mirror of
https://github.com/SELinuxProject/setools
synced 2025-04-01 22:58:12 +00:00
SELinuxPolicy: Move methods.
No code changes.
This commit is contained in:
Chris PeBenito
parent
be87732a65
commit
47f2f59dbc
@ -95,131 +95,9 @@ cdef class SELinuxPolicy:
|
|||||||
memo[id(self)] = self
|
memo[id(self)] = self
|
||||||
return self
|
return self
|
||||||
|
|
||||||
#
|
|
||||||
# Policy loading functions
|
|
||||||
#
|
|
||||||
|
|
||||||
cdef _load_policy(self, str filename):
|
|
||||||
"""Load the specified policy."""
|
|
||||||
cdef:
|
|
||||||
sepol.sepol_policy_file_t *pfile = NULL
|
|
||||||
FILE *infile = NULL
|
|
||||||
|
|
||||||
self.log.info("Opening SELinux policy \"{0}\"".format(filename))
|
|
||||||
|
|
||||||
self.sh = sepol.sepol_handle_create()
|
|
||||||
if self.sh == NULL:
|
|
||||||
raise MemoryError
|
|
||||||
|
|
||||||
sepol.sepol_msg_set_callback(self.sh, sepol_logging_callback, self.handle)
|
|
||||||
|
|
||||||
if sepol.sepol_policydb_create(&self.handle) < 0:
|
|
||||||
raise MemoryError
|
|
||||||
|
|
||||||
if sepol.sepol_policy_file_create(&pfile) < 0:
|
|
||||||
raise MemoryError
|
|
||||||
|
|
||||||
infile = fopen(filename, "rb")
|
|
||||||
if infile == NULL:
|
|
||||||
PyErr_SetFromErrnoWithFilename(OSError, filename)
|
|
||||||
|
|
||||||
sepol.sepol_policy_file_set_handle(pfile, self.sh)
|
|
||||||
sepol.sepol_policy_file_set_fp(pfile, infile)
|
|
||||||
|
|
||||||
if sepol.sepol_policydb_read(self.handle, pfile) < 0:
|
|
||||||
raise InvalidPolicy("Invalid policy: {}. A binary policy must be specified. "
|
|
||||||
"(use e.g. policy.{} or sepolicy) Source policies are not "
|
|
||||||
"supported.".format(filename,
|
|
||||||
sepol.sepol_policy_kern_vers_max()))
|
|
||||||
|
|
||||||
fclose(infile)
|
|
||||||
sepol.sepol_policy_file_free(pfile)
|
|
||||||
|
|
||||||
#
|
|
||||||
# Load policy properties
|
|
||||||
#
|
|
||||||
self.handle_unknown = HandleUnknown(self.handle.p.handle_unknown)
|
|
||||||
self.target_platform = PolicyTarget(self.handle.p.target_platform)
|
|
||||||
self.version = self.handle.p.policyvers
|
|
||||||
self.mls = <bint>self.handle.p.mls
|
|
||||||
|
|
||||||
#
|
|
||||||
# (Re)create data structures
|
|
||||||
#
|
|
||||||
if self.handle.p.attr_type_map != NULL:
|
|
||||||
self._rebuild_attrs_from_map()
|
|
||||||
# if source policies are supported in the
|
|
||||||
# future this should only run on the
|
|
||||||
# kernel policy:
|
|
||||||
#self._synthesize_attrs()
|
|
||||||
|
|
||||||
self._set_permissive_flags()
|
|
||||||
|
|
||||||
if self.mls:
|
|
||||||
self._create_mls_val_to_struct()
|
|
||||||
|
|
||||||
self.log.info("Successfully opened SELinux policy \"{0}\"".format(filename))
|
|
||||||
self.path = filename
|
|
||||||
|
|
||||||
cdef _load_running_policy(self):
|
|
||||||
"""Try to load the current running policy."""
|
|
||||||
cdef:
|
|
||||||
int min_ver = sepol.sepol_policy_kern_vers_min()
|
|
||||||
int max_ver = sepol.sepol_policy_kern_vers_max()
|
|
||||||
const char *base_policy_path = selinux.selinux_binary_policy_path()
|
|
||||||
const char *current_policy_path = selinux.selinux_current_policy_path()
|
|
||||||
list potential_policies = []
|
|
||||||
|
|
||||||
self.log.info("Attempting to locate current running policy.")
|
|
||||||
self.log.debug("SELinuxfs exists: {}".format(selinux.selinuxfs_exists()))
|
|
||||||
self.log.debug("Sepol version range: {}-{}".format(min_ver, max_ver))
|
|
||||||
self.log.debug("Current policy path: {}".format(current_policy_path
|
|
||||||
if current_policy_path != NULL else None))
|
|
||||||
self.log.debug("Binary policy path: {}".format(base_policy_path
|
|
||||||
if base_policy_path != NULL else None))
|
|
||||||
|
|
||||||
# first try libselinux for current policy
|
|
||||||
if current_policy_path != NULL:
|
|
||||||
potential_policies.append(current_policy_path)
|
|
||||||
|
|
||||||
# look through the supported policy versions
|
|
||||||
if base_policy_path != NULL:
|
|
||||||
for version in range(max_ver, min_ver - 1, -1):
|
|
||||||
potential_policies.append("{0}.{1}".format(base_policy_path, version))
|
|
||||||
|
|
||||||
self.log.debug("Potential policies: {}".format(potential_policies))
|
|
||||||
for filename in potential_policies:
|
|
||||||
try:
|
|
||||||
self._load_policy(filename)
|
|
||||||
except OSError as err:
|
|
||||||
if err.errno != ENOENT:
|
|
||||||
raise
|
|
||||||
else:
|
|
||||||
break
|
|
||||||
else:
|
|
||||||
raise RuntimeError("Unable to locate an SELinux policy to load.")
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# Policy statistics
|
# Policy statistics
|
||||||
#
|
#
|
||||||
cdef cache_constraint_counts(self):
|
|
||||||
"""Count all constraints in one iteration."""
|
|
||||||
if not self.constraint_counts:
|
|
||||||
self.constraint_counts = collections.Counter(r.ruletype for r in self.constraints())
|
|
||||||
|
|
||||||
cdef cache_terule_counts(self):
|
|
||||||
"""Count all TE rules in one iteration."""
|
|
||||||
if not self.terule_counts:
|
|
||||||
self.terule_counts = TERuleIterator.factory(self, &self.handle.p.te_avtab).ruletype_count()
|
|
||||||
self.terule_counts[TERuletype.type_transition.value] += \
|
|
||||||
len(FileNameTERuleIterator.factory(self, &self.handle.p.filename_trans))
|
|
||||||
|
|
||||||
for c in self.conditionals():
|
|
||||||
self.terule_counts.update(c.true_rules().ruletype_count())
|
|
||||||
self.terule_counts.update(c.false_rules().ruletype_count())
|
|
||||||
|
|
||||||
self.terule_counts
|
|
||||||
|
|
||||||
@property
|
@property
|
||||||
def allow_count(self):
|
def allow_count(self):
|
||||||
"""The number of (type) allow rules."""
|
"""The number of (type) allow rules."""
|
||||||
@ -783,6 +661,106 @@ cdef class SELinuxPolicy:
|
|||||||
#
|
#
|
||||||
# Internal methods
|
# Internal methods
|
||||||
#
|
#
|
||||||
|
cdef _load_policy(self, str filename):
|
||||||
|
"""Load the specified policy."""
|
||||||
|
cdef:
|
||||||
|
sepol.sepol_policy_file_t *pfile = NULL
|
||||||
|
FILE *infile = NULL
|
||||||
|
|
||||||
|
self.log.info("Opening SELinux policy \"{0}\"".format(filename))
|
||||||
|
|
||||||
|
self.sh = sepol.sepol_handle_create()
|
||||||
|
if self.sh == NULL:
|
||||||
|
raise MemoryError
|
||||||
|
|
||||||
|
sepol.sepol_msg_set_callback(self.sh, sepol_logging_callback, self.handle)
|
||||||
|
|
||||||
|
if sepol.sepol_policydb_create(&self.handle) < 0:
|
||||||
|
raise MemoryError
|
||||||
|
|
||||||
|
if sepol.sepol_policy_file_create(&pfile) < 0:
|
||||||
|
raise MemoryError
|
||||||
|
|
||||||
|
infile = fopen(filename, "rb")
|
||||||
|
if infile == NULL:
|
||||||
|
PyErr_SetFromErrnoWithFilename(OSError, filename)
|
||||||
|
|
||||||
|
sepol.sepol_policy_file_set_handle(pfile, self.sh)
|
||||||
|
sepol.sepol_policy_file_set_fp(pfile, infile)
|
||||||
|
|
||||||
|
if sepol.sepol_policydb_read(self.handle, pfile) < 0:
|
||||||
|
raise InvalidPolicy("Invalid policy: {}. A binary policy must be specified. "
|
||||||
|
"(use e.g. policy.{} or sepolicy) Source policies are not "
|
||||||
|
"supported.".format(filename,
|
||||||
|
sepol.sepol_policy_kern_vers_max()))
|
||||||
|
|
||||||
|
fclose(infile)
|
||||||
|
sepol.sepol_policy_file_free(pfile)
|
||||||
|
|
||||||
|
#
|
||||||
|
# Load policy properties
|
||||||
|
#
|
||||||
|
self.handle_unknown = HandleUnknown(self.handle.p.handle_unknown)
|
||||||
|
self.target_platform = PolicyTarget(self.handle.p.target_platform)
|
||||||
|
self.version = self.handle.p.policyvers
|
||||||
|
self.mls = <bint>self.handle.p.mls
|
||||||
|
|
||||||
|
#
|
||||||
|
# (Re)create data structures
|
||||||
|
#
|
||||||
|
if self.handle.p.attr_type_map != NULL:
|
||||||
|
self._rebuild_attrs_from_map()
|
||||||
|
# if source policies are supported in the
|
||||||
|
# future this should only run on the
|
||||||
|
# kernel policy:
|
||||||
|
#self._synthesize_attrs()
|
||||||
|
|
||||||
|
self._set_permissive_flags()
|
||||||
|
|
||||||
|
if self.mls:
|
||||||
|
self._create_mls_val_to_struct()
|
||||||
|
|
||||||
|
self.log.info("Successfully opened SELinux policy \"{0}\"".format(filename))
|
||||||
|
self.path = filename
|
||||||
|
|
||||||
|
cdef _load_running_policy(self):
|
||||||
|
"""Try to load the current running policy."""
|
||||||
|
cdef:
|
||||||
|
int min_ver = sepol.sepol_policy_kern_vers_min()
|
||||||
|
int max_ver = sepol.sepol_policy_kern_vers_max()
|
||||||
|
const char *base_policy_path = selinux.selinux_binary_policy_path()
|
||||||
|
const char *current_policy_path = selinux.selinux_current_policy_path()
|
||||||
|
list potential_policies = []
|
||||||
|
|
||||||
|
self.log.info("Attempting to locate current running policy.")
|
||||||
|
self.log.debug("SELinuxfs exists: {}".format(selinux.selinuxfs_exists()))
|
||||||
|
self.log.debug("Sepol version range: {}-{}".format(min_ver, max_ver))
|
||||||
|
self.log.debug("Current policy path: {}".format(current_policy_path
|
||||||
|
if current_policy_path != NULL else None))
|
||||||
|
self.log.debug("Binary policy path: {}".format(base_policy_path
|
||||||
|
if base_policy_path != NULL else None))
|
||||||
|
|
||||||
|
# first try libselinux for current policy
|
||||||
|
if current_policy_path != NULL:
|
||||||
|
potential_policies.append(current_policy_path)
|
||||||
|
|
||||||
|
# look through the supported policy versions
|
||||||
|
if base_policy_path != NULL:
|
||||||
|
for version in range(max_ver, min_ver - 1, -1):
|
||||||
|
potential_policies.append("{0}.{1}".format(base_policy_path, version))
|
||||||
|
|
||||||
|
self.log.debug("Potential policies: {}".format(potential_policies))
|
||||||
|
for filename in potential_policies:
|
||||||
|
try:
|
||||||
|
self._load_policy(filename)
|
||||||
|
except OSError as err:
|
||||||
|
if err.errno != ENOENT:
|
||||||
|
raise
|
||||||
|
else:
|
||||||
|
break
|
||||||
|
else:
|
||||||
|
raise RuntimeError("Unable to locate an SELinux policy to load.")
|
||||||
|
|
||||||
cdef _set_permissive_flags(self):
|
cdef _set_permissive_flags(self):
|
||||||
"""
|
"""
|
||||||
Set permissive flag in type datums.
|
Set permissive flag in type datums.
|
||||||
@ -994,3 +972,19 @@ cdef class SELinuxPolicy:
|
|||||||
# memory now owned by policydb, do not free
|
# memory now owned by policydb, do not free
|
||||||
tmp_name = NULL
|
tmp_name = NULL
|
||||||
tmp_type = NULL
|
tmp_type = NULL
|
||||||
|
|
||||||
|
cdef cache_constraint_counts(self):
|
||||||
|
"""Count all constraints in one iteration."""
|
||||||
|
if not self.constraint_counts:
|
||||||
|
self.constraint_counts = collections.Counter(r.ruletype for r in self.constraints())
|
||||||
|
|
||||||
|
cdef cache_terule_counts(self):
|
||||||
|
"""Count all TE rules in one iteration."""
|
||||||
|
if not self.terule_counts:
|
||||||
|
self.terule_counts = TERuleIterator.factory(self, &self.handle.p.te_avtab).ruletype_count()
|
||||||
|
self.terule_counts[TERuletype.type_transition.value] += \
|
||||||
|
len(FileNameTERuleIterator.factory(self, &self.handle.p.filename_trans))
|
||||||
|
|
||||||
|
for c in self.conditionals():
|
||||||
|
self.terule_counts.update(c.true_rules().ruletype_count())
|
||||||
|
self.terule_counts.update(c.false_rules().ruletype_count())
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user