관리-도구
편집 파일: __init__.cpython-39.pyc
a ��yeē � @ st d dl Z d dlZd dlZd dlmZ d dlmZ d dlZd dlZd dl Z d dl Z d dl m Z d dl mZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d d lmZ d d lm Z d d l m Z d Z zFd dl Z i Z!ej"d k r�de!d< e j#e fddie!�ddi��Z$e$j Z%W nJ zd dl&Z&e'e&j(d< W n& e)�yV d dl*Z*e+e*j(d< Y n0 Y n0 dZ,dZ-dZ.dZ/dZ0dZ1dZ2dZ3d Z4d Z5d Z6d Z7d Z8d!Z9d"Z:d#Z;d$Z<i Z=d%e=d&< d'e=d(< d)e=d*< d)e=d+< d)e=d,< d-e=d.< d/e=d0< d1e=d2< d3e=d4< d3e=d5< d6e=d7< d6e=d8< d9e=d:< d;e=d<< i Z>e%d=�e>d>< e%d?�e>d@< e%dA�e>dB< e%dC�e>dD< e%dE�e>dF< e%dG�e>dH< e%dI�e>dJ< e%dK�e>dL< i Z?d>e?dM< d@e?dN< dBe?dO< dDe?dP< dFe?dQ< dHe?dR< dJe?dS< dLe?dT< da@daAdaBdaCdaDg aEdaFdaGdaHdaIdaJdaKdaLdaMdaNdaOdaPdaQdaRdaSdaTdaUdaVdaWdaXdUdV� ZYd�dXdY�ZZdZd[� Z[d\d]� Z\d^d_� Z]d`da� Z^d�dbdc�Z_ddde� Z`d�dfdg�Zadhdi� Zbdjdk� Zcdldm� Zddndo� Zedpdq� Zfdrds� Zgdtdu� Zhg fdvdw�Zig fdxdy�Zjdzd{� Zke�l� fd|d}�Zme�l� fd~d�Zne�l� fd�d��Zoe�l� fd�d��Zpd�d�� Zqd�d�� Zrd�d�� Zsd�d�� Ztd�d�� Zud�d�� Zvd�d�� Zwd�d�� Zxd�d�� Zyd�d�� Zzd�d�� Z{d�d�� Z|d�d�� Z}d�d�� Z~d�d�� Zd�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�e�fd�d��Z�d�d�� Z�d�dÄ Z�d�dń Z�d�dDŽ Z�d�dɄ Z�d�d˄ Z�d�d̈́ Z�d�dτ Z�d�d�d҄Z�d�d�dԄZ�d�dք Z�d�d Z�d�dڄ Z�d�d܄ Z�dS )�� N)� BoolQuery)� PortconQuery)� SELinuxPolicy)� ObjClassQuery)� RBACRuleQuery)� RoleQuery)� TERuleQuery)�TypeAttributeQuery)� TypeQuery)� UserQueryzselinux-python)� T�unicode� localedirz/usr/share/locale�fallback�_� � r � � � � �allowZ auditallowZ neverallowZ dontaudit�source�target�permlist�classZ transitionZ role_allowZetc_tz/etcZtmp_tz/tmpZ unit_file_tz/usr/lib/systemd/systemz/lib/systemd/systemz/etc/systemd/systemZ var_cache_tz /var/cacheZ var_lib_tz/var/libZlog_tz/var/logZ var_run_tz/var/runz/runZ var_lock_tz /run/lockz /var/run/lockZ var_spool_tz /var/spoolZ content_tz/var/wwwz all files�az regular file�fZ directory�dzcharacter device�cz block device�bz socket file�sz symbolic link�lz named pipe�p� z--z-dz-cz-bz-sz-lz-pc C s> | � dd�d }zt|�| fW S ty8 d| f Y S 0 d S )Nz/policy.r r )�rsplit�int� ValueError)Z policy_path� extension� r) �5/usr/lib/python3.9/site-packages/sepolicy/__init__.py�policy_sortkey� s r+ �/c C sN z0| t �� }t�d| �}|jtd� |d W S Y n0 ttd���d S )Nz%s.*��key���zNo SELinux Policy installed)�selinuxZselinux_binary_policy_path�glob�sortr+ r' r )�root�path�policiesr) r) r* �get_installed_policy� s r6 c C s2 t � dt�� | f �}|s dS |jtd� |d S )z?Get the path to the policy file located in the given store namez%s%s/policy/policy.*Nr- r/ )r1 r0 Z selinux_pathr2 r+ )�storer5 r) r) r* �get_store_policy� s � r8 c C sR d a d ad ad ad ad ad ad ad az t | �a W n t t d�| ��Y n0 d S )Nz Failed to read %s policy file) � all_domains�all_attributes�bools� all_types� role_allowsZusers�roles� file_types� port_typesr �_polr' r �� policy_filer) r) r* �policy� s rD c C s t | �}|sd S t|� d S �N)r8 rD )r7 rC r) r) r* �load_store_policy� s rF c C s t � } t| � d S rE )r6 rD rB r) r) r* � init_policy� s rG c C s� t s t� | tkrbtt �}||_t|�� �}|rTt|�dk rTd |_||_t|�� �}dd� |D �S | t kr�t t �}|r|||_dd� |�� D �S | t kr�t t �}|r�||_dd� |�� D �S | t k�rHtt �}|�r dd� |�d�D �}t|�d k� r�||_n t|�dk�r |d |d f|_t j�r6d d� |�� D �S d d� |�� D �S | tk�r�tt �}|�rf||_t j�r�d d� |�� D �S dd� |�� D �S | tk�r�tt �}|�r�||_dd� |�� D �S | tk�r�tt �}|�r�||_dd� |�� D �S td��d S )Nr c s sB | ]:}t tt|�� ��t|�t|j�t tt|�� ��d �V qdS ))�aliases�nameZ permissive� attributesN)�list�map�strrH �boolZ ispermissiverJ ��.0�xr) r) r* � <genexpr>� s ��zinfo.<locals>.<genexpr>c s s: | ]2}t |�ttt |�� ��ttt |�� ��d �V qdS ))rI r> �typesN)rM rK rL �expandrS rO r) r) r* rR � s ��c s s* | ]"}t |�ttt |�� ��d �V qdS ))rI rS N)rM rK rL rT rO r) r) r* rR � s ��c S s g | ] }t |��qS r) )r& )rP �ir) r) r* � <listcomp>� � zinfo.<locals>.<listcomp>�-r r c s s< | ]4}|j jt|j�t|jj�t|jj�|j jd �V qdS ))�high�protocol�range�type�lowN)�portsrY rM rZ �contextZrange_�type_r] rO r) r) r* rR � s � �c s s2 | ]*}|j jt|j�t|jj�|j jd �V qdS ))rY rZ r\ r] N)r^ rY rM rZ r_ r` r] rO r) r) r* rR s � �c s s8 | ]0}t |j�t |�ttt |j��t |j�d �V qdS ))r[ rI r> �levelN)rM Z mls_rangerK rL r> Z mls_levelrO r) r) r* rR s ��c s s( | ] }t |�ttt |j��d �V qdS ))rI r> N)rM rK rL r> rO r) r) r* rR s ��c s s | ]}t |�|jd �V qdS ))rI �stateN�rM rb rO r) r) r* rR s ��c s s" | ]}t |�t|j�d �V qdS ))rI r N)rM rK �permsrO r) r) r* rR ) s ��z Invalid type)rA rG �TYPEr rI rK �results�len�alias�ROLEr � ATTRIBUTEr �PORTr �splitr^ �mls�USERr �BOOLEANr �TCLASSr r' )�setyperI �qrf r^ r) r) r* �info� s� ��� �� �� � �rs c C sT t | j�t | j�t | j�t | j�d�}z<i }| jjD ]}|j|t |�< q4| jjf i |��| j k}W n t yx d}Y n0 ||d< zt t t | j ��|d< W n t y� Y n0 zt | j�|d< W n t y� Y n0 zdd� | jjD �|d< W n t �y Y n0 zt | j�|d < W n t �y* Y n0 z| j|d < W n t �yN Y n0 |S ) N)r\ r r r T�enabledr � transtypec S s g | ]}t |�|jf�qS r) rc )rP r r) r) r* rV S rW z)_setools_rule_to_dict.<locals>.<listcomp>�booleans� conditional�filename)rM �ruletyper r �tclassrw rv rb ZevaluateZconditional_block�AttributeErrorrK rL rd �defaultrx )Zruler Z boolstate�booleanrt r) r) r* �_setools_rule_to_dict2 sD � r~ c C s� t s t� |si }tttttttg�}| D ] }||vr*t dd� |� ��q*d }t |v rbt |t �}d }t |v rzt |t �}d }t|v r�t |t ��d�}g }g }t| v r�|�t� t| v r�|�t� t| v r�|�t� t| v r�|�t� t|�dk�r2tt ||||d�} t|v �r |t | _|dd� | �� D �7 }t| v �r�g d�} tt | |||d�} t|v �rj|t | _|d d� | �� D �7 }t| v �r�d g} tt | |||d�} | �� D ]"} |�t | j�t | j�d �� �q�|S ) NzType has to be in %s� �,r )ry r r rz c S s g | ] }t |��qS r) �r~ rO r) r) r* rV � rW zsearch.<locals>.<listcomp>)�type_transitionZ type_changeZ type_memberc S s g | ] }t |��qS r) r� rO r) r) r* rV � rW r )r r )rA rG �set�ALLOW� AUDITALLOW� NEVERALLOW� DONTAUDIT� TRANSITION� ROLE_ALLOWr' �join�SOURCErM �TARGET�CLASSrl �appendrg r �PERMSrd rf r r r ) rS ZseinfoZ valid_typesrq r r rz ZtoretZtertypesrr ZrtypesZratypes�rr) r) r* �searchd sz � � � � r� c s i }g }�g�� g�z(�t t�fdd�t� ��d d 7 �W n Y n0 z(�t t� fdd�t� ��d d 7 �W n Y n0 tdd� t���fdd�t� ��}zD|D ]:}|�|d |d |d fd �� ||vr�|�|� i }q�W n t� y� | Y S 0 |S ) Nc s | d � kS �NrI r) �rQ )�srcr) r* �<lambda>� rW z"get_conditionals.<locals>.<lambda>r rJ c s | d � kS r� r) r� )�destr) r* r� � rW c S s | S rE r) )�yr) r) r* r� � rW c s2 | d �v o0| d � v o0t ���| t �o0d| v S )Nr r rw )r� �issubsetr� r� )� dest_list�perm�src_listr) r* r� � s ��r rw rt )r rw )rK �filter�get_all_types_inforL �get_all_allow_rules�updater� �KeyError)r� r� rz r� ZtdictZtlistZallowsrU r) )r� r� r� r� r� r* �get_conditionals� s0 ((� r� c C sF d}| D ]}|d d rd} q"qt d�|d�ttdd� | ���f S ) NFrw r Tz-- Allowed %s [ %s ]z || c S s d| d d | d d f S )Nz%s=%drw r r r) r� r) r) r* r� � rW z.get_conditionals_format_text.<locals>.<lambda>)r r� r� rL )Zcondrt rQ r) r) r* � get_conditionals_format_text� s r� c C s t tt| ��d d S )Nr rS )rK rs rj )Z attributer) r) r* �get_types_from_attribute� s r� c C s� g }i }t � D ] }|�t| ��r|�|� qt� }|D ]D}z$|| d t|| d f||< W q6 tyx g ||< Y q60 q6|S �N�regex�ftype)�get_all_file_types� startswith�gen_short_namer� � get_fcdict� file_type_strr� )rq �flist�mpathsr �fcdictr) r) r* �get_file_types� s $ r� c C s< | s| S zt tt| ��d W S ttfy6 | Y S 0 dS )z�Return the real name of a type * If 'name' refers to a type alias, return the corresponding type name. * Otherwise return the original name (even if the type does not exist). rI N)�nextrs re � RuntimeError� StopIteration�rI r) r) r* �get_real_type_name� s r� c C s. t � }g }i }ttg| ddgdd��}|d u s:t|�dkr>|S t� }ddg}|D ]�}|d |v rbqPd |v rt|d stqP|d �d �r�|d |vr�qP|d |vr�|d | kr�|�|d � qPt|d �D ]}||vr�|�|� q�qP|D ]F} z$|| d t|| d f|| < W q� t �y& g || < Y q�0 q�|S ) N�open�write�file)r r r r Z proc_typeZ sysctl_typer rt �_tr� r� ) r� r� r� rg r� �endswithr� r� r� r� ) rq r? Z all_writesr� r r� rJ rU �tr r) r) r* �get_writable_files� s: $r� c s� t j�| �r| gS zt�d| �� W n td| � g Y S 0 | }|�d�r^|d d� d }t j�|��z�d dkr��d7 �W n ty� td� Y n0 z6t�d| �� � fdd �t �fd d �t � ���D �W S g Y S 0 d S ) Nz%s$zbad reg:z(/.*)?i����r, r/ z try failed got an IndexErrorc s g | ]}� � |�r|�qS r) )�matchrO )�patr) r* rV 5 rW z find_file.<locals>.<listcomp>c s � | S rE r) r� )r4 r) r* r� 5 rW zfind_file.<locals>.<lambda>) �osr4 �exists�re�compile�printr� �dirname� IndexErrorrL �listdir)Zregr# r) )r� r4 r* � find_file s* (r� c C sV t | �}|�� D ]@}|�d�r||vr|| D ] }t|�D ]}| S q.qd S )N�_exec_t)�get_entrypoints�keysr� r� )�domain� exclude_listZexecutable_files�exer4 r r) r) r* �find_all_files: s r� c C s` t � }zB| �d�rF| |vrF|| d D ] }t|�D ]}| W S q&W n tyZ Y n0 d S )Nr� r� )r� r� r� r� )r� r� r� r4 r r) r) r* �find_entrypoint_pathD s r� c C s� zht |d��J}|D ]4}|�� }|r|d �d�s|d |d�| |d < qW d � n1 s\0 Y W n2 ty� } z|jtjkr�� W Y d }~n d }~0 0 | S )Nr� r �#r )Zequiv�modify)r� rl r� �OSError�errno�ENOENT)Zedict�fc_pathr� �fd�er r) r) r* �read_file_equivP s : r� c C s" t rt S i a tt | d dd�a t S )Nz.subsT�r� )�file_equiv_modifiedr� �r� r) r) r* �get_file_equiv_modified] s r� c C s& t rt S t| �a tt | d dd�a t S )Nz .subs_distFr� )� file_equivr� r� r� r) r) r* �get_file_equivf s r� c C s� t rt S g a z:t| d d��}|�� }W d � n1 s:0 Y W n6 ty| } z |jtjkrd� g W Y d }~S d }~0 0 |D ]b}|�� }t|�dkr�q�z4t|�dkr�t|d }nd}t � |d |f� W q� t y� Y q�0 q�t S )N�.localr� r r r r ) � local_filesr� � readlinesr� r� r� rl rg �trans_file_type_strr� r� )r� r� �fcr� rU �recr� r) r) r* �get_local_file_pathso s, * r� c C s� t rt S t| d�}|�� }|�� t| d d�}||�� 7 }|�� i a z>t| d d�� }||�� 7 }W d � n1 sz0 Y W n2 ty� } z|jtjkr�� W Y d }~n d }~0 0 |D ]�}|�� }zjt|�dkr�t |d }nd}|d �d�d }|t v �r t | d � |d � n|d g|d �t |< W q� Y q�0 q�d d git d < d dgit d< d dgit d< d dgit d< d dgit d< d dgit d< d dgit d< d dgit d< d d git d < t S ) Nr� z .homedirsr� r r r r/ �:r� r )r� r� z all log filesZlogfilezall user tmp filesZ user_tmp_typezall user home filesZuser_home_typezall virtual image filesZvirt_image_typezBall files on file systems which do not support extended attributesZ noxattrfsz)all sandbox content in tmpfs file systemsZsandbox_tmpfs_typez&all user content in tmpfs file systemsZuser_tmpfs_typezall files on the system� file_typezAuse this label for random content that will be shared using sambaZ samba_share_t) r� r� r� �closer� r� r� rl rg r� r� )r� r� r� r� rU r� r� r� r) r) r* r� � sJ . r� c s< z � fdd�t tgddi�D �W S ttfy6 Y n0 d S )Nc s g | ]}|d � kr|�qS )ru r) rO �rq r) r* rV � rW z(get_transitions_into.<locals>.<listcomp>r �process�r� r� � TypeErrorr{ r� r) r� r* �get_transitions_into� s r� c C s0 zt tg| dd��W S ttfy* Y n0 d S )Nr� �r r r� r� r) r) r* �get_transitions� s r� c C s8 z dd� t tgd| i�D �W S ttfy2 Y n0 d S )Nc S s g | ]}|d dkr|�qS )r r� r) rO r) r) r* rV � rW z(get_file_transitions.<locals>.<listcomp>r r� r� r) r) r* �get_file_transitions� s r� c C s\ g }t tgd| i�}|D ]>}d|v rz$|d D ]}||v r.|�|� q.W q Y q0 q|S )Nr rv )r� r� r� )rq r} Zboollistr r# r r) r) r* �get_boolean_rules� s r� c C s t d�S )NZ entry_type)r� r) r) r) r* �get_all_entrypoints� s r� c s. t ttg� dgdgd�}� fdd�|�� D �S )Nr� � entrypoint)ry r rz rd c s g | ]}|j � krt|j��qS r) )r rM r rO r� r) r* rV � rW z(get_entrypoint_types.<locals>.<listcomp>)r rA r� rf )rq rr r) r� r* �get_entrypoint_types� s �r� c sh t �| �d �d�d � z2tt� fdd�ttgddd����}|d d W S ttt fyb Y n0 d S ) Nr r� r c s | d � kS )Nr r) r� �r� r) r* r� � rW z$get_init_transtype.<locals>.<lambda>�init_tr� r� r ru ) r0 Z getfileconrl rK r� r� r� r� r{ r� )r4 � entrypointsr) r� r* �get_init_transtype� s $r� c C s\ t tdgddgd�}g }|�� D ]6}z|j| kr<|�|j� W q tyT Y q Y q 0 q |S �Nr� r� r� )ry r rz )r rA rf r| r� r r{ )ru rr r� rU r) r) r* �get_init_entrypoint� s � r� c C s~ t tdgddgd�} i }| �� D ]X}z<t|j�}||v rN|| �t|j�� nt|j�g||< W q tyv Y q Y q 0 q |S r� )r rA rf rM r| r� r r{ )rr r� rU ru r) r) r* �get_init_entrypoints_str s � r� c C sH z,t dd� ttgd| dd���}t|�d W S ttfyB Y n0 d S )Nc S s | d S )Nru r) r� r) r) r* r� rW z,get_init_entrypoint_target.<locals>.<lambda>r� r� )r r r r )rL r� r� rK r� r� )r� r� r) r) r* �get_init_entrypoint_target s r� c C s\ t � }i }t| �D ]D}z$|| d t|| d f||< W q tyT g ||< Y q0 q|S r� )r� r� r� r� )rq r� r� r r) r) r* r� s $ r� c C s� t t�dkrtS t� t�� } z4t| �}t�� }|�|� t |j� � �a|� � W n& t j �d| � t �d� Y n0 t�� tS )Nr z#could not open interface info [%s] r )rg �methods�gen_interfaces�defaults�interface_infor� � interfacesZ InterfaceSetZ from_filerK r� r� �sys�stderrr� �exitr2 )�fnr� �ifsr) r) r* � get_methods+ s r c C s t d u rdd� tt�D �a t S )Nc S s g | ] }|d �qS r� r) rO r) r) r* rV C rW z!get_all_types.<locals>.<listcomp>)r< rs re r) r) r) r* � get_all_types@ s r c C s t d u rttt��a t S rE )�all_types_inforK rs re r) r) r) r* r� F s r� c C s& t d u r"ttttd��d d �a t S )NZ userdomainr rS )� user_typesrK rs rj r) r) r) r* �get_user_typesL s r c C st t rt S i a tttgd�} | �� D ]L}t|j�}t|j�}|dks"|dkrLq"|t v rdt | �|� q"|gt |< q"t S )N)ry Zsystem_r) r= r rA r� rf rM r r r� )rr r� r� Ztgtr) r) r* �get_all_role_allowsS s r c C sv dd l } g }tt� �}|D ]V}| �dd |�}t|�dkrt| �dd |d ��dkr|d |vr|�|d � q|S )Nr z(.*)%sz_exec_t$z_initrc$)r� �sortedr �findallrg r� )r� r9 rS rU �mr) r) r* �get_all_entrypoint_domainsg s (r c C s� zddl m} W n ty. ddlm} Y n0 t�� }t�� }z"t�|�j t�|�j kr`W d S W n t yt Y n0 t� � dkr�t t d���t| d�d � d S )Nr )�getstatusoutputzEYou must regenerate interface info by running /usr/bin/sepolgen-ifgenz/usr/bin/sepolgen-ifgenr )Zcommandsr � ImportError� subprocessr� r� �headersr� �stat�st_mtimer� �getuidr' r r� )r Zifiler r) r) r* r� s s r� c C s� t r t tfS i ai a tt�D ]�} | d | d kr>t| d �}n dt| d �t| d �f }| d | d ft v r�t | d | d f �|� n|gt | d | d f< d| v r�| d | d ft| d | d | d f< q | d t| d | d | d f< q t tfS )Nr] rY z%s-%sr\ rZ r[ )�portrecs� portrecsbynumrs rk rM r� )rU �portr) r) r* � gen_port_dict� s ( r c C s" t s ttttd��d d �a t S )Nr� r rS )r9 rK rs rj r) r) r) r* �get_all_domains� s r c C s0 t rt S tst� tt�} dd� | �� D �a t S )Nc S s g | ]}t |�d krt |��qS )Zobject_r)rM rO r) r) r* rV � rW z!get_all_roles.<locals>.<listcomp>)r> rA rG r rf �rr r) r) r* � get_all_roles� s r c C s< t s8ttt��a tjr8t D ] } d�| d �d��| d< qt S )Nr$ r[ r )�selinux_user_listrK rs rn rA rm r� rl r� r) r) r* �get_selinux_users� s r c C s� t rt S tt�� d�} | �� }| �� g a |�d�D ]V}|�� }t|�dks4|� d�rXq4|�d�}t � |d |d d� |dd � �d�� q4t S ) Nr� � r r� r� r r )rI Zseuserrm ) �login_mappingsr� r0 Zselinux_usersconf_path�readr� rl �striprg r� r� r� )r� �bufr rQ r) r) r* �get_login_mappings� s *r% c C s t tdd� t� ��S )Nc S s | d S r� r) r� r) r) r* r� � rW z get_all_users.<locals>.<lambda>)r rL r r) r) r) r* � get_all_users� s r& c C s& t rt S ttttd��d d �a t S )Nr� r rS )r? rK r rs rj r) r) r) r* r� � s r� c C s& t rt S ttttd��d d �a t S )NZ port_typer rS )r@ rK r rs rj r) r) r) r* �get_all_port_types� s r' c C s t sttt��a t S rE )r; rK rs ro r) r) r) r* � get_all_bools� s r( c C s d� | d t|� � �d��S )Nr r )r� rg rl )r Ztrimr) r) r* � prettyprint� s r) c C s | S rE r) )r r) r) r* �markup� s r* c C sV d|| � }| � d�r(|dt| d� S | � d�rD|dt| d� S | � d�r`|dt| d� S | � d�r||d t| d� S | � d �r�|d t| d � S | � d �r�|d t| d � S | � d �s�| � d�r�|d S | � d�r�|d S | � d�r�|dt| d� S | � d��r |dt| d� S | � d��r:|dt| d� S | � d��rX|dt| d� S | � d��r~|d| d td� � S | � d��r�|d t| d� S | � d ��r�|d t| d � S | � d ��r�|d t| d � S | � d ��r�|d t| d � S | � d!��r|d"t| d!� S | � d#��r2|d$t| d#� S | � d%��rP|d&t| d%� S | � d'��rn|d(t| d'� S | � d)��r�|d*t| d)� S | � d+��r�|d$t| d+� S | � d,��r�|d-t| d,� S | � d.��r�|d/t| d.� S | � d0��r|d1t| d0� S | � d2��r"|d3t| d2� S | � d4��r@|d1t| d4� S | � d5��r^|d1t| d5� S | � d6��r||d1t| d6� S | � d5��r�|d7t| d5� S | � d8��r�|d9t| d8� S | � d:��r�|d;t| d:� S | � d<��r�|d=t| d<� S | � d>��r|d?t| d>� S | � d@��r&|dA S | � dB��rD|dCt| dB� S |dDt| dE� S )FNz+Set files with the %s type, if you want to Z _var_run_tz8store the %s files under the /run or /var/run directory.Z_pid_tz,store the %s files under the /run directory.Z _var_lib_tz0store the %s files under the /var/lib directory.Z_var_tz,store the %s files under the /var directory.Z _var_spool_tz2store the %s files under the /var/spool directory.Z_spool_tZ_cache_tZ _var_cache_tz/store the files under the /var/cache directory.Z _keytab_tz)treat the files as kerberos keytab files.Z_lock_tzEtreat the files as %s lock data, stored under the /var/lock directoryZ_log_tzKtreat the data as %s log data, usually stored under the /var/log directory.Z _config_tzRtreat the files as %s configuration data, usually stored under the /etc directory.Z_conf_tr� z,transition an executable to the %s_t domain.Z_cgi_content_tz"treat the files as %s cgi content.Z _rw_content_tz)treat the files as %s read/write content.Z_rw_tZ_write_tZ_db_tz'treat the files as %s database content.Z _ra_content_tz*treat the files as %s read/append content.Z_cert_tz'treat the files as %s certificate data.Z_key_tz treat the files as %s key data.Z _secret_tz"treat the files as %s secret data.Z_ra_tZ_ro_tz(treat the files as %s read/only content.Z _modules_tz treat the files as %s modules.Z _content_tz treat the files as %s content.Z_state_tz!treat the files as %s state data.Z_files_tZ_file_tZ_data_tz treat the data as %s content.Z_tmp_tz1store %s temporary files in the /tmp directories.Z_etc_tz'store %s files in the /etc directories.Z_home_tz+store %s files in the users home directory.Z_tmpfs_tz&store %s files on a tmpfs file system.Z _unit_file_tz#treat files as a systemd unit file.Z _htaccess_tz#treat the file as a %s access file.ztreat the files as %s data.r� )r� r) rg )r r* Ztxtr) r) r* �get_description� s� r+ c C s" t s tttdd� tt����a t S )Nc S s | d S r� r) r� r) r) r* r� S rW z$get_all_attributes.<locals>.<lambda>)r: rK r rL rs rj r) r) r) r* �get_all_attributesP s r, c C s |D ]}|| t vr dS qdS )NFT)r� )�dictrd r� r) r) r* �_dict_has_permsW s r. c C sp t � }| �d�r&t| �} | d d� }n| }|d |vrBtd| ��|d dkr`|d d� d }n|d }||fS )Nr� ���zdomain %s_t does not existr/ r r )r r� r� r' )rq r9 � domainname� short_namer) r) r* r� ^ s r� c C s t sttg�a t S rE )�all_allow_rulesr� r� r) r) r) r* r� n s r� c C s. t s*ttddttgd�} dd� | �� D �a t S )Nz.*T)r} Z boolean_regexry c S s g | ] }t |��qS r) r� rO r) r) r* rV y rW z&get_all_bool_rules.<locals>.<listcomp>)�all_bool_rulesr rA r� r� rf r r) r) r* �get_all_bool_rulest s �r4 c C s t stttg��a t S rE )�all_transitionsrK r� r� r) r) r) r* �get_all_transitions| s r6 c s g }g }t � �\}}tdd� t� fdd�t� ��D ]�}|D ]�}t|t�sJq:zt�|d �}W n tyv |d }Y n0 |d � |�s�|d � |�r�|d |f|vr�|d | f|vr�|� |d |f� q:|d |f|vr:|d | f|vr:|� |d |f� q:q2||fS )Nc S s | d S )Nrv r) r� r) r) r* r� � rW zget_bools.<locals>.<lambda>c s d| v o| d � kS )Nrv r r) r� r� r) r* r� � rW r r ) r� rL r� r4 � isinstance�tupler0 Zsecurity_get_boolean_activer� r� r� )rq r; Z domainboolsr0 r1 rU r rt r) r� r* � get_bools� s" " ""r9 c C s t st�� d a t S )Nr )rv r0 Zsecurity_get_boolean_namesr) r) r) r* �get_all_booleans� s r: �#/usr/share/selinux/devel/policy.xmlc C sN z t �| �}|�� }|�� W n* tyH t| �}|�� }|�� Y n0 |S rE )�gzipr� r" r� �IOError)r4 r� r$ r) r) r* � policy_xml� s r> c C s� t rt S dd l}i a �z�|jj�t| ��}|�d�D �]}|�d�D ]�}|�d�D ]J}|�d��d�j� d�}t � dd|�}|� d �|� d �|ft |� d �< qR|�d �D ]J}|�d��d�j� d�}t � dd|�}|� d �|� d �|ft |� d �< q�qD|�d �D ]F}|�d��d�j� d�}t � dd|�}d |� d �|ft |� d �< �q q4|�d�D ]F}|�d��d�j� d�}t � dd|�}d |� d �|ft |� d �< �qTW n t �y� Y n0 t S ) Nr Zlayer�moduleZtunable�descr# r r rI ZdftvalrN �global)� booleans_dictZxml.etree.ElementTreeZetreeZ ElementTreeZ fromstringr> r �find�textr# r� �sub�getr= )r4 ZxmlZtreer" r r r@ rU r) r) r* � gen_bool_dict� s6 "$ "rG c C s* t � }| |v r t|| d �S td�S d S )Nr �unknown)rG r )r} rB r) r) r* �boolean_category� s rI c C sP t � }| |v r t|| d �S | �d�}td�j|d d�|dd � �d�S d S )Nr r zAllow {subject} to {rest}r r r )Zsubject�rest)rG r rl �formatr� )r} rB r@ r) r) r* � boolean_desc� s rL c C sL dd l } d}zdd l}|jdd�}W n" tttt| jfyF d}Y n0 |S )Nr r$ T)ZprettyZMisc)r �distrorI �ModuleNotFoundErrorr� r= � UnicodeErrorZCalledProcessError)r Zsystem_releaserM r) r) r* �get_os_version� s rP c C sP d a d ad ad ad ad ad ad ad ad a d a d a d a d a d a d ad ad ad ad S rE )r: r9 r< rv rB r; r� r? r� r� r r r@ r= r> r r! r r) r) r) r* �reinit� s& rQ )r, )N)N)r; )r; )�r� r0 r1 Zsepolgen.defaultsr� Zsepolgen.interfacesr r r� r� r< Zsetools.boolqueryr Zsetools.portconqueryr Zsetools.policyrepr Zsetools.objclassqueryr Zsetools.rbacrulequeryr Zsetools.rolequeryr Zsetools.terulequeryr Zsetools.typeattrqueryr Zsetools.typequeryr Zsetools.userqueryr ZPROGNAME�gettext�kwargs� version_info� translationr� r �builtinsrM �__dict__r Z __builtin__r re ri rj rk rn ro rp r� r� r� r� r� r� r� r� r� r� Z DEFAULT_DIRSr� r� rA r� r� r� r� r� r< r r r= r r r9 r> r r! r? r@ r; r: rv rB r2 r3 r5 r+ r6 r8 rD rF rG rs r~ r� r� r� r� r� r� r� r� r� r� r� Zselinux_file_context_pathr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r� r r r r� r r r r r% r& r� r' r( r) r* r+ r, r. r� r� r4 r6 r9 r: r> rG rI rL rP rQ r) r) r) r* �<module> sj ��� m2 K! $ . ]