Current Path :
/
usr
/
local
/
ssl
/
share
/
system-config-selinux
/
Or
Select Your Path :
Upload File :
New :
File
Dir
//usr/local/ssl/share/system-config-selinux/polgen.py
#!/usr/bin/python -Es # # Copyright (C) 2007-2011 Red Hat # see file 'COPYING' for use and warranty information # # policygentool is a tool for the initial generation of SELinux policy # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; either version 2 of # the License, or (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA # 02111-1307 USA # # import os, sys, stat import re import commands import setools from templates import executable from templates import boolean from templates import etc_rw from templates import var_cache from templates import var_spool from templates import var_lib from templates import var_log from templates import var_run from templates import tmp from templates import rw from templates import network from templates import script from templates import user import sepolgen.interfaces as interfaces import sepolgen.defaults as defaults ## ## I18N ## PROGNAME="policycoreutils" import gettext gettext.bindtextdomain(PROGNAME, "/usr/share/locale") gettext.textdomain(PROGNAME) try: gettext.install(PROGNAME, localedir="/usr/share/locale", unicode=False, codeset = 'utf-8') except IOError: import __builtin__ __builtin__.__dict__['_'] = unicode methods = [] fn = defaults.interface_info() try: fd = open(fn) # List of per_role_template interfaces ifs = interfaces.InterfaceSet() ifs.from_file(fd) methods = ifs.interfaces.keys() fd.close() except: sys.stderr.write("could not open interface info [%s]\n" % fn) sys.exit(1) all_types = None def get_all_types(): global all_types if all_types == None: all_types = map(lambda x: x['name'], setools.seinfo(setools.TYPE)) return all_types def get_all_ports(): dict = {} for p in setools.seinfo(setools.PORT): if p['type'] == "reserved_port_t" or \ p['type'] == "port_t" or \ p['type'] == "hi_reserved_port_t": continue dict[(p['low'], p['high'], p['protocol'])]=(p['type'], p['range']) return dict def get_all_roles(): roles = map(lambda x: x['name'], setools.seinfo(setools.ROLE)) roles.remove("object_r") roles.sort() return roles def get_all_domains(): all_domains = [] types=get_all_types() types.sort() for i in types: m = re.findall("(.*)%s" % "_exec_t$", i) if len(m) > 0: if len(re.findall("(.*)%s" % "_initrc$", m[0])) == 0 and m[0] not in all_domains: all_domains.append(m[0]) return all_domains def get_all_modules(): try: all_modules = [] rc, output=commands.getstatusoutput("semodule -l 2>/dev/null") if rc == 0: l = output.split("\n") for i in l: all_modules.append(i.split()[0]) except: pass return all_modules def get_all_users(): users = map(lambda x: x['name'], setools.seinfo(setools.USER)) users.remove("system_u") users.remove("root") users.sort() return users ALL = 0 RESERVED = 1 UNRESERVED = 2 PORTS = 3 ADMIN_TRANSITION_INTERFACE = "_admin$" USER_TRANSITION_INTERFACE = "_role$" DAEMON = 0 DBUS = 1 INETD = 2 USER = 3 CGI = 4 XUSER = 5 TUSER = 6 LUSER = 7 AUSER = 8 EUSER = 9 RUSER = 10 SANDBOX = 11 poltype={} poltype[DAEMON] = _("Standard Init Daemon") poltype[DBUS] = _("DBUS System Daemon") poltype[INETD] = _("Internet Services Daemon") poltype[CGI] = _("Web Application/Script (CGI)") poltype[USER] = _("User Application") poltype[TUSER] = _("Minimal Terminal User Role") poltype[XUSER] = _("Minimal X Windows User Role") poltype[LUSER] = _("User Role") poltype[AUSER] = _("Admin User Role") poltype[RUSER] = _("Root Admin User Role") poltype[SANDBOX] = _("Sandbox") APPLICATIONS = [ DAEMON, DBUS, INETD, USER, CGI ] USERS = [ XUSER, TUSER, LUSER, AUSER, EUSER, RUSER] def verify_ports(ports): if ports == "": return [] max_port=2**16 try: temp = [] for a in ports.split(","): r = a.split("-") if len(r) > 2: raise ValueError if len(r) == 1: begin = int (r[0]) end = int (r[0]) else: begin = int (r[0]) end = int (r[1]) if begin > end: raise ValueError for p in range(begin, end + 1): if p < 1 or p > max_port: raise ValueError temp.append(p) return temp except ValueError: raise ValueError(_("Ports must be numbers or ranges of numbers from 1 to %d " % max_port )) class policy: def __init__(self, name, type): self.ports = [] try: self.ports = get_all_ports() except ValueError, e: print "Can not get port types, must be root for this information" except RuntimeError, e: print "Can not get port types", e self.symbols = {} self.symbols["openlog"] = "set_use_kerberos(True)" self.symbols["openlog"] = "set_use_kerb_rcache(True)" self.symbols["openlog"] = "set_use_syslog(True)" self.symbols["gethostby"] = "set_use_resolve(True)" self.symbols["getaddrinfo"] = "set_use_resolve(True)" self.symbols["getnameinfo"] = "set_use_resolve(True)" self.symbols["krb"] = "set_use_kerberos(True)" self.symbols["gss_accept_sec_context"] = "set_manage_krb5_rcache(True)" self.symbols["krb5_verify_init_creds"] = "set_manage_krb5_rcache(True)" self.symbols["krb5_rd_req"] = "set_manage_krb5_rcache(True)" self.symbols["__syslog_chk"] = "set_use_syslog(True)" self.symbols["getpwnam"] = "set_use_uid(True)" self.symbols["getpwuid"] = "set_use_uid(True)" self.symbols["dbus_"] = "set_use_dbus(True)" self.symbols["pam_"] = "set_use_pam(True)" self.symbols["pam_"] = "set_use_audit(True)" self.symbols["fork"] = "add_process('fork')" self.symbols["transition"] = "add_process('transition')" self.symbols["sigchld"] = "add_process('sigchld')" self.symbols["sigkill"] = "add_process('sigkill')" self.symbols["sigstop"] = "add_process('sigstop')" self.symbols["signull"] = "add_process('signull')" self.symbols["signal"] = "add_process('signal')" self.symbols["ptrace"] = "add_process('ptrace')" self.symbols["getsched"] = "add_process('getsched')" self.symbols["setsched"] = "add_process('setsched')" self.symbols["getsession"] = "add_process('getsession')" self.symbols["getpgid"] = "add_process('getpgid')" self.symbols["setpgid"] = "add_process('setpgid')" self.symbols["getcap"] = "add_process('getcap')" self.symbols["setcap"] = "add_process('setcap')" self.symbols["share"] = "add_process('share')" self.symbols["getattr"] = "add_process('getattr')" self.symbols["setexec"] = "add_process('setexec')" self.symbols["setfscreate"] = "add_process('setfscreate')" self.symbols["noatsecure"] = "add_process('noatsecure')" self.symbols["siginh"] = "add_process('siginh')" self.symbols["setrlimit"] = "add_process('setrlimit')" self.symbols["rlimitinh"] = "add_process('rlimitinh')" self.symbols["dyntransition"] = "add_process('dyntransition')" self.symbols["setcurrent"] = "add_process('setcurrent')" self.symbols["execmem"] = "add_process('execmem')" self.symbols["execstack"] = "add_process('execstack')" self.symbols["execheap"] = "add_process('execheap')" self.symbols["setkeycreate"] = "add_process('setkeycreate')" self.symbols["setsockcreate"] = "add_process('setsockcreate')" self.symbols["chown"] = "add_capability('chown')" self.symbols["dac_override"] = "add_capability('dac_override')" self.symbols["dac_read_search"] = "add_capability('dac_read_search')" self.symbols["fowner"] = "add_capability('fowner')" self.symbols["fsetid"] = "add_capability('fsetid')" self.symbols["kill"] = "add_capability('kill')" self.symbols["setgid"] = "add_capability('setgid')" self.symbols["setresuid"] = "add_capability('setuid')" self.symbols["setuid"] = "add_capability('setuid')" self.symbols["setpcap"] = "add_capability('setpcap')" self.symbols["linux_immutable"] = "add_capability('linux_immutable')" self.symbols["net_bind_service"] = "add_capability('net_bind_service')" self.symbols["net_broadcast"] = "add_capability('net_broadcast')" self.symbols["net_admin"] = "add_capability('net_admin')" self.symbols["net_raw"] = "add_capability('net_raw')" self.symbols["ipc_lock"] = "add_capability('ipc_lock')" self.symbols["ipc_owner"] = "add_capability('ipc_owner')" self.symbols["sys_module"] = "add_capability('sys_module')" self.symbols["sys_rawio"] = "add_capability('sys_rawio')" self.symbols["chroot"] = "add_capability('sys_chroot')" self.symbols["sys_chroot"] = "add_capability('sys_chroot')" self.symbols["sys_ptrace"] = "add_capability('sys_ptrace')" self.symbols["sys_pacct"] = "add_capability('sys_pacct')" self.symbols["mount"] = "add_capability('sys_admin')" self.symbols["unshare"] = "add_capability('sys_admin')" self.symbols["sys_admin"] = "add_capability('sys_admin')" self.symbols["sys_boot"] = "add_capability('sys_boot')" self.symbols["sys_nice"] = "add_capability('sys_nice')" self.symbols["sys_resource"] = "add_capability('sys_resource')" self.symbols["sys_time"] = "add_capability('sys_time')" self.symbols["sys_tty_config"] = "add_capability('sys_tty_config')" self.symbols["mknod"] = "add_capability('mknod')" self.symbols["lease"] = "add_capability('lease')" self.symbols["audit_write"] = "add_capability('audit_write')" self.symbols["audit_control"] = "add_capability('audit_control')" self.symbols["setfcap"] = "add_capability('setfcap')" self.DEFAULT_DIRS = {} self.DEFAULT_DIRS["/etc"] = ["etc_rw", [], etc_rw]; self.DEFAULT_DIRS["/tmp"] = ["tmp", [], tmp]; self.DEFAULT_DIRS["rw"] = ["rw", [], rw]; self.DEFAULT_DIRS["/var/cache"] = ["var_cache", [], var_cache]; self.DEFAULT_DIRS["/var/lib"] = ["var_lib", [], var_lib]; self.DEFAULT_DIRS["/var/log"] = ["var_log", [], var_log]; self.DEFAULT_DIRS["/var/run"] = ["var_run", [], var_run]; self.DEFAULT_DIRS["/var/spool"] = ["var_spool", [], var_spool]; self.DEFAULT_KEYS=["/etc", "/var/cache", "/var/log", "/tmp", "rw", "/var/lib", "/var/run", "/var/spool"] self.DEFAULT_TYPES = (\ ( self.generate_daemon_types, self.generate_daemon_rules), \ ( self.generate_dbusd_types, self.generate_dbusd_rules), \ ( self.generate_inetd_types, self.generate_inetd_rules), \ ( self.generate_userapp_types, self.generate_userapp_rules), \ ( self.generate_cgi_types, self.generate_cgi_rules), \ ( self.generate_x_login_user_types, self.generate_x_login_user_rules), \ ( self.generate_min_login_user_types, self.generate_login_user_rules), \ ( self.generate_login_user_types, self.generate_login_user_rules), \ ( self.generate_admin_user_types, self.generate_login_user_rules), \ ( self.generate_existing_user_types, self.generate_existing_user_rules), \ ( self.generate_root_user_types, self.generate_root_user_rules), \ ( self.generate_sandbox_types, self.generate_sandbox_rules)) if name == "": raise ValueError(_("You must enter a name for your confined process/user")) if not re.match(r"^[a-zA-Z0-9-_]+$", name): raise ValueError(_("Name must be alpha numberic with no spaces. Consider using option \"-n MODULENAME\"")) if type == CGI: self.name = "httpd_%s_script" % name else: self.name = name self.file_name = name self.capabilities = [] self.processes = [] self.type = type self.initscript = "" self.program = "" self.in_tcp = [False, False, False, []] self.in_udp = [False, False, False, []] self.out_tcp = [False, False, False, []] self.out_udp = [False, False, False, []] self.use_resolve = False self.use_tmp = False self.use_uid = False self.use_syslog = False self.use_kerberos = False self.manage_krb5_rcache = False self.use_pam = False self.use_dbus = False self.use_audit = False self.use_etc = True self.use_localization = True self.use_fd = True self.use_terminal = False self.use_mail = False self.booleans = {} self.files = {} self.dirs = {} self.found_tcp_ports=[] self.found_udp_ports=[] self.need_tcp_type=False self.need_udp_type=False self.admin_domains = [] self.transition_domains = [] self.transition_users = [] self.roles = [] def __isnetset(self, l): return l[ALL] or l[RESERVED] or l[UNRESERVED] or len(l[PORTS]) > 0 def set_admin_domains(self, admin_domains): self.admin_domains = admin_domains def set_admin_roles(self, roles): self.roles = roles def set_transition_domains(self, transition_domains): self.transition_domains = transition_domains def set_transition_users(self, transition_users): self.transition_users = transition_users def use_in_udp(self): return self.__isnetset(self.in_udp) def use_out_udp(self): return self.__isnetset(self.out_udp) def use_udp(self): return self.use_in_udp() or self.use_out_udp() def use_in_tcp(self): return self.__isnetset(self.in_tcp) def use_out_tcp(self): return self.__isnetset(self.out_tcp) def use_tcp(self): return self.use_in_tcp() or self.use_out_tcp() def use_network(self): return self.use_tcp() or self.use_udp() def find_port(self, port, protocol="tcp"): for begin,end,p in self.ports.keys(): if port >= begin and port <= end and protocol == p: return self.ports[begin, end, protocol] return None def set_program(self, program): if self.type not in APPLICATIONS: raise ValueError(_("User Role types can not be assigned executables.")) self.program = program def set_init_script(self, initscript): if self.type != DAEMON: raise ValueError(_("Only Daemon apps can use an init script..")) self.initscript = initscript def set_in_tcp(self, all, reserved, unreserved, ports): self.in_tcp = [ all, reserved, unreserved, verify_ports(ports)] def set_in_udp(self, all, reserved, unreserved, ports): self.in_udp = [ all, reserved, unreserved, verify_ports(ports)] def set_out_tcp(self, all, ports): self.out_tcp = [ all , False, False, verify_ports(ports) ] def set_out_udp(self, all, ports): self.out_udp = [ all , False, False, verify_ports(ports) ] def set_use_resolve(self, val): if val != True and val != False: raise ValueError(_("use_resolve must be a boolean value ")) self.use_resolve = val def set_use_syslog(self, val): if val != True and val != False: raise ValueError(_("use_syslog must be a boolean value ")) self.use_syslog = val def set_use_kerberos(self, val): if val != True and val != False: raise ValueError(_("use_kerberos must be a boolean value ")) self.use_kerberos = val def set_manage_krb5_rcache(self, val): if val != True and val != False: raise ValueError(_("manage_krb5_rcache must be a boolean value ")) self.manage_krb5_rcache = val def set_use_pam(self, val): self.use_pam = val == True def set_use_dbus(self, val): self.use_dbus = val == True def set_use_audit(self, val): self.use_audit = val == True def set_use_etc(self, val): self.use_etc = val == True def set_use_localization(self, val): self.use_localization = val == True def set_use_fd(self, val): self.use_fd = val == True def set_use_terminal(self, val): self.use_terminal = val == True def set_use_mail(self, val): self.use_mail = val == True def set_use_tmp(self, val): if self.type in USERS: raise ValueError(_("USER Types automatically get a tmp type")) if val: self.DEFAULT_DIRS["/tmp"][1].append("/tmp"); else: self.DEFAULT_DIRS["/tmp"][1]=[] def set_use_uid(self, val): self.use_uid = val == True def generate_uid_rules(self): if self.use_uid: return re.sub("TEMPLATETYPE", self.name, executable.te_uid_rules) else: return "" def generate_syslog_rules(self): if self.use_syslog: return re.sub("TEMPLATETYPE", self.name, executable.te_syslog_rules) else: return "" def generate_resolve_rules(self): if self.use_resolve: return re.sub("TEMPLATETYPE", self.name, executable.te_resolve_rules) else: return "" def generate_kerberos_rules(self): if self.use_kerberos: return re.sub("TEMPLATETYPE", self.name, executable.te_kerberos_rules) else: return "" def generate_manage_krb5_rcache_rules(self): if self.manage_krb5_rcache: return re.sub("TEMPLATETYPE", self.name, executable.te_manage_krb5_rcache_rules) else: return "" def generate_pam_rules(self): newte ="" if self.use_pam: newte = re.sub("TEMPLATETYPE", self.name, executable.te_pam_rules) return newte def generate_audit_rules(self): newte ="" if self.use_audit: newte = re.sub("TEMPLATETYPE", self.name, executable.te_audit_rules) return newte def generate_etc_rules(self): newte ="" if self.use_etc: newte = re.sub("TEMPLATETYPE", self.name, executable.te_etc_rules) return newte def generate_fd_rules(self): newte ="" if self.use_fd: newte = re.sub("TEMPLATETYPE", self.name, executable.te_fd_rules) return newte def generate_localization_rules(self): newte ="" if self.use_localization: newte = re.sub("TEMPLATETYPE", self.name, executable.te_localization_rules) return newte def generate_dbus_rules(self): newte ="" if self.type != DBUS and self.use_dbus: newte = re.sub("TEMPLATETYPE", self.name, executable.te_dbus_rules) return newte def generate_mail_rules(self): newte ="" if self.use_mail: newte = re.sub("TEMPLATETYPE", self.name, executable.te_mail_rules) return newte def generate_network_action(self, protocol, action, port_name): line = "" method = "corenet_%s_%s_%s" % (protocol, action, port_name) if method in methods: line = "%s(%s_t)\n" % (method, self.name) else: line = """ gen_require(` type %s_t; ') allow %s_t %s_t:%s_socket name_%s; """ % (port_name, self.name, port_name, protocol, action) return line def generate_network_types(self): for i in self.in_tcp[PORTS]: rec = self.find_port(int(i), "tcp") if rec == None: self.need_tcp_type = True; else: port_name = rec[0][:-2] line = self.generate_network_action("tcp", "bind", port_name) # line = "corenet_tcp_bind_%s(%s_t)\n" % (port_name, self.name) if line not in self.found_tcp_ports: self.found_tcp_ports.append(line) for i in self.out_tcp[PORTS]: rec = self.find_port(int(i), "tcp") if rec == None: self.need_tcp_type = True; else: port_name = rec[0][:-2] line = self.generate_network_action("tcp", "connect", port_name) # line = "corenet_tcp_connect_%s(%s_t)\n" % (port_name, self.name) if line not in self.found_tcp_ports: self.found_tcp_ports.append(line) for i in self.in_udp[PORTS]: rec = self.find_port(int(i),"udp") if rec == None: self.need_udp_type = True; else: port_name = rec[0][:-2] line = self.generate_network_action("udp", "bind", port_name) # line = "corenet_udp_bind_%s(%s_t)\n" % (port_name, self.name) if line not in self.found_udp_ports: self.found_udp_ports.append(line) if self.need_udp_type == True or self.need_tcp_type == True: return re.sub("TEMPLATETYPE", self.name, network.te_port_types) return "" def __find_path(self, file): for d in self.DEFAULT_DIRS: if file.find(d) == 0: self.DEFAULT_DIRS[d][1].append(file) return self.DEFAULT_DIRS[d] self.DEFAULT_DIRS["rw"][1].append(file) return self.DEFAULT_DIRS["rw"] def add_capability(self, capability): if capability not in self.capabilities: self.capabilities.append(capability) def add_process(self, process): if process not in self.processes: self.processes.append(process) def add_boolean(self, name, description): self.booleans[name] = description def add_file(self, file): self.files[file] = self.__find_path(file) def add_dir(self, file): self.dirs[file] = self.__find_path(file) def generate_capabilities(self): newte = "" self.capabilities.sort() if len(self.capabilities) > 0: newte = "allow %s_t self:capability { %s };\n" % (self.name, " ".join(self.capabilities)) return newte def generate_process(self): newte = "" self.processes.sort() if len(self.processes) > 0: newte = "allow %s_t self:process { %s };\n" % (self.name, " ".join(self.processes)) return newte def generate_network_rules(self): newte = "" if self.use_network(): newte = "\n" newte += re.sub("TEMPLATETYPE", self.name, network.te_network) if self.use_tcp(): newte += "\n" newte += re.sub("TEMPLATETYPE", self.name, network.te_tcp) if self.use_in_tcp(): newte += re.sub("TEMPLATETYPE", self.name, network.te_in_tcp) if self.need_tcp_type and len(self.in_tcp[PORTS]) > 0: newte += re.sub("TEMPLATETYPE", self.name, network.te_in_need_port_tcp) if self.need_tcp_type and len(self.out_tcp[PORTS]) > 0: newte += re.sub("TEMPLATETYPE", self.name, network.te_out_need_port_tcp) if self.in_tcp[ALL]: newte += re.sub("TEMPLATETYPE", self.name, network.te_in_all_ports_tcp) if self.in_tcp[RESERVED]: newte += re.sub("TEMPLATETYPE", self.name, network.te_in_reserved_ports_tcp) if self.in_tcp[UNRESERVED]: newte += re.sub("TEMPLATETYPE", self.name, network.te_in_unreserved_ports_tcp) if self.out_tcp[ALL]: newte += re.sub("TEMPLATETYPE", self.name, network.te_out_all_ports_tcp) if self.out_tcp[RESERVED]: newte += re.sub("TEMPLATETYPE", self.name, network.te_out_reserved_ports_tcp) if self.out_tcp[UNRESERVED]: newte += re.sub("TEMPLATETYPE", self.name, network.te_out_unreserved_ports_tcp) for i in self.found_tcp_ports: newte += i if self.use_udp(): newte += "\n" newte += re.sub("TEMPLATETYPE", self.name, network.te_udp) if self.need_udp_type: newte += re.sub("TEMPLATETYPE", self.name, network.te_in_need_port_udp) if self.use_in_udp(): newte += re.sub("TEMPLATETYPE", self.name, network.te_in_udp) if self.in_udp[ALL]: newte += re.sub("TEMPLATETYPE", self.name, network.te_in_all_ports_udp) if self.in_udp[RESERVED]: newte += re.sub("TEMPLATETYPE", self.name, network.te_in_reserved_ports_udp) if self.in_udp[UNRESERVED]: newte += re.sub("TEMPLATETYPE", self.name, network.te_in_unreserved_ports_udp) for i in self.found_udp_ports: newte += i return newte def generate_transition_rules(self): newte = "" for app in self.transition_domains: tmp = re.sub("TEMPLATETYPE", self.name, user.te_transition_rules) newte += re.sub("APPLICATION", app, tmp) if self.type == USER: for u in self.transition_users: temp = re.sub("TEMPLATETYPE", self.name, executable.te_run_rules) newte += re.sub("USER", u.split("_u")[0], temp) return newte def generate_admin_rules(self): newte = "" if self.type == RUSER: newte += re.sub("TEMPLATETYPE", self.name, user.te_admin_rules) for app in self.admin_domains: tmp = re.sub("TEMPLATETYPE", self.name, user.te_admin_domain_rules) newte += re.sub("APPLICATION", app, tmp) all_roles = [] try: all_roles = get_all_roles() except ValueError, e: print "Can not get all roles, must be root for this information" except RuntimeError, e: print "Can not get all roles", e for u in self.transition_users: role = u.split("_u")[0] if (role + "_r") in all_roles: tmp = re.sub("TEMPLATETYPE", self.name, user.te_admin_trans_rules) newte += re.sub("USER", role, tmp) return newte def generate_dbus_if(self): newif = "" if self.use_dbus: newif = re.sub("TEMPLATETYPE", self.name, executable.if_dbus_rules) return newif def generate_sandbox_if(self): newif = "" if self.type != SANDBOX: return newif newif = re.sub("TEMPLATETYPE", self.name, executable.if_sandbox_rules) return newif def generate_admin_if(self): newif = "" newtypes = "" if self.initscript != "": newtypes += re.sub("TEMPLATETYPE", self.name, executable.if_initscript_admin_types) newif += re.sub("TEMPLATETYPE", self.name, executable.if_initscript_admin) for d in self.DEFAULT_KEYS: if len(self.DEFAULT_DIRS[d][1]) > 0: newtypes += re.sub("TEMPLATETYPE", self.name, self.DEFAULT_DIRS[d][2].if_admin_types) newif += re.sub("TEMPLATETYPE", self.name, self.DEFAULT_DIRS[d][2].if_admin_rules) if newif != "": ret = re.sub("TEMPLATETYPE", self.name, executable.if_begin_admin) ret += newtypes ret += re.sub("TEMPLATETYPE", self.name, executable.if_middle_admin) ret += newif ret += re.sub("TEMPLATETYPE", self.name, executable.if_end_admin) return ret return "" def generate_cgi_types(self): return re.sub("TEMPLATETYPE", self.file_name, executable.te_cgi_types) def generate_sandbox_types(self): return re.sub("TEMPLATETYPE", self.file_name, executable.te_sandbox_types) def generate_userapp_types(self): return re.sub("TEMPLATETYPE", self.name, executable.te_userapp_types) def generate_inetd_types(self): return re.sub("TEMPLATETYPE", self.name, executable.te_inetd_types) def generate_dbusd_types(self): return re.sub("TEMPLATETYPE", self.name, executable.te_dbusd_types) def generate_min_login_user_types(self): return re.sub("TEMPLATETYPE", self.name, user.te_min_login_user_types) def generate_login_user_types(self): return re.sub("TEMPLATETYPE", self.name, user.te_login_user_types) def generate_admin_user_types(self): return re.sub("TEMPLATETYPE", self.name, user.te_admin_user_types) def generate_existing_user_types(self): return re.sub("TEMPLATETYPE", self.name, user.te_existing_user_types) def generate_x_login_user_types(self): return re.sub("TEMPLATETYPE", self.name, user.te_x_login_user_types) def generate_root_user_types(self): return re.sub("TEMPLATETYPE", self.name, user.te_root_user_types) def generate_daemon_types(self): newte = re.sub("TEMPLATETYPE", self.name, executable.te_daemon_types) if self.initscript != "": newte += re.sub("TEMPLATETYPE", self.name, executable.te_initscript_types) return newte def generate_tmp_types(self): if self.use_tmp: return re.sub("TEMPLATETYPE", self.name, tmp.te_types) else: return "" def generate_booleans(self): newte = "" for b in self.booleans: tmp = re.sub("BOOLEAN", b, boolean.te_boolean) newte += re.sub("DESCRIPTION", self.booleans[b], tmp) return newte def generate_boolean_rules(self): newte = "" for b in self.booleans: newte += re.sub("BOOLEAN", b, boolean.te_rules) return newte def generate_sandbox_te(self): return re.sub("TEMPLATETYPE", self.name, executable.te_sandbox_types) def generate_cgi_te(self): return re.sub("TEMPLATETYPE", self.name, executable.te_cgi_types) def generate_daemon_rules(self): newif = re.sub("TEMPLATETYPE", self.name, executable.te_daemon_rules) return newif def generate_login_user_rules(self): return re.sub("TEMPLATETYPE", self.name, user.te_login_user_rules) def generate_existing_user_rules(self): return re.sub("TEMPLATETYPE", self.name, user.te_existing_user_rules) def generate_x_login_user_rules(self): return re.sub("TEMPLATETYPE", self.name, user.te_x_login_user_rules) def generate_root_user_rules(self): newte =re.sub("TEMPLATETYPE", self.name, user.te_root_user_rules) return newte def generate_userapp_rules(self): return re.sub("TEMPLATETYPE", self.name, executable.te_userapp_rules) def generate_inetd_rules(self): return re.sub("TEMPLATETYPE", self.name, executable.te_inetd_rules) def generate_dbusd_rules(self): return re.sub("TEMPLATETYPE", self.name, executable.te_dbusd_rules) def generate_tmp_rules(self): if self.use_tmp: return re.sub("TEMPLATETYPE", self.name, tmp.te_rules) else: return "" def generate_cgi_rules(self): newte = "" newte += re.sub("TEMPLATETYPE", self.name, executable.te_cgi_rules) return newte def generate_sandbox_rules(self): newte = "" newte += re.sub("TEMPLATETYPE", self.name, executable.te_sandbox_rules) return newte def generate_user_if(self): newif ="" if self.use_terminal or self.type == USER: newif = re.sub("TEMPLATETYPE", self.name, executable.if_user_program_rules) if self.type in ( TUSER, XUSER, AUSER, LUSER): newif += re.sub("TEMPLATETYPE", self.name, executable.if_role_change_rules) return newif def generate_if(self): newif = "" newif += re.sub("TEMPLATETYPE", self.name, executable.if_heading_rules) if self.program != "": newif += re.sub("TEMPLATETYPE", self.name, executable.if_program_rules) if self.initscript != "": newif += re.sub("TEMPLATETYPE", self.name, executable.if_initscript_rules) for d in self.DEFAULT_KEYS: if len(self.DEFAULT_DIRS[d][1]) > 0: newif += re.sub("TEMPLATETYPE", self.name, self.DEFAULT_DIRS[d][2].if_rules) for i in self.DEFAULT_DIRS[d][1]: if os.path.exists(i) and stat.S_ISSOCK(os.stat(i)[stat.ST_MODE]): newif += re.sub("TEMPLATETYPE", self.name, self.DEFAULT_DIRS[d][2].if_stream_rules) break newif += self.generate_user_if() newif += self.generate_dbus_if() newif += self.generate_admin_if() newif += self.generate_sandbox_if() return newif def generate_default_types(self): return self.DEFAULT_TYPES[self.type][0]() def generate_default_rules(self): return self.DEFAULT_TYPES[self.type][1]() def generate_roles_rules(self): newte = "" if self.type in ( TUSER, XUSER, AUSER, LUSER, EUSER): roles = "" if len(self.roles) > 0: newte += re.sub("TEMPLATETYPE", self.name, user.te_sudo_rules) newte += re.sub("TEMPLATETYPE", self.name, user.te_newrole_rules) for role in self.roles: tmp = re.sub("TEMPLATETYPE", self.name, user.te_roles_rules) newte += re.sub("ROLE", role, tmp) return newte def generate_te(self): newte = self.generate_default_types() for d in self.DEFAULT_KEYS: if len(self.DEFAULT_DIRS[d][1]) > 0: # CGI scripts already have a rw_t if self.type != CGI or d != "rw": newte += re.sub("TEMPLATETYPE", self.name, self.DEFAULT_DIRS[d][2].te_types) newte +=""" ######################################## # # %s local policy # """ % self.name newte += self.generate_capabilities() newte += self.generate_process() newte += self.generate_network_types() newte += self.generate_tmp_types() newte += self.generate_booleans() newte += self.generate_default_rules() newte += self.generate_boolean_rules() for d in self.DEFAULT_KEYS: if len(self.DEFAULT_DIRS[d][1]) > 0: newte += re.sub("TEMPLATETYPE", self.name, self.DEFAULT_DIRS[d][2].te_rules) for i in self.DEFAULT_DIRS[d][1]: if os.path.exists(i) and stat.S_ISSOCK(os.stat(i)[stat.ST_MODE]): newte += re.sub("TEMPLATETYPE", self.name, self.DEFAULT_DIRS[d][2].te_stream_rules) break newte += self.generate_tmp_rules() newte += self.generate_network_rules() newte += self.generate_fd_rules() newte += self.generate_etc_rules() newte += self.generate_pam_rules() newte += self.generate_uid_rules() newte += self.generate_audit_rules() newte += self.generate_syslog_rules() newte += self.generate_localization_rules() newte += self.generate_resolve_rules() newte += self.generate_roles_rules() newte += self.generate_mail_rules() newte += self.generate_transition_rules() newte += self.generate_admin_rules() newte += self.generate_dbus_rules() newte += self.generate_kerberos_rules() newte += self.generate_manage_krb5_rcache_rules() return newte def generate_fc(self): newfc = "" fclist = [] if self.type in USERS + [ SANDBOX ]: return re.sub("EXECUTABLE", self.program, executable.fc_user) if self.program == "": raise ValueError(_("You must enter the executable path for your confined process")) t1 = re.sub("EXECUTABLE", self.program, executable.fc_program) fclist.append(re.sub("TEMPLATETYPE", self.name, t1)) if self.initscript != "": t1 = re.sub("EXECUTABLE", self.initscript, executable.fc_initscript) fclist.append(re.sub("TEMPLATETYPE", self.name, t1)) for i in self.files.keys(): if os.path.exists(i) and stat.S_ISSOCK(os.stat(i)[stat.ST_MODE]): t1 = re.sub("TEMPLATETYPE", self.name, self.files[i][2].fc_sock_file) else: t1 = re.sub("TEMPLATETYPE", self.name, self.files[i][2].fc_file) t2 = re.sub("FILENAME", i, t1) fclist.append(re.sub("FILETYPE", self.files[i][0], t2)) for i in self.dirs.keys(): t1 = re.sub("TEMPLATETYPE", self.name, self.dirs[i][2].fc_dir) t2 = re.sub("FILENAME", i, t1) fclist.append(re.sub("FILETYPE", self.dirs[i][0], t2)) fclist.sort() newfc="\n".join(fclist) return newfc def generate_user_sh(self): newsh = "" if self.type not in ( TUSER, XUSER, AUSER, LUSER, EUSER): return newsh roles = "" for role in self.roles: roles += " %s_r" % role if roles != "": roles += " system_r" if self.type == EUSER: tmp = re.sub("TEMPLATETYPE", self.name, script.eusers) else: tmp = re.sub("TEMPLATETYPE", self.name, script.users) newsh += re.sub("ROLES", roles, tmp) if self.type == RUSER: for u in self.transition_users: tmp = re.sub("TEMPLATETYPE", self.name, script.admin_trans) newsh += re.sub("USER", u, tmp) if self.type == LUSER: newsh += re.sub("TEMPLATETYPE", self.name, script.min_login_user_default_context) else: newsh += re.sub("TEMPLATETYPE", self.name, script.x_login_user_default_context) return newsh def generate_sh(self): temp = re.sub("TEMPLATETYPE", self.file_name, script.compile) if self.type == EUSER: newsh = re.sub("TEMPLATEFILE", "my%s" % self.file_name, temp) else: newsh = re.sub("TEMPLATEFILE", self.file_name, temp) if self.program != "": newsh += re.sub("FILENAME", self.program, script.restorecon) if self.initscript != "": newsh += re.sub("FILENAME", self.initscript, script.restorecon) for i in self.files.keys(): newsh += re.sub("FILENAME", i, script.restorecon) for i in self.dirs.keys(): newsh += re.sub("FILENAME", i, script.restorecon) for i in self.in_tcp[PORTS] + self.out_tcp[PORTS]: if self.find_port(i,"tcp") == None: t1 = re.sub("PORTNUM", "%d" % i, script.tcp_ports) newsh += re.sub("TEMPLATETYPE", self.name, t1) for i in self.in_udp[PORTS]: if self.find_port(i,"udp") == None: t1 = re.sub("PORTNUM", "%d" % i, script.udp_ports) newsh += re.sub("TEMPLATETYPE", self.name, t1) newsh += self.generate_user_sh() return newsh def write_te(self, out_dir): if self.type == EUSER: tefile = "%s/my%s.te" % (out_dir, self.file_name) else: tefile = "%s/%s.te" % (out_dir, self.file_name) fd = open(tefile, "w") fd.write(self.generate_te()) fd.close() return tefile def write_sh(self, out_dir): if self.type == EUSER: shfile = "%s/my%s.sh" % (out_dir, self.file_name) else: shfile = "%s/%s.sh" % (out_dir, self.file_name) fd = open(shfile, "w") fd.write(self.generate_sh()) fd.close() os.chmod(shfile, 0750) return shfile def write_if(self, out_dir): if self.type == EUSER: iffile = "%s/my%s.if" % (out_dir, self.file_name) else: iffile = "%s/%s.if" % (out_dir, self.file_name) fd = open(iffile, "w") fd.write(self.generate_if()) fd.close() return iffile def write_fc(self,out_dir): if self.type == EUSER: fcfile = "%s/my%s.fc" % (out_dir, self.file_name) else: fcfile = "%s/%s.fc" % (out_dir, self.file_name) fd = open(fcfile, "w") fd.write(self.generate_fc()) fd.close() return fcfile def gen_writeable(self): fd = os.popen("rpm -qlf %s" % self.program) for f in fd.read().split(): for b in self.DEFAULT_DIRS: if b == "/etc": continue if f.startswith(b): if os.path.isfile(f): self.add_file(f) else: self.add_dir(f) fd.close() if os.path.isfile("/var/run/%s.pid" % self.name): self.add_file("/var/run/%s.pid" % self.name) if os.path.isfile("/etc/rc.d/init.d/%s" % self.name): self.set_init_script("/etc/rc\.d/init\.d/%s" % self.name) def gen_symbols(self): if self.type not in APPLICATIONS: return fd = os.popen("nm -D %s | grep U" % self.program) for s in fd.read().split(): for b in self.symbols: if s.startswith(b): exec "self.%s" % self.symbols[b] fd.close() def generate(self, out_dir = "."): self.write_te(out_dir) self.write_if(out_dir) self.write_fc(out_dir) self.write_sh(out_dir) out = "Created the following files in:\n%s/\n" % out_dir out += "%s.te # %s\n" % (self.file_name, _("Type Enforcement file")) out += "%s.if # %s\n" % (self.file_name, _("Interface file")) out += "%s.fc # %s\n" % (self.file_name, _("File Contexts file")) out += "%s.sh # %s\n" % (self.file_name, _("Setup Script")) return out def errorExit(error): sys.stderr.write("%s: " % sys.argv[0]) sys.stderr.write("%s\n" % error) sys.stderr.flush() sys.exit(1) def test(): import tempfile tmpdir = tempfile.mkdtemp(prefix="polgen_") mypolicy = policy("myrwho", DAEMON) mypolicy.set_program("/usr/sbin/myrwhod") mypolicy.set_init_script("/etc/init.d/myrwhod") mypolicy.add_dir("/etc/nasd") mypolicy.set_in_tcp(1, 0, 0, "513") mypolicy.set_use_uid(True) mypolicy.set_use_tmp(True) mypolicy.set_use_syslog(True) mypolicy.set_use_pam(True) mypolicy.add_dir("/var/run/myrwho") mypolicy.add_dir("/var/lib/myrwho") print mypolicy.generate(tmpdir) mypolicy = policy("mywhois", USER) mypolicy.set_program("/usr/bin/jwhois") mypolicy.set_out_tcp(0, "43,63,4321") mypolicy.set_out_udp(0, "43,63,4321") mypolicy.add_dir("/var/cache/jwhois") mypolicy.set_transition_users(["staff_u"]) print mypolicy.generate(tmpdir) mypolicy = policy("mytuser", TUSER) mypolicy.set_admin_roles(["mydbadm"]) mypolicy.add_boolean("allow_mytuser_setuid", "Allow mytuser users to run setuid applications") print mypolicy.generate(tmpdir) mypolicy = policy("mycgi", CGI) mypolicy.set_program("/var/www/cgi-bin/cgi") mypolicy.set_in_tcp(1, 0, 0, "512, 55000-55000") mypolicy.set_in_udp(1, 0, 0, "1513") mypolicy.set_use_uid(True) mypolicy.set_use_tmp(False) mypolicy.set_use_syslog(True) mypolicy.set_use_pam(True) mypolicy.set_out_tcp(0,"8000") print mypolicy.generate(tmpdir) mypolicy = policy("myinetd", INETD) mypolicy.set_program("/usr/bin/mytest") mypolicy.set_in_tcp(1, 0, 0, "513") mypolicy.set_in_udp(1, 0, 0, "1513") mypolicy.set_use_uid(True) mypolicy.set_use_tmp(True) mypolicy.set_use_syslog(True) mypolicy.set_use_pam(True) mypolicy.add_file("/var/lib/mysql/mysql.sock") mypolicy.add_file("/var/run/rpcbind.sock") mypolicy.add_file("/var/run/daemon.pub") mypolicy.add_file("/var/log/daemon.log") mypolicy.add_dir("/var/lib/daemon") mypolicy.add_dir("/etc/daemon") mypolicy.add_dir("/etc/daemon/special") mypolicy.set_use_uid(True) mypolicy.set_use_syslog(True) mypolicy.set_use_pam(True) mypolicy.set_use_audit(True) mypolicy.set_use_dbus(True) mypolicy.set_use_terminal(True) mypolicy.set_use_mail(True) mypolicy.set_out_tcp(0,"8000") print mypolicy.generate(tmpdir) mypolicy = policy("mydbus", DBUS) mypolicy.set_program("/usr/libexec/mydbus") mypolicy.set_in_tcp(1, 0, 0, "513") mypolicy.set_in_udp(1, 0, 0, "1513") mypolicy.set_use_uid(True) mypolicy.set_use_tmp(True) mypolicy.set_use_syslog(True) mypolicy.set_use_pam(True) print mypolicy.generate(tmpdir) mypolicy = policy("myxuser", XUSER) mypolicy.set_in_tcp(1, 1, 1, "28920") mypolicy.set_in_udp(0, 0, 1, "1513") mypolicy.set_transition_domains(["mozilla"]) print mypolicy.generate(tmpdir) mypolicy = policy("myuser", USER) mypolicy.set_program("/usr/bin/myuser") mypolicy.set_in_tcp(1, 0, 0, "513") mypolicy.set_in_udp(1, 0, 0, "1513") mypolicy.set_use_uid(True) mypolicy.set_use_tmp(True) mypolicy.set_use_syslog(True) mypolicy.set_use_pam(True) mypolicy.add_file("/var/lib/myuser/myuser.sock") mypolicy.set_out_tcp(0,"8000") mypolicy.set_transition_users(["unconfined_u", "staff_u"]) print mypolicy.generate(tmpdir) mypolicy = policy("mysandbox", SANDBOX) mypolicy.set_out_udp(0, "993") print mypolicy.generate("/tmp") mypolicy = policy("mydbadm", RUSER) mypolicy.set_admin_domains(["postgresql", "mysql"]) print mypolicy.generate(tmpdir) os.chdir(tmpdir) rc, output=commands.getstatusoutput("make -f /usr/share/selinux/devel/Makefile") print output sys.exit(os.WEXITSTATUS(rc)) import os, sys, getopt, socket, random, fcntl def usage(msg): print _(""" %s sepolgen [ -n moduleName ] [ -m ] [ -t type ] [ executable | Name ] valid Types: """) % msg keys=poltype.keys() for i in keys: print "\t%s\t%s" % (i, poltype[i]) sys.exit(-1) if __name__ == '__main__': setype = DAEMON name = None try: gopts, cmds = getopt.getopt(sys.argv[1:], "ht:mn:", ["type=", "mount", "test", "name=", "help"]) for o, a in gopts: if o == "-t" or o == "--type": try: if int(a) not in poltype: usage ("invalid type %s" % a ) except: usage ("invalid type %s" % a ) setype = int(a) if o == "-m" or o == "--mount": mount_ind = True if o == "-n" or o == "--name": name = a if o == "-h" or o == "--help": usage("") if o == "--test": test() sys.exit(0) except getopt.error, error: usage(_("Options Error %s ") % error.msg) if len(cmds) == 0: usage(_("Executable or Name required")) try: if not name: name = os.path.basename(cmds[0]).replace("-","_") cmd = cmds[0] mypolicy = policy(name, setype) if setype not in USERS + [ SANDBOX ]: mypolicy.set_program(cmd) if setype in APPLICATIONS: mypolicy.gen_writeable() mypolicy.gen_symbols() print mypolicy.generate() sys.exit(0) except ValueError, e: usage(e)
