�
��^c@s
dZd
dl
Z
d
dlZd
dljZyd
dlTWn


n
XddlmZ
ddlmZ
ddlm	Z	
ddlm
Z

dd	lmZ
dd
lmZ
dZ
dZdZd
dd��YZded�Zd�Zddd��YZd�ZdS(s>
classes and algorithms for the generation of SELinux policy.
i����N(
t
*i
(
t	refpolicy(
tobjectmodel(
taccess(
t
interfaces(
tmatching(
tutiliitPolicyGeneratorcBs�eZ
dZdd
�
Zddd�Zed�
Zed�
Z	d�Z
d�Zdd�
Zd	�Z
d
�Zd�Zd�Zd
�ZRS(s�Generate a reference policy module from access vectors.

    PolicyGenerator generates a new reference policy module
    or updates an existing module based on requested access
    in the form of access vectors.

    It generates allow rules and optionally module require
    statements and reference policy interfaces. By default
    only allow rules are generated. The methods .set_gen_refpol
    and .set_gen_requires turns on interface generation and
    requires generation respectively.

    PolicyGenerator can also optionally add comments explaining
    why a particular access was allowed based on the audit
    messages that generated the access. The access vectors
    passed in must have the .audit_msgs field set correctly
    and .explain set to SHORT|LONG_EXPLANATION to enable this
    feature.

    The module created by PolicyGenerator can be passed to
    output.ModuleWriter to output a text representation.
    cCs[d
|_
t|_t|_|
r-|
|_ntj�|_	t|_
d
|_d
|_d
S(s�Initialize a PolicyGenerator with an optional
        existing module.

        If the module paramater is not None then access
        will be added to the passed in module. Otherwise
        a new reference policy module will be created.
        N(
tNonetifgentNO_EXPLANATIONtexplaintFalsetgen_requirestmoduelR
tModuletmodulet	dontauditt	mislabledtdomains(tselfR((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyt__init__Ds	
	
	

	
	
cCs;|
r$t|
|�|_
t|_n	d
|_
|j�
d
S(s?
Set whether reference policy interfaces are generated.

        To turn on interface generation pass in an interface set
        to use for interface generation. To turn off interface
        generation pass in None.

        If interface generation is enabled requires generation
        will also be enabled.
        N(tInterfaceGeneratorR	tTrueR
Rt"_PolicyGenerator__set_module_style(Rtif_sett	perm_maps((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pytset_gen_refpolXs



	
cCs
|
|_d
S(s&
Set whether module requires are generated.

        Passing in true will turn on requires generation and
        False will disable generation. If requires generation is
        disabled interface generation will also be disabled and
        can only be re-enabled via .set_gen_refpol.
        N(
R
(Rtstatus((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pytset_gen_requiresjscCs
|
|_d
S(s)Set whether access is explained.
        N(
R(RR((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pytset_gen_explaintscCs
|
|_dS(
N(
R(RR((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pytset_gen_dontauditys
c
Cs?|jrt
}
nt}
x |jj�D]}|
|_q(WdS(
N(R	RRRtmodule_declarationsR
(RR
tmod((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyt__set_module_style|s

	
	

s1.0cCs�d}x|j
j�D]}|}qW|sQtj�}|j
jjd
|�
n|
|_||_|j	rxt
|_n	t|_dS(s?Set the name of the module and optionally the version.
        iN(RRR R
tModuleDeclarationtchildrentinserttnametversionR	RR(RR&R't
mR!((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pytset_module_name�s






	
	
	
c

Cs |jrt|j
�

n|j
S(
N(R
R(
R((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyt
get_module�s	
cCsyd
dl}yL|j
|
jd�}|djd�
d}||
jkrW||_dSWntk
rk


n
Xd|_dS(Ni����ii
t
:i(tselinuxtmatchpathcontobj_pathtsplitttgt_typeRtOSErrorR(RtavR,tcontextR/((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyt__restore_label�s





	




cCs&x|
D]}tj
|�
}|jr4|j|_nd
|_|jrpttjt	|d|j�

�
�
|_n|j
�}|ddkr�|jtj
kr�|jdd
j|d�
7_nx9|jD].}|dks�|dkr�t}Pq�t}q�W|ddk	r�
|ddkr�
|r�
|jtj
kr�
|jtkrM
d}nd
}|jd	d
j|d
�
d
j|d�
d
j|d�
f7_|jd
kr�
|jdd
j|d�
d
j|j�
d
j|�
d
j|j�
f7_q�
n|j|�

|jdk	rZ|jtj
krZ|jdd
j|j�
d
j|j�
f7_n|jtj
kr~|jd
7_n|jtjkr�|jd7_n|jtjkr#t|j�
dkr|jddjg|jD]}|d^q��
7_q#|jd|jdd7_n|jtjkr�|jd7_|jd7_|jd|jd7_x+|jdD]}	|jd|	7_q{Wnyf
|jtjkrd|jkrd|jks�d|jkr|jsttdd�

dd|_ng}
xngt t
g
i|j!t"6|jt#6|jt$6�D]}|t%^q@D]%}||jkrT|
j&|�

qTqTWt|
�
dkr�|jd|j!|jdj|
�
f7_qt|
�
dkr|jd|j!|jdj|
�
f7_qnWn


n
X|j'j(j&|�

qWdS(Ntt	verbosityis$
#!!!! WARNING: '%s' is a base type.i
twritetcreates(/.*?)sU
#!!!! WARNING '%s' is not allowed to write or create to %s.  Change the label to %s.isG
#!!!! $ semanage fcontext -a -t %s %s%s   
#!!!! $ restorecon -R -v %ssY
#!!!! The file '%s' is mislabeled on your system.  
#!!!! Fix with $ restorecon -R -v %ss0
#!!!! This avc is allowed in the current policys:
#!!!! This avc has a dontaudit rule in the current policysH
#!!!! This avc can be allowed using one of the these booleans:
#     %ss, s5
#!!!! This avc can be allowed using the boolean '%s's�
#!!!! This avc is a constraint violation.  You would need to modify the attributes of either the source or target types to allow this access.s
#Constraint rule: s
#	s?
#	Possible cause is the source %s and target %s are different.tdirtopenR&tdomainttypessL
#!!!! The source type '%s' can write to a '%s' of the following type:
# %s
sM
#!!!! The source type '%s' can write to a '%s' of the following types:
# %s
()R
tAVRuleRt	DONTAUDITt	rule_typetcommentRtstrtCommenttexplain_accesstbase_file_typettypet	audit2whytALLOWtjointpermsRRRt	obj_classR9R.t_PolicyGenerator__restore_labelRtBOOLEANtlentdatat
CONSTRAINTtTERULERtseinfot	ATTRIBUTEtsesearchtsrc_typetSCONTEXTtCLASStPERMStTCONTEXTtappendRR$(RtavsR2trulet	base_typetpermt
permissiontcompt
xtreasonR<t
i((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyt__add_allow_rules�sr



	

	
	
*
"
#




 


	
C

S

!
4





9!








	
 
N



.

5


cCsT|jr=|jj
|
|j�\}}|jjj|�

n|
}|j|�

d
S(sJAdd the access from the access vector set to this
        module.
        N(R	tgenRRR$textendt!_PolicyGenerator__add_allow_rules(Rtav_sett	raw_allowtifcalls((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyt
add_access�s
		

cCs(x!|
D]}|jj
j|�

qWdS(
N(RR$RY(Rt
role_type_sett	role_type((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pytadd_role_types
s


N(t__name__t
__module__t__doc__RRRRRtSHORT_EXPLANATIONRRRR)R*RKRfRjRm(((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyR-s

					J	c	s�
g�
��
fd
�}|tkr�x�|j
D]�}�
jd|j�

�
jdt|j�
t|j�
f�

�
jd|jtj	|j
�
f�

�
jd|j|j|j
f�

�
jtjd|jddd	d
dd��

q.W|�
n�|r
�
jd
|j|j|j|jj�f�

t|j
�
dkru
|j
d}�
jd|j|j|j
f�

n|�
n�
S(s�Explain why a policy statement was generated.

    Return a string containing a text explanation of
    why a policy statement was generated. The string is
    commented and wrapped and can be directly inserted
    into a policy.

    Params:
      av - access vector representing the access. Should
       have .audit_msgs set appropriately.
      verbosity - the amount of explanation provided. Should
       be set to NO_EXPLANATION, SHORT_EXPLANATION, or
       LONG_EXPLANATION.
    Returns:
      list of strings - strings explaining the access or an empty
       string if verbosity=NO_EXPLANATION or there is not sufficient
       information to provide an explanation.
    csg�s
dS�
jd
�

xI�j
�D];}t|j�j�}
�
jd|
j�|jf�

q$WdS(Ns Interface options:s   %s # [%d](RYtalltcall_interfacet	interfaceR2t	to_stringtdist(tmatchtifcall(tmlt
s(s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pytexplain_interfaces
s






s %ss  scontext="%s" tcontext="%s"s  class="%s" perms="%s"s  comm="%s" exe="%s" path="%s"s	message="t
"iPtinitial_indents  tsubsequent_indents   s) src="%s" tgt="%s" class="%s", perms="%s"is comm="%s" exe="%s" path="%s"(tLONG_EXPLANATIONt
audit_msgsRYtheaderRAtscontextttcontextttclassR
tlist_to_space_strtaccessestcommtexetpathRettextwraptwraptmessageRTR0RJRItto_space_strRM(R2RyR6R{tmsg((RyRzs8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyRC	
s*


	
 
	

#
&




	
&


&


cCs+
g}g}|j|j
j��

|jd
d�dt�
tj�}|j|_x�t	t
|�
�
D]�}||jtjkr�|j
j|
j�

qf||jtjkr�|j
j|
j�

qf||jtjkr�|j
j|
j�

qf||jGHdsft�
qfWt
|j
�
dks'
t�
|S(Ntkeyc


Ss|jS(
N(
tnum(
tparam((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyt<lambda>E
streversei(RetparamstvaluestsortRR
t
InterfaceCallR&tifnametrangeRMREtSRC_TYPEtargsRYRTtTGT_TYPER0t	OBJ_CLASSRJtAssertionError(RtR2R�R�RxRb((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyRs@
s"










RcBs/eZ
dd�
Zd
�Zd�Zd�ZRS(cCs5|
|_|j
|
�

tj|�
|_g|_dS(
N(tifsthack_check_ifsRt
AccessMatchertmatchertcalls(RR�R((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyRZ
s
	



cCs�x�|
jj
�D]�}g}|j|jj
��

|jd
d�dt�
xptt|�
�
D]\}|d||jkr�t	|_
Pn||jtj
tjtjgkr^t	|_
Pq^q^WqWdS(NR�c


Ss|jS(
N(
R�(
R�((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyR�h
sR�i
(RR�ReR�R�RR�RMR�RtenabledRER
R�R�R�(RR�R`R�Rb((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyR�`
s




	


	
cCs
|j|
�
}g}xi|j
D]^}t|j�j|j�}|rjtjt|j||��
|_	n|j
||f�

qWg}x�|D]y\}}t}	xN|D]F}
|
j|�
r�|
j	r�|j	r�|
j	j
|j	�

nt}	q�q�W|	s�|j
|�

q�q�W||fS(
N(RwR�RstbestRtR2R
RBRCR@RYRtmatchestmergeR(RRZR6traw_avRiRyRxt
dR�tfoundto_ifcall((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyRdw
s$





$











cCslg}x_|
D]W}tj
�}|jj|j||�
t|�
rW|jj|�

q
|j|�

q
W|S(
N(Rt	MatchListR�t
search_ifsR�RMR�RY(RRZR�R2tans((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyRw�
s






N(RnRoRRR�RdRw(((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyRY
s
		c
Cs.d
�}
x|j�D]}|
|�

qWdS(s*Add require statements to the module.
    c
Ss
tj
�}
xa|j�D]S}|
jj|j�

|
jj|j�

x$|jD]}|
j||j	�
qOWqWx8|j
�D]*}x!|jD]}|
jj|�

q�Wq}Wx:|j
�D],}|
jj|j�

|
jj|j�

q�W|
jjd
�

|jjd|
�
dS(NRi(R
tRequiretavrulesR<tupdatet	src_typest	tgt_typestobj_classest
add_obj_classRItinterface_callsR�taddt
role_typestrolestroletdiscardR$R%(tnodet
rtavruletobjRxtargRl((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pytcollect_requires�
s








N(
tnodes(RR�R�((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyR
�
s	
(((Rpt	itertoolsR�tselinux.audit2whyRFtsetoolsR5R
RRRRRR
RqRRRRCRsRR
(((s8/usr/lib64/python2.7/site-packages/sepolgen/policygen.pyt<module>s*











�7	B