Viewing file:  refpolicy.py (21.52 KB) -rw-r--r--
Select action/file-type:
 (+) |  (+) |  (+) | Code (+) | Session (+) |  (+) | SDB (+) |  (+) |  (+) |  (+) |  (+) |  (+) |
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
#
# Copyright (C) 2006 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License as
# published by the Free Software Foundation; version 2 only
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
import string
import itertools
# OVERVIEW
#
# This file contains objects and functions used to represent the reference
# policy (including the headers, M4 macros, and policy language statements).
#
# This representation is very different from the semantic representation
# used in libsepol. Instead, it is a more typical abstract representation
# used by the first stage of compilers. It is basically a parse tree.
#
# This choice is intentional as it allows us to handle the unprocessed
# M4 statements - including the $1 style arguments - and to more easily generate
# the data structures that we need for policy generation.
#
# Constans for referring to fields
SRC_TYPE = 0
TGT_TYPE = 1
OBJ_CLASS = 2
PERMS = 3
ROLE = 4
DEST_TYPE = 5
# String represenations of the above constants
field_to_str = ["source", "target", "object", "permission", "role", "destination" ]
str_to_field = { "source" : SRC_TYPE, "target" : TGT_TYPE, "object" : OBJ_CLASS,
"permission" : PERMS, "role" : ROLE, "destination" : DEST_TYPE }
# Base Classes
class Node:
"""Base class objects produced from parsing the reference policy.
The Node class is used as the base class for any non-leaf
object produced by parsing the reference policy. This object
should contain a reference to its parent (or None for a top-level
object) and 0 or more children.
The general idea here is to have a very simple tree structure. Children
are not separated out by type. Instead the tree structure represents
fairly closely the real structure of the policy statements.
The object should be iterable - by default over all children but
subclasses are free to provide additional iterators over a subset
of their childre (see Interface for example).
"""
def __init__(self, parent=None):
self.parent = parent
self.children = []
self.comment = None
def __iter__(self):
return iter(self.children)
# Not all of the iterators will return something on all Nodes, but
# they won't explode either. Putting them here is just easier.
# Top level nodes
def nodes(self):
return itertools.ifilter(lambda x: isinstance(x, Node), walktree(self))
def modules(self):
return itertools.ifilter(lambda x: isinstance(x, Module), walktree(self))
def interfaces(self):
return itertools.ifilter(lambda x: isinstance(x, Interface), walktree(self))
def templates(self):
return itertools.ifilter(lambda x: isinstance(x, Template), walktree(self))
def support_macros(self):
return itertools.ifilter(lambda x: isinstance(x, SupportMacros), walktree(self))
# Common policy statements
def module_declarations(self):
return itertools.ifilter(lambda x: isinstance(x, ModuleDeclaration), walktree(self))
def interface_calls(self):
return itertools.ifilter(lambda x: isinstance(x, InterfaceCall), walktree(self))
def avrules(self):
return itertools.ifilter(lambda x: isinstance(x, AVRule), walktree(self))
def typerules(self):
return itertools.ifilter(lambda x: isinstance(x, TypeRule), walktree(self))
def typeattributes(self):
"""Iterate over all of the TypeAttribute children of this Interface."""
return itertools.ifilter(lambda x: isinstance(x, TypeAttribute), walktree(self))
def requires(self):
return itertools.ifilter(lambda x: isinstance(x, Require), walktree(self))
def roles(self):
return itertools.ifilter(lambda x: isinstance(x, Role), walktree(self))
def __str__(self):
if self.comment:
return str(self.comment) + "\n" + self.to_string()
else:
return self.to_string()
def __repr__(self):
return "<%s(%s)>" % (self.__class__.__name__, self.to_string())
def to_string(self):
return ""
class Leaf:
def __init__(self):
self.comment = None
def __str__(self):
if self.comment:
return str(self.comment) + "\n" + self.to_string()
else:
return self.to_string()
def __repr__(self):
return "<%s(%s)>" % (self.__class__.__name__, self.to_string())
def to_string(self):
return ""
# Utility functions
def walktree(node, depthfirst=True, showdepth=False, type=None):
"""Iterate over a Node and its Children.
The walktree function iterates over a tree containing Nodes and
leaf objects. The iteration can perform a depth first or a breadth
first traversal of the tree (controlled by the depthfirst
paramater. The passed in node will be returned.
This function will only work correctly for trees - arbitrary graphs
will likely cause infinite looping.
"""
# We control depth first / versus breadth first by
# how we pop items off of the node stack.
if depthfirst:
index = -1
else:
index = 0
stack = [(node, 0)]
while len(stack) > 0:
cur, depth = stack.pop(index)
if showdepth:
yield cur, depth
else:
yield cur
# If the node is not a Node instance it must
# be a leaf - so no need to add it to the stack
if isinstance(cur, Node):
items = []
i = len(cur.children) - 1
while i >= 0:
if type is None or isinstance(cur.children[i], type):
items.append((cur.children[i], depth + 1))
i -= 1
stack.extend(items)
def walknode(node, type=None):
"""Iterate over the direct children of a Node.
The walktree function iterates over the children of a Node.
Unlike walktree it does note return the passed in node or
the children of any Node objects (that is, it does not go
beyond the current level in the tree).
"""
for x in node:
if type is None or isinstance(x, type):
yield x
def list_to_space_str(s, cont=('{', '}')):
"""Convert a set (or any sequence type) into a string representation
formatted to match SELinux space separated list conventions.
For example the list ['read', 'write'] would be converted into:
'{ read write }'
"""
l = len(s)
str = ""
if l < 1:
raise ValueError("cannot convert 0 len set to string")
str = " ".join(s)
if l == 1:
return str
else:
return cont[0] + " " + str + " " + cont[1]
def list_to_comma_str(s):
l = len(s)
if l < 1:
raise ValueError("cannot conver 0 len set to comma string")
return ", ".join(s)
# Basic SELinux types
class IdSet(set):
def __init__(self, list=None):
if list:
set.__init__(self, list)
else:
set.__init__(self)
self.compliment = False
def to_space_str(self):
return list_to_space_str(self)
def to_comma_str(self):
return list_to_comma_str(self)
class SecurityContext(Leaf):
"""An SELinux security context with optional MCS / MLS fields."""
def __init__(self, context=None):
"""Create a SecurityContext object, optionally from a string.
Parameters:
[context] - string representing a security context. Same format
as a string passed to the from_string method.
"""
Leaf.__init__(self)
self.user = ""
self.role = ""
self.type = ""
self.level = ""
if context is not None:
self.from_string(context)
def from_string(self, context):
"""Parse a string representing a context into a SecurityContext.
The string should be in the standard format - e.g.,
'user:role:type:level'.
Raises ValueError if the string is not parsable as a security context.
"""
fields = context.split(":")
if len(fields) < 3:
raise ValueError("context string [%s] not in a valid format" % context)
self.user = fields[0]
self.role = fields[1]
self.type = fields[2]
if len(fields) > 3:
# FUTURE - normalize level fields to allow more comparisons to succeed.
self.level = string.join(fields[3:], ':')
else:
self.level = ""
def __eq__(self, other):
"""Compare two SecurityContext objects - all fields must be exactly the
the same for the comparison to work. It is possible for the level fields
to be semantically the same yet syntactically different - in this case
this function will return false.
"""
return self.user == other.user and \
self.role == other.role and \
self.type == other.type and \
self.level == other.level
def to_string(self, default_level="s0"):
"""Return a string representing this security context.
By default, the string will contiain a MCS / MLS level
potentially from the default which is passed in if none was
set.
Arguments:
default_level - the default level to use if self.level is an
empty string.
Returns:
A string represening the security context in the form
'user:role:type:level'.
"""
fields = [self.user, self.role, self.type]
if self.level == "":
if default_level != "":
fields.append(default_level)
else:
fields.append(self.level)
return ":".join(fields)
class ObjectClass:
"""SELinux object class and permissions.
This class is a basic representation of an SELinux object
class - it does not represent separate common permissions -
just the union of the common and class specific permissions.
It is meant to be convenient for policy generation.
"""
def __init__(self, name=""):
self.name = name
self.perms = IdSet()
# Basic statements
class TypeAttribute(Leaf):
"""SElinux typeattribute statement.
This class represents a typeattribute statement.
"""
def __init__(self):
Leaf.__init__(self)
self.type = ""
self.attributes = IdSet()
def to_string(self):
return "typeattribute %s %s;" % (self.type, self.attributes.to_comma_str())
class Role(Leaf):
def __init__(self):
Leaf.__init__(self)
self.role = ""
self.types = IdSet()
def to_string(self):
return "role %s types %s;" % (self.role, self.types.to_comma_str())
class Type(Leaf):
def __init__(self, name=""):
Leaf.__init__(self)
self.name = name
self.attributes = IdSet()
self.aliases = IdSet()
def to_string(self):
s = "type %s" % self.name
if len(self.aliases) > 0:
s = s + "alias %s" % self.aliases.to_space_str()
if len(self.attributes) > 0:
s = s + ", %s" % self.attributes.to_comma_str()
return s + ";"
class TypeAlias(Leaf):
def __init__(self):
Leaf.__init__(self)
self.type = ""
self.aliases = IdSet()
def to_string(self):
return "typealias %s alias %s;" % (self.type, self.aliases.to_space_str())
class Attribute(Leaf):
def __init__(self, name=""):
Leaf.__init__(self)
self.name = name
def to_string(self):
return "attribute %s;" % self.name
# Classes representing rules
class AVRule(Leaf):
"""SELinux access vector (AV) rule.
The AVRule class represents all varieties of AV rules including
allow, dontaudit, and auditallow (indicated by the flags self.ALLOW,
self.DONTAUDIT, and self.AUDITALLOW respectively).
The source and target types, object classes, and perms are all represented
by sets containing strings. Sets are used to make it simple to add
strings repeatedly while avoiding duplicates.
No checking is done to make certain that the symbols are valid or
consistent (e.g., perms that don't match the object classes). It is
even possible to put invalid types like '$1' into the rules to allow
storage of the reference policy interfaces.
"""
ALLOW = 0
DONTAUDIT = 1
AUDITALLOW = 2
def __init__(self, av=None):
Leaf.__init__(self)
self.src_types = IdSet()
self.tgt_types = IdSet()
self.obj_classes = IdSet()
self.perms = IdSet()
self.rule_type = self.ALLOW
if av:
self.from_av(av)
def __rule_type_str(self):
if self.rule_type == self.ALLOW:
return "allow"
elif self.rule_type == self.DONTAUDIT:
return "dontaudit"
else:
return "auditallow"
def from_av(self, av):
"""Add the access from an access vector to this allow
rule.
"""
self.src_types.add(av.src_type)
if av.src_type == av.tgt_type:
self.tgt_types.add("self")
else:
self.tgt_types.add(av.tgt_type)
self.obj_classes.add(av.obj_class)
self.perms.update(av.perms)
def to_string(self):
"""Return a string representation of the rule
that is a valid policy language representation (assuming
that the types, object class, etc. are valie).
"""
return "%s %s %s:%s %s;" % (self.__rule_type_str(),
self.src_types.to_space_str(),
self.tgt_types.to_space_str(),
self.obj_classes.to_space_str(),
self.perms.to_space_str())
class TypeRule(Leaf):
"""SELinux type rules.
This class is very similar to the AVRule class, but is for representing
the type rules (type_trans, type_change, and type_member). The major
difference is the lack of perms and only and sing destination type.
"""
TYPE_TRANSITION = 0
TYPE_CHANGE = 1
TYPE_MEMBER = 2
def __init__(self):
Leaf.__init__(self)
self.src_types = IdSet()
self.tgt_types = IdSet()
self.obj_classes = IdSet()
self.dest_type = ""
self.rule_type = self.TYPE_TRANSITION
def __rule_type_str(self):
if self.rule_type == self.TYPE_TRANSITION:
return "type_transition"
elif self.rule_type == self.TYPE_CHANGE:
return "type_change"
else:
return "type_member"
def to_string(self):
return "%s %s %s:%s %s;" % (self.__rule_type_str(),
self.src_types.to_space_str(),
self.tgt_types.to_space_str(),
self.obj_classes.to_space_str(),
self.dest_type)
class RoleAllow(Leaf):
def __init__(self):
Leaf.__init__(self)
self.src_roles = IdSet()
self.tgt_roles = IdSet()
def to_string(self):
return "allow %s %s;" % (self.src_roles.to_comma_str(),
self.tgt_roles.to_comma_str())
class ModuleDeclaration(Leaf):
def __init__(self):
Leaf.__init__(self)
self.name = ""
self.version = ""
self.refpolicy = False
def to_string(self):
if self.refpolicy:
return "policy_module(%s, %s)" % (self.name, self.version)
else:
return "module %s %s;" % (self.name, self.version)
# Reference policy specific types
def print_tree(head):
for node, depth in walktree(head, showdepth=True):
s = ""
for i in range(depth):
s = s + "\t"
print s + str(node)
class Headers(Node):
def __init__(self, parent=None):
Node.__init__(self, parent)
def to_string(self):
return "[Headers]"
class Module(Node):
def __init__(self, parent=None):
Node.__init__(self, parent)
def to_string(self):
return ""
class Interface(Node):
"""A reference policy interface definition.
This class represents a reference policy interface definition.
"""
def __init__(self, name="", parent=None):
Node.__init__(self, parent)
self.name = name
def to_string(self):
return "[Interface name: %s]" % self.name
class TunablePolicy(Node):
def __init__(self, parent=None):
Node.__init__(self, parent)
self.cond_expr = []
def to_string(self):
return "[Tunable Policy %s]" % list_to_space_str(self.cond_expr, cont=("", ""))
class Template(Node):
def __init__(self, name="", parent=None):
Node.__init__(self, parent)
self.name = name
def to_string(self):
return "[Template name: %s]" % self.name
class IfDef(Node):
def __init__(self, name="", parent=None):
Node.__init__(self, parent)
self.name = name
def to_string(self):
return "[Ifdef name: %s]" % self.name
class Conditional(Node):
def __init__(self, parent=None):
Node.__init__(self, parent)
self.cond_expr = []
def to_string(self):
return "[If %s]" % list_to_space_str(self.cond_expr, cont=("", ""))
class InterfaceCall(Leaf):
def __init__(self, ifname=""):
Leaf.__init__(self)
self.ifname = ifname
self.args = []
self.comments = []
def matches(self, other):
if self.ifname != other.ifname:
return False
if len(self.args) != len(other.args):
return False
for a,b in zip(self.args, other.args):
if a != b:
return False
return True
def to_string(self):
s = "%s(" % self.ifname
i = 0
for a in self.args:
if isinstance(a, list):
str = list_to_space_str(a)
else:
str = a
if i != 0:
s = s + ", %s" % str
else:
s = s + str
i += 1
return s + ")"
class OptionalPolicy(Node):
def __init__(self, parent=None):
Node.__init__(self, parent)
def to_string(self):
return "[Optional Policy]"
class SupportMacros(Node):
def __init__(self, parent=None):
Node.__init__(self, parent)
self.map = None
def to_string(self):
return "[Support Macros]"
def __expand_perm(self, perm):
# Recursive expansion - the assumption is that these
# are ordered correctly so that no macro is used before
# it is defined
s = set()
if self.map.has_key(perm):
for p in self.by_name(perm):
s.update(self.__expand_perm(p))
else:
s.add(perm)
return s
def __gen_map(self):
self.map = {}
for x in self:
exp_perms = set()
for perm in x.perms:
exp_perms.update(self.__expand_perm(perm))
self.map[x.name] = exp_perms
def by_name(self, name):
if not self.map:
self.__gen_map()
return self.map[name]
def has_key(self, name):
if not self.map:
self.__gen_map()
return self.map.has_key(name)
class Require(Leaf):
def __init__(self):
Leaf.__init__(self)
self.types = IdSet()
self.obj_classes = { }
self.roles = IdSet()
self.bools = IdSet()
self.users = IdSet()
def add_obj_class(self, obj_class, perms):
p = self.obj_classes.setdefault(obj_class, IdSet())
p.update(perms)
def to_string(self):
s = []
s.append("require {")
for type in self.types:
s.append("\ttype %s;" % type)
for obj_class, perms in self.obj_classes.items():
s.append("\tclass %s %s;" % (obj_class, perms.to_space_str()))
for role in self.roles:
s.append("\trole %s;" % role)
for bool in self.bools:
s.append("\tbool %s;" % bool)
for user in self.users:
s.append("\tuser %s;" % user)
s.append("}")
# Handle empty requires
if len(s) == 2:
return ""
return "\n".join(s)
class ObjPermSet:
def __init__(self, name):
self.name = name
self.perms = set()
def to_string(self):
return "define(`%s', `%s')" % (self.name, self.perms.to_space_str())
class ClassMap:
def __init__(self, obj_class, perms):
self.obj_class = obj_class
self.perms = perms
def to_string(self):
return self.obj_class + ": " + self.perms
class Comment:
def __init__(self, l=None):
if l:
self.lines = l
else:
self.lines = []
def to_string(self):
# If there are no lines, treat this as a spacer between
# policy statements and return a new line.
if len(self.lines) == 0:
return ""
else:
out = []
for line in self.lines:
out.append("#" + line)
return "\n".join(out)
def merge(self, other):
if len(other.lines):
for line in other.lines:
if line != "":
self.lines.append(line)
def __str__(self):
return self.to_string()
|