관리-도구
편집 파일: seobject.cpython-39.pyc
a z f�� � @ sJ d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlT dZ d dl Z d dl m Z d dl mZ d dlZzFd dlZi Zejdk r�ded< eje fd d ie�d di��ZejZW nH zd dlZeejd < W n$ ey� d dlZeejd < Y n0 Y n0 d dl Z i Z e e d < e e d< e e d< e e d< e e d< e e d< e e d< e e d< e e d< e!e d< e!e d< e!e d< e"e d< e"e d< e"e d< e#e d < e#e d < e#e d < e$e d < e$e d < e$e d!< e%e d"< e%e d#< e%e d$< dddddd d d"d%�Z&d&d&d'd(d)d*d+d,d d-� Z'z(d dl(Z(e(�)e(�*� � G d.d/� d/�Z+W n& e,ef�yL G d0d/� d/�Z+Y n0 G d1d2� d2�Z-d3d4� Z.dTd6d7�Z/dUd8d9�Z0G d:d;� d;�Z1G d<d=� d=e1�Z2G d>d?� d?e1�Z3G d@dA� dAe1�Z4G dBdC� dCe1�Z5G dDdE� dEe1�Z6G dFdG� dGe1�Z7G dHdI� dIe1�Z8G dJdK� dKe1�Z9G dLdM� dMe1�Z:G dNdO� dOe1�Z;G dPdQ� dQe1�Z<G dRdS� dSe1�Z=dS )V� N)�*zselinux-python)� SELinuxPolicy)� TypeQuery)� T�unicode� localedirz/usr/share/locale�fallback�_� � all files�a� regular filez--�fz-d� directory�dz-c�character device�cz-b� block device�bz-s�socket�sz-l�l� symbolic link�pz-p� named pipe)r r r r r r r r �any�block�char�dir�file�symlink�pipe) r r r r r r r r r c @ s8 e Zd Zdd� Zd dd�Zddd�Zdd � Zd d � Zd S )�loggerc C s t �� | _g | _g | _d S �N)�audit� audit_open�audit_fd�log_list�log_change_list��self� r+ �,/usr/lib/python3.9/site-packages/seobject.py�__init__n s �logger.__init__r c C s� d} ||kr || d 7 }d} ||kr4|| d 7 }d} ||krL|| d 7 }d} | j �| jtjtjd t|�|d||||||dddg� d S )N�-�sename�,�role�ranger r )r' �appendr& r$ ZAUDIT_ROLE_ASSIGN�sys�argv�str) r* �msg�namer0 �serole�serange� oldsename� oldserole� oldserange�sepr+ r+ r, �logs s � logger.logc C s< | j �| jtjtjd t|�|d||||||dddg� d S )Nr r )r' r4 r& r$ ZAUDIT_ROLE_REMOVEr5 r6 r7 � r* r8 r9 r0 r: r; r< r= r> r+ r+ r, � log_remove� s �logger.log_removec C s& | j �| jtjt|�ddddg� d S )N�semanager )r( r4 r& r$ Z AUDIT_USER_MAC_CONFIG_CHANGEr7 �r* r8 r+ r+ r, � log_change� s �logger.log_changec C sH | j D ]}tj||g � q| jD ]}tj||g � q"g | _ g | _d S r# )r' r$ Zaudit_log_semanage_messager( Zaudit_log_user_comm_message)r* �successr r+ r+ r, �commit� s � logger.commitN)r r r r r r r )r r r r r r r ��__name__� __module__� __qualname__r- r@ rC rG rJ r+ r+ r+ r, r" l s r" c @ s8 e Zd Zdd� Zd dd�Zddd�Zdd � Zd d � Zd S )r" c C s g | _ d S r# )r' r) r+ r+ r, r- � s r. r c C s� d||f } |dkr | d| 7 } |dkr4| d| 7 } |dkrH| d| 7 } |dkr\| d| 7 } |dkrx|d urx| d| 7 } |dkr�|d ur�| d| 7 } | j �| � d S ) Nz %s name=%sr z sename=z oldsename=z role=z old_role=z MLSRange=z old_MLSRange=�r' r4 ) r* r8 r9 r0 r: r; r< r= r> �messager+ r+ r, r@ � s rA c C s | � ||||||||� d S r# )r@ rB r+ r+ r, rC � s rD c C s | j �d| � d S )Nz %srP rF r+ r+ r, rG � s rH c C s4 |dkrd}nd}| j D ]}t�tj|| � qd S )N� z Successful: zFailed: )r' �syslogZLOG_INFO)r* rI rQ r r+ r+ r, rJ � s rK N)r r r r r r r )r r r r r r r rL r+ r+ r+ r, r" � s c @ s0 e Zd Zd dd�Zd dd�Zdd� Zdd � Zd S ) � nullloggerr c C s d S r# r+ rB r+ r+ r, r@ � s znulllogger.logc C s d S r# r+ rB r+ r+ r, rC � s znulllogger.log_removec C s d S r# r+ rF r+ r+ r, rG � s znulllogger.log_changec C s d S r# r+ )r* rI r+ r+ r, rJ � s znulllogger.commitN)r r r r r r r )r r r r r r r )rM rN rO r@ rC rG rJ r+ r+ r+ r, rT � s rT c C sX d}d}|d | d }|d | d }|d | d d | d }t �d | d | �S ) Nzs[0-9]*zc[0-9]*z(\.z)?z(\,z)*z(-z(:�^�$)�re�search)�rawZ sensitivity�categoryZ cat_range� categoriesZregr+ r+ r, �validate_level� s r\ rR c C s` d}|dkrd|| f }n| }t �|�\}}|dkr8| S |rL|t|�d � }|dkrX| S |S d S �Nza:b:c:rR �%s%sr r )�selinuxZ selinux_raw_to_trans_context�len)rY �prepend�filler�context�rc�transr+ r+ r, � translate� s rf c C s` d}|dkrd|| f }n| }t �|�\}}|dkr8| S |rL|t|�d � }|dkrX| S |S d S r] )r_ Z selinux_trans_to_raw_contextr` )re ra rb rc rd rY r+ r+ r, � untranslate� s rg c @ sf e Zd ZdZdZdZdZddd�Zdd� Zdd� Z d d � Z d d � Z d d� Z dd� Z dd� Zdd� ZdS )�semanageRecordsFNc C s� |r t |t�r|| _n|| _t|dd�| _| js>t|dd�| _| �| j�| _t� � \}}| jdksl| j|krvt � | _ n,t � | j� t�dt�� | jf � t� | _ d S )N�noreloadF�storer r^ )� isinstancer7 rj �args�getattrri � get_handle�shr_ �selinux_getpolicytyper" �mylog�sepolicyZload_store_policyZselinux_set_policy_rootZ selinux_pathrT )r* rl rd Z localstorer+ r+ r, r- � s zsemanageRecords.__init__c C s | | _ d S r# )ri )r* �loadr+ r+ r, � set_reload s zsemanageRecords.set_reloadc C s� t jr t jS t� }|s"ttd���t jsB|dkrBt||t� |t _t |�s^t |� ttd���t |�}|t k r�t |� ttd���t |�}|dk r�t |� ttd���t|�atdk r�t |� ttd���|t _t jS )Nz Could not create semanage handler z:SELinux policy is not managed or store cannot be accessed.zCannot read policy store.r z'Could not establish semanage connectionz!Could not test MLS enabled status)rh �handleZsemanage_handle_create� ValueErrorr � transactionZsemanage_select_storeZSEMANAGE_CON_DIRECTrj Zsemanage_is_managedZsemanage_handle_destroyZsemanage_access_checkZSEMANAGE_CAN_READZsemanage_connectZsemanage_mls_enabled�is_mls_enabled)r* rj ru rd r+ r+ r, rn s2 zsemanageRecords.get_handlec C s t td���d S �NzNot yet implemented�rv r r) r+ r+ r, � deleteall3 s zsemanageRecords.deleteallc C s$ t jrttd���| �� dt _d S )Nz(Semanage transaction already in progressT)rh rw rv r �beginr) r+ r+ r, �start6 s zsemanageRecords.startc C s, t jr d S t| j�}|dk r(ttd���d S )Nr z$Could not start semanage transaction)rh rw Zsemanage_begin_transactionro rv r �r* rd r+ r+ r, r| < s zsemanageRecords.beginc C s t td���d S ry rz r) r+ r+ r, � customizedC s zsemanageRecords.customizedc C sV t jr d S | jr t| jd� t| j�}|dk rF| j�d� tt d���| j�d� d S )Nr z%Could not commit semanage transactionrR ) rh rw ri Zsemanage_set_reloadro Zsemanage_commitrq rJ rv r r~ r+ r+ r, rJ F s zsemanageRecords.commitc C s$ t jsttd���dt _| �� d S )Nz$Semanage transaction not in progressF)rh rw rv r rJ r) r+ r+ r, �finishR s zsemanageRecords.finish)N)rM rN rO rw ru rj rl r- rt rn r{ r} r| r rJ r� r+ r+ r+ r, rh � s $ rh c @ sP e Zd Zddd�Zdd� Zdd� Zdd d �Zd d � Zdd� Zdd� Z dd� Z dS )� moduleRecordsNc C s t �| |� d S r# �rh r- �r* rl r+ r+ r, r- [ s zmoduleRecords.__init__c C s g }t | j�\}}}|dk r(ttd���t|�D ]�}t||�}t| j|�\}}|dk rbttd���t| j|�\}}|dk r�ttd���t| j|�\}} |dk r�ttd���t | j|�\}} |dk r�ttd���|� ||| | f� q0|j dd� d d � |j d d� d � |S ) Nr � Could not list SELinux moduleszCould not get module namez Could not get module enabledz Could not get module priorityz Could not get module lang_extc S s | d S )Nr r+ ��tr+ r+ r, �<lambda>z � z'moduleRecords.get_all.<locals>.<lambda>T)�key�reversec S s | d S �Nr r+ r� r+ r+ r, r� { r� )r� ) Zsemanage_module_list_allro rv r r3 �semanage_module_list_nthZ semanage_module_info_get_nameZ semanage_module_info_get_enabledZ!semanage_module_info_get_priorityZ!semanage_module_info_get_lang_extr4 �sort) r* r rd �mlist�number�i�modr9 Zenabled�priorityZlang_extr+ r+ r, �get_all^ s, zmoduleRecords.get_allc C s0 | � � }t|�dkrg S dd� dd� |D �D �S )Nr c S s g | ]}d |d �qS )z-d %sr r+ ��.0�xr+ r+ r, � <listcomp>� r� z,moduleRecords.customized.<locals>.<listcomp>c S s g | ]}|d dkr|�qS �rR r r+ �r� r� r+ r+ r, r� � r� )r� r` )r* �allr+ r+ r, r ~ s zmoduleRecords.customizedrR r c C s� | � � }t|�dkrd S |r:tdtd�td�td�f � |D ]D}|d dkrXtd�}n |r^q>d}td |d |d |d |f � q>d S ) Nr z %-25s %-9s %s z Module NameZPriorityZLanguagerR ZDisabledr z%-25s %-9s %-5s %s� r )r� r` �printr )r* �heading� locallistr� r� Zdisabledr+ r+ r, �list� s zmoduleRecords.listc C s` t j�|�s ttd�| ��t| j|�}|dk r@ttd�| ��t| j|�}|dkr\| �� d S )NzModule does not exist: %s r �3Invalid priority %d (needs to be between 1 and 999)) �os�path�existsrv r � semanage_set_default_priorityro Z semanage_module_install_filerJ )r* r r� rd r+ r+ r, �add� s zmoduleRecords.addc C s� |� � D ]�}t| j�\}}|dk r.ttd���t| j||�}|dk rPttd���t| j||�}|dk r|r|ttd�| ��qttd�| ��q| �� d S )Nr zCould not create module keyz Could not set module key namezCould not enable module %szCould not disable module %s)�splitZsemanage_module_key_createro rv r Z semanage_module_key_set_nameZsemanage_module_set_enabledrJ )r* �module�enable�mrd r� r+ r+ r, � set_enabled� s zmoduleRecords.set_enabledc C sj t | j|�}|dk r$ttd�| ��|�� D ]0}t| j|�}|dk r,|dkr,ttd�| ��q,| �� d S )Nr r� ���z*Could not remove module %s (remove failed))r� ro rv r r� �semanage_module_removerJ )r* r� r� rd r� r+ r+ r, �delete� s zmoduleRecords.deletec C s6 dd� dd� | � � D �D �}|D ]}| �|d� q d S )Nc S s g | ] }|d �qS )r r+ r� r+ r+ r, r� � r� z+moduleRecords.deleteall.<locals>.<listcomp>c S s g | ]}|d dkr|�qS r� r+ r� r+ r+ r, r� � r� T)r� r� )r* r r� r+ r+ r, r{ � s zmoduleRecords.deleteall)N)rR r ) rM rN rO r- r� r r� r� r� r� r{ r+ r+ r+ r, r� Y s r� c @ s e Zd Zddd�Zdd� ZdS )�dontauditClassNc C s t �| |� d S r# r� r� r+ r+ r, r- � s zdontauditClass.__init__c C s8 |dvrt td���| �� t| j|dk� | �� d S )N)�on�offz'dontaudit requires either 'on' or 'off'r� )rv r r| Z semanage_set_disable_dontauditro rJ )r* Z dontauditr+ r+ r, �toggle� s zdontauditClass.toggle)N)rM rN rO r- r� r+ r+ r+ r, r� � s r� c @ sH e Zd Zddd�Zdd� Zdd� Zdd d �Zd d � Zdd� Zdd� Z dS )�permissiveRecordsNc C s t �| |� d S r# r� r� r+ r+ r, r- � s zpermissiveRecords.__init__c C sn g }t | j�\}}}|dk r(ttd���t|�D ]8}t||�}t|�}|r0|�d�r0|�|� d�d � q0|S )Nr r� Z permissive_rR ) Zsemanage_module_listro rv r r3 r� Zsemanage_module_get_name� startswithr4 r� )r* r rd r� r� r� r� r9 r+ r+ r, r� � s zpermissiveRecords.get_allc C s dd� t | �� �D �S )Nc S s g | ] }d | �qS )z-a %sr+ r� r+ r+ r, r� � r� z0permissiveRecords.customized.<locals>.<listcomp>)�sortedr� r) r+ r+ r, r � s z permissiveRecords.customizedrR r c C s� dd� dd� t �t j�D �D �}t|�dkr0d S |rDtdtd� � | �� }|D ]}||vrPt|� qPt|�dkrvd S |r�tdtd� � |D ] }t|� q�d S )Nc S s g | ] }|d �qS )r9 r+ )r� �yr+ r+ r, r� � r� z*permissiveRecords.list.<locals>.<listcomp>c S s g | ]}|d r|�qS )Z permissiver+ r� r+ r+ r, r� � r� r z %-25s zBuiltin Permissive TypeszCustomized Permissive Types)rr �infoZTYPEr` r� r r� )r* r� r� r� r r� r+ r+ r, r� � s zpermissiveRecords.listc C sR d| }d| }t | j|t|�|d�}|dkr6| �� |dk rNttd�| ��d S )N� permissive_%sz(typepermissive %s)Zcilr z?Could not set permissive domain %s (module installation failed))Zsemanage_module_installro r` rJ rv r )r* �typer9 Zmodtxtrd r+ r+ r, r� � s zpermissiveRecords.addc C sB |� � D ],}t| jd| �}|dk rttd�| ��q| �� d S )Nr� r z5Could not remove permissive domain %s (remove failed))r� r� ro rv r rJ )r* r9 �nrd r+ r+ r, r� s zpermissiveRecords.deletec C s, | � � }t|�dkr(d�|�}| �|� d S )Nr � )r� r` �joinr� )r* r r� r+ r+ r, r{ s zpermissiveRecords.deleteall)N)rR r ) rM rN rO r- r� r r� r� r� r{ r+ r+ r+ r, r� � s r� c @ s~ e Zd Zd dd�Zdd� Zdd� Zdd � Zd d d �Zd!d d�Zdd� Z dd� Z dd� Z dd� Z d"dd�Z dd� Zd#d d �ZdS )$� loginRecordsNc C s( t �| |� d | _d | _d | _d | _d S r# )rh r- r< r> r0 r; r� r+ r+ r, r- s zloginRecords.__init__c C s� t �|�\}| _| _|dkr d}t| j�}|�| j�\}\}}|�|�\}\}} tdkrn|dkrjt|�}n|}t | j |�\}} |dk r�t t d�| ��|d dkr�zt �|dd � � W n$ t t d�|dd � ��Y n0 n,zt�|� W n t t d�| ��Y n0 t| j �\}} |dk �r4t t d �| ��t| j | |�}|dk �r\t t d �| ��tdk�r�|dk�r�t| j | |�}|dk �r�t t d �| ��t| j | |�}|dk �r�t t d �| ��t| j | | �}|dk �r�t t d �| ��t| � t| � d S )Nr Zuser_urR r � Could not create a key for %s�%z Linux Group %s does not existz Linux User %s does not existz%Could not create login mapping for %s�Could not set name for %s� Could not set MLS range for %sz!Could not set SELinux user for %sz"Could not add login mapping for %s)r_ �getseuserbynamer< r> �seluserRecordsrl �getrx rg �semanage_seuser_key_createro rv r �grp�getgrnam�pwd�getpwnamZsemanage_seuser_createZsemanage_seuser_set_name� semanage_seuser_set_mlsrange�semanage_seuser_set_sename� semanage_seuser_modify_local�semanage_seuser_key_free�semanage_seuser_free) r* r9 r0 r; �rec�userrecr3 rd r= r: �k�ur+ r+ r, �__add sP zloginRecords.__addc C sz zL| � � | �|�r4ttd�| � | �|||� n| �|||� | �� W n( tyt } z|�W Y d }~n d }~0 0 d S )Nz:Login mapping for %s is already defined, modifying instead)r| �_loginRecords__existsr� r �_loginRecords__modify�_loginRecords__addrJ rv �r* r9 r0 r; �errorr+ r+ r, r� S s zloginRecords.addc C s\ t | j|�\}}|dk r(ttd�| ��t| j|�\}}|dk rPttd�| ��t|� |S )Nr r� �2Could not check if login mapping for %s is defined)r� ro rv r �semanage_seuser_existsr� �r* r9 rd r� r� r+ r+ r, �__existsa s zloginRecords.__existsr c C s� t �|�\}| _| _|dkr0|dkr0ttd���t| j�}|�| j�\}\}}|dkrj|�|�\}\}} n|} |dkr~|| _ n|| _ t | j |�\}} |dk r�ttd�| ��t | j | �\}} |dk r�ttd�| ��| s�ttd�| ��t | j | �\}} |dk �rttd�| ��t| �| _t| �| _tdk�rL|dk�rLt| j | t|�� |dk�rlt| j | |� || _n| j| _t| j | | �}|dk �r�ttd �| ��t| � t| � d S ) Nr zRequires seuser or seranger r� r� �#Login mapping for %s is not definedz Could not query seuser for %srR z%Could not modify login mapping for %s)r_ r� r< r> rv r r� rl r� r; r� ro r� Zsemanage_seuser_query� semanage_seuser_get_mlsrange�semanage_seuser_get_senamerx r� rg r� r0 r� r� r� ) r* r9 r0 r; r� r� r3 rd r= r: r� r� r� r+ r+ r, �__modifym sF zloginRecords.__modifyc C sP z"| � � | �|||� | �� W n( tyJ } z|�W Y d }~n d }~0 0 d S r# )r| r� rJ rv r� r+ r+ r, �modify� s zloginRecords.modifyc C s* t �|�\}| _| _t| j�}|�| j�\}\}}t| j|�\}}|dk rZt t d�| ��t | j|�\}}|dk r�t t d�| ��|s�t t d�| ��t | j|�\}}|dk r�t t d�| ��|s�t t d�| ��t | j|�}|dk r�t t d�| ��t|� t �d�\}| _| _|�| j�\}\}} d S )Nr r� r� r� z<Login mapping for %s is defined in policy, cannot be deletedz%Could not delete login mapping for %sZ __default__)r_ r� r< r> r� rl r� r� ro rv r r� Z semanage_seuser_exists_localZsemanage_seuser_del_localr� r0 r; ) r* r9 r� r� r3 rd r= r� r� r: r+ r+ r, �__delete� s, zloginRecords.__deletec C sL z | � � | �|� | �� W n( tyF } z|�W Y d }~n d }~0 0 d S r# )r| �_loginRecords__deleterJ rv �r* r9 r� r+ r+ r, r� � s zloginRecords.deletec C s| t | j�\}}|dk r"ttd���z,| �� |D ]}| �t|�� q0| �� W n( tyv } z|�W Y d }~n d }~0 0 d S �Nr � Could not list login mappings)�semanage_seuser_list_localro rv r r| r� �semanage_seuser_get_namerJ �r* rd �ulistr� r� r+ r+ r, r{ � s zloginRecords.deleteallc C s� i }t �� d | _t�| j�D ]z\}}}|| jkr |D ]`}zHt|d | �}|�� �� �d�}|� � |d |d |d f||< W q6 t y� Y q60 q6q |S )Nz/logins�/�:rR r� r ) r_ Zselinux_policy_root� logins_pathr� �walk�open�read�rstripr� �close� IndexError)r* �ddictr� �dirs�filesr9 �fdr� r+ r+ r, �get_all_logins� s zloginRecords.get_all_loginsr c C sl i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���| jD ]"}t|�}t|�t|�df||< qD|S )Nr r� r ) r� ro r� Zsemanage_seuser_listrv r r� r� r� )r* r� r� rd r� r9 r+ r+ r, r� � s zloginRecords.get_allc C sp g }| � d�}t|�� �D ]P}|| d rP|�d|| d || d |f � q|�d|| d |f � q|S )NTrR z-a -s %s -r '%s' %sr z -a -s %s %s�r� r� �keysr4 �r* r r� r� r+ r+ r, r � s & zloginRecords.customizedrR c C s@ | � |�}| �� }t|�� �}t|�� �}t|�dkrFt|�dkrFd S tdkr�|rvtdtd�td�td�td�f � |D ]0}|| }td||d t|d �|d f � qzt|�r�td | j � |D ]0}|| }td||d t|d �|d f � q�nB|�rtd td�td�f � |D ] }td ||| d f � �q d S ) Nr rR z %-20s %-20s %-20s %s z Login Name� SELinux Userz MLS/MCS RangeZServicez%-20s %-20s %-20s %sr� z Local customization in %sz %-25s %-25s z %-25s %-25s) r� r� r� r� r` rx r� r rf r� ) r* r� r� r� ZldictZlkeysr� r� r� r+ r+ r, r� s* $&(zloginRecords.list)N)r r )r r )r )rR r )rM rN rO r- r� r� r� r� r� r� r� r{ r� r� r r� r+ r+ r+ r, r� s 6 2 r� c @ s� e Zd Zd dd�Zdd� Zdd� Zdd � Zd d � Zg d d d fd d�Zg d d d fdd�Z dd� Z dd� Z dd� Z d dd�Z dd� Zd!d d �ZdS )"r� Nc C s t �| |� d S r# r� r� r+ r+ r, r- s zseluserRecords.__init__c C s� t | j|�\}}|dk r(ttd�| ��t| j|�\}}|dk rPttd�| ��t| j|�\}}|dk rxttd�| ��t|�}t| j|�}t|� t |� ||fS )Nr r� �-Could not check if SELinux user %s is defined�Could not query user for %s) �semanage_user_key_createro rv r �semanage_user_exists�semanage_user_query�semanage_user_get_mlsrange�semanage_user_get_roles�semanage_user_key_free�semanage_user_free)r* r9 rd r� r� r� r; r: r+ r+ r, r� " s zseluserRecords.getc C s t dkr4|dkrd}nt|�}|dkr,d}nt|�}t|�dk rPttd�| ��t| j|�\}}|dk rxttd�| ��t| j�\}}|dk r�ttd�| ��t| j||�}|dk r�ttd�| ��|D ]0} t | j|| �}|dk r�ttd �j | |d ���q�t dk�rTt | j||�}|dk �r,ttd �| ��t | j||�}|dk �rTttd �| ��t | j||�}|dk �r�ttd �j | |d���t| j|�\}} |dk �r�ttd�| ��t| j||�}|dk �r�ttd�| ��t|� t|� | jjd|d�|�|d� d S )NrR r �s0z%You must add at least one role for %sr r� z$Could not create SELinux user for %sr� z$Could not add role {role} for {name})r2 r9 r� z Could not set MLS level for %sz(Could not add prefix {prefix} for {role})r2 �prefixz Could not extract key for %sz Could not add SELinux user %s�seuserr1 )r0 r: r; )rx rg r` rv r r� ro Zsemanage_user_createZsemanage_user_set_name�semanage_user_add_role�format�semanage_user_set_mlsrange�semanage_user_set_mlslevel�semanage_user_set_prefixZsemanage_user_key_extract�semanage_user_modify_localr r rq r@ r� ) r* r9 �roles�selevelr; r rd r� r� �rr� r+ r+ r, r� 2 sR zseluserRecords.__addc C s� zT| � � | �|�r8ttd�| � | �|||||� n| �|||||� | �� W n4 ty� } z | j�d� |�W Y d }~n d }~0 0 d S )Nz5SELinux user %s is already defined, modifying insteadr ) r| �_seluserRecords__existsr� r �_seluserRecords__modify�_seluserRecords__addrJ rv rq �r* r9 r r r; r r� r+ r+ r, r� i s zseluserRecords.addc C s\ t | j|�\}}|dk r(ttd�| ��t| j|�\}}|dk rPttd�| ��t|� |S )Nr r� r� )r� ro rv r r� r r� r+ r+ r, r� v s zseluserRecords.__existsr c C s8 d}d}d� |�}|dkrXt|�dkrX|dkrX|dkrXtdkrLttd���n ttd���t| j|�\} } | dk r�ttd�| ��t| j| �\} } | dk r�ttd�| ��| s�ttd �| ��t| j| �\} } | dk r�ttd �| ��t | �}t | j| �\} } | dk�rd� | �}tdk�r6|dk�r6t | j| t |�� tdk�r\|dk�r\t | j| t |�� |dk�rtt| j| |� t|�dk�r�| D ]}||v�r�t| |� �q�|D ] }|| v�r�t| j| |� �q�t| j| | �} | dk �r�ttd �| ��t| � t| � d � |�� �}d � |�� �}| jjd ||||||d� d S )Nr r� r rR z&Requires prefix, roles, level or rangezRequires prefix or rolesr� r� � SELinux user %s is not definedr� z Could not modify SELinux user %sr1 r )r0 r< r: r; r= r> )r� r` rx rv r r� ro r� r r r r rg r r Zsemanage_user_del_roler r r r r� rq r@ )r* r9 r r r; r r= r> Znewrolesrd r� r� r� �rlistr r2 r+ r+ r, r� � sV $ zseluserRecords.__modifyc C s` z&| � � | �|||||� | �� W n4 tyZ } z | j�d� |�W Y d }~n d }~0 0 d S r� )r| r rJ rv rq r r+ r+ r, r� � s zseluserRecords.modifyc C s8 t | j|�\}}|dk r(ttd�| ��t| j|�\}}|dk rPttd�| ��|sdttd�| ��t| j|�\}}|dk r�ttd�| ��|s�ttd�| ��t| j|�\}}|dk r�ttd�| ��t|�}t| j|�\}}d� |�}t | j|�}|dk �rttd�| ��t |� t |� | j jd |||d � d S ) Nr r� r� r z7SELinux user %s is defined in policy, cannot be deletedr� r1 z Could not delete SELinux user %sr )r< r> r= )r� ro rv r r� Zsemanage_user_exists_localr r r r� Zsemanage_user_del_localr r rq rC ) r* r9 rd r� r� r� r> r r= r+ r+ r, r� � s2 zseluserRecords.__deletec C sX z | � � | �|� | �� W n4 tyR } z | j�d� |�W Y d }~n d }~0 0 d S r� )r| �_seluserRecords__deleterJ rv rq r� r+ r+ r, r� � s zseluserRecords.deletec C s� t | j�\}}|dk r"ttd���z,| �� |D ]}| �t|�� q0| �� W n4 ty� } z | j�d� |�W Y d }~n d }~0 0 d S r� ) �semanage_user_list_localro rv r r| r �semanage_user_get_namerJ rq r� r+ r+ r, r{ � s zseluserRecords.deleteallr c C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���| jD ]^}t|�}t| j|�\}}|dk rxttd�| ��d�|�}t |�t |�t |�|f|t|�< qD|S )Nr z Could not list SELinux usersz Could not list roles for user %sr� ) r ro r� Zsemanage_user_listrv r r r r� Zsemanage_user_get_prefixZsemanage_user_get_mlslevelr )r* r� r� rd r� r9 r r r+ r+ r, r� � s "zseluserRecords.get_allc C s� g }| � d�}t|�� �D ]f}|| d s6|| d rf|�d|| d || d || d |f � q|�d|| d |f � q|S )NTrR r� z-a -L %s -r %s -R '%s' %sr z -a -R '%s' %sr� r� r+ r+ r, r s 0 zseluserRecords.customizedrR c C s | � |�}t|�dkrd S t|�� �}tdkr�|r|tddtd�td�td�f � tdtd�td �td �td �td �f � |D ]B}td ||| d t|| d �t|| d �|| d f � q�n>|r�tdtd�td �f � |D ] }td||| d f � q�d S )Nr rR z %-15s %-10s %-10s %-30sr ZLabelingzMLS/z%-15s %-10s %-10s %-30s %s r� ZPrefixz MCS Levelz MCS Rangez SELinux Rolesz%-15s %-10s %-10s %-30s %sr� r z %-15s %s z%-15s %s)r� r` r� r� rx r� r rf �r* r� r� r� r� r� r+ r+ r, r� s *BzseluserRecords.list)N)r )rR r )rM rN rO r- r� r r� r r r� r r� r{ r� r r� r+ r+ r+ r, r� s 7 8 ! r� c @ s� e Zd Zg Zd dd�Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dd� Z dd� Z dd� Z d!dd�Zd"dd�Zdd � Zd#d d �ZdS )$� portRecordsNc C sH t �| |� z$ttt�tjd��d d �| _W n tyB Y n0 d S )NZ port_typer �types)rh r- r� rr r� � ATTRIBUTE� valid_types� RuntimeErrorr� r+ r+ r, r- 1 s $ zportRecords.__init__c C s� t tttd�}||�� v r$|| }n ttd���|dkrDttd���t|t�r\|� dd�}n|f}t |�dkr�t |d � }}nt |d �}t |d �}|dkr�ttd ���t | j |||�\}} |dk r�ttd �j||d ���| |||fS ) N)ZtcpZudpZsctpZdccpz0Protocol has to be one of udp, tcp, dccp or sctpr zPort is requiredr/ rR r � z Invalid Portz)Could not create a key for {proto}/{port}��proto�port)ZSEMANAGE_PROTO_TCPZSEMANAGE_PROTO_UDPZSEMANAGE_PROTO_SCTPZSEMANAGE_PROTO_DCCPr� rv r rk r7 r� r` �intZsemanage_port_key_createro r ) r* r# r" Z protocols�proto_dZports�high�lowrd r� r+ r+ r, �__genkey8 s. � zportRecords.__genkeyc C s> t dkr |dkrd}nt|�}|dkr2ttd���t�|�}|| jvrVttd�| ��| �||�\}}}}t| j �\} } | dk r�ttd�j ||d���t | |� t | ||� t | j �\} } | dk r�ttd �j ||d���t| j | d �} | dk �rttd �j ||d���t| j | d �} | dk �r4ttd �j ||d���t| j | |�} | dk �rbttd�j ||d���t dk�r�|dk�r�t| j | |�} | dk �r�ttd�j ||d���t| j | | �} | dk �r�ttd�j ||d���t| j || �} | dk �r ttd�j ||d���t| � t|� t| � | j�d|t�|�d d ||f � d S )NrR r r �Type is required�'Type %s is invalid, must be a port typer z(Could not create port for {proto}/{port}r! z+Could not create context for {proto}/{port}�system_uz5Could not set user in port context for {proto}/{port}�object_rz5Could not set role in port context for {proto}/{port}z5Could not set type in port context for {proto}/{port}z;Could not set mls fields in port context for {proto}/{port}z-Could not set port context for {proto}/{port}z!Could not add port {proto}/{port}z8resrc=port op=add lport=%s proto=%s tcontext=%s:%s:%s:%s)rx rg rv r rr �get_real_type_namer �_portRecords__genkeyZsemanage_port_createro r Zsemanage_port_set_protoZsemanage_port_set_range�semanage_context_create�semanage_context_set_user�semanage_context_set_role�semanage_context_set_type�semanage_context_set_mlsZsemanage_port_set_con�semanage_port_modify_local�semanage_context_free�semanage_port_key_free�semanage_port_freerq rG r �getprotobyname) r* r# r" r; r� r� r% r' r& rd r �conr+ r+ r, r� X sR zportRecords.__addc C sX | � � | �||�r<ttd�j||d�� | �||||� n| �||||� | �� d S )Nz6Port {proto}/{port} already defined, modifying insteadr! )r| �_portRecords__existsr� r r �_portRecords__modify�_portRecords__addrJ )r* r# r" r; r� r+ r+ r, r� � s zportRecords.addc C sN | � ||�\}}}}t| j|�\}}|dk rBttd�j||d���t|� |S )Nr �1Could not check if port {proto}/{port} is definedr! )r. �semanage_port_existsro rv r r r6 � r* r# r" r� r% r' r& rd r� r+ r+ r, r� � s zportRecords.__existsc C s� |dkr2|dkr2t dkr&ttd���n ttd���t�|�}|rZ|| jvrZttd�| ��| �||�\}}}}t| j|�\} } | dk r�ttd�j ||d���| s�ttd �j ||d���t | j|�\} } | dk r�ttd �j ||d���t | �} t dk�r|dk�rd }nt | j| t |�� |dk�r0t| j| |� t| j|| �} | dk �r^ttd �j ||d���t|� t| � | j�d |t�|�dd||f � d S )Nr rR �Requires setype or serange�Requires setyper* r r= r! �"Port {proto}/{port} is not definedz#Could not query port {proto}/{port}r z$Could not modify port {proto}/{port}z;resrc=port op=modify lport=%s proto=%s tcontext=%s:%s:%s:%sr+ r, )rx rv r rr r- r r. r> ro r Zsemanage_port_query�semanage_port_get_conr3 rg r2 r4 r6 r7 rq rG r r8 ) r* r# r" r; �setyper� r% r' r& rd r� r r9 r+ r+ r, r� � s: zportRecords.__modifyc C s$ | � � | �||||� | �� d S r# )r| r; rJ )r* r# r" r; rD r+ r+ r, r� � s zportRecords.modifyc C s� t | j�\}}|dk r"ttd���| �� |D ]�}t|�}t|�}t|�}t|�}d||f }| � ||�\} } }}|dk r�ttd�| ��t | j| �}|dk r�ttd�| ��t | � ||kr�|}| j � d|t�|�f � q.| �� d S )Nr zCould not list the ports�%s-%sr� z Could not delete the port %s�&resrc=port op=delete lport=%s proto=%s)�semanage_port_list_localro rv r r| �semanage_port_get_proto�semanage_port_get_proto_str�semanage_port_get_low�semanage_port_get_highr. �semanage_port_del_localr6 rq rG r r8 rJ ) r* rd �plistr# r" � proto_strr' r& Zport_strr� r% r+ r+ r, r{ � s* zportRecords.deleteallc C s� | � ||�\}}}}t| j|�\}}|dk rBttd�j||d���|s\ttd�j||d���t| j|�\}}|dk r�ttd�j||d���|s�ttd�j||d���t| j|�}|dk r�ttd�j||d���t|� | j � d|t � |�f � d S )Nr r= r! rB z;Port {proto}/{port} is defined in policy, cannot be deletedz$Could not delete port {proto}/{port}rF ) r. r> ro rv r r Zsemanage_port_exists_localrL r6 rq rG r r8 r? r+ r+ r, r� � s zportRecords.__deletec C s | � � | �||� | �� d S r# )r| �_portRecords__deleterJ )r* r# r" r+ r+ r, r� s zportRecords.deleter c C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���| jD ]N}t|�}t|�}t|�}t |�}t |�} t |�} t |�} ||f|| | | f< qD|S )Nr �Could not list ports) rG ro rM �semanage_port_listrv r rC �semanage_context_get_type�semanage_context_get_mlsrH rI rJ rK ) r* r� r� rd r# r9 �ctype�levelr" rN r' r& r+ r+ r, r� s zportRecords.get_allc C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���| jD ]�}t|�}t|�}t|�}t |�}t |�} t |�} ||f|� � vr�g |||f< | | kr�|||f � d| � qD|||f � d| | f � qD|S )Nr rP z%dz%d-%d)rG ro rM rQ rv r rC rR rH rI rJ rK r� r4 ) r* r� r� rd r# r9 rT r" rN r' r& r+ r+ r, �get_all_by_type! s& zportRecords.get_all_by_typec C s� g }| � d�}t|�� �D ]�}|d |d kr6|d nd|d |d f }|| d r�|�d|| d || d |d |f � q|�d|| d |d |f � q|S )NTr rR rE z-a -t %s -r '%s' -p %s %sr� z-a -t %s -p %s %sr� �r* r r� r� r# r+ r+ r, r 9 s , ,"zportRecords.customizedrR c C s� | � |�}t|�dkrd S t|�� �}|rHtdtd�td�td�f � |D ]J}d| }|d|| d 7 }|| dd � D ]}|d | 7 }q|t|� qLd S ) Nr z%-30s %-8s %s zSELinux Port TypeZProto� Port Numberz %-30s %-8s �%srR �, %s)rV r` r� r� r� r �r* r� r� r� r� r� r� r r+ r+ r, r� D s zportRecords.list)N)r )r )rR r )rM rN rO r r- r. r< r� r: r; r� r{ rO r� r� rV r r� r+ r+ r+ r, r - s : * r c @ s� e Zd Zg Zd dd�Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dd� Z dd� Z dd� Z d!dd�Zd"dd�Zdd � Zd#d d �ZdS )$� ibpkeyRecordsNc C sT t �| |� z6ttt�| j��dgd�}tdd� |�� D ��| _ W n Y n0 d S )NZ ibpkey_type��attrsc s s | ]}t |�V qd S r# �r7 r� r+ r+ r, � <genexpr>[ r� z)ibpkeyRecords.__init__.<locals>.<genexpr>) rh r- r r rr �get_store_policyrj r� �resultsr �r* rl �qr+ r+ r, r- W s zibpkeyRecords.__init__c C s� |dkrt td���|�d�}t|�dkr>t|d d� }}n t|d d�}t|d d�}|dkrnt td���t| j|||�\}}|dk r�t td�j||d ���||||fS ) Nr zSubnet Prefix is requiredr/ rR r r z Invalid Pkeyz1Could not create a key for {subnet_prefix}/{pkey}�� subnet_prefix�pkey)rv r r� r` r$ Zsemanage_ibpkey_key_createro r )r* rg rf Zpkeysr& r' rd r� r+ r+ r, r( _ s zibpkeyRecords.__genkeyc C s t dkr |dkrd}nt|�}|dkr2ttd���t�|�}|| jvrVttd�| ��| �||�\}}}}t| j �\}} |dk r�ttd�j ||d���t | j | |� t | ||� t | j �\}} |dk r�ttd �j ||d���t| j | d �}|dk �r ttd �j ||d���t| j | d �}|dk �r8ttd �j ||d���t| j | |�}|dk �rfttd�j ||d���t dk�r�|dk�r�t| j | |�}|dk �r�ttd�j ||d���t| j | | �}|dk �r�ttd�j ||d���t| j || �}|dk �rttd�j ||d���t| � t|� t| � d S )NrR r r r) �)Type %s is invalid, must be a ibpkey typer z2Could not create ibpkey for {subnet_prefix}/{pkey}re z3Could not create context for {subnet_prefix}/{pkey}r+ z?Could not set user in ibpkey context for {subnet_prefix}/{pkey}r, z?Could not set role in ibpkey context for {subnet_prefix}/{pkey}z?Could not set type in ibpkey context for {subnet_prefix}/{pkey}zECould not set mls fields in ibpkey context for {subnet_prefix}/{pkey}z7Could not set ibpkey context for {subnet_prefix}/{pkey}z+Could not add ibpkey {subnet_prefix}/{pkey})rx rg rv r rr r- r �_ibpkeyRecords__genkeyZsemanage_ibpkey_createro r Z!semanage_ibpkey_set_subnet_prefixZsemanage_ibpkey_set_ranger/ r0 r1 r2 r3 Zsemanage_ibpkey_set_con� semanage_ibpkey_modify_localr5 �semanage_ibpkey_key_free�semanage_ibpkey_free) r* rg rf r; r� r� r' r& rd r r9 r+ r+ r, r� r sP zibpkeyRecords.__addc C sX | � � | �||�r<ttd�j||d�� | �||||� n| �||||� | �� d S )Nz@ibpkey {subnet_prefix}/{pkey} already defined, modifying insteadre )r| �_ibpkeyRecords__existsr� r r �_ibpkeyRecords__modify�_ibpkeyRecords__addrJ )r* rg rf r; r� r+ r+ r, r� � s zibpkeyRecords.addc C sN | � ||�\}}}}t| j|�\}}|dk rBttd�j||d���t|� |S )Nr �;Could not check if ibpkey {subnet_prefix}/{pkey} is definedre )ri �semanage_ibpkey_existsro rv r Zformnatrk �r* rg rf r� r' r& rd r� r+ r+ r, r� � s zibpkeyRecords.__existsc C sl |dkr2|dkr2t dkr&ttd���n ttd���t�|�}|rZ|| jvrZttd�| ��| �||�\}}}}t| j|�\}} |dk r�ttd�j ||d���| s�ttd �j ||d���t | j|�\}} |dk r�ttd �j ||d���t | �} t dk�r|dk�rt | j| t |�� |dk�r*t| j| |� t| j|| �}|dk �rXttd �j ||d���t|� t| � d S ) Nr rR r@ rA rh r rp re �,ibpkey {subnet_prefix}/{pkey} is not definedz-Could not query ibpkey {subnet_prefix}/{pkey}z.Could not modify ibpkey {subnet_prefix}/{pkey})rx rv r rr r- r ri rq ro r Zsemanage_ibpkey_query�semanage_ibpkey_get_conr3 rg r2 rj rk rl ) r* rg rf r; rD r� r' r& rd r� r r9 r+ r+ r, r� � s4 zibpkeyRecords.__modifyc C s$ | � � | �||||� | �� d S r# )r| rn rJ )r* rg rf r; rD r+ r+ r, r� � s zibpkeyRecords.modifyc C s� t | j�\}}|dk r"ttd���| �� |D ]�}t| j|�\}}t|�}t|�}d||f }| �||�\}}}}|dk r�ttd�| ��t | j|�}|dk r�ttd�| ��t |� q.| � � d S )Nr zCould not list the ibpkeysrE r� z Could not delete the ibpkey %s) �semanage_ibpkey_list_localro rv r r| �!semanage_ibpkey_get_subnet_prefix�semanage_ibpkey_get_low�semanage_ibpkey_get_highri �semanage_ibpkey_del_localrk rJ ) r* rd rM �ibpkeyrf r' r& Zpkey_strr� r+ r+ r, r{ � s" zibpkeyRecords.deleteallc C s� | � ||�\}}}}t| j|�\}}|dk rBttd�j||d���|s\ttd�j||d���t| j|�\}}|dk r�ttd�j||d���|s�ttd�j||d���t| j|�}|dk r�ttd�j||d���t|� d S )Nr rp re rs zEibpkey {subnet_prefix}/{pkey} is defined in policy, cannot be deletedz.Could not delete ibpkey {subnet_prefix}/{pkey}) ri rq ro rv r r Z semanage_ibpkey_exists_localry rk rr r+ r+ r, r� � s zibpkeyRecords.__deletec C s | � � | �||� | �� d S r# )r| �_ibpkeyRecords__deleterJ )r* rg rf r+ r+ r, r� s zibpkeyRecords.deleter c C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���| jD ]X}t|�}t|�}|dkrbqDt|�}t | j|�\}}t |�} t |�} ||f|| | |f< qD|S )Nr �Could not list ibpkeysZreserved_ibpkey_t) ru ro rM �semanage_ibpkey_listrv r rt rR rS rv rw rx ) r* r� r� rd rz r9 rT rU rf r' r& r+ r+ r, r� s" zibpkeyRecords.get_allc C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���| jD ]�}t|�}t|�}t| j|�\}}t |�}t |�} ||f|� � vr�g |||f< || kr�|||f � d| � qD|||f � d|| f � qD|S )Nr r| �0x%xz 0x%x-0x%x) ru ro rM r} rv r rt rR rv rw rx r� r4 ) r* r� r� rd rz r9 rT rf r' r& r+ r+ r, rV - s$ z ibpkeyRecords.get_all_by_typec C s� g }| � d�}t|�� �D ]�}|d |d kr6|d nd|d |d f }|| d r�|�d|| d || d |d |f � q|�d|| d |d |f � q|S )NTr rR rE z-a -t %s -r '%s' -x %s %sr� z-a -t %s -x %s %sr� rW r+ r+ r, r D s , ,"zibpkeyRecords.customizedrR c C s� | � |�}|�� }t|�dkr"d S |rDtdtd�td�td�f � t|�D ]J}d| }|d|| d 7 }|| dd � D ]}|d | 7 }q|t|� qLd S ) Nr �%-30s %-18s %s zSELinux IB Pkey TypeZ Subnet_Prefixz Pkey Number� %-30s %-18s rY rR rZ �rV r� r` r� r r� r[ r+ r+ r, r� P s zibpkeyRecords.list)N)r )r )rR r )rM rN rO r r- ri ro r� rm rn r� r{ r{ r� r� rV r r� r+ r+ r+ r, r\ S s 8 & r\ c @ s� e Zd Zg Zd dd�Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dd� Z dd� Z dd� Z d!dd�Zd"dd�Zdd � Zd#d d �ZdS )$�ibendportRecordsNc C sT t �| |� z6ttt�| j��dgd�}tdd� |�� D ��| _ W n Y n0 d S )NZibendport_typer] c s s | ]}t |�V qd S r# r_ r� r+ r+ r, r` g r� z,ibendportRecords.__init__.<locals>.<genexpr>) rh r- r r rr ra rj �setrb r rc r+ r+ r, r- c s zibendportRecords.__init__c C sr |dkrt td���t|�}|dks,|dk r8t td���t| j||�\}}|dk rht td�j||d���|||fS ) Nr zIB device name is required� rR zInvalid Port Numberr z=Could not create a key for ibendport {ibdev_name}/{ibendport}�� ibdev_name� ibendport)rv r r$ Z semanage_ibendport_key_createro r )r* r� r� r# rd r� r+ r+ r, r( k s zibendportRecords.__genkeyc C s t dkr |dkrd}nt|�}|dkr2ttd���t�|�}|| jvrVttd�| ��| �||�\}}}t| j �\}}|dk r�ttd�j ||d���t | j ||� t ||� t | j �\}} |dk r�ttd �j ||d���t| j | d �}|dk �rttd �j ||d���t| j | d �}|dk �r4ttd �j ||d���t| j | |�}|dk �rbttd�j ||d���t dk�r�|dk�r�t| j | |�}|dk �r�ttd�j ||d���t| j || �}|dk �r�ttd�j ||d���t| j ||�}|dk �r ttd�j ||d���t| � t|� t|� d S )NrR r r r) �-Type %s is invalid, must be an ibendport typer z2Could not create ibendport for {ibdev_name}/{port}�r� r# z/Could not create context for {ibendport}/{port}r+ z?Could not set user in ibendport context for {ibdev_name}/{port}r, z?Could not set role in ibendport context for {ibdev_name}/{port}z?Could not set type in ibendport context for {ibdev_name}/{port}zECould not set mls fields in ibendport context for {ibdev_name}/{port}z7Could not set ibendport context for {ibdev_name}/{port}z+Could not add ibendport {ibdev_name}/{port})rx rg rv r rr r- r �_ibendportRecords__genkeyZsemanage_ibendport_createro r Z!semanage_ibendport_set_ibdev_nameZsemanage_ibendport_set_portr/ r0 r1 r2 r3 Zsemanage_ibendport_set_con� semanage_ibendport_modify_localr5 �semanage_ibendport_key_free�semanage_ibendport_free) r* r� r� r; r� r� r# rd r r9 r+ r+ r, r� y sP zibendportRecords.__addc C sX | � � | �||�r<ttd�j|td�� | �||||� n| �||||� | �� d S )Nz@ibendport {ibdev_name}/{port} already defined, modifying insteadr� ) r| �_ibendportRecords__existsr� r r r# �_ibendportRecords__modify�_ibendportRecords__addrJ )r* r� r� r; r� r+ r+ r, r� � s zibendportRecords.addc C sL | � ||�\}}}t| j|�\}}|dk r@ttd�j||d���t|� |S )Nr z;Could not check if ibendport {ibdev_name}/{port} is definedr� )r� �semanage_ibendport_existsro rv r r r� �r* r� r� r� r# rd r� r+ r+ r, r� � s zibendportRecords.__existsc C sj |dkr2|dkr2t dkr&ttd���n ttd���t�|�}|rZ|| jvrZttd�| ��| �||�\}}}t| j|�\}}|dk r�ttd�j ||d���|s�ttd �j ||d���t | j|�\}} |dk r�ttd �j ||d���t | �} t dk�r|dk�rt | j| t |�� |dk�r(t| j| |� t| j|| �}|dk �rVttd �j ||d���t|� t| � d S ) Nr rR r@ rA r� r �@Could not check if ibendport {ibdev_name}/{ibendport} is definedr� �1ibendport {ibdev_name}/{ibendport} is not definedz2Could not query ibendport {ibdev_name}/{ibendport}z3Could not modify ibendport {ibdev_name}/{ibendport})rx rv r rr r- r r� r� ro r Zsemanage_ibendport_query�semanage_ibendport_get_conr3 rg r2 r� r� r� ) r* r� r� r; rD r� r# rd r� r r9 r+ r+ r, r� � s4 zibendportRecords.__modifyc C s$ | � � | �||||� | �� d S r# )r| r� rJ )r* r� r� r; rD r+ r+ r, r� � s zibendportRecords.modifyc C s� t | j�\}}|dk r"ttd���| �� |D ]�}t| j|�\}}t|�}| �t|�|�\}}}|dk r~ttd�j ||d���t | j|�}|dk r�ttd�j ||d���t |� q.| � � d S )Nr z Could not list the ibendportsz.Could not create a key for {ibdev_name}/{port}r� z2Could not delete the ibendport {ibdev_name}/{port}) � semanage_ibendport_list_localro rv r r| �!semanage_ibendport_get_ibdev_name�semanage_ibendport_get_portr� r7 r � semanage_ibendport_del_localr� rJ )r* rd rM r� r� r# r� r+ r+ r, r{ � s zibendportRecords.deleteallc C s� | � ||�\}}}t| j|�\}}|dk r@ttd�j||d���|sZttd�j||d���t| j|�\}}|dk r�ttd�j||d���|s�ttd�j||d���t| j|�}|dk r�ttd�j||d���t|� d S )Nr r� r� r� zJibendport {ibdev_name}/{ibendport} is defined in policy, cannot be deletedz3Could not delete ibendport {ibdev_name}/{ibendport}) r� r� ro rv r r Z semanage_ibendport_exists_localr� r� r� r+ r+ r, r� s zibendportRecords.__deletec C s | � � | �||� | �� d S r# )r| �_ibendportRecords__deleterJ )r* r� r� r+ r+ r, r� s zibendportRecords.deleter c C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���| jD ]N}t|�}t|�}|dkrbqDt|�}t | j|�\}}t |�} ||f|| |f< qD|S )Nr �Could not list ibendportsZreserved_ibendport_t) r� ro rM �semanage_ibendport_listrv r r� rR rS r� r� ) r* r� r� rd r� r9 rT rU r� r# r+ r+ r, r� s zibendportRecords.get_allc C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���| jD ]^}t|�}t|�}t| j|�\}}t |�}||f|� � vr�g |||f< |||f � d| � qD|S )Nr r� r~ ) r� ro rM r� rv r r� rR r� r� r� r4 ) r* r� r� rd r� r9 rT r� r# r+ r+ r, rV 0 s z ibendportRecords.get_all_by_typec C s� g }| � d�}t|�� �D ]d}|| d rZ|�d|| d || d |d |d f � q|�d|| d |d |d f � q|S )NTrR z-a -t %s -r '%s' -z %s %sr z-a -t %s -z %s %sr� r� r+ r+ r, r C s 0&zibendportRecords.customizedrR c C s� | � |�}|�� }t|�dkr"d S |rDtdtd�td�td�f � t|�D ]J}d| }|d|| d 7 }|| dd � D ]}|d | 7 }q|t|� qLd S ) Nr r zSELinux IB End Port TypezIB Device NamerX r� rY rR rZ r� r[ r+ r+ r, r� N s zibendportRecords.list)N)r )r )rR r )rM rN rO r r- r� r� r� r� r� r� r{ r� r� r� rV r r� r+ r+ r+ r, r� _ s 7 & r� c @ s~ e Zd Zg Zd dd�Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dd� Z dd� Z dd� Z d dd�Zdd� Zd d d �ZdS )!� nodeRecordsNc C sR t �| |� ddg| _z$ttt�tjd��d d �| _W n tyL Y n0 d S )N�ipv4Zipv6Z node_typer r ) rh r- �protocolr� rr r� r r r r� r+ r+ r, r- a s $ znodeRecords.__init__c C s� |}|}d}|dkr t td���t|�dks8|d dkrdt�|| �}t|j�}t|j�}d|j }z| j � |�}W n t td���Y n0 zt � |�}W n( |dkr�t j }n t td���Y n0 ||||fS )Nr zNode Address is requiredr r� zipv%dzUnknown or missing protocolr� )rv r r` � ipaddressZ ip_networkr7 Znetwork_addressZnetmask�versionr� �indexr r8 Z IPPROTO_IPIP) r* �addr�maskr� ZnewaddrZnewmaskZ newprotocolr� Zaudit_protocolr+ r+ r, �validatei s* znodeRecords.validatec C sf | � |||�\}}}}tdkr4|dkr,d}nt|�}|dkrHttd���t�|�}|| jvrlttd�| ��t| j |||�\}}|dk r�ttd�| ��t | j �\}} |dk r�ttd�| ��t | |� t | j | ||�}t | j �\}} |dk r�ttd �| ��t| j | ||�}|dk �r(ttd �| ��t| j | d �}|dk �rPttd �| ��t| j | d �}|dk �rxttd�| ��t| j | |�}|dk �r�ttd�| ��tdk�r�|dk�r�t| j | |�}|dk �r�ttd�| ��t| j | | �}|dk �rttd�| ��t| j || �}|dk �r,ttd�| ��t| � t|� t| � | j�d|||d d ||f � d S )NrR r r z SELinux node type is required�'Type %s is invalid, must be a node typer �Could not create key for %sz Could not create addr for %s� Could not create context for %szCould not set mask for %sr+ z)Could not set user in addr context for %sr, z)Could not set role in addr context for %sz)Could not set type in addr context for %sz/Could not set mls fields in addr context for %sz!Could not set addr context for %szCould not add addr %szCresrc=node op=add laddr=%s netmask=%s proto=%s tcontext=%s:%s:%s:%s)r� rx rg rv r rr r- r �semanage_node_key_createro Zsemanage_node_createZsemanage_node_set_protoZsemanage_node_set_addrr/ Zsemanage_node_set_maskr0 r1 r2 r3 Zsemanage_node_set_con�semanage_node_modify_localr5 �semanage_node_key_free�semanage_node_freerq rG ) r* r� r� r" r; rT � audit_protord r� �noder9 r+ r+ r, r� � s^ znodeRecords.__addc C sX | � � | �|||�r:ttd�| � | �|||||� n| �|||||� | �� d S )Nz*Addr %s already defined, modifying instead)r| �_nodeRecords__existsr� r �_nodeRecords__modify�_nodeRecords__addrJ )r* r� r� r" r; rT r+ r+ r, r� � s znodeRecords.addc C sv | � |||�\}}}}t| j|||�\}}|dk rBttd�| ��t| j|�\}}|dk rjttd�| ��t|� |S )Nr r� �%Could not check if addr %s is defined)r� r� ro rv r �semanage_node_existsr� �r* r� r� r" r� rd r� r� r+ r+ r, r� � s znodeRecords.__existsc C s� | � |||�\}}}}|dkr2|dkr2ttd���t�|�}|rZ|| jvrZttd�| ��t| j|||�\}}|dk r�ttd�| ��t| j|�\}} |dk r�ttd�| ��| s�ttd�| ��t | j|�\}} |dk r�ttd�| ��t | �} t d k�r|dk�rt | j| t |�� |dk�r0t| j| |� t| j|| �}|dk �rXttd �| ��t|� t| � | j�d |||d d ||f � d S )Nr r@ r� r r� r� �Addr %s is not definedzCould not query addr %srR zCould not modify addr %szFresrc=node op=modify laddr=%s netmask=%s proto=%s tcontext=%s:%s:%s:%sr+ r, )r� rv r rr r- r r� ro r� Zsemanage_node_query�semanage_node_get_conrx r3 rg r2 r� r� r� rq rG ) r* r� r� r" r; rD r� rd r� r� r� r9 r+ r+ r, r� � s8 znodeRecords.__modifyc C s& | � � | �|||||� | �� d S r# )r| r� rJ )r* r� r� r" r; rD r+ r+ r, r� s znodeRecords.modifyc C s | � |||�\}}}}t| j|||�\}}|dk rBttd�| ��t| j|�\}}|dk rjttd�| ��|s~ttd�| ��t| j|�\}}|dk r�ttd�| ��|s�ttd�| ��t| j|�}|dk r�ttd�| ��t|� | j � d|||f � d S )Nr r� r� r� z/Addr %s is defined in policy, cannot be deletedzCould not delete addr %sz1resrc=node op=delete laddr=%s netmask=%s proto=%s) r� r� ro rv r r� Zsemanage_node_exists_localZsemanage_node_del_localr� rq rG r� r+ r+ r, r� s& znodeRecords.__deletec C s" | � � | �|||� | �� d S r# )r| �_nodeRecords__deleterJ )r* r� r� r" r+ r+ r, r� , s znodeRecords.deletec C sp t | j�\}}|dk r"ttd���| �� |D ]4}| �t| j|�d t| j|�d | jt |� � q.| � � d S )Nr z!Could not deleteall node mappingsrR ) �semanage_node_list_localro rv r r| r� �semanage_node_get_addr�semanage_node_get_maskr� �semanage_node_get_protorJ )r* rd Znlistr� r+ r+ r, r{ 1 s 2znodeRecords.deleteallr c C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���| jD ]`}t|�}t| j|�}t| j|�}| j t |� }t |�t |�t |�t|�f||d |d |f< qD|S )Nr zCould not list addrsrR )r� ro �ilistZsemanage_node_listrv r r� r� r� r� r� �semanage_context_get_user�semanage_context_get_rolerR rS ) r* r� r� rd r� r9 r� r� r" r+ r+ r, r� ; s 0znodeRecords.get_allc C s� g }| � d�}t|�� �D ]p}|| d r`|�d|d |d || d || d |d f � q|�d|d |d || d |d f � q|S )NTr z -a -M %s -p %s -t %s -r '%s' %srR r� r z-a -M %s -p %s -t %s %sr� r� r+ r+ r, r M s 6,znodeRecords.customizedrR c C s� | � |�}t|�dkrd S t|�� �}|r6tdd � tr�|D ]n}d}|D ]}|d t|� }qJtd|d |d |d || d || d || d t|| d d �f � q>nF|D ]@}td |d |d |d || d || d || d f � q�d S ) Nr z%-18s %-18s %-5s %-5s )z IP AddressZNetmask�Protocol�Contextr � z %-18s %-18s %-5s %s:%s:%s:%s rR r� r Fz%-18s %-18s %-5s %s:%s:%s )r� r` r� r� r� rx r7 rf )r* r� r� r� r� r� �val�fieldsr+ r+ r, r� W s PznodeRecords.list)N)r )rR r )rM rN rO r r- r� r� r� r� r� r� r� r� r{ r� r r� r+ r+ r+ r, r� ] s "B ( r� c @ sr e Zd Zd dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zdd� Z dd� Z dd� Z d dd�Z dd� Z d dd�ZdS ) �interfaceRecordsNc C s t �| |� d S r# r� r� r+ r+ r, r- l s zinterfaceRecords.__init__c C s t dkr |dkrd}nt|�}|dkr2ttd���t| j|�\}}|dk rZttd�| ��t| j�\}}|dk r�ttd�| ��t| j||�}t| j�\}}|dk r�ttd�| ��t | j|d �}|dk r�ttd �| ��t | j|d �}|dk �rttd �| ��t | j||�}|dk �r*ttd �| ��t dk�rf|dk�rft | j||�}|dk �rfttd�| ��t | j||�}|dk �r�ttd�| ��t| j||�}|dk �r�ttd�| ��t| j||�}|dk �r�ttd�| ��t|� t|� t|� | j�d|d d ||f � d S )NrR r r �SELinux Type is requiredr r� z!Could not create interface for %sr� r+ z.Could not set user in interface context for %sr, z.Could not set role in interface context for %sz.Could not set type in interface context for %sz4Could not set mls fields in interface context for %sz&Could not set interface context for %sz$Could not set message context for %szCould not add interface %sz4resrc=interface op=add netif=%s tcontext=%s:%s:%s:%s)rx rg rv r �semanage_iface_key_createro Zsemanage_iface_createZsemanage_iface_set_namer/ r0 r1 r2 r3 Zsemanage_iface_set_ifconZsemanage_iface_set_msgcon�semanage_iface_modify_localr5 �semanage_iface_key_free�semanage_iface_freerq rG )r* � interfacer; rT rd r� �ifacer9 r+ r+ r, r� o sT zinterfaceRecords.__addc C sL | � � | �|�r2ttd�| � | �|||� n| �|||� | �� d S )Nz/Interface %s already defined, modifying instead)r| �_interfaceRecords__existsr� r �_interfaceRecords__modify�_interfaceRecords__addrJ )r* r� r; rT r+ r+ r, r� � s zinterfaceRecords.addc C s\ t | j|�\}}|dk r(ttd�| ��t| j|�\}}|dk rPttd�| ��t|� |S )Nr r� �*Could not check if interface %s is defined)r� ro rv r �semanage_iface_existsr� �r* r� rd r� r� r+ r+ r, r� � s zinterfaceRecords.__existsc C s> |dkr |dkr t td���t| j|�\}}|dk rDt td�| ��t| j|�\}}|dk rlt td�| ��|s�t td�| ��t| j|�\}}|dk r�t td�| ��t|�}tdkr�|dkr�t| j|t |�� |dkr�t | j||� t | j||�}|dk �rt td �| ��t |� t |� | j�d |d d ||f � d S ) Nr r@ r r� r� �Interface %s is not definedz Could not query interface %srR z Could not modify interface %sz7resrc=interface op=modify netif=%s tcontext=%s:%s:%s:%sr+ r, )rv r r� ro r� Zsemanage_iface_query�semanage_iface_get_ifconrx r3 rg r2 r� r� r� rq rG ) r* r� r; rD rd r� r� r� r9 r+ r+ r, r� � s0 zinterfaceRecords.__modifyc C s" | � � | �|||� | �� d S r# )r| r� rJ )r* r� r; rD r+ r+ r, r� � s zinterfaceRecords.modifyc C s� t | j|�\}}|dk r(ttd�| ��t| j|�\}}|dk rPttd�| ��|sdttd�| ��t| j|�\}}|dk r�ttd�| ��|s�ttd�| ��t| j|�}|dk r�ttd�| ��t|� | j� d| � d S )Nr r� r� r� z4Interface %s is defined in policy, cannot be deletedz Could not delete interface %sz"resrc=interface op=delete netif=%s) r� ro rv r r� Zsemanage_iface_exists_localZsemanage_iface_del_localr� rq rG r� r+ r+ r, r� � s$ zinterfaceRecords.__deletec C s | � � | �|� | �� d S r# )r| �_interfaceRecords__deleterJ )r* r� r+ r+ r, r� � s zinterfaceRecords.deletec C sN t | j�\}}|dk r"ttd���| �� |D ]}| �t|�� q.| �� d S )Nr z(Could not delete all interface mappings)�semanage_iface_list_localro rv r r| r� �semanage_iface_get_namerJ )r* rd r� r� r+ r+ r, r{ s zinterfaceRecords.deleteallr c C sz i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���| jD ]0}t|�}t|�t|�t |�t |�f|t |�< qD|S )Nr zCould not list interfaces) r� ro r� Zsemanage_iface_listrv r r� r� r� rR rS r� )r* r� r� rd r� r9 r+ r+ r, r� s &zinterfaceRecords.get_allc C sp g }| � d�}t|�� �D ]P}|| d rP|�d|| d || d |f � q|�d|| d |f � q|S )NTr z-a -t %s -r '%s' %sr� z -a -t %s %sr� r� r+ r+ r, r s & zinterfaceRecords.customizedrR c C s� | � |�}t|�dkrd S t|�� �}|rBtdtd�td�f � tr�|D ]@}td||| d || d || d t|| d d �f � qJn6|D ]0}td ||| d || d || d f � q�d S ) Nr z %-30s %s zSELinux Interfacer� z%-30s %s:%s:%s:%s rR r� r Fz%-30s %s:%s:%s )r� r` r� r� r� r rx rf r r+ r+ r, r� & s @zinterfaceRecords.list)N)r )rR r )rM rN rO r- r� r� r� r� r� r� r� r{ r� r r� r+ r+ r+ r, r� j s : " r� c @ s� e Zd Zg Zd(dd�Zdd� Zdd� Zdd � Zd)d d �Zd d� Z d*dd�Z d+dd�Z dd� Z dd� Z dd� Zdd� Zd d � Zd d � Zd,d!d"�Zd#d$� Zd-d&d'�ZdS ).�fcontextRecordsNc C sv t �| |� zLttt�tjd��d d �| _| jttt�tjd��d d �7 _W n tyj Y n0 i | _i | _ d| _ z`t t � � d�}|�� D ]<}|�� }t|�dkr�q�|�d�r�q�|�� \}}|| j|< q�|�� W n ty� Y n0 zjt t �� d�}|�� D ]F}|�� }t|�dk�r(�q |�d��r8�q |�� \}}|| j |< �q |�� W n t�yp Y n0 d S )NZ file_typer r Z device_nodeFr �#)rh r- r� rr r� r r r �equiv� equiv_dist� equal_indr� r_ � selinux_file_context_subs_path� readlines�stripr` r� r� r� �IOErrorZ#selinux_file_context_subs_dist_path)r* rl r� r� �target� substituter+ r+ r, r- : sF , zfcontextRecords.__init__c C s� | j r�t�� }d| }t|d�}| j�� D ] }|�d|| j| f � q*|�� z t� |t� |�t j � W n Y n0 t� ||� d| _ t �| � d S )Nz%s.tmp�wz%s %s F)r� r_ r� r� r� r� �writer� r� �chmod�stat�ST_MODE�renamerh rJ )r* Z subs_fileZtmpfiler� r� r+ r+ r, rJ ` s zfcontextRecords.commitc C sD | � � |dkr,|d dkr,ttd�| ��|dkrP|d dkrPttd�| ��|| j�� v r�ttd�| � || j|< d| _| j�dt � d|d �t � d |d �f � | � � d S | � |� | j| j fD ]6}|D ],}|�|d �r�ttd �|||| f ��q�q�| j�d t � d|d �t � d |d �f � || j|< d| _| � � d S ) Nr� ���z=Target %s is not valid. Target is not allowed to end with '/'zESubstitute %s is not valid. Substitute is not allowed to end with '/'z:Equivalence class for %s already exists, modifying insteadT�$resrc=fcontext op=modify-equal %s %s�sglobr �tglobz4File spec %s conflicts with equivalency rule '%s %s'z!resrc=fcontext op=add-equal %s %s)r| rv r r� r� r� r� rq rG r$ �audit_encode_nv_stringrJ r� r� r� )r* r� r� �fdictr� r+ r+ r, � add_equalp s* ( ( zfcontextRecords.add_equalc C sj | � � || j�� vr&ttd�| ��|| j|< d| _| j�dt� d|d�t� d|d�f � | � � d S )Nz'Equivalence class for %s does not existTr� r� r r� ) r| r� r� rv r r� rq rG r$ r� rJ )r* r� r� r+ r+ r, � modify_equal� s (z fcontextRecords.modify_equalr+ c C s� t | j�\}}|dk r&ttd�| ��|dkr2d}t| j||�}|dk rXttd�| ��t| j|d�}|dk r~ttd�| ��tdkr�t| j|d �}|dk r�ttd �| ��|S ) Nr r� r r+ z)Could not set user in file context for %sr, z)Could not set role in file context for %srR r �/Could not set mls fields in file context for %s)r/ ro rv r r0 r1 rx r3 )r* r� r rd r9 r+ r+ r, � createcon� s zfcontextRecords.createconc C s� |dks|� d�dkr"ttd���|� d�dkr<ttd���| j| jfD ]J}|D ]@}|�|d �rPt�||| |�}ttd �|||| |f ��qPqHd S ) Nr � r zInvalid file specificationr� r� z)File specification can not include spacesr� zMFile spec %s conflicts with equivalency rule '%s %s'; Try adding '%s' instead)�findrv r r� r� r� rW �sub)r* r� r� r� r� r+ r+ r, r� � s zfcontextRecords.validater c C s� | � |� tdkrt|�}|dkr.ttd���|dkrZt�|�}|| jvrZttd�| ��t| j |t | �\}}|dk r�ttd�| ��t | j �\}}|dk r�ttd�| ��t | j ||�}|dk�r\| � ||�} t| j | |�}|dk r�ttd �| ��tdk�r4|dk�r4t| j | |�}|dk �r4ttd �| ��t| j || �}|dk �r\ttd �| ��t|t | � t| j ||�}|dk �r�ttd �| ��|dk�r�t| � t|� t|� |�s�d }| j�dt�d|d�t| |d||f � d S )NrR r r� �<<none>>�1Type %s is invalid, must be a file or device typer r� z$Could not create file context for %sz)Could not set type in file context for %sr� �!Could not set file context for %sz!Could not add file context for %sr+ z6resrc=fcontext op=add %s ftype=%s tcontext=%s:%s:%s:%sr� r, )r� rx rg rv r rr r- r � semanage_fcontext_key_createro � file_typesZsemanage_fcontext_createZsemanage_fcontext_set_exprr� r2 r3 �semanage_fcontext_set_conZsemanage_fcontext_set_type� semanage_fcontext_modify_localr5 �semanage_fcontext_key_free�semanage_fcontext_freerq rG r$ r� �ftype_to_audit) r* r� r� �ftyper; r rd r� �fcontextr9 r+ r+ r, r� � sN zfcontextRecords.__addc C sV | � � | �||�r8ttd�| � | �|||||� n| �|||||� | �� d S )Nz6File context for %s already defined, modifying instead)r| �_fcontextRecords__existsr� r �_fcontextRecords__modify�_fcontextRecords__addrJ )r* r� r� r� r; r r+ r+ r, r� � s zfcontextRecords.addc C s� t | j|t| �\}}|dk r.ttd�| ��t| j|�\}}|dk rVttd�| ��|s�t| j|�\}}|dk r�ttd�| ��t|� |S )Nr r� �1Could not check if file context for %s is defined)r� ro r� rv r �semanage_fcontext_exists� semanage_fcontext_exists_localr� �r* r� r� rd r� r� r+ r+ r, r� � s zfcontextRecords.__existsc C s� |dkr$|dkr$|dkr$t td���|dvrPt�|�}|| jvrPt td�| ��| �|� t| j|t| �\}}|dk r�t td�| ��t | j|�\}}|dk r�t td�| ��|r�zt | j|�\}} W n" t y� t td�| ��Y n0 nzt | j|�\}}|dk �rt td�| ��|�s.t td �| ��zt | j|�\}} W n$ t �yf t td�| ��Y n0 |d k�rt| �} | d u �r�| �|�} td k�r�|dk�r�t| j| t|�� |dk�r�t| j| |� |dk�r�t| j| |� t| j| | �}|dk �r6t td �| ��n(t| j| d �}|dk �r6t td �| ��t| j|| �}|dk �r^t td �| ��t|� t| � |�sxd}| j�dt� d|d�t | |d||f � d S )Nr z"Requires setype, serange or seuser)r r� r� r r� r z#Could not query file context for %s�"File context for %s is not definedr� rR r� z$Could not modify file context for %sr+ z9resrc=fcontext op=modify %s ftype=%s tcontext=%s:%s:%s:%sr� r, ) rv r rr r- r r� r� ro r� r Zsemanage_fcontext_query�OSErrorr Z semanage_fcontext_query_local�semanage_fcontext_get_conr� rx r3 rg r0 r2 r� r� r� r� rq rG r$ r� r� ) r* r� rD r� r; r rd r� r� r r9 r+ r+ r, r� sf zfcontextRecords.__modifyc C s& | � � | �|||||� | �� d S r# )r| r rJ )r* r� rD r� r; r r+ r+ r, r� L s zfcontextRecords.modifyc C s� t | j�\}}|dk r"ttd���| �� |D ]�}t|�}t|�}t|�}t| j|t | �\}}|dk rxttd�| ��t | j|�}|dk r�ttd�| ��t |� | j � dt�d|d�tt| f � q.i | _d| _| �� d S )Nr z Could not list the file contextsr� z$Could not delete the file context %s�$resrc=fcontext op=delete %s ftype=%sr� T)� semanage_fcontext_list_localro rv r r| �semanage_fcontext_get_expr�semanage_fcontext_get_type� semanage_fcontext_get_type_strr� r� �semanage_fcontext_del_localr� rq rG r$ r� r� �file_type_str_to_optionr� r� rJ )r* rd �flistr r� r� � ftype_strr� r+ r+ r, r{ Q s& (zfcontextRecords.deleteallc C s: || j �� v r>| j �|� d| _| j�dt�d|d� � d S t| j |t | �\}}|dk rlt t d�| ��t | j |�\}}|dk r�t t d�| ��|s�t| j |�\}}|dk r�t t d�| ��|r�t t d�| ��nt t d�| ��t| j |�}|dk �r t t d �| ��t|� | j�d t�d|d�t| f � d S ) NTz!resrc=fcontext op=delete-equal %sr� r r� r z;File context for %s is defined in policy, cannot be deletedr z$Could not delete file context for %sr )r� r� �popr� rq rG r$ r� r� ro r� rv r r r r r� r� r r+ r+ r, r� k s. zfcontextRecords.__deletec C s | � � | �||� | �� d S r# )r| �_fcontextRecords__deleterJ )r* r� r� r+ r+ r, r� � s zfcontextRecords.deleter c C s |rt | j�\}| _n�t| j�\}| _|dk r:ttd���t| j�\}}|dk r\ttd���t | j�\}}|dk r~ttd���| j|7 _| j|7 _i }| jD ]Z}t|�}t|�}t |�} t |�} | r�t | �t | �t | �t| �f||| f< q�| ||| f< q�|S )Nr z Could not list file contextsz1Could not list file contexts for home directoriesz"Could not list local file contexts)r ro r Zsemanage_fcontext_listrv r Z semanage_fcontext_list_homedirsr r r r r� r� rR rS ) r* r� rd Z fchomedirsZfclocalr� r �exprr� r r9 r+ r+ r, r� � s. &zfcontextRecords.get_allc C s� g }| � d�}|�� D ]t}|| r|| d rb|�dt|d || d || d |d f � q|�dt|d || d |d f � qt| j�r�| j�� D ] }|�d| j| |f � q�|S ) NTr z-a -f %s -t %s -r '%s' '%s'rR r� r z-a -f %s -t %s '%s'z -a -e %s %s)r� r� r4 r r` r� )r* r � fcon_dictr� r� r+ r+ r, r � s 4* zfcontextRecords.customizedrR c C s� | � |�}t|�dk�r|r:tdtd�td�td�f � |rH|�� }n t|�� �}|D ]�}|| r�tr�td|d |d || d || d || d t|| d d �f � n6td |d |d || d || d || d f � qXtd |d |d f � qXt| j��rN|�sN|�r&ttd �� | j�� D ] }td|| j| f � �q0t| j ��r�|�rlttd�� | j �� D ] }td|| j | f � �qvd S )Nr z%-50s %-18s %s zSELinux fcontextr� r� z%-50s %-18s %s:%s:%s:%s rR r� r Fz%-50s %-18s %s:%s:%s z%-50s %-18s <<None>>z, SELinux Distribution fcontext Equivalence z%s = %sz% SELinux Local fcontext Equivalence ) r� r` r� r r� r� rx rf r� r� )r* r� r� r Zfkeysr� r� r+ r+ r, r� � s0 H8 zfcontextRecords.list)N)r+ )r r r+ )r r r+ )r )rR r )rM rN rO r r- rJ r� r� r� r� r r� r r r� r{ r r� r� r r� r+ r+ r+ r, r� 6 s$ & 6 C! r� c @ sl e Zd Zddd�Zdd� Zd dd�Zd d � Zd d � Zd d� Zd dd�Z dd� Z dd� Z dd� Z d dd�Z dS ) �booleanRecordsNc C s� t �| |� i | _d| jd< d| jd< d| jd< d| jd< d| jd< d| jd< z t�� \}| _t�� \}}W n g | _d }Y n0 | jd ks�| j|kr�d | _nd | _d S ) NrR ZTRUEr ZFALSEZONZOFF�1�0r TF) rh r- �dictr_ Zsecurity_get_boolean_names�current_booleansrp rj � modify_local)r* rl rd Zptyper+ r+ r, r- � s" zbooleanRecords.__init__c C sN t �|�}t| j|�\}}|dk r2ttd�| ��t| j|�\}}|dk rZttd�| ��|snttd�| ��t| j|�\}}|dk r�ttd�| ��|�� | j v r�t || j |�� � n ttd�d� | j � � � ��| j �r|| jv �rt| j||�}|dk �rttd�| ��t| j||�}|dk �r:ttd �| ��t|� t|� d S ) Nr r� �(Could not check if boolean %s is defined�Boolean %s is not definedz Could not query file context %sz0You must specify one of the following values: %sz, z(Could not set active value of boolean %szCould not modify boolean %s)r_ �selinux_boolean_sub�semanage_bool_key_createro rv r �semanage_bool_existsZsemanage_bool_query�upperr Zsemanage_bool_set_valuer� r� r r Zsemanage_bool_set_activeZsemanage_bool_modify_local�semanage_bool_key_freeZsemanage_bool_free)r* r9 �valuerd r� r� r r+ r+ r, Z__mod� s0 zbooleanRecords.__modFc C s� | � � |r�t|�}|�� �d�D ]j}|�� }t|�dkr<q"z|�d�\}}W n( tyv ttd�j||d���Y n0 | � |�� |�� � q"|� � n | � ||� | � � d S )Nr� r �=z&Bad format {filename}: Record {record})�filename�record) r| r� r� r� r� r` rv r r �_booleanRecords__modr� rJ )r* r9 r% �use_filer� r Zboolnamer� r+ r+ r, r� s zbooleanRecords.modifyc C s� t �|�}t| j|�\}}|dk r2ttd�| ��t| j|�\}}|dk rZttd�| ��|snttd�| ��t| j|�\}}|dk r�ttd�| ��|s�ttd�| ��t| j|�}|dk r�ttd�| ��t |� d S )Nr r� r r z2Boolean %s is defined in policy, cannot be deletedzCould not delete boolean %s) r_ r r! ro rv r r" Zsemanage_bool_exists_localZsemanage_bool_del_localr$ r� r+ r+ r, r� , s$ zbooleanRecords.__deletec C s | � � | �|� | �� d S r# )r| �_booleanRecords__deleterJ �r* r9 r+ r+ r, r� D s zbooleanRecords.deletec C sV t | j�\}| _|dk r$ttd���| �� | jD ]}t|�}| �|� q2| �� d S �Nr zCould not list booleans) �semanage_bool_list_localro �blistrv r r| �semanage_bool_get_namer+ rJ )r* rd �booleanr9 r+ r+ r, r{ I s zbooleanRecords.deleteallr c C s� i }|rt | j�\}| _nt| j�\}| _|dk r>ttd���| jD ]t}g }t|�}|�t|�� | j r�|| j v r�|�t � |�� |�t � |�� n |�|d � |�|d � |||< qD|S r- )r. ro r/ Zsemanage_bool_listrv r r0 r4 Zsemanage_bool_get_valuer r r_ Z security_get_boolean_pendingZsecurity_get_boolean_active)r* r� r� rd r1 r% r9 r+ r+ r, r� V s" zbooleanRecords.get_allc C s t �|�}t�|�S r# )r_ r rr Z boolean_descr, r+ r+ r, �get_descm s zbooleanRecords.get_descc C s t �|�}t�|�S r# )r_ r rr Zboolean_categoryr, r+ r+ r, � get_categoryq s zbooleanRecords.get_categoryc C sF g }| � d�}t|�� �D ]&}|| r|�d|| d |f � q|S )NTz -m -%s %sr� r� r� r+ r+ r, r u s zbooleanRecords.customizedTc C s� t d�t d�f}|rT| �|�}t|�� �D ]$}|| r*td||| d f � q*d S | �|�}t|�dkrnd S |r�tdt d�t d�t d �t d �f � t|�� �D ]>}|| r�td |||| d ||| d | �|�f � q�d S ) Nr� r� z%s=%sr� r z%-30s %s %s %s zSELinux boolean�StateZDefaultZ Descriptionz%-30s (%-5s,%5s) %s)r r� r� r� r� r` r2 )r* r� r� r* Zon_offr� r� r+ r+ r, r� } s $zbooleanRecords.list)N)NF)r )TFF)rM rN rO r- r) r� r+ r� r{ r� r2 r3 r r� r+ r+ r+ r, r � s r )rR )rR )>r� r� r_ r� rW r5 r� r rE ZPROGNAMErr Zsetools.policyrepr Zsetools.typequeryr r� �gettext�kwargs� version_info� translationr� r �builtinsr7 �__dict__� ImportErrorZ __builtin__r rS r� ZSEMANAGE_FCONTEXT_ALLZSEMANAGE_FCONTEXT_REGZSEMANAGE_FCONTEXT_DIRZSEMANAGE_FCONTEXT_CHARZSEMANAGE_FCONTEXT_BLOCKZSEMANAGE_FCONTEXT_SOCKZSEMANAGE_FCONTEXT_LINKZSEMANAGE_FCONTEXT_PIPEr r� r$ Z audit_closer% r" r rT r\ rf rg rh r� r� r� r� r� r r\ r� r� r� r� r r+ r+ r+ r, �<module> s� ��� � � $$ ik C ( M .