From patchwork Thu Sep 22 15:17:33 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Zaman X-Patchwork-Id: 9345529 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B4BBF6077A for ; Thu, 22 Sep 2016 15:21:08 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9E9BE2AB7A for ; Thu, 22 Sep 2016 15:21:08 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 92A982ABA8; Thu, 22 Sep 2016 15:21:08 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, T_DKIM_INVALID autolearn=no version=3.3.1 Received: from emsm-gh1-uea10.nsa.gov (smtp.nsa.gov [8.44.101.8]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 8487B2AB7A for ; Thu, 22 Sep 2016 15:21:04 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.30,378,1470700800"; d="scan'208";a="17864555" IronPort-PHdr: =?us-ascii?q?9a23=3ANCwu+xQiH9ZIUSc4mCrO7ZkokNpsv+yvbD5Q0YIu?= =?us-ascii?q?jvd0So/mwa64YBON2/xhgRfzUJnB7Loc0qyN4vqmATBLscvJmUtBWaQEbwUCh8?= =?us-ascii?q?QSkl5oK+++Imq/EsTXaTcnFt9JTl5v8iLzG0FUHMHjew+a+SXqvnYsExnyfTB4?= =?us-ascii?q?Ov7yUtaLyZ/mjabqp9aDPk1hv3mUWftKNhK4rAHc5IE9oLBJDeIP8CbPuWZCYO?= =?us-ascii?q?9MxGlldhq5lhf44dqsrtY4q3wD888784Z8dYmyP+FhFf0LRAghZns44MztqAnr?= =?us-ascii?q?URqE5nxaVH4f1BVPHVvr9hb/C7X4qSz8/th03SCcdZn0RKszXxy64r1lSRnpjy?= =?us-ascii?q?FBPDk8pjKEwvdshb5W9Ury7yd0xJTZNcTMbPc=3D?= X-IPAS-Result: =?us-ascii?q?A2E/CQB+9uNX/wHyM5BeHAEBBAEBCgEBGAEFAQsBgn0TAQE?= =?us-ascii?q?BAQEeV3ymUgGKJIoCHAOBeFSFIUwBAQEBAQEBAQIBAlsngjIEAxMFeVs9AgEDA?= =?us-ascii?q?QIPCAEMEwYBAQwgDAIDCQEBFykICAMBLQMBBQELEQ4LBRgEAYgpAaB/gTI+Mop?= =?us-ascii?q?WhTABAQWIKAgQhBeKbwsRAYV6AYgzB4V+dkSJP0iGJ4lBZYEHToccJQyFY4cGi?= =?us-ascii?q?BwxgRFUgkkMNg4cgV1lAYU7eIEnAQEB?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea10.nsa.gov with ESMTP; 22 Sep 2016 15:20:37 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u8MFKa9m015933; Thu, 22 Sep 2016 11:20:37 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u8MFIWBk125865 for ; Thu, 22 Sep 2016 11:18:32 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u8MFIW5C015315 for ; Thu, 22 Sep 2016 11:18:32 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1DAAABR9eNXhrDAVdFeHAEBBAEBCgEBgygTAQEBAQF1fLB3igUcgkyDNgKBaEwBAgEBAQEBAhMBAQEICwsJGYURAgEDEggBDBkBATcBD1E0AQUBHBkiiCkBoQCBMj4yilaFMAEBBYd/AQEBAQYCARwIEIQXim+GF4g0B4V+dkSJP0iGJ4lBZYEHToccMYVjhwaIHDGBEYNfDhELgV1lAYdaAQEB X-IPAS-Result: A1DAAABR9eNXhrDAVdFeHAEBBAEBCgEBgygTAQEBAQF1fLB3igUcgkyDNgKBaEwBAgEBAQEBAhMBAQEICwsJGYURAgEDEggBDBkBATcBD1E0AQUBHBkiiCkBoQCBMj4yilaFMAEBBYd/AQEBAQYCARwIEIQXim+GF4g0B4V+dkSJP0iGJ4lBZYEHToccMYVjhwaIHDGBEYNfDhELgV1lAYdaAQEB X-IronPort-AV: E=Sophos;i="5.30,378,1470715200"; d="scan'208";a="5722221" Received: from emsm-gh1-uea10.corp.nsa.gov (HELO emsm-gh1-uea10.nsa.gov) ([10.208.41.36]) by goalie.tycho.ncsc.mil with ESMTP; 22 Sep 2016 11:18:29 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3AT7Ob8RN+eLvECKRta4kl6mtUPXoX/o7sNwtQ0KIM?= =?us-ascii?q?zox0KP/5rarrMEGX3/hxlliBBdydsKMezbKK+PC9EUU7or+5+EgYd5JNUxJXwe?= =?us-ascii?q?43pCcHRPC/NEvgMfTxZDY7FskRHHVs/nW8LFQHUJ2mPw6anHS+4HYoFwnlMkIt?= =?us-ascii?q?f6KuS9SU15j8h7360qaQSj0AvCC6b7J2IUf+hiTqne5Sv7FfLL0swADCuHpCdr?= =?us-ascii?q?ce72ppIVWOg0S0vZ/or9YwuxhX7uks889GTLXSY7UzTbseCi8vdW8y+p7Frx7G?= =?us-ascii?q?GCmG/XwaGlcflxNOS1zH5Qr9WL/pvzH0t+x83y/cNsrzG+NnEQ++5rtmHUe7wB?= =?us-ascii?q?wMMCQ0pTna?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0GVAgBR9eNXhrDAVdFeHAEBBAEBCgEBG?= =?us-ascii?q?AEFAQsBgn0TAQEBAQF1fKZTiiSKBRyBeFSDNgKBaEwBAQEBAQEBAQIBAhABAQE?= =?us-ascii?q?ICwsJGS+CMhiBAFs9AgEDEggBDBkBATcBD1E0AQUBHBkiiCkBoQCBMj4yilaFM?= =?us-ascii?q?AEBBYd/AQEBAQYCARwIEIQXim+GF4g0B4V+dkSJP0iGJ4lBZYEHToccMYVjhwa?= =?us-ascii?q?IHDGBEYNfDhELgV1lAYdaAQEB?= X-IPAS-Result: =?us-ascii?q?A0GVAgBR9eNXhrDAVdFeHAEBBAEBCgEBGAEFAQsBgn0TAQE?= =?us-ascii?q?BAQF1fKZTiiSKBRyBeFSDNgKBaEwBAQEBAQEBAQIBAhABAQEICwsJGS+CMhiBA?= =?us-ascii?q?Fs9AgEDEggBDBkBATcBD1E0AQUBHBkiiCkBoQCBMj4yilaFMAEBBYd/AQEBAQY?= =?us-ascii?q?CARwIEIQXim+GF4g0B4V+dkSJP0iGJ4lBZYEHToccMYVjhwaIHDGBEYNfDhELg?= =?us-ascii?q?V1lAYdaAQEB?= X-IronPort-AV: E=Sophos;i="5.30,378,1470700800"; d="scan'208";a="17864384" Received: from mail-pf0-f176.google.com ([209.85.192.176]) by emsm-gh1-uea10.nsa.gov with ESMTP/TLS/AES128-GCM-SHA256; 22 Sep 2016 15:18:25 +0000 Received: by mail-pf0-f176.google.com with SMTP id 21so31674083pfy.0 for ; Thu, 22 Sep 2016 08:18:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfinion-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=rysU7WR0inn8+u5eTPRAEQWHOibM1QOFD/glOmqe7Ec=; b=gk++ZDqeZ2GmXN1i+artvERDSY2V19kVoZDmM99YDjVgCPrC7MiFNKYIQ2IkQDUZ3V jeAlvGTXJNL/IAg3iQOvyYvcfCnR+513htfDgGKB/kF06Z6HQDRhOkWm1XxoF/ToKLX5 qpmYtn7+EL3/zFEqglNADRvPu3fq4seqS63f8xAxvNP0KUwOXyNjj3E6Y9NMqRduNyuL 03gMTXodymrCDPptmqhaXwvZHCl7Ypms/Dtx4o5vEeFZ1cOnFHpZl6ov8l6EamcBTJW3 lxYmIYSmNUdQSvIS2c6vGp8UHsx5RbSKNU1xrHd1eqNRwJihk5RSOOcogqrnBES7m0jB evMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=rysU7WR0inn8+u5eTPRAEQWHOibM1QOFD/glOmqe7Ec=; b=QNsqr45kRTeqcrX5+4x8Ees0GP5HYJGQir0gIBhkFfn5W+ILMoSdEZf3E9DDfap5cx E63s6/CBTXaBWSJm0jlCyyuPGY2Ga3wNMr8yZPKf8dzwXx2xvnDHB0Dt5CazQgI7mYaD u9hI2VSRCtJjPnAnOFRiqhrQnkzCjHEeFnZkDKdRF+83Je0fFgZX6336fCI58l7LvSnm 2WJzovvQjrvfiDiPNUeH099711nTj0tI7Vp0r7ccMYhJSR/vEkV0Ztil5tLTA+vuaQVK Hd50wI0z2HR1FrwYMtuBluugyk02Xigm8qDDYIm3sp09ZzFEQrPOK+ZfvZAg/XulflUv 4LGw== X-Gm-Message-State: AE9vXwODcAJu9G6ALQO/K0qEjz/5jZV4Prm/QNVlAr9CpjqzZMdxM2PSr01Twh+ExiZT3A== X-Received: by 10.98.87.90 with SMTP id l87mr4165685pfb.133.1474557503434; Thu, 22 Sep 2016 08:18:23 -0700 (PDT) Received: from localhost ([2404:e800:e600:57b:e014:183:951f:342c]) by smtp.gmail.com with ESMTPSA id r66sm4948726pfb.54.2016.09.22.08.18.21 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 22 Sep 2016 08:18:22 -0700 (PDT) From: Jason Zaman To: selinux@tycho.nsa.gov Subject: [PATCH 7/7] sepolicy: update setup.py to remove C module Date: Thu, 22 Sep 2016 23:17:33 +0800 Message-Id: <1474557453-14379-8-git-send-email-jason@perfinion.com> X-Mailer: git-send-email 2.7.3 In-Reply-To: <1474557453-14379-1-git-send-email-jason@perfinion.com> References: <1474557453-14379-1-git-send-email-jason@perfinion.com> X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP Signed-off-by: Jason Zaman --- policycoreutils/sepolicy/common.h | 69 -- policycoreutils/sepolicy/info.c | 1381 ------------------------- policycoreutils/sepolicy/policy.c | 116 --- policycoreutils/sepolicy/policy.h | 7 - policycoreutils/sepolicy/search.c | 1029 ------------------ policycoreutils/sepolicy/sepolicy/__init__.py | 2 - policycoreutils/sepolicy/setup.py | 24 +- 7 files changed, 17 insertions(+), 2611 deletions(-) delete mode 100644 policycoreutils/sepolicy/common.h delete mode 100644 policycoreutils/sepolicy/info.c delete mode 100644 policycoreutils/sepolicy/policy.c delete mode 100644 policycoreutils/sepolicy/policy.h delete mode 100644 policycoreutils/sepolicy/search.c diff --git a/policycoreutils/sepolicy/common.h b/policycoreutils/sepolicy/common.h deleted file mode 100644 index e453def..0000000 --- a/policycoreutils/sepolicy/common.h +++ /dev/null @@ -1,69 +0,0 @@ -#include "Python.h" - -#ifdef UNUSED -#elif defined(__GNUC__) -# define UNUSED(x) UNUSED_ ## x __attribute__((unused)) -#elif defined(__LCLINT__) -# define UNUSED(x) /*@unused@*/ x -#else -# define UNUSED(x) x -#endif - -#define py_decref(x) { if (x) Py_DECREF(x); } - -#if PY_MAJOR_VERSION >= 3 -# define PyIntObject PyLongObject -# define PyInt_Type PyLong_Type -# define PyInt_Check(op) PyLong_Check(op) -# define PyInt_CheckExact(op) PyLong_CheckExact(op) -# define PyInt_FromString PyLong_FromString -# define PyInt_FromUnicode PyLong_FromUnicode -# define PyInt_FromLong PyLong_FromLong -# define PyInt_FromSize_t PyLong_FromSize_t -# define PyInt_FromSsize_t PyLong_FromSsize_t -# define PyInt_AsLong PyLong_AsLong -# define PyInt_AS_LONG PyLong_AS_LONG -# define PyInt_AsSsize_t PyLong_AsSsize_t -# define PyInt_AsUnsignedLongMask PyLong_AsUnsignedLongMask -# define PyInt_AsUnsignedLongLongMask PyLong_AsUnsignedLongLongMask -# define PyString_FromString PyUnicode_FromString -# define PyString_AsString PyUnicode_AsUTF8 -#endif - -static int py_append_string(PyObject *list, const char* value) -{ - int rt; - PyObject *obj = PyString_FromString(value); - if (!obj) return -1; - rt = PyList_Append(list, obj); - Py_DECREF(obj); - return rt; -} - -static int py_append_obj(PyObject *list, PyObject *obj) -{ - int rt; - if (!obj) return -1; - rt = PyList_Append(list, obj); - return rt; -} - -static int py_insert_obj(PyObject *dict, const char *name, PyObject *obj) -{ - int rt; - if (!obj) return -1; - rt = PyDict_SetItemString(dict, name, obj); - return rt; -} - -static int py_insert_string(PyObject *dict, const char *name, const char* value) -{ - int rt; - PyObject *obj = PyString_FromString(value); - if (!obj) return -1; - rt = PyDict_SetItemString(dict, name, obj); - Py_DECREF(obj); - return rt; -} - - diff --git a/policycoreutils/sepolicy/info.c b/policycoreutils/sepolicy/info.c deleted file mode 100644 index bbb6844..0000000 --- a/policycoreutils/sepolicy/info.c +++ /dev/null @@ -1,1381 +0,0 @@ -/** - * @file - * Command line tool to search TE rules. - * - * @author Frank Mayer mayerf@tresys.com - * @author Jeremy A. Mowery jmowery@tresys.com - * @author Paul Rosenfeld prosenfeld@tresys.com - * @author Thomas Liu - * @author Dan Walsh - * - * Copyright (C) 2003-2008 Tresys Technology, LLC - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - */ - -/** - * This is a modified version of seinfo to be used as part of a library for - * Python bindings. - */ - -#include "common.h" -#include "policy.h" - -/* libapol */ -#include -#include -#include -#include - -/* libqpol */ -#include -#include - -/* other */ -#include -#include -#include -#include -#include - -#define COPYRIGHT_INFO "Copyright (C) 2003-2007 Tresys Technology, LLC" - -enum input -{ - TYPE, ATTRIBUTE, ROLE, USER, PORT, BOOLEAN, CLASS, SENS, CATS -}; - -static int py_insert_long(PyObject *dict, const char *name, int value) -{ - int rt; - PyObject *obj = PyLong_FromLong(value); - if (!obj) return -1; - rt = PyDict_SetItemString(dict, name, obj); - Py_DECREF(obj); - return rt; -} - -static int py_insert_bool(PyObject *dict, const char *name, int value) -{ - int rt; - PyObject *obj = PyBool_FromLong(value); - if (!obj) return -1; - rt = PyDict_SetItemString(dict, name, obj); - Py_DECREF(obj); - return rt; -} - -/** - * Get a policy's MLS sensitivities. - * If this function is given a name, it will attempt to - * get statistics about a particular sensitivity; otherwise - * the function gets statistics about all of the policy's - * sensitivities. - * - * @param name Reference to a sensitivity's name; if NULL, - * all sensitivities will be considered - * @param policydb Reference to a policy - * - * @return 0 on success, < 0 on error. - */ -static PyObject* get_sens(const char *name, const apol_policy_t * policydb) -{ - PyObject *dict = NULL; - int error = 0; - int rt = 0; - size_t i; - char *tmp = NULL; - const char *lvl_name = NULL; - apol_level_query_t *query = NULL; - apol_vector_t *v = NULL; - const qpol_level_t *level = NULL; - apol_mls_level_t *ap_mls_lvl = NULL; - qpol_policy_t *q = apol_policy_get_qpol(policydb); - - query = apol_level_query_create(); - if (!query) - goto cleanup; - if (apol_level_query_set_sens(policydb, query, name)) - goto cleanup; - if (apol_level_get_by_query(policydb, query, &v)) - goto cleanup; - - dict = PyDict_New(); - if (!dict) goto err; - for (i = 0; i < apol_vector_get_size(v); i++) { - level = apol_vector_get_element(v, i); - if (qpol_level_get_name(q, level, &lvl_name)) - goto err; - ap_mls_lvl = (apol_mls_level_t *) apol_mls_level_create_from_qpol_level_datum(policydb, level); - tmp = apol_mls_level_render(policydb, ap_mls_lvl); - apol_mls_level_destroy(&ap_mls_lvl); - if (!tmp) - goto cleanup; - if (py_insert_string(dict, lvl_name, tmp)) - goto err; - free(tmp); tmp = NULL; - if (rt) goto err; - } - - if (name && !apol_vector_get_size(v)) { - goto cleanup; - } - - goto cleanup; -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(error)); - py_decref(dict); dict = NULL; -cleanup: - free(tmp); - apol_level_query_destroy(&query); - apol_vector_destroy(&v); - errno = error; - return dict; -} - -/** - * Compare two qpol_cat_datum_t objects. - * This function is meant to be passed to apol_vector_compare - * as the callback for performing comparisons. - * - * @param datum1 Reference to a qpol_type_datum_t object - * @param datum2 Reference to a qpol_type_datum_t object - * @param data Reference to a policy - * @return Greater than 0 if the first argument is less than the second argument, - * less than 0 if the first argument is greater than the second argument, - * 0 if the arguments are equal - */ -static int qpol_cat_datum_compare(const void *datum1, const void *datum2, void *data) -{ - const qpol_cat_t *cat_datum1 = NULL, *cat_datum2 = NULL; - apol_policy_t *policydb = NULL; - qpol_policy_t *q; - uint32_t val1, val2; - - policydb = (apol_policy_t *) data; - q = apol_policy_get_qpol(policydb); - assert(policydb); - - if (!datum1 || !datum2) - goto exit_err; - cat_datum1 = datum1; - cat_datum2 = datum2; - - if (qpol_cat_get_value(q, cat_datum1, &val1)) - goto exit_err; - if (qpol_cat_get_value(q, cat_datum2, &val2)) - goto exit_err; - - return (val1 > val2) ? 1 : ((val1 == val2) ? 0 : -1); - - exit_err: - assert(0); - return 0; -} - -/** - * Compare two qpol_level_datum_t objects. - * This function is meant to be passed to apol_vector_compare - * as the callback for performing comparisons. - * - * @param datum1 Reference to a qpol_level_datum_t object - * @param datum2 Reference to a qpol_level_datum_t object - * @param data Reference to a policy - * @return Greater than 0 if the first argument is less than the second argument, - * less than 0 if the first argument is greater than the second argument, - * 0 if the arguments are equal - */ -static int qpol_level_datum_compare(const void *datum1, const void *datum2, void *data) -{ - const qpol_level_t *lvl_datum1 = NULL, *lvl_datum2 = NULL; - apol_policy_t *policydb = NULL; - qpol_policy_t *q; - uint32_t val1, val2; - - policydb = (apol_policy_t *) data; - assert(policydb); - q = apol_policy_get_qpol(policydb); - - if (!datum1 || !datum2) - goto exit_err; - lvl_datum1 = datum1; - lvl_datum2 = datum2; - - if (qpol_level_get_value(q, lvl_datum1, &val1)) - goto exit_err; - if (qpol_level_get_value(q, lvl_datum2, &val2)) - goto exit_err; - - return (val1 > val2) ? 1 : ((val1 == val2) ? 0 : -1); - - exit_err: - assert(0); - return 0; -} - -/** - * Gets a textual representation of a MLS category and - * all of that category's sensitivies. - * - * @param type_datum Reference to sepol type_datum - * @param policydb Reference to a policy - */ -static PyObject* get_cat_sens(const qpol_cat_t * cat_datum, const apol_policy_t * policydb) -{ - const char *cat_name, *lvl_name; - apol_level_query_t *query = NULL; - apol_vector_t *v = NULL; - const qpol_level_t *lvl_datum = NULL; - qpol_policy_t *q = apol_policy_get_qpol(policydb); - size_t i, n_sens = 0; - int error = 0; - PyObject *list = NULL; - PyObject *dict = PyDict_New(); - if (!dict) goto err; - if (!cat_datum || !policydb) - goto err; - - /* get category name for apol query */ - if (qpol_cat_get_name(q, cat_datum, &cat_name)) - goto cleanup; - - query = apol_level_query_create(); - if (!query) - goto err; - if (apol_level_query_set_cat(policydb, query, cat_name)) - goto err; - if (apol_level_get_by_query(policydb, query, &v)) - goto err; - apol_vector_sort(v, &qpol_level_datum_compare, (void *)policydb); - dict = PyDict_New(); - if (!dict) goto err; - if (py_insert_string(dict, "name", cat_name)) - goto err; - n_sens = apol_vector_get_size(v); - list = PyList_New(0); - if (!list) goto err; - for (i = 0; i < n_sens; i++) { - lvl_datum = (qpol_level_t *) apol_vector_get_element(v, i); - if (!lvl_datum) - goto err; - if (qpol_level_get_name(q, lvl_datum, &lvl_name)) - goto err; - if (py_append_string(list, lvl_name)) - goto err; - } - if (py_insert_obj(dict, "level", list)) - goto err; - Py_DECREF(list); - - goto cleanup; -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(list); list = NULL; - py_decref(dict); dict = NULL; -cleanup: - apol_level_query_destroy(&query); - apol_vector_destroy(&v); - errno = error; - return dict; -} - -/** - * Prints statistics regarding a policy's MLS categories. - * If this function is given a name, it will attempt to - * get statistics about a particular category; otherwise - * the function gets statistics about all of the policy's - * categories. - * - * @param name Reference to a MLS category's name; if NULL, - * all categories will be considered - * @param policydb Reference to a policy - * - * @return 0 on success, < 0 on error. - */ -static PyObject* get_cats(const char *name, const apol_policy_t * policydb) -{ - PyObject *obj = NULL; - apol_cat_query_t *query = NULL; - apol_vector_t *v = NULL; - const qpol_cat_t *cat_datum = NULL; - size_t i, n_cats; - int error = 0; - int rt; - PyObject *list = PyList_New(0); - if (!list) goto err; - - query = apol_cat_query_create(); - if (!query) - goto err; - if (apol_cat_query_set_cat(policydb, query, name)) - goto err; - if (apol_cat_get_by_query(policydb, query, &v)) - goto err; - n_cats = apol_vector_get_size(v); - apol_vector_sort(v, &qpol_cat_datum_compare, (void *)policydb); - - for (i = 0; i < n_cats; i++) { - cat_datum = apol_vector_get_element(v, i); - if (!cat_datum) - goto err; - obj = get_cat_sens(cat_datum, policydb); - if (!obj) - goto err; - rt = py_append_obj(list, obj); - Py_DECREF(obj); - if (rt) goto err; - } - - if (name && !n_cats) { - goto err; - } - - goto cleanup; -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(list); list = NULL; -cleanup: - apol_cat_query_destroy(&query); - apol_vector_destroy(&v); - errno = error; - return list; -} - -/** - * Get the alias of a type. - * - * @param type_datum Reference to sepol type_datum - * @param policydb Reference to a policy - * attributes - */ -static PyObject* get_type_aliases(const qpol_type_t * type_datum, const apol_policy_t * policydb) -{ - qpol_iterator_t *iter = NULL; - size_t alias_size; - unsigned char isattr, isalias; - const char *type_name = NULL; - const char *alias_name; - int error = 0; - qpol_policy_t *q = apol_policy_get_qpol(policydb); - PyObject *list = PyList_New(0); - if (!list) goto err; - - if (qpol_type_get_name(q, type_datum, &type_name)) - goto cleanup; - if (qpol_type_get_isattr(q, type_datum, &isattr)) - goto cleanup; - if (qpol_type_get_isalias(q, type_datum, &isalias)) - goto cleanup; - - if (qpol_type_get_alias_iter(q, type_datum, &iter)) - goto cleanup; - if (qpol_iterator_get_size(iter, &alias_size)) - goto cleanup; - if (alias_size > 0) { - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&alias_name)) - goto err; - if (py_append_string(list, alias_name)) - goto err; - } - } - goto cleanup; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(list); list = NULL; - -cleanup: - qpol_iterator_destroy(&iter); - errno = error; - return list; -} - -/** - * Gets a textual representation of an attribute, and - * all of that attribute's types. - * - * @param type_datum Reference to sepol type_datum - * @param policydb Reference to a policy - */ -static PyObject* get_attr(const qpol_type_t * type_datum, const apol_policy_t * policydb) -{ - PyObject *list = NULL; - const qpol_type_t *attr_datum = NULL; - qpol_iterator_t *iter = NULL; - const char *attr_name = NULL, *type_name = NULL; - qpol_policy_t *q = apol_policy_get_qpol(policydb); - unsigned char isattr; - int error = 0; - int rt = 0; - PyObject *dict = PyDict_New(); - if (!dict) goto err; - - if (qpol_type_get_name(q, type_datum, &attr_name)) - goto err; - - if (py_insert_string(dict, "name", attr_name)) - goto err; - - /* get an iterator over all types this attribute has */ - if (qpol_type_get_isattr(q, type_datum, &isattr)) - goto err; - - if (isattr) { /* sanity check */ - if (qpol_type_get_type_iter(q, type_datum, &iter)) - goto err; - list = PyList_New(0); - if (!list) goto err; - - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&attr_datum)) - goto err; - if (qpol_type_get_name(q, attr_datum, &type_name)) - goto err; - if (py_append_string(list, type_name)) - goto err; - } - qpol_iterator_destroy(&iter); - rt = PyDict_SetItemString(dict, "types", list); - Py_DECREF(list); list = NULL; - if (rt) goto err; - } else /* this should never happen */ - goto err; - goto cleanup; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(dict); dict = NULL; - py_decref(list); - -cleanup: - qpol_iterator_destroy(&iter); - errno = error; - return dict; -} - -/** - * Gets statistics regarding a policy's attributes. - * If this function is given a name, it will attempt to - * get statistics about a particular attribute; otherwise - * the function gets statistics about all of the policy's - * attributes. - * - * @param name Reference to an attribute's name; if NULL, - * all object classes will be considered - * @param policydb Reference to a policy - * - * @return 0 on success, < 0 on error. - */ -static PyObject* get_attribs(const char *name, const apol_policy_t * policydb) -{ - PyObject *obj; - apol_attr_query_t *attr_query = NULL; - apol_vector_t *v = NULL; - const qpol_type_t *type_datum = NULL; - size_t n_attrs, i; - int error = 0; - int rt = 0; - PyObject *list = PyList_New(0); - if (!list) goto err; - - /* we are only getting information about 1 attribute */ - if (name != NULL) { - attr_query = apol_attr_query_create(); - if (!attr_query) - goto err; - if (apol_attr_query_set_attr(policydb, attr_query, name)) - goto err; - if (apol_attr_get_by_query(policydb, attr_query, &v)) - goto err; - apol_attr_query_destroy(&attr_query); - if (apol_vector_get_size(v) == 0) { - apol_vector_destroy(&v); - errno = EINVAL; - goto err; - } - - type_datum = apol_vector_get_element(v, (size_t) 0); - obj = get_attr(type_datum, policydb); - rt = py_append_obj(list, obj); - Py_DECREF(obj); - if (rt) goto err; - } else { - attr_query = apol_attr_query_create(); - if (!attr_query) - goto err; - if (apol_attr_get_by_query(policydb, attr_query, &v)) - goto err; - apol_attr_query_destroy(&attr_query); - n_attrs = apol_vector_get_size(v); - - for (i = 0; i < n_attrs; i++) { - /* get qpol_type_t* item from vector */ - type_datum = (qpol_type_t *) apol_vector_get_element(v, (size_t) i); - if (!type_datum) - goto err; - obj = get_attr(type_datum, policydb); - rt = py_append_obj(list, obj); - Py_DECREF(obj); - if (rt) goto err; - } - } - apol_vector_destroy(&v); - goto cleanup; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(list); list = NULL; - -cleanup: - apol_attr_query_destroy(&attr_query); - apol_vector_destroy(&v); - errno = error; - return list; -} - -/** - * Get a textual representation of a type, and - * all of that type's attributes. - * - * @param type_datum Reference to sepol type_datum - * @param policydb Reference to a policy - */ -static PyObject* get_type_attrs(const qpol_type_t * type_datum, const apol_policy_t * policydb) -{ - qpol_iterator_t *iter = NULL; - const char *attr_name = NULL; - const qpol_type_t *attr_datum = NULL; - qpol_policy_t *q = apol_policy_get_qpol(policydb); - int error = 0; - PyObject *list = PyList_New(0); - if (!list) goto err; - - if (qpol_type_get_attr_iter(q, type_datum, &iter)) - goto err; - - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&attr_datum)) - goto err; - if (qpol_type_get_name(q, attr_datum, &attr_name)) - goto err; - if (py_append_string(list, attr_name)) - goto err; - } - goto cleanup; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(list); list = NULL; - -cleanup: - qpol_iterator_destroy(&iter); - errno = error; - return list; -} - -static PyObject* get_type(const qpol_type_t * type_datum, const apol_policy_t * policydb) { - - PyObject *obj; - qpol_policy_t *q = apol_policy_get_qpol(policydb); - const char *type_name = NULL; - int error = 0; - int rt; - unsigned char isalias, ispermissive, isattr; - PyObject *dict = PyDict_New(); - if (!dict) goto err; - - if (qpol_type_get_name(q, type_datum, &type_name)) - goto err; - if (qpol_type_get_isalias(q, type_datum, &isalias)) - goto err; - if (qpol_type_get_isattr(q, type_datum, &isattr)) - goto err; - if (qpol_type_get_ispermissive(q, type_datum, &ispermissive)) - goto err; - - if (py_insert_string(dict, "name", type_name)) - goto err; - - if (py_insert_bool(dict, "permissive", ispermissive)) - goto err; - - if (!isattr && !isalias) { - obj = get_type_attrs(type_datum, policydb); - rt = py_insert_obj(dict, "attributes", obj); - Py_DECREF(obj); - if (rt) goto err; - } - - obj = get_type_aliases(type_datum, policydb); - rt = py_insert_obj(dict, "aliases", obj); - Py_DECREF(obj); - if (rt) goto err; - goto cleanup; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(error)); - py_decref(dict); dict = NULL; - -cleanup: - errno = error; - return dict; -} - -/** - * Gets statistics regarding a policy's booleans. - * If this function is given a name, it will attempt to - * get statistics about a particular boolean; otherwise - * the function gets statistics about all of the policy's booleans. - * - * @param name Reference to a boolean's name; if NULL, - * all booleans will be considered - * @param policydb Reference to a policy - * - * @return new reference, or NULL (setting an exception) - */ -static PyObject* get_booleans(const char *name, const apol_policy_t * policydb) -{ - PyObject *dict = NULL; - int error = 0; - int rt = 0; - const char *bool_name = NULL; - int state; - qpol_bool_t *bool_datum = NULL; - qpol_iterator_t *iter = NULL; - qpol_policy_t *q = apol_policy_get_qpol(policydb); - size_t n_bools = 0; - PyObject *list = PyList_New(0); - if (!list) goto err; - - if (name != NULL) { - if (qpol_policy_get_bool_by_name(q, name, &bool_datum)) - goto err; - if (qpol_bool_get_state(q, bool_datum, &state)) - goto err; - - dict = PyDict_New(); - if (!dict) goto err; - if (py_insert_string(dict, "name", name)) - goto err; - if (py_insert_bool(dict, "name", state)) - goto err; - rt = py_append_obj(list, dict); - Py_DECREF(dict); dict = NULL; - if (rt) goto err; - } else { - if (qpol_policy_get_bool_iter(q, &iter)) - goto err; - if (qpol_iterator_get_size(iter, &n_bools)) - goto err; - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&bool_datum)) - goto err; - if (qpol_bool_get_name(q, bool_datum, &bool_name)) - goto err; - if (qpol_bool_get_state(q, bool_datum, &state)) - goto err; - - dict = PyDict_New(); - if (!dict) goto err; - if (py_insert_string(dict, "name", bool_name)) - goto err; - if (py_insert_bool(dict, "state", state)) - goto err; - rt = py_append_obj(list, dict); - Py_DECREF(dict); dict = NULL; - if (rt) goto err; - } - qpol_iterator_destroy(&iter); - } - goto cleanup; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(error)); - py_decref(list); list = NULL; - py_decref(dict); dict = NULL; - -cleanup: - qpol_iterator_destroy(&iter); - errno = error; - return list; -} - -/** - * Gets a textual representation of a user, and - * all of that user's roles. - * - * @param type_datum Reference to sepol type_datum - * @param policydb Reference to a policy - * roles - */ -static PyObject* get_user(const qpol_user_t * user_datum, const apol_policy_t * policydb) -{ - int error = 0; - int rt; - const qpol_role_t *role_datum = NULL; - qpol_iterator_t *iter = NULL; - const qpol_mls_range_t *range = NULL; - const qpol_mls_level_t *dflt_level = NULL; - apol_mls_level_t *ap_lvl = NULL; - apol_mls_range_t *ap_range = NULL; - qpol_policy_t *q = apol_policy_get_qpol(policydb); - char *tmp = NULL; - const char *user_name, *role_name; - PyObject *dict = NULL; - PyObject *list = PyList_New(0); - if (!list) goto err; - - if (qpol_user_get_name(q, user_datum, &user_name)) - goto err; - - dict = PyDict_New(); - if (!dict) goto err; - - if (py_insert_string(dict, "name", user_name)) - goto err; - - if (qpol_policy_has_capability(q, QPOL_CAP_MLS)) { - if (qpol_user_get_dfltlevel(q, user_datum, &dflt_level)) - goto err; - ap_lvl = apol_mls_level_create_from_qpol_mls_level(policydb, dflt_level); - tmp = apol_mls_level_render(policydb, ap_lvl); - if (!tmp) goto err; - if (py_insert_string(dict, "level", tmp)) - goto err; - free(tmp); tmp = NULL; - - if (qpol_user_get_range(q, user_datum, &range)) - goto err; - ap_range = apol_mls_range_create_from_qpol_mls_range(policydb, range); - tmp = apol_mls_range_render(policydb, ap_range); - if (!tmp) goto err; - if (py_insert_string(dict, "range", tmp)) - goto err; - free(tmp); tmp=NULL; - } - - if (qpol_user_get_role_iter(q, user_datum, &iter)) - goto err; - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&role_datum)) - goto err; - if (qpol_role_get_name(q, role_datum, &role_name)) - goto err; - if (py_append_string(list, role_name)) - goto err; - } - - rt = py_insert_obj(dict, "roles", list); - Py_DECREF(list); list=NULL; - if (rt) goto err; - goto cleanup; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(list); list=NULL; - py_decref(dict); dict=NULL; - -cleanup: - free(tmp); - qpol_iterator_destroy(&iter); - apol_mls_level_destroy(&ap_lvl); - apol_mls_range_destroy(&ap_range); - errno = error; - return dict; -} - -/** - * Prints a textual representation of an object class and possibly - * all of that object class' permissions. - * - * @param type_datum Reference to sepol type_datum - * @param policydb Reference to a policy - */ -static PyObject* get_class(const qpol_class_t * class_datum, const apol_policy_t * policydb) -{ - const char *class_name = NULL, *perm_name = NULL; - qpol_iterator_t *iter = NULL; - const qpol_common_t *common_datum = NULL; - qpol_policy_t *q = apol_policy_get_qpol(policydb); - int error = 0; - int rt; - PyObject *list = NULL; - PyObject *dict = PyDict_New(); - if (!dict) goto err; - - if (!class_datum) - goto err; - - if (qpol_class_get_name(q, class_datum, &class_name)) - goto err; - - if (py_insert_string(dict, "name", class_name)) - goto err; - /* get commons for this class */ - if (qpol_class_get_common(q, class_datum, &common_datum)) - goto err; - - list = PyList_New(0); - if (!list) goto err; - - if (common_datum) { - if (qpol_common_get_perm_iter(q, common_datum, &iter)) - goto err; - /* print perms for the common */ - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&perm_name)) - goto err; - if (py_append_string(list, perm_name)) - goto err; - } - } - /* print unique perms for this class */ - if (qpol_class_get_perm_iter(q, class_datum, &iter)) - goto err; - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&perm_name)) - goto err; - if (py_append_string(list, perm_name)) - goto err; - } - rt = py_insert_obj(dict, "permlist", list); - Py_DECREF(list); list = NULL; - if (rt) goto err; - qpol_iterator_destroy(&iter); - goto cleanup; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(list); list=NULL; - py_decref(dict); dict=NULL; - -cleanup: - errno = error; - qpol_iterator_destroy(&iter); - return dict; -} - -/** - * Get statistics regarding a policy's object classes. - * If this function is given a name, it will attempt to - * print statistics about a particular object class; otherwise - * the function prints statistics about all of the policy's object - * classes. - * - * @param name Reference to an object class' name; if NULL, - * all object classes will be considered - * @param policydb Reference to a policy - * - * @return 0 on success, < 0 on error. - */ -static PyObject* get_classes(const char *name, const apol_policy_t * policydb) -{ - qpol_iterator_t *iter = NULL; - size_t n_classes = 0; - const qpol_class_t *class_datum = NULL; - qpol_policy_t *q = apol_policy_get_qpol(policydb); - int error = 0; - int rt; - PyObject *obj; - PyObject *list = PyList_New(0); - if (!list) goto err; - - if (name != NULL) { - if (qpol_policy_get_class_by_name(q, name, &class_datum)) - goto err; - obj = get_class(class_datum, policydb); - rt = py_append_obj(list, obj); - Py_DECREF(obj); - if (rt) goto err; - } else { - if (qpol_policy_get_class_iter(q, &iter)) - goto err; - if (qpol_iterator_get_size(iter, &n_classes)) - goto err; - - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&class_datum)) - goto err; - obj = get_class(class_datum, policydb); - rt = py_append_obj(list, obj); - Py_DECREF(obj); - if (rt) goto err; - } - qpol_iterator_destroy(&iter); - } - goto cleanup; -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(list); list = NULL; - -cleanup: - qpol_iterator_destroy(&iter); - errno = error; - return list; -} - -/** - * Gets statistics regarding a policy's users. - * If this function is given a name, it will attempt to - * get statistics about a particular user; otherwise - * the function gets statistics about all of the policy's - * users. - * - * @param name Reference to a user's name; if NULL, - * all users will be considered - * @param policydb Reference to a policy - * - * @return 0 on success, < 0 on error. - */ -static PyObject* get_users(const char *name, const apol_policy_t * policydb) -{ - qpol_iterator_t *iter = NULL; - const qpol_user_t *user_datum = NULL; - qpol_policy_t *q = apol_policy_get_qpol(policydb); - int error = 0; - int rt; - PyObject *obj; - PyObject *list = PyList_New(0); - if (!list) goto err; - - if (name != NULL) { - if (qpol_policy_get_user_by_name(q, name, &user_datum)) { - errno = EINVAL; - goto err; - } - obj = get_user(user_datum, policydb); - rt = py_append_obj(list, obj); - Py_DECREF(obj); - if (rt) goto err; - } else { - if (qpol_policy_get_user_iter(q, &iter)) - goto err; - - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&user_datum)) - goto err; - obj = get_user(user_datum, policydb); - rt = py_append_obj(list, obj); - Py_DECREF(obj); - if (rt) goto err; - } - qpol_iterator_destroy(&iter); - } - goto cleanup; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(list); list = NULL; - -cleanup: - qpol_iterator_destroy(&iter); - errno = error; - return list; -} - -/** - * get a textual representation of a role, and - * all of that role's types. - * - * @param type_datum Reference to sepol type_datum - * @param policydb Reference to a policy - * types - */ -static PyObject* get_role(const qpol_role_t * role_datum, const apol_policy_t * policydb) -{ - const char *role_name = NULL, *type_name = NULL; - const qpol_role_t *dom_datum = NULL; - const qpol_type_t *type_datum = NULL; - qpol_iterator_t *iter = NULL; - qpol_policy_t *q = apol_policy_get_qpol(policydb); - size_t n_dom = 0, n_types = 0; - int error = 0; - int rt; - PyObject *list = NULL; - PyObject *dict = PyDict_New(); - if (!dict) goto err; - - if (qpol_role_get_name(q, role_datum, &role_name)) - goto err; - if (py_insert_string(dict, "name", role_name)) - goto err; - - if (qpol_role_get_dominate_iter(q, role_datum, &iter)) - goto err; - if (qpol_iterator_get_size(iter, &n_dom)) - goto err; - if ((int)n_dom > 0) { - list = PyList_New(0); - if (!list) goto err; - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&dom_datum)) - goto err; - if (qpol_role_get_name(q, dom_datum, &role_name)) - goto err; - if (py_append_string(list, role_name)) - goto err; - } - rt = py_insert_obj(dict, "roles", list); - Py_DECREF(list); list = NULL; - if (rt) goto err; - } - qpol_iterator_destroy(&iter); - - if (qpol_role_get_type_iter(q, role_datum, &iter)) - goto err; - if (qpol_iterator_get_size(iter, &n_types)) - goto err; - if ((int)n_types > 0) { - list = PyList_New(0); - if (!list) goto err; - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&type_datum)) - goto err; - if (qpol_type_get_name(q, type_datum, &type_name)) - goto err; - if (py_append_string(list, type_name)) - goto err; - } - rt = py_insert_obj(dict, "types", list); - Py_DECREF(list); list = NULL; - if (rt) goto err; - } - goto cleanup; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(list); list = NULL; - py_decref(dict); dict = NULL; - -cleanup: - qpol_iterator_destroy(&iter); - errno = error; - return dict; -} - -/** - * Get statistics regarding a policy's ports. - * If this function is given a name, it will attempt to - * get statistics about a particular port; otherwise - * the function get statistics about all of the policy's ports. - * - * @param name Reference to an port's name; if NULL, - * all ports will be considered - * @param policydb Reference to a policy - * - * @return 0 on success, < 0 on error. - */ -static PyObject* get_ports(const char *num, const apol_policy_t * policydb) -{ - const qpol_portcon_t *portcon = NULL; - qpol_iterator_t *iter = NULL; - uint16_t low_port, high_port; - uint8_t ocon_proto; - qpol_policy_t *q = apol_policy_get_qpol(policydb); - const qpol_context_t *ctxt = NULL; - const char *proto_str = NULL; - const char *type = NULL; - const apol_mls_range_t *range = NULL; - char *range_str = NULL; - apol_context_t *c = NULL; - int error = 0; - int rt = 0; - PyObject *dict = NULL; - PyObject *list = PyList_New(0); - if (!list) goto err; - - if (qpol_policy_get_portcon_iter(q, &iter)) - goto err; - - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&portcon)) - goto err; - if (qpol_portcon_get_low_port(q, portcon, &low_port)) - goto err; - if (qpol_portcon_get_high_port(q, portcon, &high_port)) - goto err; - if (qpol_portcon_get_protocol(q, portcon, &ocon_proto)) - goto err; - if (num) { - if (atoi(num) < low_port || atoi(num) > high_port) - continue; - } - - if ((ocon_proto != IPPROTO_TCP) && - (ocon_proto != IPPROTO_UDP)) - goto err; - - if (qpol_portcon_get_context(q, portcon, &ctxt)) { - PyErr_SetString(PyExc_RuntimeError, "Could not get for port context."); - goto err; - } - - if ((proto_str = apol_protocol_to_str(ocon_proto)) == NULL) { - PyErr_SetString(PyExc_RuntimeError, "Invalid protocol for port"); - goto err; - } - - if ((c = apol_context_create_from_qpol_context(policydb, ctxt)) == NULL) { - goto err; - } - - if((type = apol_context_get_type(c)) == NULL) { - apol_context_destroy(&c); - goto err; - } - - dict = PyDict_New(); - if (!dict) goto err; - if (py_insert_string(dict, "type", type)) - goto err; - - if((range = apol_context_get_range(c)) != NULL) { - range_str = apol_mls_range_render(policydb, range); - if (range_str == NULL) { - goto err; - } - if (py_insert_string(dict, "range", range_str)) - goto err; - } - - if (py_insert_string(dict, "protocol", proto_str)) - goto err; - - if (py_insert_long(dict, "high", high_port)) - goto err; - - if (py_insert_long(dict, "low", low_port)) - goto err; - - rt = py_append_obj(list, dict); - Py_DECREF(dict); dict = NULL; - if (rt) goto err; - } - goto cleanup; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(list); list = NULL; - py_decref(dict); dict = NULL; - -cleanup: - free(range_str); - apol_context_destroy(&c); - qpol_iterator_destroy(&iter); - errno = error; - return list; -} - -/** - * Get statistics regarding a policy's roles. - * If this function is given a name, it will attempt to - * get statistics about a particular role; otherwise - * the function get statistics about all of the policy's roles. - * - * @param name Reference to an role's name; if NULL, - * all roles will be considered - * @param policydb Reference to a policy - * - * @return 0 on success, < 0 on error. - */ -static PyObject* get_roles(const char *name, const apol_policy_t * policydb) -{ - const qpol_role_t *role_datum = NULL; - qpol_iterator_t *iter = NULL; - qpol_policy_t *q = apol_policy_get_qpol(policydb); - int error = 0; - int rt; - PyObject *obj; - PyObject *list = PyList_New(0); - if (!list) goto err; - - if (name != NULL) { - if (qpol_policy_get_role_by_name(q, name, &role_datum)) { - errno = EINVAL; - goto err; - } - obj = get_role(role_datum, policydb); - rt = py_append_obj(list, obj); - Py_DECREF(obj); - if (rt) goto err; - } else { - if (qpol_policy_get_role_iter(q, &iter)) - goto err; - - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&role_datum)) - goto err; - obj = get_role(role_datum, policydb); - rt = py_append_obj(list, obj); - Py_DECREF(obj); - if (rt) goto err; - } - qpol_iterator_destroy(&iter); - } - goto cleanup; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(list); list = NULL; - -cleanup: - qpol_iterator_destroy(&iter); - errno = error; - return list; -} - -/** - * Get statistics regarding a policy's types. - * If this function is given a name, it will attempt to - * print statistics about a particular type; otherwise - * the function prints statistics about all of the policy's types. - * - * @param name Reference to a type's name; if NULL, - * all object classes will be considered - * @param policydb Reference to a policy - * - * @return 0 on success, < 0 on error. - */ -static PyObject* get_types(const char *name, const apol_policy_t * policydb) -{ - const qpol_type_t *type_datum = NULL; - qpol_iterator_t *iter = NULL; - qpol_policy_t *q = apol_policy_get_qpol(policydb); - int error = 0; - int rt; - PyObject *obj; - PyObject *list = PyList_New(0); - if (!list) goto err; - /* if name was provided, only print that name */ - if (name != NULL) { - if (qpol_policy_get_type_by_name(q, name, &type_datum)) { - errno = EINVAL; - goto err; - } - obj = get_type(type_datum, policydb); - rt = py_append_obj(list, obj); - Py_DECREF(obj); - if (rt) goto err; - } else { - if (qpol_policy_get_type_iter(q, &iter)) - goto err; - - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&type_datum)) - goto err; - obj = get_type(type_datum, policydb); - rt = py_append_obj(list, obj); - Py_DECREF(obj); - if (rt) goto err; - } - } - goto cleanup; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(list); list = NULL; - -cleanup: - qpol_iterator_destroy(&iter); - errno = error; - return list; -} - -PyObject* info( int type, const char *name) -{ - PyObject* output = NULL; - - switch(type) { - /* display requested info */ - case TYPE: - output = get_types(name, global_policy); - break; - case ATTRIBUTE: - output = get_attribs(name, global_policy); - break; - case ROLE: - output = get_roles(name, global_policy); - break; - case USER: - output = get_users(name, global_policy); - break; - case CLASS: - output = get_classes(name, global_policy); - break; - case BOOLEAN: - output = get_booleans(name, global_policy); - break; - case PORT: - output = get_ports(name, global_policy); - break; - case SENS: - output = get_sens(name, global_policy); - break; - case CATS: - output = get_cats(name, global_policy); - break; - default: - errno = EINVAL; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - break; - } - - return output; -} - -PyObject *wrap_info(PyObject *UNUSED(self), PyObject *args){ - int type; - const char *name; - - if (!global_policy) { - PyErr_SetString(PyExc_RuntimeError,"Policy not loaded"); - return NULL; - } - - if (!PyArg_ParseTuple(args, "iz", &type, &name)) - return NULL; - - return info(type, name); -} - -void init_info (PyObject *m) { - PyModule_AddIntConstant(m, "ATTRIBUTE", ATTRIBUTE); - PyModule_AddIntConstant(m, "PORT", PORT); - PyModule_AddIntConstant(m, "ROLE", ROLE); - PyModule_AddIntConstant(m, "TYPE", TYPE); - PyModule_AddIntConstant(m, "USER", USER); - PyModule_AddIntConstant(m, "CLASS", CLASS); - PyModule_AddIntConstant(m, "BOOLEAN", BOOLEAN); - PyModule_AddIntConstant(m, "SENS", SENS); - PyModule_AddIntConstant(m, "CATS", CATS); -} diff --git a/policycoreutils/sepolicy/policy.c b/policycoreutils/sepolicy/policy.c deleted file mode 100644 index 423a926..0000000 --- a/policycoreutils/sepolicy/policy.c +++ /dev/null @@ -1,116 +0,0 @@ -/** - * @file - * Python bindings to search SELinux Policy rules. - * - * @author Dan Walsh - * - * Copyright (C) 2012 Red Hat, INC - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - */ - -#include "Python.h" - -#ifdef UNUSED -#elif defined(__GNUC__) -# define UNUSED(x) UNUSED_ ## x __attribute__((unused)) -#elif defined(__LCLINT__) -# define UNUSED(x) /*@unused@*/ x -#else -# define UNUSED(x) x -#endif - -#include "policy.h" -apol_policy_t *global_policy = NULL; - -/* other */ -#include -#include -#include -#include -#include - -#define COPYRIGHT_INFO "Copyright (C) 2003-2007 Tresys Technology, LLC" - -PyObject *wrap_policy(PyObject *UNUSED(self), PyObject *args){ - const char *policy_file; - apol_vector_t *mod_paths = NULL; - apol_policy_path_type_e path_type = APOL_POLICY_PATH_TYPE_MONOLITHIC; - apol_policy_path_t *pol_path = NULL; - - if (!PyArg_ParseTuple(args, "z", &policy_file)) - return NULL; - - if (global_policy) - apol_policy_destroy(&global_policy); - - int policy_load_options = 0; - - pol_path = apol_policy_path_create(path_type, policy_file, mod_paths); - if (!pol_path) { - apol_vector_destroy(&mod_paths); - PyErr_SetString(PyExc_RuntimeError,strerror(ENOMEM)); - return NULL; - } - apol_vector_destroy(&mod_paths); - - global_policy = apol_policy_create_from_policy_path(pol_path, policy_load_options, NULL, NULL); - apol_policy_path_destroy(&pol_path); - if (!global_policy) { - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - return NULL; - } - - return Py_None; -} - -static PyMethodDef methods[] = { - {"policy", (PyCFunction) wrap_policy, METH_VARARGS, - "Initialize SELinux policy for use with search and info"}, - {"info", (PyCFunction) wrap_info, METH_VARARGS, - "Return SELinux policy info about types, attributes, roles, users"}, - {"search", (PyCFunction) wrap_search, METH_VARARGS, - "Search SELinux Policy for allow, neverallow, auditallow, dontaudit and transition records"}, - {NULL, NULL, 0, NULL} /* sentinel */ -}; - -#if PY_MAJOR_VERSION >= 3 - -static struct PyModuleDef module_def = -{ - PyModuleDef_HEAD_INIT, - "_policy", /* name of module */ - "", /* module documentation, may be NULL */ - -1, /* size of per-interpreter state of the module, or -1 if the module keeps state in global variables. */ - (PyMethodDef*)&methods, -}; - -PyMODINIT_FUNC PyInit__policy(void) -{ - PyObject *m; - m = PyModule_Create(&module_def); - init_info(m); - return m; -} - -#else // python 2 - -void init_policy(void) { - PyObject *m; - m = Py_InitModule("_policy", methods); - init_info(m); -} - -#endif diff --git a/policycoreutils/sepolicy/policy.h b/policycoreutils/sepolicy/policy.h deleted file mode 100644 index ffac497..0000000 --- a/policycoreutils/sepolicy/policy.h +++ /dev/null @@ -1,7 +0,0 @@ -#include -extern apol_policy_t *global_policy; -extern PyObject *wrap_info(PyObject *self, PyObject *args); -extern void init_info (PyObject *m); -extern PyObject *wrap_search(PyObject *self, PyObject *args); - - diff --git a/policycoreutils/sepolicy/search.c b/policycoreutils/sepolicy/search.c deleted file mode 100644 index d608006..0000000 --- a/policycoreutils/sepolicy/search.c +++ /dev/null @@ -1,1029 +0,0 @@ -// Author: Thomas Liu - -/** - * @file - * Python bindings used to search TE rules. - * - * @author Thomas Liu - * @author Dan Walsh - * Copyright (C) 2012-2013 Red Hat, inc - * - * Sections copied from sesearch.c in setools package - * @author Frank Mayer mayerf@tresys.com - * @author Jeremy A. Mowery jmowery@tresys.com - * @author Paul Rosenfeld prosenfeld@tresys.com - * Copyright (C) 2003-2008 Tresys Technology, LLC - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - */ - -/** - * This is a modified version of sesearch to be used as part of a sepython library for - * Python bindings. - */ - -#include "common.h" -#include "policy.h" - -/* libapol */ -#include -#include -#include -#include - -/* libqpol*/ -#include -#include -#include -#include - -/* other */ -#include -#include -#include -#include -#include -#include -#include - -#define COPYRIGHT_INFO "Copyright (C) 2012 Red Hat, Inc, Tresys Technology, LLC" - -enum opt_values -{ - RULE_NEVERALLOW = 256, RULE_AUDIT, RULE_AUDITALLOW, RULE_DONTAUDIT, - RULE_ROLE_ALLOW, RULE_ROLE_TRANS, RULE_RANGE_TRANS, RULE_ALL, - EXPR_ROLE_SOURCE, EXPR_ROLE_TARGET -}; - -; - -typedef struct options -{ - char *src_name; - char *tgt_name; - char *src_role_name; - char *tgt_role_name; - char *class_name; - char *permlist; - char *bool_name; - apol_vector_t *class_vector; - bool all; - bool lineno; - bool semantic; - bool indirect; - bool allow; - bool nallow; - bool auditallow; - bool dontaudit; - bool type; - bool rtrans; - bool role_allow; - bool role_trans; - bool useregex; - bool show_cond; - apol_vector_t *perm_vector; -} options_t; - -static int py_tuple_insert_obj(PyObject *tuple, int pos, PyObject *obj) -{ - int rt; - if (!obj) return -1; - rt = PyTuple_SetItem(tuple, pos, obj); - return rt; -} - -static int perform_ra_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v) -{ - apol_role_allow_query_t *raq = NULL; - int error = 0; - - if (!policy || !opt || !v) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return -1; - } - - if (!opt->role_allow && !opt->all) { - *v = NULL; - return 0; /* no search to do */ - } - - raq = apol_role_allow_query_create(); - if (!raq) { - ERR(policy, "%s", strerror(ENOMEM)); - errno = ENOMEM; - return -1; - } - - apol_role_allow_query_set_regex(policy, raq, opt->useregex); - if (opt->src_role_name) { - if (apol_role_allow_query_set_source(policy, raq, opt->src_role_name)) { - error = errno; - goto err; - } - } - if (opt->tgt_role_name) - if (apol_role_allow_query_set_target(policy, raq, opt->tgt_role_name)) { - error = errno; - goto err; - } - - if (apol_role_allow_get_by_query(policy, raq, v)) { - error = errno; - goto err; - } - apol_role_allow_query_destroy(&raq); - return 0; - - err: - apol_vector_destroy(v); - apol_role_allow_query_destroy(&raq); - ERR(policy, "%s", strerror(error)); - errno = error; - return -1; -} - -static PyObject* get_ra_results(const apol_policy_t * policy, const apol_vector_t * v, PyObject *output) -{ - size_t i, num_rules = 0; - qpol_policy_t *q; - const qpol_role_allow_t *rule = NULL; - const char *tmp; - PyObject *obj, *dict=NULL; - const qpol_role_t *role = NULL; - int error = 0; - errno = EINVAL; - int rt; - - if (!policy || !v) { - errno = EINVAL; - goto err; - } - - if (!(num_rules = apol_vector_get_size(v))) - return NULL; - - q = apol_policy_get_qpol(policy); - - for (i = 0; i < num_rules; i++) { - dict = PyDict_New(); - if (!dict) goto err; - if (!(rule = apol_vector_get_element(v, i))) - goto err; - - if (qpol_role_allow_get_source_role(q, rule, &role)) { - goto err; - } - if (qpol_role_get_name(q, role, &tmp)) { - goto err; - } - obj = PyString_FromString(tmp); - if (py_insert_obj(dict, "source", obj)) - goto err; - - if (qpol_role_allow_get_target_role(q, rule, &role)) { - goto err; - } - if (qpol_role_get_name(q, role, &tmp)) { - goto err; - } - obj = PyString_FromString(tmp); - if (py_insert_obj(dict, "target", obj)) - goto err; - - rt = py_append_obj(output, dict); - if (rt) goto err; - py_decref(dict); dict=NULL; - } - goto cleanup; -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(error)); - py_decref(dict); - -cleanup: - errno = error; - return output; -} - -static int perform_te_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v) -{ - apol_terule_query_t *teq = NULL; - unsigned int rules = 0; - int error = 0; - size_t i; - - if (!policy || !opt || !v) { - PyErr_SetString(PyExc_RuntimeError,strerror(EINVAL)); - errno = EINVAL; - return -1; - } - - if (opt->all || opt->type) { - rules = (QPOL_RULE_TYPE_TRANS | QPOL_RULE_TYPE_CHANGE | QPOL_RULE_TYPE_MEMBER); - } else { - *v = NULL; - return 0; /* no search to do */ - } - - teq = apol_terule_query_create(); - if (!teq) { - PyErr_SetString(PyExc_RuntimeError,strerror(ENOMEM)); - errno = ENOMEM; - return -1; - } - - apol_terule_query_set_rules(policy, teq, rules); - apol_terule_query_set_regex(policy, teq, opt->useregex); - - if (opt->src_name) - apol_terule_query_set_source(policy, teq, opt->src_name, opt->indirect); - if (opt->tgt_name) - apol_terule_query_set_target(policy, teq, opt->tgt_name, opt->indirect); - if (opt->bool_name) - apol_terule_query_set_bool(policy, teq, opt->bool_name); - if (opt->class_name) { - if (opt->class_vector == NULL) { - if (apol_terule_query_append_class(policy, teq, opt->class_name)) { - error = errno; - goto err; - } - } else { - for (i = 0; i < apol_vector_get_size(opt->class_vector); ++i) { - char *class_name; - class_name = apol_vector_get_element(opt->class_vector, i); - if (!class_name) - continue; - if (apol_terule_query_append_class(policy, teq, class_name)) { - error = errno; - goto err; - } - } - } - } - - if (!(opt->semantic) && qpol_policy_has_capability(apol_policy_get_qpol(policy), QPOL_CAP_SYN_RULES)) { - if (apol_syn_terule_get_by_query(policy, teq, v)) { - goto err; - } - } else { - if (apol_terule_get_by_query(policy, teq, v)) { - goto err; - } - } - - apol_terule_query_destroy(&teq); - return 0; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(error)); - apol_vector_destroy(v); - apol_terule_query_destroy(&teq); - errno = error; - return -1; -} - -static PyObject* get_bool(const qpol_policy_t *q, const qpol_cond_t * cond, int enabled) -{ - qpol_iterator_t *iter = NULL; - qpol_cond_expr_node_t *expr = NULL; - char *tmp = NULL; - const char *bool_name = NULL; - int error = 0; - uint32_t expr_type = 0; - qpol_bool_t *cond_bool = NULL; - PyObject *obj, *tuple = NULL; - PyObject *boollist = NULL; - - if (!q || !cond) { - errno = EINVAL; - return NULL; - } - if (qpol_cond_get_expr_node_iter(q, cond, &iter) < 0) { - goto err; - } - - boollist = PyList_New(0); - if (! boollist) goto err; - - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&expr)) { - goto err; - } - if (qpol_cond_expr_node_get_expr_type(q, expr, &expr_type)) { - goto err; - } - if (expr_type != QPOL_COND_EXPR_BOOL) { - obj = PyString_FromString(apol_cond_expr_type_to_str(expr_type)); - if (!obj) goto err; - if (py_append_obj(boollist, obj)) - goto err; - } else { - tuple = PyTuple_New(2); - if (!tuple) goto err; - - if (qpol_cond_expr_node_get_bool(q, expr, &cond_bool)) { - goto err; - } - if (qpol_bool_get_name(q, cond_bool, &bool_name)) { - goto err; - } - obj = PyString_FromString(bool_name); - if (py_tuple_insert_obj(tuple, 0, obj)) - goto err; - obj = PyBool_FromLong(enabled); - if (py_tuple_insert_obj(tuple, 1, obj)) - goto err; - if (py_append_obj(boollist, tuple)) - goto err; - tuple=NULL; - } - } - - qpol_iterator_destroy(&iter); - return boollist; - - err: - error = errno; - qpol_iterator_destroy(&iter); - py_decref(tuple); - py_decref(boollist); - free(tmp); - errno = error; - return NULL; -} - -static PyObject* get_te_results(const apol_policy_t * policy, const apol_vector_t * v, PyObject *output) -{ - int error = 0; - int rt = 0; - PyObject *obj, *dict=NULL, *tuple = NULL; - qpol_policy_t *q; - uint32_t rule_type = 0; - const qpol_type_t *type; - size_t i, num_rules = 0; - const qpol_terule_t *rule = NULL; - char *tmp = NULL, *rule_str = NULL, *expr = NULL; - const qpol_cond_t *cond = NULL; - uint32_t enabled = 0; - const char *tmp_name; - const qpol_class_t *obj_class = NULL; - - if (!policy || !v) { - errno = EINVAL; - goto err; - } - - if (!(num_rules = apol_vector_get_size(v))) - return NULL; - - q = apol_policy_get_qpol(policy); - - for (i = 0; i < num_rules; i++) { - dict = PyDict_New(); - if (!dict) goto err; - if (!(rule = apol_vector_get_element(v, i))) - goto err; - if (qpol_terule_get_cond(q, rule, &cond)) - goto err; - if (qpol_terule_get_is_enabled(q, rule, &enabled)) - goto err; - - if (cond) { - obj = get_bool(q, cond, enabled); - if (!obj) goto err; - rt = PyDict_SetItemString(dict, "boolean", obj); - py_decref(obj); - } - - if (qpol_terule_get_rule_type(q, rule, &rule_type)) - goto err; - - if (!(rule_type &= (QPOL_RULE_TYPE_TRANS | QPOL_RULE_TYPE_CHANGE | QPOL_RULE_TYPE_MEMBER))) { - PyErr_SetString(PyExc_RuntimeError,"Invalid TE rule type"); - errno = EINVAL; - goto err; - } - if (!(tmp_name = apol_rule_type_to_str(rule_type))) { - PyErr_SetString(PyExc_RuntimeError, "Could not get TE rule type's string"); - errno = EINVAL; - goto err; - } - - if (py_insert_string(dict, "type", tmp_name)) - goto err; - - if (qpol_terule_get_source_type(q, rule, &type)) - goto err; - if (qpol_type_get_name(q, type, &tmp_name)) - goto err; - if (py_insert_string(dict, "source", tmp_name)) - goto err; - - if (qpol_terule_get_target_type(q, rule, &type)) - goto err; - if (qpol_type_get_name(q, type, &tmp_name)) - goto err; - if (py_insert_string(dict, "target", tmp_name)) - goto err; - - if (qpol_terule_get_object_class(q, rule, &obj_class)) - goto err; - if (qpol_class_get_name(q, obj_class, &tmp_name)) - goto err; - if (py_insert_string(dict, "class", tmp_name)) - goto err; - - if (qpol_terule_get_default_type(q, rule, &type)) - goto err; - if (qpol_type_get_name(q, type, &tmp_name)) - goto err; - if (py_insert_string(dict, "transtype", tmp_name)) - goto err; - - rt = py_append_obj(output, dict); - dict = NULL; - if(rt) goto err; - - free(rule_str); rule_str = NULL; - free(expr); expr = NULL; - } - goto cleanup; - -err: - error = errno; - py_decref(dict); - py_decref(tuple); - PyErr_SetString(PyExc_RuntimeError,strerror(error)); -cleanup: - free(tmp); - free(rule_str); - free(expr); - errno = error; - return output; -} - -static int perform_ft_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v) -{ - apol_filename_trans_query_t *ftq = NULL; - size_t i; - int error = 0; - - if (!policy || !opt || !v) { - PyErr_SetString(PyExc_RuntimeError,strerror(EINVAL)); - errno = EINVAL; - return -1; - } - - if (!opt->type && !opt->all) { - *v = NULL; - return 0; /* no search to do */ - } - - ftq = apol_filename_trans_query_create(); - if (!ftq) { - PyErr_SetString(PyExc_RuntimeError,strerror(ENOMEM)); - errno = ENOMEM; - return -1; - } - - apol_filename_trans_query_set_regex(policy, ftq, opt->useregex); - if (opt->src_name) { - if (apol_filename_trans_query_set_source(policy, ftq, opt->src_name, opt->indirect)) { - goto err; - } - } - - if (opt->tgt_name) { - if (apol_filename_trans_query_set_target(policy, ftq, opt->tgt_name, opt->indirect)) { - goto err; - } - } - if (opt->class_name) { - if (opt->class_vector == NULL) { - if (apol_filename_trans_query_append_class(policy, ftq, opt->class_name)) { - goto err; - } - } else { - for (i = 0; i < apol_vector_get_size(opt->class_vector); ++i) { - char *class_name; - class_name = apol_vector_get_element(opt->class_vector, i); - if (!class_name) - continue; - if (apol_filename_trans_query_append_class(policy, ftq, class_name)) { - goto err; - } - } - } - } - - if (apol_filename_trans_get_by_query(policy, ftq, v)) - goto err; - - apol_filename_trans_query_destroy(&ftq); - return 0; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - apol_vector_destroy(v); - apol_filename_trans_query_destroy(&ftq); - errno = error; - return -1; -} - -static PyObject* get_ft_results(const apol_policy_t * policy, const apol_vector_t * v, PyObject *list) -{ - PyObject *dict = NULL; - size_t i, num_filename_trans = 0; - const char *tmp_name; - int error = 0; - int rt; - const qpol_filename_trans_t *filename_trans = NULL; - const qpol_class_t *obj_class = NULL; - char *tmp = NULL, *filename_trans_str = NULL, *expr = NULL; - qpol_policy_t *q; - const qpol_type_t *type = NULL; - - if (!policy || !v) { - errno = EINVAL; - goto err; - } - - if (!(num_filename_trans = apol_vector_get_size(v))) - return NULL; - - q = apol_policy_get_qpol(policy); - - for (i = 0; i < num_filename_trans; i++) { - if (!(filename_trans = apol_vector_get_element(v, i))) - goto err; - - dict = PyDict_New(); - if (!dict) goto err; - - if (py_insert_string(dict, "type", "type_transition")) - goto err; - - /* source type */ - if (qpol_filename_trans_get_source_type(q, filename_trans, &type)) { - goto err; - } - if (qpol_type_get_name(q, type, &tmp_name)) { - goto err; - } - - if (py_insert_string(dict, "source", tmp_name)) - goto err; - - if (qpol_filename_trans_get_target_type(q, filename_trans, &type)) - goto err; - - if (qpol_type_get_name(q, type, &tmp_name)) - goto err; - - if (py_insert_string(dict, "target", tmp_name)) - goto err; - - if (qpol_filename_trans_get_object_class(q, filename_trans, &obj_class)) - goto err; - - if (qpol_class_get_name(q, obj_class, &tmp_name)) - goto err; - - if (py_insert_string(dict, "class", tmp_name)) - goto err; - - if (qpol_filename_trans_get_default_type(q, filename_trans, &type)) - goto err; - if (qpol_type_get_name(q, type, &tmp_name)) - goto err; - if (py_insert_string(dict, "transtype", tmp_name)) - goto err; - - if (! qpol_filename_trans_get_filename(q, filename_trans, &tmp_name)) { - if (py_insert_string(dict, "filename", tmp_name)) - goto err; - } - - rt = py_append_obj(list, dict); - dict = NULL; - if (rt) goto err; - - free(filename_trans_str); filename_trans_str = NULL; - free(expr); expr = NULL; - } - goto cleanup; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(dict); -cleanup: - free(tmp); - free(filename_trans_str); - free(expr); - errno = error; - return list; -} - -static int perform_av_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v) -{ - apol_avrule_query_t *avq = NULL; - unsigned int rules = 0; - int error = 0; - char *tmp = NULL, *tok = NULL, *s = NULL; - - if (!policy || !opt || !v) { - PyErr_SetString(PyExc_RuntimeError,strerror(EINVAL)); - errno = EINVAL; - return -1; - } - - if (!opt->all && !opt->allow && !opt->nallow && !opt->auditallow && !opt->dontaudit) { - *v = NULL; - return 0; /* no search to do */ - } - - avq = apol_avrule_query_create(); - if (!avq) { - PyErr_SetString(PyExc_RuntimeError,strerror(ENOMEM)); - errno = ENOMEM; - return -1; - } - - if (opt->allow || opt->all) - rules |= QPOL_RULE_ALLOW; - if (opt->nallow || opt->all) // Add this regardless of policy capabilities - rules |= QPOL_RULE_NEVERALLOW; - if (opt->auditallow || opt->all) - rules |= QPOL_RULE_AUDITALLOW; - if (opt->dontaudit || opt->all) - rules |= QPOL_RULE_DONTAUDIT; - if (rules != 0) // Setting rules = 0 means you want all the rules - apol_avrule_query_set_rules(policy, avq, rules); - apol_avrule_query_set_regex(policy, avq, opt->useregex); - if (opt->src_name) - apol_avrule_query_set_source(policy, avq, opt->src_name, opt->indirect); - if (opt->tgt_name) - apol_avrule_query_set_target(policy, avq, opt->tgt_name, opt->indirect); - if (opt->bool_name) - apol_avrule_query_set_bool(policy, avq, opt->bool_name); - if (opt->class_name) { - if (opt->class_vector == NULL) { - if (apol_avrule_query_append_class(policy, avq, opt->class_name)) { - goto err; - } - } else { - size_t i; - for (i = 0; i < apol_vector_get_size(opt->class_vector); ++i) { - char *class_name; - class_name = apol_vector_get_element(opt->class_vector, i); - if (!class_name) - continue; - if (apol_avrule_query_append_class(policy, avq, class_name)) { - goto err; - } - } - } - } - - if (opt->permlist) { - tmp = strdup(opt->permlist); - for (tok = strtok(tmp, ","); tok; tok = strtok(NULL, ",")) { - if (apol_avrule_query_append_perm(policy, avq, tok)) { - goto err; - } - if ((s = strdup(tok)) == NULL || apol_vector_append(opt->perm_vector, s) < 0) { - goto err; - } - s = NULL; - } - free(tmp); - tmp = NULL; - } - - if (!(opt->semantic) && qpol_policy_has_capability(apol_policy_get_qpol(policy), QPOL_CAP_SYN_RULES)) { - if (apol_syn_avrule_get_by_query(policy, avq, v)) { - goto err; - } - } else { - if (apol_avrule_get_by_query(policy, avq, v)) { - goto err; - } - } - - apol_avrule_query_destroy(&avq); - return 0; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(error)); - apol_vector_destroy(v); - apol_avrule_query_destroy(&avq); - free(tmp); - free(s); - errno = error; - return -1; -} - -static PyObject* get_av_results(const apol_policy_t * policy, const apol_vector_t * v, PyObject *output) -{ - PyObject *obj, *dict=NULL; - PyObject *permlist = NULL; - PyObject *boollist = NULL; - uint32_t rule_type = 0; - int rt; - int error = 0; - qpol_policy_t *q; - size_t i, num_rules = 0; - const qpol_avrule_t *rule = NULL; - char *tmp = NULL, *rule_str = NULL; - qpol_cond_expr_node_t *expr = NULL; - qpol_iterator_t *iter = NULL; - const qpol_cond_t *cond = NULL; - uint32_t enabled = 0; - const qpol_type_t *type; - const char *tmp_name; - const qpol_class_t *obj_class = NULL; - - if (!policy || !v) { - errno = EINVAL; - goto err; - } - - if (!(num_rules = apol_vector_get_size(v))) - return NULL; - - q = apol_policy_get_qpol(policy); - - for (i = 0; i < num_rules; i++) { - if (!(rule = apol_vector_get_element(v, i))) - goto err; - - dict = PyDict_New(); - if (!dict) goto err; - - if (qpol_avrule_get_rule_type(q, rule, &rule_type)) - goto err; - - if (!(tmp_name = apol_rule_type_to_str(rule_type))) { - PyErr_SetString(PyExc_RuntimeError, "Could not get TE rule type's string"); - errno = EINVAL; - goto err; - } - - if (py_insert_string(dict, "type", tmp_name)) - goto err; - - if (qpol_avrule_get_source_type(q, rule, &type)) { - goto err; - } - - if (qpol_type_get_name(q, type, &tmp_name)) { - goto err; - } - - if (py_insert_string(dict, "source", tmp_name)) - goto err; - - if (qpol_avrule_get_target_type(q, rule, &type)) { - goto err; - } - if (qpol_type_get_name(q, type, &tmp_name)) { - goto err; - } - - if (py_insert_string(dict, "target", tmp_name)) - goto err; - - if (qpol_avrule_get_object_class(q, rule, &obj_class)) { - goto err; - } - if (qpol_class_get_name(q, obj_class, &tmp_name)) { - goto err; - } - - if (py_insert_string(dict, "class", tmp_name)) - goto err; - - if (qpol_avrule_get_perm_iter(q, rule, &iter)) { - goto err; - } - - permlist = PyList_New(0); - if (! permlist) goto err; - - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - const char *perm_name = NULL; - if (qpol_iterator_get_item(iter, (void **)&perm_name)) - goto err; - if (py_append_string(permlist, perm_name)) - goto err; - } - - rt = PyDict_SetItemString(dict, "permlist", permlist); - py_decref(permlist); permlist=NULL; - if (rt) goto err; - - if (qpol_avrule_get_cond(q, rule, &cond)) - goto err; - if (qpol_avrule_get_is_enabled(q, rule, &enabled)) - goto err; - - obj = PyBool_FromLong(enabled); - rt = PyDict_SetItemString(dict, "enabled", obj); - py_decref(obj); - - if (cond) { - obj = get_bool(q, cond, enabled); - if (!obj) goto err; - rt = PyDict_SetItemString(dict, "boolean", obj); - py_decref(obj); - } - - rt = py_append_obj(output, dict); - py_decref(dict); dict=NULL; - if (rt) goto err; - - free(rule_str); rule_str = NULL; - free(expr); expr = NULL; - } - goto cleanup; - -err: - error = errno; - PyErr_SetString(PyExc_RuntimeError,strerror(errno)); - py_decref(dict); - py_decref(permlist); - py_decref(boollist); - -cleanup: - free(tmp); - free(rule_str); - free(expr); - errno = error; - return output; -} - -PyObject* search(bool allow, - bool neverallow, - bool auditallow, - bool dontaudit, - bool transition, - bool role_allow, - const char *src_name, - const char *tgt_name, - const char *class_name, - const char *permlist - ) -{ - options_t cmd_opts; - PyObject *output = NULL; - apol_vector_t *v = NULL; - - memset(&cmd_opts, 0, sizeof(cmd_opts)); - cmd_opts.indirect = true; - cmd_opts.show_cond = true; - cmd_opts.allow = allow; - cmd_opts.nallow = neverallow; - cmd_opts.auditallow = auditallow; - cmd_opts.dontaudit = dontaudit; - cmd_opts.type = transition; - cmd_opts.role_allow = role_allow; - if (src_name) - cmd_opts.src_name = strdup(src_name); - if (tgt_name) - cmd_opts.tgt_name = strdup(tgt_name); - if (class_name) - cmd_opts.class_name = strdup(class_name); - if (permlist){ - cmd_opts.perm_vector = apol_vector_create(free); - cmd_opts.permlist = strdup(permlist); - } - if (!cmd_opts.semantic && qpol_policy_has_capability(apol_policy_get_qpol(global_policy), QPOL_CAP_SYN_RULES)) { - if (qpol_policy_build_syn_rule_table(apol_policy_get_qpol(global_policy))) { - PyErr_SetString(PyExc_RuntimeError,"Query failed"); - goto cleanup; - } - } - - /* if syntactic rules are not available always do semantic search */ - if (!qpol_policy_has_capability(apol_policy_get_qpol(global_policy), QPOL_CAP_SYN_RULES)) { - cmd_opts.semantic = 1; - } - - /* supress line numbers if doing semantic search or not available */ - if (cmd_opts.semantic || !qpol_policy_has_capability(apol_policy_get_qpol(global_policy), QPOL_CAP_LINE_NUMBERS)) { - cmd_opts.lineno = 0; - } - if (perform_av_query(global_policy, &cmd_opts, &v)) { - goto cleanup; - } - output = PyList_New(0); - if (!output) - goto cleanup; - - if (v) { - get_av_results(global_policy, v, output); - } - - apol_vector_destroy(&v); - if (perform_te_query(global_policy, &cmd_opts, &v)) { - goto cleanup; - } - if (v) { - get_te_results(global_policy, v, output); - } - - if (cmd_opts.all || cmd_opts.type) { - apol_vector_destroy(&v); - if (perform_ft_query(global_policy, &cmd_opts, &v)) { - goto cleanup; - } - - if (v) { - get_ft_results(global_policy, v, output); - } - } - - if (cmd_opts.all || cmd_opts.role_allow) { - apol_vector_destroy(&v); - if (perform_ra_query(global_policy, &cmd_opts, &v)) { - goto cleanup; - } - - if (v) { - get_ra_results(global_policy, v, output); - } - } - - apol_vector_destroy(&v); - - cleanup: - free(cmd_opts.src_name); - free(cmd_opts.tgt_name); - free(cmd_opts.class_name); - free(cmd_opts.permlist); - free(cmd_opts.bool_name); - free(cmd_opts.src_role_name); - free(cmd_opts.tgt_role_name); - apol_vector_destroy(&cmd_opts.perm_vector); - apol_vector_destroy(&cmd_opts.class_vector); - - if (output && PyList_GET_SIZE(output) == 0) { - py_decref(output); - return Py_None; - } - return output; -} - -static int Dict_ContainsInt(PyObject *dict, const char *key){ - PyObject *item = PyDict_GetItemString(dict, key); - if (item) - return PyInt_AsLong(item); - return false; -} - -static const char *Dict_ContainsString(PyObject *dict, const char *key){ - PyObject *item = PyDict_GetItemString(dict, key); - if (item) - return PyString_AsString(item); - return NULL; -} - -PyObject *wrap_search(PyObject *UNUSED(self), PyObject *args){ - PyObject *dict; - if (!PyArg_ParseTuple(args, "O", &dict)) - return NULL; - int allow = Dict_ContainsInt(dict, "allow"); - int neverallow = Dict_ContainsInt(dict, "neverallow"); - int auditallow = Dict_ContainsInt(dict, "auditallow"); - int dontaudit = Dict_ContainsInt(dict, "dontaudit"); - int transition = Dict_ContainsInt(dict, "transition"); - int role_allow = Dict_ContainsInt(dict, "role_allow"); - - if (!global_policy) { - PyErr_SetString(PyExc_RuntimeError,"Policy not loaded"); - return NULL; - } - const char *src_name = Dict_ContainsString(dict, "source"); - const char *tgt_name = Dict_ContainsString(dict, "target"); - const char *class_name = Dict_ContainsString(dict, "class"); - const char *permlist = Dict_ContainsString(dict, "permlist"); - - return search(allow, neverallow, auditallow, dontaudit, transition, role_allow, src_name, tgt_name, class_name, permlist); -} diff --git a/policycoreutils/sepolicy/sepolicy/__init__.py b/policycoreutils/sepolicy/sepolicy/__init__.py index b00ec81..8fbd5b4 100644 --- a/policycoreutils/sepolicy/sepolicy/__init__.py +++ b/policycoreutils/sepolicy/sepolicy/__init__.py @@ -4,7 +4,6 @@ # Author: Ryan Hallisey # Author: Jason Zaman -from . import _policy import selinux import setools import glob @@ -149,7 +148,6 @@ def policy(policy_file): global _pol try: - _policy.policy(policy_file) _pol = setools.SELinuxPolicy(policy_file) except: raise ValueError(_("Failed to read %s policy file") % policy_file) diff --git a/policycoreutils/sepolicy/setup.py b/policycoreutils/sepolicy/setup.py index e74e68d..4bd8353 100644 --- a/policycoreutils/sepolicy/setup.py +++ b/policycoreutils/sepolicy/setup.py @@ -2,11 +2,21 @@ # Author: Thomas Liu # Author: Dan Walsh -import os -from distutils.core import setup, Extension -policy = Extension("sepolicy._policy", - libraries=["apol", "qpol"], - sources=["policy.c", "info.c", "search.c"] - ) +from distutils.core import setup -setup(name="sepolicy", version="1.1", description="Python SELinux Policy Analyses bindings", author="Daniel Walsh", author_email="dwalsh@redhat.com", ext_modules=[policy], packages=["sepolicy", "sepolicy.templates", "sepolicy.help"], package_data={'sepolicy': ['*.glade'], 'sepolicy.help': ['*.txt', '*.png']}) +setup( + name="sepolicy", + version="1.1", + description="Python SELinux Policy Analyses bindings", + author="Daniel Walsh", + author_email="dwalsh@redhat.com", + packages=[ + "sepolicy", + "sepolicy.templates", + "sepolicy.help" + ], + package_data={ + 'sepolicy': ['*.glade'], + 'sepolicy.help': ['*.txt', '*.png'] + } +)