:-6] + "/" |
| |
| path = os.path.dirname(p) |
| |
| try: # Bug fix: when "all files on system" |
| if path[-1] != "/": # is pass in it breaks without try block |
| path += "/" |
| except IndexError: |
| print "try failed got an IndexError" |
| pass |
| |
| try: |
| pat = re.compile(r"%s$" % reg) |
| return filter(pat.match, map(lambda x: path + x, os.listdir(path))) |
| except: |
| return [] |
| |
| |
| def find_all_files(domain, exclude_list=[]): |
| all_entrypoints = [] |
| executable_files = get_entrypoints(domain) |
| for exe in executable_files.keys(): |
| if exe.endswith("_exec_t") and exe not in exclude_list: |
| for path in executable_files[exe]: |
| for f in find_file(path): |
| return f |
| #all_entrypoints.append(f) |
| return None |
| |
| #return all_entrypoints |
| |
| |
| def find_entrypoint_path(exe, exclude_list=[]): |
| fcdict = get_fcdict() |
| try: |
| if exe.endswith("_exec_t") and exe not in exclude_list: |
| for path in fcdict[exe]["regex"]: |
| for f in find_file(path): |
| return f |
| except KeyError: |
| pass |
| return None |
| |
| |
| def read_file_equiv(edict, fc_path, modify): |
| fd = open(fc_path, "r") |
| fc = fd.readlines() |
| fd.close() |
| for e in fc: |
| f = e.split() |
| edict[f[0]] = {"equiv": f[1], "modify": modify} |
| return edict |
| |
| file_equiv_modified = None |
| |
| |
| def get_file_equiv_modified(fc_path=selinux.selinux_file_context_path()): |
| global file_equiv_modified |
| if file_equiv_modified: |
| return file_equiv_modified |
| file_equiv_modified = {} |
| file_equiv_modified = read_file_equiv(file_equiv_modified, fc_path + ".subs", modify=True) |
| return file_equiv_modified |
| |
| file_equiv = None |
| |
| |
| def get_file_equiv(fc_path=selinux.selinux_file_context_path()): |
| global file_equiv |
| if file_equiv: |
| return file_equiv |
| file_equiv = get_file_equiv_modified(fc_path) |
| file_equiv = read_file_equiv(file_equiv, fc_path + ".subs_dist", modify=False) |
| return file_equiv |
| |
| local_files = None |
| |
| |
| def get_local_file_paths(fc_path=selinux.selinux_file_context_path()): |
| global local_files |
| if local_files: |
| return local_files |
| local_files = [] |
| fd = open(fc_path + ".local", "r") |
| fc = fd.readlines() |
| fd.close() |
| for i in fc: |
| rec = i.split() |
| if len(rec) == 0: |
| continue |
| try: |
| if len(rec) > 2: |
| ftype = trans_file_type_str[rec[1]] |
| else: |
| ftype = "a" |
| |
| local_files.append((rec[0], ftype)) |
| except KeyError: |
| pass |
| return local_files |
| |
| fcdict = None |
| |
| |
| def get_fcdict(fc_path=selinux.selinux_file_context_path()): |
| global fcdict |
| if fcdict: |
| return fcdict |
| fd = open(fc_path, "r") |
| fc = fd.readlines() |
| fd.close() |
| fd = open(fc_path + ".homedirs", "r") |
| fc += fd.readlines() |
| fd.close() |
| fcdict = {} |
| fd = open(fc_path + ".local", "r") |
| fc += fd.readlines() |
| fd.close() |
| |
| for i in fc: |
| rec = i.split() |
| try: |
| if len(rec) > 2: |
| ftype = trans_file_type_str[rec[1]] |
| else: |
| ftype = "a" |
| |
| t = rec[-1].split(":")[2] |
| if t in fcdict: |
| fcdict[t]["regex"].append(rec[0]) |
| else: |
| fcdict[t] = {"regex": [rec[0]], "ftype": ftype} |
| except: |
| pass |
| |
| fcdict["logfile"] = {"regex": ["all log files"]} |
| fcdict["user_tmp_type"] = {"regex": ["all user tmp files"]} |
| fcdict["user_home_type"] = {"regex": ["all user home files"]} |
| fcdict["virt_image_type"] = {"regex": ["all virtual image files"]} |
| fcdict["noxattrfs"] = {"regex": ["all files on file systems which do not support extended attributes"]} |
| fcdict["sandbox_tmpfs_type"] = {"regex": ["all sandbox content in tmpfs file systems"]} |
| fcdict["user_tmpfs_type"] = {"regex": ["all user content in tmpfs file systems"]} |
| fcdict["file_type"] = {"regex": ["all files on the system"]} |
| fcdict["samba_share_t"] = {"regex": ["use this label for random content that will be shared using samba"]} |
| return fcdict |
| |
| |
| def get_transitions_into(setype): |
| try: |
| return filter(lambda x: x["transtype"] == setype, search([TRANSITION], {'class': 'process'})) |
| except TypeError: |
| pass |
| return None |
| |
| |
| def get_transitions(setype): |
| try: |
| return search([TRANSITION], {'source': setype, 'class': 'process'}) |
| except TypeError: |
| pass |
| return None |
| |
| |
| def get_file_transitions(setype): |
| try: |
| return filter(lambda x: x['class'] != "process", search([TRANSITION], {'source': setype})) |
| except TypeError: |
| pass |
| return None |
| |
| |
| def get_boolean_rules(setype, boolean): |
| boollist = [] |
| permlist = search([ALLOW], {'source': setype}) |
| for p in permlist: |
| if "boolean" in p: |
| try: |
| for b in p["boolean"]: |
| if boolean in b: |
| boollist.append(p) |
| except: |
| pass |
| return boollist |
| |
| |
| def get_all_entrypoints(): |
| return get_types_from_attribute("entry_type") |
| |
| |
| def get_entrypoint_types(setype): |
| entrypoints = [] |
| try: |
| entrypoints = map(lambda x: x['target'], filter(lambda x: x['source'] == setype, search([ALLOW], {'source': setype, 'permlist': ['entrypoint'], 'class': 'file'}))) |
| except TypeError: |
| pass |
| return entrypoints |
| |
| |
| def get_init_transtype(path): |
| entrypoint = selinux.getfilecon(path)[1].split(":")[2] |
| try: |
| entrypoints = filter(lambda x: x['target'] == entrypoint, search([TRANSITION], {'source': "init_t", 'class': 'process'})) |
| if len(entrypoints) == 0: |
| return None |
| return entrypoints[0]["transtype"] |
| except TypeError: |
| pass |
| return None |
| |
| |
| def get_init_entrypoint(transtype): |
| try: |
| entrypoints = filter(lambda x: x['transtype'] == transtype, search([TRANSITION], {'source': "init_t", 'class': 'process'})) |
| if len(entrypoints) == 0: |
| return None |
| return entrypoints[0]["target"] |
| except TypeError: |
| pass |
| return None |
| |
| |
| def get_init_entrypoint_target(entrypoint): |
| try: |
| entrypoints = map(lambda x: x['transtype'], search([TRANSITION], {'source': "init_t", 'target': entrypoint, 'class': 'process'})) |
| return entrypoints[0] |
| except TypeError: |
| pass |
| return None |
| |
| |
| def get_entrypoints(setype): |
| fcdict = get_fcdict() |
| mpaths = {} |
| for f in get_entrypoint_types(setype): |
| try: |
| mpaths[f] = (fcdict[f]["regex"], file_type_str[fcdict[f]["ftype"]]) |
| except KeyError: |
| mpaths[f] = [] |
| return mpaths |
| |
| |
| def get_installed_policy(root="/"): |
| try: |
| path = root + selinux.selinux_binary_policy_path() |
| policies = glob.glob("%s.*" % path) |
| policies.sort() |
| return policies[-1] |
| except: |
| pass |
| raise ValueError(_("No SELinux Policy installed")) |
| |
| methods = [] |
| |
| |
| def get_methods(): |
| global methods |
| if len(methods) > 0: |
| return methods |
| gen_interfaces() |
| fn = defaults.interface_info() |
| try: |
| fd = open(fn) |
| # List of per_role_template interfaces |
| ifs = interfaces.InterfaceSet() |
| ifs.from_file(fd) |
| methods = ifs.interfaces.keys() |
| fd.close() |
| except: |
| sys.stderr.write("could not open interface info [%s]\n" % fn) |
| sys.exit(1) |
| |
| methods.sort() |
| return methods |
| |
| all_types = None |
| |
| |
| def get_all_types(): |
| global all_types |
| if all_types == None: |
| all_types = map(lambda x: x['name'], info(TYPE)) |
| return all_types |
| |
| user_types = None |
| |
| |
| def get_user_types(): |
| global user_types |
| if user_types == None: |
| user_types = info(ATTRIBUTE, "userdomain")[0]["types"] |
| return user_types |
| |
| role_allows = None |
| |
| |
| def get_all_role_allows(): |
| global role_allows |
| if role_allows: |
| return role_allows |
| role_allows = {} |
| for r in search([ROLE_ALLOW]): |
| if r["source"] == "system_r" or r["target"] == "system_r": |
| continue |
| if r["source"] in role_allows: |
| role_allows[r["source"]].append(r["target"]) |
| else: |
| role_allows[r["source"]] = [r["target"]] |
| |
| return role_allows |
| |
| |
| def get_all_entrypoint_domains(): |
| import re |
| all_domains = [] |
| types = get_all_types() |
| types.sort() |
| for i in types: |
| m = re.findall("(.*)%s" % "_exec_t$", i) |
| if len(m) > 0: |
| if len(re.findall("(.*)%s" % "_initrc$", m[0])) == 0 and m[0] not in all_domains: |
| all_domains.append(m[0]) |
| return all_domains |
| |
| portrecs = None |
| portrecsbynum = None |
| |
| |
| def gen_interfaces(): |
| import commands |
| ifile = defaults.interface_info() |
| headers = defaults.headers() |
| rebuild = False |
| try: |
| if os.stat(headers).st_mtime <= os.stat(ifile).st_mtime: |
| return |
| except OSError: |
| pass |
| |
| if os.getuid() != 0: |
| raise ValueError(_("You must regenerate interface info by running /usr/bin/sepolgen-ifgen")) |
| print commands.getstatusoutput("/usr/bin/sepolgen-ifgen")[1] |
| |
| |
| def gen_port_dict(): |
| global portrecs |
| global portrecsbynum |
| if portrecs: |
| return (portrecs, portrecsbynum) |
| portrecsbynum = {} |
| portrecs = {} |
| for i in info(PORT): |
| if i['low'] == i['high']: |
| port = str(i['low']) |
| else: |
| port = "%s-%s" % (str(i['low']), str(i['high'])) |
| |
| if (i['type'], i['protocol']) in portrecs: |
| portrecs[(i['type'], i['protocol'])].append(port) |
| else: |
| portrecs[(i['type'], i['protocol'])] = [port] |
| |
| if 'range' in i: |
| portrecsbynum[(i['low'], i['high'], i['protocol'])] = (i['type'], i['range']) |
| else: |
| portrecsbynum[(i['low'], i['high'], i['protocol'])] = (i['type']) |
| |
| return (portrecs, portrecsbynum) |
| |
| all_domains = None |
| |
| |
| def get_all_domains(): |
| global all_domains |
| if not all_domains: |
| all_domains = info(ATTRIBUTE, "domain")[0]["types"] |
| return all_domains |
| |
| roles = None |
| |
| |
| def get_all_roles(): |
| global roles |
| if roles: |
| return roles |
| roles = map(lambda x: x['name'], info(ROLE)) |
| roles.remove("object_r") |
| roles.sort() |
| return roles |
| |
| selinux_user_list = None |
| |
| |
| def get_selinux_users(): |
| global selinux_user_list |
| if not selinux_user_list: |
| selinux_user_list = info(USER) |
| for x in selinux_user_list: |
| x['range'] = "".join(x['range'].split(" ")) |
| return selinux_user_list |
| |
| login_mappings = None |
| |
| |
| def get_login_mappings(): |
| global login_mappings |
| if login_mappings: |
| return login_mappings |
| |
| fd = open(selinux.selinux_usersconf_path(), "r") |
| buf = fd.read() |
| fd.close() |
| login_mappings = [] |
| for b in buf.split("\n"): |
| b = b.strip() |
| if len(b) == 0 or b.startswith("#"): |
| continue |
| x = b.split(":") |
| login_mappings.append({"name": x[0], "seuser": x[1], "mls": ":".join(x[2:])}) |
| return login_mappings |
| |
| |
| def get_all_users(): |
| users = map(lambda x: x['name'], get_selinux_users()) |
| users.sort() |
| return users |
| |
| file_types = None |
| |
| |
| def get_all_file_types(): |
| global file_types |
| if file_types: |
| return file_types |
| file_types = info(ATTRIBUTE, "file_type")[0]["types"] |
| file_types.sort() |
| return file_types |
| |
| port_types = None |
| |
| |
| def get_all_port_types(): |
| global port_types |
| if port_types: |
| return port_types |
| port_types = info(ATTRIBUTE, "port_type")[0]["types"] |
| port_types.sort() |
| return port_types |
| |
| bools = None |
| |
| |
| def get_all_bools(): |
| global bools |
| if not bools: |
| bools = info(BOOLEAN) |
| return bools |
| |
| |
| def prettyprint(f, trim): |
| return " ".join(f[:-len(trim)].split("_")) |
| |
| |
| def markup(f): |
| return f |
| |
| # Autofill for adding files ************************* |
| DEFAULT_DIRS = {} |
| DEFAULT_DIRS["/etc"] = "etc_t" |
| DEFAULT_DIRS["/tmp"] = "tmp_t" |
| DEFAULT_DIRS["/usr/lib/systemd/system"] = "unit_file_t" |
| DEFAULT_DIRS["/lib/systemd/system"] = "unit_file_t" |
| DEFAULT_DIRS["/etc/systemd/system"] = "unit_file_t" |
| DEFAULT_DIRS["/var/cache"] = "var_cache_t" |
| DEFAULT_DIRS["/var/lib"] = "var_lib_t" |
| DEFAULT_DIRS["/var/log"] = "log_t" |
| DEFAULT_DIRS["/var/run"] = "var_run_t" |
| DEFAULT_DIRS["/run"] = "var_run_t" |
| DEFAULT_DIRS["/run/lock"] = "var_lock_t" |
| DEFAULT_DIRS["/var/run/lock"] = "var_lock_t" |
| DEFAULT_DIRS["/var/spool"] = "var_spool_t" |
| DEFAULT_DIRS["/var/www"] = "content_t" |
| |
| |
| def get_description(f, markup=markup): |
| |
| txt = "Set files with the %s type, if you want to " % markup(f) |
| |
| if f.endswith("_var_run_t"): |
| return txt + "store the %s files under the /run or /var/run directory." % prettyprint(f, "_var_run_t") |
| if f.endswith("_pid_t"): |
| return txt + "store the %s files under the /run directory." % prettyprint(f, "_pid_t") |
| if f.endswith("_var_lib_t"): |
| return txt + "store the %s files under the /var/lib directory." % prettyprint(f, "_var_lib_t") |
| if f.endswith("_var_t"): |
| return txt + "store the %s files under the /var directory." % prettyprint(f, "_var_lib_t") |
| if f.endswith("_var_spool_t"): |
| return txt + "store the %s files under the /var/spool directory." % prettyprint(f, "_spool_t") |
| if f.endswith("_spool_t"): |
| return txt + "store the %s files under the /var/spool directory." % prettyprint(f, "_spool_t") |
| if f.endswith("_cache_t") or f.endswith("_var_cache_t"): |
| return txt + "store the files under the /var/cache directory." |
| if f.endswith("_keytab_t"): |
| return txt + "treat the files as kerberos keytab files." |
| if f.endswith("_lock_t"): |
| return txt + "treat the files as %s lock data, stored under the /var/lock directory" % prettyprint(f, "_lock_t") |
| if f.endswith("_log_t"): |
| return txt + "treat the data as %s log data, usually stored under the /var/log directory." % prettyprint(f, "_log_t") |
| if f.endswith("_config_t"): |
| return txt + "treat the files as %s configuration data, usually stored under the /etc directory." % prettyprint(f, "_config_t") |
| if f.endswith("_conf_t"): |
| return txt + "treat the files as %s configuration data, usually stored under the /etc directory." % prettyprint(f, "_conf_t") |
| if f.endswith("_exec_t"): |
| return txt + "transition an executable to the %s_t domain." % f[:-len("_exec_t")] |
| if f.endswith("_cgi_content_t"): |
| return txt + "treat the files as %s cgi content." % prettyprint(f, "_cgi_content_t") |
| if f.endswith("_rw_content_t"): |
| return txt + "treat the files as %s read/write content." % prettyprint(f, "_rw_content_t") |
| if f.endswith("_rw_t"): |
| return txt + "treat the files as %s read/write content." % prettyprint(f, "_rw_t") |
| if f.endswith("_write_t"): |
| return txt + "treat the files as %s read/write content." % prettyprint(f, "_write_t") |
| if f.endswith("_db_t"): |
| return txt + "treat the files as %s database content." % prettyprint(f, "_db_t") |
| if f.endswith("_ra_content_t"): |
| return txt + "treat the files as %s read/append content." % prettyprint(f, "_ra_conten_t") |
| if f.endswith("_cert_t"): |
| return txt + "treat the files as %s certificate data." % prettyprint(f, "_cert_t") |
| if f.endswith("_key_t"): |
| return txt + "treat the files as %s key data." % prettyprint(f, "_key_t") |
| |
| if f.endswith("_secret_t"): |
| return txt + "treat the files as %s secret data." % prettyprint(f, "_key_t") |
| |
| if f.endswith("_ra_t"): |
| return txt + "treat the files as %s read/append content." % prettyprint(f, "_ra_t") |
| |
| if f.endswith("_ro_t"): |
| return txt + "treat the files as %s read/only content." % prettyprint(f, "_ro_t") |
| |
| if f.endswith("_modules_t"): |
| return txt + "treat the files as %s modules." % prettyprint(f, "_modules_t") |
| |
| if f.endswith("_content_t"): |
| return txt + "treat the files as %s content." % prettyprint(f, "_content_t") |
| |
| if f.endswith("_state_t"): |
| return txt + "treat the files as %s state data." % prettyprint(f, "_state_t") |
| |
| if f.endswith("_files_t"): |
| return txt + "treat the files as %s content." % prettyprint(f, "_files_t") |
| |
| if f.endswith("_file_t"): |
| return txt + "treat the files as %s content." % prettyprint(f, "_file_t") |
| |
| if f.endswith("_data_t"): |
| return txt + "treat the files as %s content." % prettyprint(f, "_data_t") |
| |
| if f.endswith("_file_t"): |
| return txt + "treat the data as %s content." % prettyprint(f, "_file_t") |
| |
| if f.endswith("_tmp_t"): |
| return txt + "store %s temporary files in the /tmp directories." % prettyprint(f, "_tmp_t") |
| if f.endswith("_etc_t"): |
| return txt + "store %s files in the /etc directories." % prettyprint(f, "_tmp_t") |
| if f.endswith("_home_t"): |
| return txt + "store %s files in the users home directory." % prettyprint(f, "_home_t") |
| if f.endswith("_tmpfs_t"): |
| return txt + "store %s files on a tmpfs file system." % prettyprint(f, "_tmpfs_t") |
| if f.endswith("_unit_file_t"): |
| return txt + "treat files as a systemd unit file." |
| if f.endswith("_htaccess_t"): |
| return txt + "treat the file as a %s access file." % prettyprint(f, "_htaccess_t") |
| |
| return txt + "treat the files as %s data." % prettyprint(f, "_t") |
| |
| all_attributes = None |
| |
| |
| def get_all_attributes(): |
| global all_attributes |
| if not all_attributes: |
| all_attributes = map(lambda x: x['name'], info(ATTRIBUTE)) |
| return all_attributes |
| |
| |
| def policy(policy_file): |
| global all_domains |
| global all_attributes |
| global bools |
| global all_types |
| global role_allows |
| global users |
| global roles |
| global file_types |
| global port_types |
| all_domains = None |
| all_attributes = None |
| bools = None |
| all_types = None |
| role_allows = None |
| users = None |
| roles = None |
| file_types = None |
| port_types = None |
| try: |
| _policy.policy(policy_file) |
| except: |
| raise ValueError(_("Failed to read %s policy file") % policy_file) |
| |
| try: |
| policy_file = get_installed_policy() |
| policy(policy_file) |
| except ValueError, e: |
| if selinux.is_selinux_enabled() == 1: |
| raise e |
| |
| |
| def _dict_has_perms(dict, perms): |
| for perm in perms: |
| if perm not in dict[PERMS]: |
| return False |
| return True |
| |
| |
| def gen_short_name(setype): |
| all_domains = get_all_domains() |
| if setype.endswith("_t"): |
| domainname = setype[:-2] |
| else: |
| domainname = setype |
| if domainname + "_t" not in all_domains: |
| raise ValueError("domain %s_t does not exist" % domainname) |
| if domainname[-1] == 'd': |
| short_name = domainname[:-1] + "_" |
| else: |
| short_name = domainname + "_" |
| return (domainname, short_name) |
| |
| |
| def get_bools(setype): |
| bools = [] |
| domainbools = [] |
| domainname, short_name = gen_short_name(setype) |
| for i in map(lambda x: x['boolean'], filter(lambda x: 'boolean' in x, search([ALLOW], {'source': setype}))): |
| for b in i: |
| if not isinstance(b, tuple): |
| continue |
| try: |
| enabled = selinux.security_get_boolean_active(b[0]) |
| except OSError: |
| enabled = b[1] |
| if b[0].startswith(short_name) or b[0].startswith(domainname): |
| if (b[0], enabled) not in domainbools and (b[0], not enabled) not in domainbools: |
| domainbools.append((b[0], enabled)) |
| else: |
| if (b[0], enabled) not in bools and (b[0], not enabled) not in bools: |
| bools.append((b[0], enabled)) |
| return (domainbools, bools) |
| |
| booleans = None |
| |
| |
| def get_all_booleans(): |
| global booleans |
| if not booleans: |
| booleans = selinux.security_get_boolean_names()[1] |
| return booleans |
| |
| booleans_dict = None |
| import gzip |
| |
| |
| def policy_xml(path="/usr/share/selinux/devel/policy.xml"): |
| try: |
| fd = gzip.open(path) |
| buf = fd.read() |
| fd.close() |
| except IOError: |
| fd = open(path) |
| buf = fd.read() |
| fd.close() |
| return buf |
| |
| |
| def gen_bool_dict(path="/usr/share/selinux/devel/policy.xml"): |
| global booleans_dict |
| if booleans_dict: |
| return booleans_dict |
| import xml.etree.ElementTree |
| import re |
| booleans_dict = {} |
| try: |
| tree = xml.etree.ElementTree.fromstring(policy_xml(path)) |
| for l in tree.findall("layer"): |
| for m in l.findall("module"): |
| for b in m.findall("tunable"): |
| desc = b.find("desc").find("p").text.strip("\n") |
| desc = re.sub("\n", " ", desc) |
| booleans_dict[b.get('name')] = (m.get("name"), b.get('dftval'), desc) |
| for b in m.findall("bool"): |
| desc = b.find("desc").find("p").text.strip("\n") |
| desc = re.sub("\n", " ", desc) |
| booleans_dict[b.get('name')] = (m.get("name"), b.get('dftval'), desc) |
| for i in tree.findall("bool"): |
| desc = i.find("desc").find("p").text.strip("\n") |
| desc = re.sub("\n", " ", desc) |
| booleans_dict[i.get('name')] = ("global", i.get('dftval'), desc) |
| for i in tree.findall("tunable"): |
| desc = i.find("desc").find("p").text.strip("\n") |
| desc = re.sub("\n", " ", desc) |
| booleans_dict[i.get('name')] = ("global", i.get('dftval'), desc) |
| except IOError, e: |
| pass |
| return booleans_dict |
| |
| |
| def boolean_category(boolean): |
| booleans_dict = gen_bool_dict() |
| if boolean in booleans_dict: |
| return _(booleans_dict[boolean][0]) |
| else: |
| return _("unknown") |
| |
| |
| def boolean_desc(boolean): |
| booleans_dict = gen_bool_dict() |
| if boolean in booleans_dict: |
| return _(booleans_dict[boolean][2]) |
| else: |
| desc = boolean.split("_") |
| return "Allow %s to %s" % (desc[0], " ".join(desc[1:])) |
| |
| |
| def get_os_version(): |
| os_version = "" |
| pkg_name = "selinux-policy" |
| try: |
| import commands |
| rc, output = commands.getstatusoutput("rpm -q '%s'" % pkg_name) |
| if rc == 0: |
| os_version = output.split(".")[-2] |
| except: |
| os_version = "" |
| |
| if os_version[0:2] == "fc": |
| os_version = "Fedora" + os_version[2:] |
| elif os_version[0:2] == "el": |
| os_version = "RHEL" + os_version[2:] |
| else: |
| os_version = "" |
| |
| return os_version |
| |
| |
| def reinit(): |
| global all_attributes |
| global all_domains |
| global all_types |
| global booleans |
| global booleans_dict |
| global bools |
| global fcdict |
| global file_types |
| global local_files |
| global methods |
| global methods |
| global portrecs |
| global portrecsbynum |
| global port_types |
| global role_allows |
| global roles |
| global login_mappings |
| global selinux_user_list |
| global user_types |
| all_attributes = None |
| all_domains = None |
| all_types = None |
| booleans = None |
| booleans_dict = None |
| bools = None |
| fcdict = None |
| file_types = None |
| local_files = None |
| methods = None |
| methods = None |
| portrecs = None |
| portrecsbynum = None |
| port_types = None |
| role_allows = None |
| roles = None |
| user_types = None |
| login_mappings = None |
| selinux_user_list = None |
