| Server IP : 3.96.16.70 / Your IP : 216.73.216.15 Web Server : Apache System : Linux ip-172-31-26-103.ca-central-1.compute.internal 6.1.163-186.299.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Feb 24 16:35:42 UTC 2026 x86_64 User : ec2-user ( 1000) PHP Version : 8.4.18 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF Directory : /usr/lib/python3.9/site-packages/sepolicy/__pycache__/ |
Upload File : |
a
���c� � @ s� d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZ d dlZddl m
Z
ddl m Z ddl m Z ddl m
Z
ddl mZ dd l mZ dd
l mZ dd l mZ dd l mZ dd
l mZ ddl mZ ddl mZ ddl mZ ddl mZ ddl mZ d dlmZ d dlm Z dZ zHd dl Z i Z ej dk �r6de d< e j!e fddie �ddi��Z"e"j Z#W nJ zd dl$Z$e%e$j&d< W n& e'�y� d dl(Z(e)e(j&d< Y n0 Y n0 dd � Z*d d � Z+d d � Z,d!d"� Z-d Z.dZ/d#Z0d$Z1d%Z2d&Z3d Z4dZ5d#Z6d$Z7d'Z8d(Z9d)Z:d*Z;d+Z<d,Z=d-Z>d.Z?d/Z@i ZAe#d0�eAe4< e#d1�eAe5< e#d2�eAe6< e#d3�eAe7< e#d4�eAe8< e#d5�eAe9< e#d6�eAe:< e#d7�eAe;< e#d8�eAe<< e#d9�eAe=< e#d:�eAe>< e#d;�eAe?< e#d<�eAe@< d=d>� ZBe4e5e6e9e7gZCe<e;e=e>e?gZDd?d@� ZEG dAdB� dB�ZFdS )C� N)�
get_all_types�get_all_attributes�
get_all_roles� )�
executable)�boolean)�etc_rw)� unit_file)� var_cache)� var_spool)�var_lib)�var_log)�var_run)�tmp)�rw)�network)�script)�spec)�userzselinux-python)� T�unicodeZ localedirz/usr/share/localeZfallback�_c C sF | d }| d }| d }|d |� d�d }|� d�d }|||gS )z6Given an RPM header return the package NVR as a string�name�version�release�-�.r r )�split)Zhdrr r r Zrelease_versionZ
os_version� r �5/usr/lib/python3.9/site-packages/sepolicy/generate.py�get_rpm_nvr_from_headerG s r c C s^ z<dd l }d }|�� }|�|j| �}|D ]}t|�} q:q(W n td| � d }Y n0 |S )Nr z"Failed to retrieve rpm info for %s)�rpm�tsZdbMatchZ RPMTAG_NAMEr �print)�packager! Znvrr" �mi�hr r r �get_rpm_nvr_listR s
r' c C s� i } t �t j�D ]j}|d dks|d dks|d dks|d dks|d dkrRq|d |�d�f| |d |d |d
f< q| S ) N�typeZreserved_port_tZport_tZhi_reserved_port_tZephemeral_port_tZunreserved_port_t�rangeZlowZhigh�protocol)�sepolicy�infoZPORT�get)�dict�pr r r �
get_all_portsb s
�
�
�
�*r0 c C s6 dd� t �t j�D �} | �d� | �d� | �� | S )Nc S s g | ] }|d �qS )r r )�.0�xr r r �
<listcomp>p � z!get_all_users.<locals>.<listcomp>Zsystem_u�root)r+ r, �USER�remove�sort)�usersr r r �
get_all_userso s
r: � r z_admin$z_role$� � � � � � �
� � zStandard Init DaemonzDBUS System DaemonzInternet Services Daemonz Web Application/Script (CGI)ZSandboxzUser ApplicationzExisting Domain Typez Minimal Terminal Login User Rolez!Minimal X Windows Login User RolezDesktop Login User Rolez Administrator Login User Rolez Confined Root Administrator Rolez!Module information for a new typec C s: t �� } | �� td�}| D ]}|d|t | f 7 }q |S )Nz
Valid Types:
z%2s: %s
)�poltype�keysr8 r )rF �msg�kr r r �get_poltype_desc� s rI c C s� | dkr g S d}z�g }| � d�D ]�}|� d�}t|�dkr>t�t|�dkrdt|d �}t|d �}n$t|d �}t|d �}||kr�t�t||d �D ]"}|dk s�||kr�t�|�|� q�q |W S ty� ttd�| ��Y n0 d S ) N� i �,r r; r r z8Ports must be numbers or ranges of numbers from 1 to %d )r �len�
ValueError�intr) �appendr )�portsZmax_port�temp�a�r�begin�endr/ r r r � verify_ports� s.
rV c @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd � Zd�d d �Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&dJdK� Z'dLdM� Z(dNdO� Z)dPdQ� Z*dRdS� Z+dTdU� Z,dVdW� Z-dXdY� Z.dZd[� Z/d\d]� Z0d^d_� Z1d`da� Z2dbdc� Z3ddde� Z4dfdg� Z5dhdi� Z6djdk� Z7dldm� Z8dndo� Z9dpdq� Z:drds� Z;dtdu� Z<dvdw� Z=dxdy� Z>dzd{� Z?d|d}� Z@d~d� ZAd�d�� ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�� ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�� ZOd�d�� ZPd�d�� ZQd�d�� ZRd�d�� ZSd�d�� ZTd�d�� ZUd�d�� ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�� ZZd�d�� Z[d�d�� Z\d�d�� Z]d�d�� Z^d�d�� Z_d�d�� Z`d�d�� Zad�d�� Zbd�dÄ Zcd�dń Zdd�dDŽ Zed�dɄ Zfd�d˄ Zgd�d̈́ Zhd�dτ Zid�dф Zjd�dӄ Zkd�dՄ Zld�dׄ Zmd�dل Znd�dۄ Zod�d݄ Zpd�d߄ Zqd�d� Zrd�d� Zset�u� fd�d�Zvd�S )��policyc C s g | _ i | _t� | _g | _|tvr.ttd���|sFttd�t| ��z t� | _W nX ty~ } zt d� W Y d }~n6d }~0 t
y� } zt d|� W Y d }~n
d }~0 0 i | _ d| j d< d| j d< d| j d< d | j d
< d | j d < d | j d < d| j d
< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d< d| j d < d | j d < d | j d < d!| j d"< d#| j d$< d%| j d&< d'| j d(< d)| j d*< d+| j d,< d-| j d.< d/| j d0< d1| j d2< d3| j d4< d5| j d6< d7| j d8< d9| j d:< d;| j d<< d=| j d>< d?| j d@< dA| j dB< dC| j dD< dE| j dF< dG| j dH< dI| j dJ< dK| j dL< dM| j dN< dO| j dP< dQ| j dR< dS| j dT< dU| j dV< dW| j dX< dY| j dZ< d[| j d\< d]| j d^< d_| j d`< da| j db< da| j dc< da| j dd< da| j de< df| j dg< df| j dh< df| j di< df| j dj< df| j dg< dk| j dl< dm| j dn< do| j dp< dq| j dr< ds| j dt< du| j dv< dw| j dx< dy| j dz< d{| j d|< d}| j d~< d| j d�< d| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< d�| j d�< i | _ d�g t
g| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< d�g tg| j d�< i | _t| jd�< t| jd�< t| jd�< t| jd�< t| jd�< t| jd�< t| jd�< t| jd�< g d��| _| j| jf| j| j f| j | j f| j | j f| j!| j"f| j#| j$f| j%| j&f| j'| j(f| j)| j*f| j+| j(f| j,| j(f| j-| j.f| j/| j0ff
| _1t2�3d�|��s�ttd����|t4k�r�d�| | _5n|| _5|| _6g | _7g | _8|| _9d�| _:d | _;d�d�d�g g| _<d�d�d�g g| _=d�d�d�g g| _>d�d�d�g g| _?d�| _@d�| _Ad�| _Bd�| _Cd�| _Dd�| _Ed�| _Fd�| _Gd�| _H| j9tItJfv| _K| j9tItJfv| _L| j9tItJfv| _Md�| _Nd�| _Oi | _Pi | _Qi | _Rg | _Sg | _Td�| _Ud�| _Vg | _Wg | _Xg | _Yg | _Zg | _[d S )�Nz"You must enter a valid policy typez;You must enter a name for your policy module for your '%s'.z9Can not get port types, must be root for this informationzCan not get port typeszset_use_kerberos(True)Zopenlogzset_use_kerb_rcache(True)zset_use_syslog(True)zset_use_resolve(True)Z gethostbyZ getaddrinfoZ getnameinfoZkrbz set_manage_krb5_rcache(True)Zgss_accept_sec_contextZkrb5_verify_init_credsZ krb5_rd_reqZ __syslog_chkzset_use_uid(True)�getpwnam�getpwuidzset_use_dbus(True)Zdbus_zset_use_pam(True)Zpam_zset_use_audit(True)zadd_process('fork')�forkzadd_process('transition')Z
transitionzadd_process('sigchld')Zsigchldzadd_process('sigkill')Zsigkillzadd_process('sigstop')Zsigstopzadd_process('signull')Zsignullzadd_process('ptrace')Zptracezadd_process('getsched')Zgetschedzadd_process('setsched')Zsetschedzadd_process('getsession')Z
getsessionzadd_process('getpgid')�getpgidzadd_process('setpgid')�setpgidzadd_process('getcap')Zgetcapzadd_process('setcap')Zsetcapzadd_process('share')Zsharezadd_process('getattr')�getattrzadd_process('setexec')Zsetexeczadd_process('setfscreate')Z setfscreatezadd_process('noatsecure')Z
noatsecurezadd_process('siginh')Zsiginhzadd_process('signal_perms')�killzadd_process('setrlimit')Z setrlimitzadd_process('rlimitinh')Z rlimitinhz add_process('dyntransition')Z
dyntransitionzadd_process('setcurrent')Z
setcurrentzadd_process('execmem')Zexecmemzadd_process('execstack')Z execstackzadd_process('execheap')Zexecheapzadd_process('setkeycreate')Z setkeycreatez add_process('setsockcreate')Z
setsockcreatezadd_capability('chown')�chownz add_capability('dac_override')Z dac_overridez!add_capability('dac_read_search')Zdac_read_searchzadd_capability('fowner')Zfownerzadd_capability('fsetid')Zfsetidzadd_capability('setgid')�setgid�setegid� setresgid�setregidzadd_capability('setuid')� setresuid�setuid�seteuid�setreuidzadd_capability('setpcap')Zsetpcapz!add_capability('linux_immutable')Zlinux_immutablez"add_capability('net_bind_service')Znet_bind_servicez add_capability('net_broadcast')Z
net_broadcastzadd_capability('net_admin')Z net_adminzadd_capability('net_raw')Znet_rawzadd_capability('ipc_lock')Zipc_lockzadd_capability('ipc_owner')Z ipc_ownerz add_capability('sys_module')�
sys_modulezadd_capability('sys_rawio')Z sys_rawioz add_capability('sys_chroot')�chrootZ
sys_chrootz add_capability('sys_ptrace')Z
sys_ptracezadd_capability('sys_pacct')Z sys_pacctzadd_capability('sys_admin')ZmountZunshareZ sys_adminzadd_capability('sys_boot')Zsys_bootzadd_capability('sys_nice')Zsys_nicez add_capability('sys_resource')Z sys_resourcezadd_capability('sys_time')Zsys_timez add_capability('sys_tty_config')Zsys_tty_configzadd_capability('mknod')�mknodzadd_capability('lease')Zleasez add_capability('audit_write')Z audit_writez add_capability('audit_control')Z
audit_controlzadd_capability('setfcap')Zsetfcapr �/etcr �/tmpr r �/usr/lib/systemd/system�/lib/systemd/system�/etc/systemd/systemr
�
/var/cacher �/var/libr
�/var/logr �/var/runr �
/var/spoolZ_tmp_tZ _unit_file_tZ _var_cache_tZ
_var_lib_tZ
_var_log_tZ
_var_run_tZ _var_spool_tZ_port_t) rk rp rr rl r rq rs rt ro rm rn z^[a-zA-Z0-9-_]+$zOName must be alphanumeric with no spaces. Consider using option "-n MODULENAME"zhttpd_%s_scriptrJ F)\�rpmsrP r � all_roles�typesrE rM r r0 r# � RuntimeError�symbols� DEFAULT_DIRSr r r r r
r r
r r � DEFAULT_EXTr � DEFAULT_KEYS�generate_daemon_types�generate_daemon_rules�generate_dbusd_types�generate_dbusd_rules�generate_inetd_types�generate_inetd_rules�generate_cgi_types�generate_cgi_rules�generate_sandbox_types�generate_sandbox_rules�generate_userapp_types�generate_userapp_rules� generate_existing_user_types� generate_existing_user_rules� generate_min_login_user_types�generate_login_user_rules�generate_x_login_user_types�generate_x_login_user_rules�generate_login_user_types�generate_admin_user_types�generate_root_user_types�generate_root_user_rules�generate_new_types�generate_new_rules�
DEFAULT_TYPES�re�match�CGIr � file_name� capabilities� processesr( �
initscript�program�in_tcp�in_udp�out_tcp�out_udp� use_resolve�use_tmp�use_uid�
use_syslog� use_kerberos�manage_krb5_rcache�use_pam�use_dbus� use_audit�EUSER�NEWTYPE�use_etc�use_localization�use_fd� use_terminal�use_mail�booleans�files�dirs�found_tcp_ports�found_udp_ports�
need_tcp_type�
need_udp_type�
admin_domains�existing_domains�transition_domains�transition_users�roles)�selfr r( �er r r �__init__� sf
�
zpolicy.__init__c C s( |t p&|t p&|t p&t|t �dkS �Nr )�ALL�RESERVED�
UNRESERVEDrL �PORTS)r� �lr r r Z
__isnetset� s zpolicy.__isnetsetc C s
|| _ d S �N)r� )r� r� r r r �set_admin_domains� s zpolicy.set_admin_domainsc C s
|| _ d S r� )r� )r� r� r r r �set_existing_domains� s zpolicy.set_existing_domainsc C s
|| _ d S r� )r� )r� r� r r r �set_admin_roles� s zpolicy.set_admin_rolesc C s
|| _ d S r� )r� )r� r� r r r �set_transition_domains� s z policy.set_transition_domainsc C s
|| _ d S r� )r� )r� r� r r r �set_transition_users� s zpolicy.set_transition_usersc C s | � | j�S r� )�_policy__isnetsetr� �r� r r r �
use_in_udp� s zpolicy.use_in_udpc C s | � | j�S r� )r� r� r� r r r � use_out_udp� s zpolicy.use_out_udpc C s | � � p| �� S r� )r� r� r� r r r �use_udp� s zpolicy.use_udpc C s | � | j�S r� )r� r� r� r r r �
use_in_tcp� s zpolicy.use_in_tcpc C s | � | j�S r� )r� r� r� r r r � use_out_tcp� s zpolicy.use_out_tcpc C s | � � p| �� S r� )r� r� r� r r r �use_tcp� s zpolicy.use_tcpc C s | � � p| �� S r� )r� r� r� r r r � use_network� s zpolicy.use_network�tcpc C sF | j �� D ]6\}}}||kr
||kr
||kr
| j |||f S q
d S r� )rP rF )r� �portr* rT rU r/ r r r � find_port� s zpolicy.find_portc C s | j tvrttd���|| _d S )Nz0User Role types can not be assigned executables.)r( � APPLICATIONSrM r r� )r� r� r r r � set_program� s
zpolicy.set_programc C s | j tkrttd���|| _d S )Nz(Only Daemon apps can use an init script.)r( �DAEMONrM r r� )r� r� r r r �set_init_script� s
zpolicy.set_init_scriptc C s |||t |�g| _d S r� )rV r� �r� �allZreservedZ
unreservedrP r r r �
set_in_tcp� s zpolicy.set_in_tcpc C s |||t |�g| _d S r� )rV r� r� r r r �
set_in_udp� s zpolicy.set_in_udpc C s |ddt |�g| _d S �NF)rV r� �r� r� rP r r r � set_out_tcp� s zpolicy.set_out_tcpc C s |ddt |�g| _d S r� )rV r� r� r r r � set_out_udp� s zpolicy.set_out_udpc C s" t |�turttd���|| _d S )Nz$use_resolve must be a boolean value )r( �boolrM r r� �r� �valr r r �set_use_resolve� s zpolicy.set_use_resolvec C s" t |�turttd���|| _d S )Nz#use_syslog must be a boolean value )r( r� rM r r� r� r r r �set_use_syslog� s zpolicy.set_use_syslogc C s" t |�turttd���|| _d S )Nz%use_kerberos must be a boolean value )r( r� rM r r� r� r r r �set_use_kerberos� s zpolicy.set_use_kerberosc C s" t |�turttd���|| _d S )Nz+manage_krb5_rcache must be a boolean value )r( r� rM r r� r� r r r �set_manage_krb5_rcache� s z policy.set_manage_krb5_rcachec C s |du | _ d S �NT)r� r� r r r � set_use_pam� s zpolicy.set_use_pamc C s |du | _ d S r� )r� r� r r r � set_use_dbus� s zpolicy.set_use_dbusc C s |du | _ d S r� )r� r� r r r �
set_use_audit� s zpolicy.set_use_auditc C s |du | _ d S r� )r� r� r r r � set_use_etc� s zpolicy.set_use_etcc C s |du | _ d S r� )r� r� r r r �set_use_localization� s zpolicy.set_use_localizationc C s |du | _ d S r� )r� r� r r r �
set_use_fd� s zpolicy.set_use_fdc C s |du | _ d S r� )r� r� r r r �set_use_terminal� s zpolicy.set_use_terminalc C s |du | _ d S r� )r� r� r r r � set_use_mail� s zpolicy.set_use_mailc C sB | j tv rttd���|r0| jd d �d� ng | jd d< d S )Nz'USER Types automatically get a tmp typerl r )r( �USERSrM r rz rO r� r r r � set_use_tmp� s
zpolicy.set_use_tmpc C s |du | _ d S r� )r� r� r r r � set_use_uid s zpolicy.set_use_uidc C s | j rt�d| jtj�S dS d S �N� TEMPLATETYPErJ )r� r� �subr r Z te_uid_rulesr� r r r �generate_uid_rules s zpolicy.generate_uid_rulesc C s | j rt�d| jtj�S dS d S r� )r� r� r� r r Zte_syslog_rulesr� r r r �generate_syslog_rules s z policy.generate_syslog_rulesc C s | j rt�d| jtj�S dS d S r� )r� r� r� r r Zte_resolve_rulesr� r r r �generate_resolve_rules s z policy.generate_resolve_rulesc C s | j rt�d| jtj�S dS d S r� )r� r� r� r r Zte_kerberos_rulesr� r r r �generate_kerberos_rules s z policy.generate_kerberos_rulesc C s | j rt�d| jtj�S dS d S r� )r� r� r� r r Zte_manage_krb5_rcache_rulesr� r r r �!generate_manage_krb5_rcache_rules s z(policy.generate_manage_krb5_rcache_rulesc C s d}| j r t�d| jtj�}|S �NrJ r� )r� r� r� r r Z te_pam_rules�r� �newter r r �generate_pam_rules& s zpolicy.generate_pam_rulesc C s d}| j r t�d| jtj�}|S r )r� r� r� r r Zte_audit_rulesr r r r �generate_audit_rules, s zpolicy.generate_audit_rulesc C s d}| j r t�d| jtj�}|S r )r� r� r� r r Z te_etc_rulesr r r r �generate_etc_rules2 s zpolicy.generate_etc_rulesc C s d}| j r t�d| jtj�}|S r )r� r� r� r r Z te_fd_rulesr r r r �generate_fd_rules8 s zpolicy.generate_fd_rulesc C s d}| j r t�d| jtj�}|S r )r� r� r� r r Zte_localization_rulesr r r r �generate_localization_rules> s z"policy.generate_localization_rulesc C s* d}| j tkr&| jr&t�d| jtj�}|S r )r( �DBUSr� r� r� r r Z
te_dbus_rulesr r r r �generate_dbus_rulesD s zpolicy.generate_dbus_rulesc C s d}| j r t�d| jtj�}|S r )r� r� r� r r Z
te_mail_rulesr r r r �generate_mail_rulesJ s zpolicy.generate_mail_rulesc C sF d}d|||f }|t �� v r.d|| jf }nd|| j|||f }|S )NrJ zcorenet_%s_%s_%sz %s(%s_t)
zD
gen_require(`
type %s_t;
')
allow %s_t %s_t:%s_socket name_%s;
)r+ Z get_methodsr )r� r* �action� port_name�line�methodr r r �generate_network_actionP s �z policy.generate_network_actionc C sZ | j t D ]X}| �t|�d�}|d u r.d| _q
|d d d� }| �dd|�}|| jvr
| j�|� q
| jt D ]X}| �t|�d�}|d u r�d| _qn|d d d� }| �dd|�}|| jvrn| j�|� qn| j t D ]X}| �t|�d�}|d u r�d| _
q�|d d d� }| �dd|�}|| j vr�| j �|� q�| j
du �sD| jdu �rVt �
d| jtj�S d S )
Nr� Tr ���ZbindZconnect�udpr� rJ )r� r� r� rN r� r r� rO r� r� r� r� r� r� r r �te_types)r� �iZrecr r
r r r �generate_network_types^ s6
z policy.generate_network_typesc C sZ | j D ]4}|�|�dkr| j | d �|� | j | S q| j d d �|� | j d S )Nr r r )rz �findrO )r� �file�dr r r Z __find_path� s
zpolicy.__find_pathc C s || j vr| j �|� d S r� )r� rO )r� Z
capabilityr r r �add_capability� s
zpolicy.add_capabilityc C s
|| _ d S r� )rw )r� rw r r r � set_types� s zpolicy.set_typesc C s || j vr| j �|� d S r� )r� rO )r� Zprocessr r r � add_process� s
zpolicy.add_processc C s || j |< d S r� )r� )r� r � descriptionr r r � add_boolean� s zpolicy.add_booleanc C s | � |�| j|< d S r� )�_policy__find_pathr� �r� r r r r �add_file� s zpolicy.add_filec C s | � |�| j|< d S r� )r r� r r r r �add_dir� s zpolicy.add_dirc C s6 d}| j �� t| j �dkr2d| jd�| j �f }|S )NrJ r z#allow %s_t self:capability { %s };
� )r� r8 rL r �joinr r r r �generate_capabilities� s
z policy.generate_capabilitiesc C s6 d}| j �� t| j �dkr2d| jd�| j �f }|S )NrJ r z allow %s_t self:process { %s };
r! )r� r8 rL r r" r r r r �generate_process� s
zpolicy.generate_processc C s� d}| � � �r�d}|t�d| jtj�7 }| �� �r�|d7 }|t�d| jtj�7 }| �� r�|t�d| jtj �7 }| j
r�t | j t
�dkr�|t�d| jtj�7 }| j
r�t | jt
�dkr�|t�d| jtj�7 }| j t r�|t�d| jtj�7 }| j t �r |t�d| jtj�7 }| j t �r.|t�d| jtj�7 }| jt �rP|t�d| jtj�7 }| jt �rr|t�d| jtj�7 }| jt �r�|t�d| jtj�7 }| jD ]}||7 }�q�| �� �r�|d7 }|t�d| jtj �7 }| j �r�|t�d| jtj �7 }| � � �r|t�d| jtj �7 }| j!t �r2|t�d| jtj"�7 }| j!t �rT|t�d| jtj#�7 }| j!t �rv|t�d| jtj$�7 }| j%D ]}||7 }�q||S )NrJ �
r� r )&r� r� r� r r Z
te_networkr� Zte_tcpr� Z te_in_tcpr� rL r� r� Zte_in_need_port_tcpr� Zte_out_need_port_tcpr� Zte_in_all_ports_tcpr� Zte_in_reserved_ports_tcpr� Zte_in_unreserved_ports_tcpZte_out_all_ports_tcpZte_out_reserved_ports_tcpZte_out_unreserved_ports_tcpr� r� Zte_udpr� Zte_in_need_port_udpr� Z te_in_udpr� Zte_in_all_ports_udpZte_in_reserved_ports_udpZte_in_unreserved_ports_udpr� )r� r r r r r �generate_network_rules� sV
z policy.generate_network_rulesc C s| d}| j D ](}t�d| jtj�}|t�d||�7 }q
| jtkrx| jD ]2}t�d| jt j
�}|t�d|� d�d |�7 }qD|S )NrJ r� � APPLICATIONr6 �_ur ) r� r� r� r r Zte_transition_rulesr( r6 r� r Z te_run_rulesr )r� r �appr �urQ r r r �generate_transition_rules� s
z policy.generate_transition_rulesc C s d}| j tkrz| jD ]`}|�d�d }|d }| jD ]>}t�d|tj�}|| j vr`t�|d|�}|t�d||�7 }q4q|S | j t
k�r|t�d| j tj �7 }| jD ](}t�d| j tj�}|t�d||�7 }q�| j
D ]D}|�d�d }|d | j v r�t�d| j tj�}|t�d ||�7 }q�|S )
NrJ �_tr �_rr� Zsystem_rr' r( r6 )r( r� r� r r� r� r� r Zte_admin_domain_rulesrv �RUSERr Zte_admin_rulesr� Zte_admin_trans_rules)r� r r r �roler) r r* r r r �generate_admin_rules� s,
zpolicy.generate_admin_rulesc C s d}| j r t�d| jtj�}|S r )r� r� r� r r Z
if_dbus_rules�r� �newifr r r �generate_dbus_if s zpolicy.generate_dbus_ifc C s( d}| j tkr|S t�d| jtj�}|S r )r( �SANDBOXr� r� r r Zif_sandbox_rulesr1 r r r �generate_sandbox_if s
zpolicy.generate_sandbox_ifc C s� d}d}| j dkr>|t�d| jtj�7 }|t�d| jtj�7 }| jD ]Z}t| j | d �dkrD|t�d| j| j | d j
�7 }|t�d| j| j | d j �7 }qD|dkr�t�d| jtj �}||7 }|t�d| jtj
�7 }||7 }|t�d| jtj�7 }|S dS �NrJ r� r r r; )r� r� r� r r Zif_initscript_admin_typesZif_initscript_adminr| rL rz Zif_admin_typesZif_admin_rulesZif_begin_adminZif_middle_adminZ if_end_admin)r� r2 Znewtypesr �retr r r �generate_admin_if s"
"zpolicy.generate_admin_ifc C s t �d| jtj�S �Nr� )r� r� r� r � te_cgi_typesr� r r r r� 5 s zpolicy.generate_cgi_typesc C s t �d| jtj�S r9 )r� r� r� r �te_sandbox_typesr� r r r r� 8 s z policy.generate_sandbox_typesc C s t �d| jtj�S r9 )r� r� r r Zte_userapp_typesr� r r r r� ; s z policy.generate_userapp_typesc C s t �d| jtj�S r9 )r� r� r r Zte_inetd_typesr� r r r r� > s zpolicy.generate_inetd_typesc C s t �d| jtj�S r9 )r� r� r r Zte_dbusd_typesr� r r r r A s zpolicy.generate_dbusd_typesc C s t �d| jtj�S r9 )r� r� r r Zte_min_login_user_typesr� r r r r� D s z$policy.generate_min_login_user_typesc C s t �d| jtj�S r9 )r� r� r r Zte_login_user_typesr� r r r r� G s z policy.generate_login_user_typesc C s t �d| jtj�S r9 )r� r� r r Zte_admin_user_typesr� r r r r� J s z policy.generate_admin_user_typesc C s� t | j�dkr$ttd�t| j ��t�d| jt j
�}|d7 }| jD ]8}|d| 7 }|� d�d d }|| j v rD|d| 7 }qD|d 7 }|S )
Nr z,'%s' policy modules require existing domainsr� z
gen_require(`z
type %s;r, r- z
role %s;z
')
)
rL r� rM r rE r( r� r� r r Zte_existing_user_typesr rv )r� r r r/ r r r r� M s
�
�z#policy.generate_existing_user_typesc C s t �d| jtj�S r9 )r� r� r r Zte_x_login_user_typesr� r r r r� _ s z"policy.generate_x_login_user_typesc C s t �d| jtj�S r9 )r� r� r r Zte_root_user_typesr� r r r r� b s z policy.generate_root_user_typesc
C s� d}t | j�dkr ttd���| jD ]^}| jD ]R}|�|�r.t||d t |� � � |t�d|d t |� � | j| j �7 } q$q.q$t
r�|dkr�g }| jD ]}|� |� q�ttd�d� |� ��|S )NrJ r zType field requiredr� z3You need to define a new type which ends with:
%sz
)
rL rw rM r r{ �endswithr# r� r� r r� rO r" )r� r �tr Z default_extr r r r� e s
(
zpolicy.generate_new_typesc C s dS )NrJ r r� r r r r� y s zpolicy.generate_new_rulesc C s6 t �d| jtj�}| jdkr2|t �d| jtj�7 }|S r� )r� r� r r Zte_daemon_typesr� Zte_initscript_typesr r r r r} | s
z policy.generate_daemon_typesc C s | j rt�d| jtj�S dS d S r� )r� r� r� r r r r� r r r �generate_tmp_types� s zpolicy.generate_tmp_typesc C s< d}| j D ],}t�d|tj�}|t�d| j | |�7 }q
|S )NrJ �BOOLEANZ DESCRIPTION)r� r� r� r Z
te_boolean)r� r �br r r r �generate_booleans� s
zpolicy.generate_booleansc C s( d}| j D ]}|t�d|tj�7 }q
|S )NrJ r? )r� r� r� r �te_rules)r� r r@ r r r �generate_boolean_rules� s
z policy.generate_boolean_rulesc C s t �d| jtj�S r9 )r� r� r r r; r� r r r �generate_sandbox_te� s zpolicy.generate_sandbox_tec C s t �d| jtj�S r9 )r� r� r r r: r� r r r �generate_cgi_te� s zpolicy.generate_cgi_tec C s t �d| jtj�}|S r9 )r� r� r r Zte_daemon_rulesr1 r r r r~ � s z policy.generate_daemon_rulesc
C sl d}| j D ]\}| jD ]P}|�|�r|d t|� � d }|t�d|d t|� � | j| j�7 } q
qq
|S )NrJ r, r� )rw r{ r< rL r� r� �if_rules)r� r2 r= r Zreqtyper r r �generate_new_type_if� s
(zpolicy.generate_new_type_ifc C s t �d| jtj�S r9 )r� r� r r Zte_login_user_rulesr� r r r r� � s z policy.generate_login_user_rulesc C s t �d| jtj�}|S r9 )r� r� r r Zte_existing_user_rules)r� Znerulesr r r r� � s z#policy.generate_existing_user_rulesc C s t �d| jtj�S r9 )r� r� r r Zte_x_login_user_rulesr� r r r r� � s z"policy.generate_x_login_user_rulesc C s t �d| jtj�}|S r9 )r� r� r r Zte_root_user_rulesr r r r r� � s z policy.generate_root_user_rulesc C s t �d| jtj�S r9 )r� r� r r Zte_userapp_rulesr� r r r r� � s z policy.generate_userapp_rulesc C s t �d| jtj�S r9 )r� r� r r Zte_inetd_rulesr� r r r r� � s zpolicy.generate_inetd_rulesc C s t �d| jtj�S r9 )r� r� r r Zte_dbusd_rulesr� r r r r� � s zpolicy.generate_dbusd_rulesc C s | j rt�d| jtj�S dS d S r� )r� r� r� r r rB r� r r r �generate_tmp_rules� s zpolicy.generate_tmp_rulesc C s d}|t �d| jtj�7 }|S r )r� r� r r Z te_cgi_rulesr r r r r� � s zpolicy.generate_cgi_rulesc C s d}|t �d| jtj�7 }|S r )r� r� r r Zte_sandbox_rulesr r r r r� � s z policy.generate_sandbox_rulesc C sR d}| j s| jtkr&t�d| jtj�}| jtt t
t fv rN|t�d| jtj �7 }|S r )
r� r( r6 r� r� r r Zif_user_program_rules�TUSER�XUSER�AUSER�LUSERZif_role_change_rulesr1 r r r �generate_user_if� s zpolicy.generate_user_ifc C s> d}|t �d| jtj�7 }| jr6|t �d| jtj�7 }| jdkrV|t �d| jtj�7 }| j D ]�}t
| j | d �dkr\|t �d| j| j | d j �7 }| j | d D ]J}t
j�|�r�t�t
�|�tj �r�|t �d| j| j | d j�7 } q\q�q\|| �� 7 }|| �� 7 }|| �� 7 }|| �� 7 }|| �� 7 }|| �� 7 }|S r6 )r� r� r r Zif_heading_rulesr� Zif_program_rulesr� Zif_initscript_rulesr| rL rz rF �os�path�exists�stat�S_ISSOCK�ST_MODEZif_stream_rulesrM r3 r8 r5 rG r� )r� r2 r r r r r � generate_if� s(
" zpolicy.generate_ifc C s | j | j d � S r� �r� r( r� r r r �generate_default_types� s z policy.generate_default_typesc C s& | j | j d r"| j | j d � S dS )Nr rJ rU r� r r r �generate_default_rules� s z policy.generate_default_rulesc C s� d}| j ttttfv r�d}t| j�dkr�|t�d| j t
j �7 }|t�d| j t
j �7 }| jD ](}t�d| j t
j
�}|t�d||�7 }qZ|S )NrJ r r� ZROLE)r( rI rJ rK rL rL r� r� r� r r Z
te_sudo_rulesZte_newrole_rulesZte_roles_rules)r� r r� r/ r r r r �generate_roles_rules� s
zpolicy.generate_roles_rulesc
C s� | � � }| jD ]L}t| j| d �dkr| jtks:|dkr|t�d| j| j| d j �7 }q| jt
krt|d| j 7 }|| � � 7 }|| � � 7 }|| �
� 7 }|| �� 7 }|| �� 7 }|| �� 7 }|| �� 7 }| jD �]>}t| j| d �dkr�| jt
k�rLd}| jD ]H}|t�d|d d � d
| j| d j�7 }|t�d | jd |�7 }�q n |t�d| j| j| d j�7 }| j| d D ]�}tj�|��rzt�t�|�tj ��rz| jt
k�r�| jD ],}|t�d|d d � | j| d j�7 }�q�n |t�d| j| j| d j�7 } qΐqzq�|| �� 7 }|| � � 7 }|| � � 7 }|| � � 7 }|| � � 7 }|| � � 7 }|| �!� 7 }|| �"� 7 }|| �#� 7 }|| �$� 7 }|| �%� 7 }|| �&� 7 }|| �'� 7 }|| �(� 7 }|| �)� 7 }|| �*� 7 }|| �+� 7 }|S )
Nr r r r� r; z@
########################################
#
# %s local policy
#
rJ ZTEMPLATETYPE_tr r, ZTEMPLATETYPE_rw_tZ_rw_t),rV r| rL rz r( r� r� r� r r r� r# r$ r r> rA rW rC r� rB rN rO rP rQ rR rS Zte_stream_rulesrH r& r r r r� r r� r r� rX r
r+ r0 r r� r� )r� r r Z newte_tmpZdomainr r r r � generate_te sb
"
�
* &
,
zpolicy.generate_tec C s� d}g }| j �� D ]�}tj�|�rVt�t�|�tj �rVt� d| j
| j | d j �}n t� d| j
| j | d j �}t� d||�}|�
t� d| j | d |�� q| j�� D ]L}t� d| j
| j| d j�}t� d||�}|�
t� d| j| d |�� q�| jttg v �r t|�dk�r tjS | jttttg v�rH| j�sHttd���| j�rxt� d| jtj�}|�
t� d| j
|�� | j dk�r�t� d| j tj �}|�
t� d| j
|�� |� � d � |�}|S )
NrJ r� r; �FILENAMEZFILETYPEr z<You must enter the executable path for your confined processZ
EXECUTABLEr% ) r� rF rN rO rP rQ rR rS r� r� r Z fc_sock_fileZfc_filerO r� Zfc_dirr( r� r4 rL r Zfc_userr� r� r� rM r Z
fc_programr� Z
fc_initscriptr8 r" )r� ZnewfcZfclistr �t1�t2r r r � generate_fcD s4 "
zpolicy.generate_fcc C s� d}| j tttttfvr |S d}| jD ]}|d| 7 }q&|dkrH|d7 }t�d| j t
j �}|t�d||�7 }| j tks�| j tkr�| j D ](}t�d| j t
j
�}|t�d||�7 }q�| j tkr�|t�d| j t
j�7 }n|t�d| j t
j�7 }|S )NrJ z %s_rz system_rr� ZROLESr6 )r( rI rJ rK rL r. r� r� r� r r r9 r� Z admin_transZ min_login_user_default_contextZ x_login_user_default_context)r� �newshr� r/ r r* r r r �generate_user_shg s$
zpolicy.generate_user_shc C s� t �d| jtj�}t �d| j|�}| jtkrBt �dd| j |�}n&t �d| j|�}|t �d| jtj�7 }| j r�|t �d| j tj
�7 }| j dkr�|t �d| j tj
�7 }| j �
� D ]}|t �d|tj
�7 }q�| j�
� D ]}|t �d|tj
�7 }q�| jt | jt D ]@}| �|d�d u �r t �dd | tj�}|t �d| j|�7 }�q | jt D ]@}| �|d
�d u �rLt �dd | tj�}|t �d| j|�7 }�qL|| �� 7 }|t �d| jtj�7 }|S ) Nr� Z
DOMAINTYPEZ TEMPLATEFILEz%srZ rJ r� ZPORTNUMz%dr )r� r� r� r �compiler r( r� Zmanpager� Z
restoreconr� r� rF r� r� r� r� r� Z tcp_portsr� Z udp_portsr_ r! )r� rQ r^ r r[ r r r � generate_sh� s2
zpolicy.generate_shc C s� d}t d�}|d u rd}n|d }|tj7 }| jtv r�|tj7 }| jr\|t�d| jtj �7 }| j
dkr||t�d| j
tj �7 }| j � � D ]}|t�d|tj �7 }q�| j
� � D ]}|t�d|tj �7 }q�|t�d|tj�7 }t�d| j|�}t�d| j|�}t| j�d k�r |d
d �| j� 7 }|t�d| jtj�7 }t�d| j|�}t�d t�d
�|�}| jtv�rpt�dd|�}| jtk�r�t�d| j d|�}| jttttt fv�r�t�d| j d|�}|S )NrJ zselinux-policyz0.0.0r rZ ZVERSIONZ
MODULENAMEZ
DOMAINNAMEr zRequires(post): %s
z, Z
TODAYSDATEz %a %b %e %Yz%relabel_filesz.*%s_selinux.8.*z.*%s_u.*) r' r Zheader_comment_sectionr( r� Zdefine_relabel_files_beginr� r� r� Zdefine_relabel_files_endr� r� rF r� Z base_sectionr� r rL ru r" Z mid_section�time�strftimer� rI rJ rK rL r. )r� ZnewspecZselinux_policynvrZselinux_policyverr r r r �
generate_spec� s>
zpolicy.generate_specc C s2 d|| j f }t|d�}|�| �� � |�� |S )Nz%s/%s_selinux.spec�w)r� �open�writerd �close)r� �out_dirZspecfile�fdr r r �
write_spec� s
zpolicy.write_specc C s2 d|| j f }t|d�}|�| �� � |�� |S )Nz%s/%s.tere )r� rf rg rY rh )r� ri Ztefilerj r r r �write_te� s
zpolicy.write_tec C s> d|| j f }t|d�}|�| �� � |�� t�|d� |S )Nz%s/%s.shre i� )r� rf rg ra rh rN �chmod)r� ri Zshfilerj r r r �write_sh� s
zpolicy.write_shc C s2 d|| j f }t|d�}|�| �� � |�� |S )Nz%s/%s.ifre )r� rf rg rT rh )r� ri Ziffilerj r r r �write_if� s
zpolicy.write_ifc C s2 d|| j f }t|d�}|�| �� � |�� |S )Nz%s/%s.fcre )r� rf rg r] rh )r� ri Zfcfilerj r r r �write_fc� s
zpolicy.write_fcc C s� dd l }|�� }|�� |j�| j�D ]�}| j�|j� |j |j
|j D ]F}| j D ]:}|dkrbqT|�
|�rTtj�|�r�| �|� qT| �|� qTqJ|j�|jg�D ]^}|j |j
|j D ]F}| j D ]:}|dkr�q�|�
|�r�tj�|�r�| �|� q�| �|� q�q�q�q&| j�d�d }|j�d| g�D ]l}|j
|j |j D ]R}| j D ]D}|dk�rX�qF|�
|��rFtj�|��r~| �|� n
| �|� �qF�q<�q&d S )Nr rk �/���z
%s-systemd)�yumZYumBaseZ setCacheDirZrpmdbZsearchProvidesr� ru rO r ZdirlistZfilelistZ ghostlistrz �
startswithrN rO �isfiler r Z searchNamesZbase_package_namer )r� rs ZybZpkgZfnamer@ ZbpkgZ binary_namer r r Z__extract_rpms� s@
zpolicy.__extract_rpmsc C s� z | � � W n ty Y n0 tj�d| j �rB| �d| j � tj�d| j �rd| �d| j � tj�d| j �r�| �d| j � tj�d| j �r�| �d| j � tj�d| j �r�| �d| j � tj�d| j �r�| � d| j � g }| j
� � D ]�}g }z| j
| d d d
}W n t �y4 Y q�Y n0 | j
| d D ]"}|�
|��rD|�|� n�qD�qDt|�d kr�|D ]>}|| j� � v �r�| j|= n || j� � v �rx| j|= n�qx�qxtt| j
| d �t|� �| j
| d< q�d S ) Nz/var/run/%s.pidz /var/run/%sz /var/log/%sz/var/log/%s.logz /var/lib/%sz/etc/rc.d/init.d/%sz/etc/rc\.d/init\.d/%sr r rq )�_policy__extract_rpms� ImportErrorrN rO ru r r �isdirr r� rz rF �
IndexErrorrt rO rL r� r� �list�set)r� Z
temp_basepathr/ Z temp_dirsr r r r �
gen_writeable sF
zpolicy.gen_writeablec C s� | j tvrd S tj�| j�s2tj�d| j � d S t� d| j �}|�
� � � D ],}| j D ] }|�
|�rXtd| j | � qXqN|�� d S )Nzl
***************************************
Warning %s does not exist
***************************************
znm -D %s | grep Uzself.%s)r( r� rN rO rP r� �sys�stderrrg �popen�readr ry rt �execrh )r� rj �sr@ r r r � gen_symbolsO s
�
zpolicy.gen_symbolsc C s� t d�}|d| �|�t d�f 7 }|d| �|�t d�f 7 }|d| �|�t d�f 7 }| jtkr�|d| �|�t d�f 7 }|d| �|�t d�f 7 }|S )Nz Created the following files:
z%s # %s
zType Enforcement filezInterface filezFile Contexts filez Spec filez Setup Script)r rl ro rp r( r� rk rn )r� ri �outr r r �generatea s
zpolicy.generateN)r� )w�__name__�
__module__� __qualname__r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r
r r r r r r r r r r# r$ r& r+ r0 r3 r5 r8 r� r� r� r� r r� r� r� r� r� r� r� r� r} r> rA rC rD rE r~ rG r� r� r� r� r� r� r� rH r� r� rM rT rV rW rX rY r] r_ ra rd rk rl rn ro rp rv r| r� rN �getcwdr� r r r r rW � s� B
&8
>##**3rW )GrN r} rQ r� r+ r r r rb Z templatesr r r r r
r r r
r r r r r r r Zsepolgen.interfacesZ
interfacesZsepolgen.defaults�defaultsZPROGNAME�gettext�kwargs� version_infoZ translationr= r �builtins�str�__dict__rw Z __builtin__r r r' r0 r: r� r� r� r� ZADMIN_TRANSITION_INTERFACEZUSER_TRANSITION_INTERFACEr� r ZINETDr� r4 r6 r� rI rJ rL rK r. r� rE rI r� r� rV rW r r r r �<module> s�
���