MOON
Server: Apache
System: Linux s5.yayogua.com.py 6.12.0-124.55.3.el10_1.x86_64 #1 SMP PREEMPT_DYNAMIC Thu May 7 16:54:02 EDT 2026 x86_64
User: sanbercountryclu (1012)
PHP: 8.2.33
Disabled: NONE
Upload Files
File: //proc/thread-self/root/lib/python3.12/site-packages/sepolicy/__pycache__/generate.cpython-312.pyc
�

�j������ddlZddlZddlZddlZddlZddlmZmZmZddlZddl	m
Z
ddl	mZddl	mZddl	m
Z
ddl	mZdd	l	mZdd
l	mZddl	mZddl	mZdd
l	mZddl	mZddl	mZddl	mZddl	mZddl	mZddlmZddlmZdZ	ddlZiZej@dkrded<ejBefddie�ddi��Z"e"j<Z#d�Z*d�Z+d�Z,d�Z-dZ.dZ/dZ0d Z1d!Z2d"Z3dZ4dZ5dZ6d Z7d#Z8d$Z9d%Z:d&Z;d'Z<d(Z=d)Z>d*Z?d+Z@iZAe#d,�eAe4<e#d-�eAe5<e#d.�eAe6<e#d/�eAe7<e#d0�eAe8<e#d1�eAe9<e#d2�eAe:<e#d3�eAe;<e#d4�eAe<<e#d5�eAe=<e#d6�eAe><e#d7�eAe?<e#d8�eAe@<d9�ZBe4e5e6e9e7gZCe<e;e=e>e?gZDd:�ZEGd;�d<�ZFy#	ddl$Z$e%e$jLd<n#e'$rddl(Z(e)e(jLd<YnwxYwY��xYw)=�N)�
get_all_types�get_all_attributes�
get_all_roles�)�
executable)�boolean)�etc_rw)�	unit_file)�	var_cache)�	var_spool)�var_lib)�var_log)�var_run)�tmp)�rw)�network)�script)�spec)�userzselinux-python)�T�unicode�	localedirz/usr/share/locale�fallback�_c��|d}|d}|d}|dz|jd�dz}|jd�d}|||gS)z6Given an RPM header return the package NVR as a string�name�version�release�-�.rr)�split)�hdrrrr�release_version�
os_versions      �6/usr/lib/python3.12/site-packages/sepolicy/generate.py�get_rpm_nvr_from_headerr&GsY���v�;�D��)�n�G��)�n�G���m�g�m�m�C�&8��&;�;�O����s�#�A�&�J��/�:�.�.�c���	ddl}d}|j�}|j|j|�}|D]}t	|�}|S	|S#td|z�d}Y|SxYw)Nrz"Failed to retrieve rpm info for %s)�rpm�ts�dbMatch�RPMTAG_NAMEr&�print)�packager)�nvrr*�mi�hs      r%�get_rpm_nvr_listr2Rsr��
����
�V�V�X��
�Z�Z�����
1���A�)�!�,�C��
�J���J��	�
�3�w�>�?����J�s�AA�A�A c��i}tjtj�D]P}|ddk(s |ddk(s|ddk(s|ddk(s|ddk(r�,|d|jd�f||d|d	|d
f<�R|S)N�type�reserved_port_t�port_t�hi_reserved_port_t�ephemeral_port_t�unreserved_port_t�range�low�high�protocol)�sepolicy�info�PORT�get)�dict�ps  r%�
get_all_portsrDbs���
�D�
�]�]�8�=�=�
)���V�9�)�)��&�	�X�%��&�	�1�1��&�	�/�/��&�	�0�0��67��i����w��5P��a��h��&�	�1�Z�=�
1�2�*��Kr'c���tjtj�D�cgc]}|d��	}}|jd�|jd�|j	�|Scc}w)Nr�system_u�root)r>r?�USER�remove�sort)�x�userss  r%�
get_all_usersrMosT�� (�
�
�h�m�m� <�=� <�1�Q�v�Y� <�E�=�	�L�L���	�L�L���	�J�J�L��L��	
>s�A(�rz_admin$z_role$������	�
��zStandard Init DaemonzDBUS System DaemonzInternet Services DaemonzWeb Application/Script (CGI)�SandboxzUser ApplicationzExisting Domain Typez Minimal Terminal Login User Rolez!Minimal X Windows Login User RolezDesktop Login User RolezAdministrator Login User Rolez Confined Root Administrator Rolez!Module information for a new typec��tj�}|j�td�}|D]}||d�dt|�d�z
}�|S)Nz
Valid Types:
z>2z: �
)�poltype�keysrJr)r\�msg�ks   r%�get_poltype_descr_�sC���<�<�>�D��I�I�K�
��
�C�
���a����,�,����Jr'c���|dk(rgSd}	g}|jd�D]�}|jd�}t|�dkDrt�t|�dk(rt|d�}t|d�}n't|d�}t|d�}||kDrt�t	||dz�D]#}|dks||kDrt�|j|��%��|S#t$rtt
d�|z��wxYw)	N�i�,rrNrrz8Ports must be numbers or ranges of numbers from 1 to %d )r!�len�
ValueError�intr:�appendr)�ports�max_port�temp�a�r�begin�endrCs        r%�verify_portsrn�s�����{��	��H�c������S�!�A������A��1�v��z� � ��1�v��{��A�a�D�	���!�A�$�i���A�a�D�	���!�A�$�i���3�;�$�$��5�#��'�*���q�5�A��L�$�$����A��+�"�$����c���U�V�Ya�a�b�b�c�s�CC�!C2c���eZdZd�Zd�Zd�Zd�Zd�Zd�Zd�Z	d�Z
d	�Zd
�Zd�Z
d�Zd
�Zd�Zdvd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Z d�Z!d �Z"d!�Z#d"�Z$d#�Z%d$�Z&d%�Z'd&�Z(d'�Z)d(�Z*d)�Z+d*�Z,d+�Z-d,�Z.d-�Z/d.�Z0d/�Z1d0�Z2d1�Z3d2�Z4d3�Z5d4�Z6d5�Z7d6�Z8d7�Z9d8�Z:d9�Z;d:�Z<d;�Z=d<�Z>d=�Z?d>�Z@d?�ZAd@�ZBdA�ZCdB�ZDdC�ZEdD�ZFdE�ZGdF�ZHdG�ZIdH�ZJdI�ZKdJ�ZLdK�ZMdL�ZNdM�ZOdN�ZPdO�ZQdP�ZRdQ�ZSdR�ZTdS�ZUdT�ZVdU�ZWdV�ZXdW�ZYdX�ZZdY�Z[dZ�Z\d[�Z]d\�Z^d]�Z_d^�Z`d_�Zad`�Zbda�Zcdb�Zddc�Zedd�Zfde�Zgdf�Zhdg�Zidh�Zjdi�Zkdj�Zldk�Zmdl�Zndm�Zodn�Zpdo�Zqdp�Zrdq�Zsdr�Ztds�Zuevj��fdt�Zxyu)w�policyc�p�g|_i|_t�|_g|_|t
vrt
td���|st
td�t
|z��	t�|_i|_d|jd<d|jd<d|jd<d	|jd
<d	|jd<d	|jd<d|jd
<d|jd<d|jd<d|jd<d|jd<d|jd<d|jd<d|jd<d|jd<d|jd<d|jd<d|jd<d|jd <d!|jd"<d#|jd$<d%|jd&<d'|jd(<d)|jd*<d+|jd,<d-|jd.<d/|jd0<d1|jd2<d3|jd4<d5|jd6<d7|jd8<d9|jd:<d;|jd<<d=|jd><d?|jd@<dA|jdB<dC|jdD<dE|jdF<dG|jdH<dI|jdJ<dK|jdL<dM|jdN<dO|jdP<dQ|jdR<dS|jdT<dU|jdV<dW|jdX<dY|jdZ<d[|jd\<d]|jd^<d_|jd`<da|jdb<da|jdc<da|jdd<da|jde<df|jdg<df|jdh<df|jdi<df|jdj<df|jdg<dk|jdl<dm|jdn<do|jdp<dq|jdr<ds|jdt<du|jdv<dw|jdx<dy|jdz<d{|jd|<d}|jd~<d|jd�<d|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<d�|jd�<i|_d�gtg|jd�<d�gtg|jd�<d�gtg|jd�<d�gt g|jd�<d�gt g|jd�<d�gt g|jd�<d�gt"g|jd�<d�gt$g|jd�<d�gt&g|jd�<d�gt(g|jd�<d�gt*g|jd�<i|_t|j,d�<t |j,d�<t"|j,d�<t$|j,d�<t&|j,d�<t(|j,d�<t*|j,d�<t.|j,d�<gd��|_|j2|j4f|j6|j8f|j:|j<f|j>|j@f|jB|jDf|jF|jHf|jJ|jLf|jN|jPf|jR|jTf|jV|jPf|jX|jPf|jZ|j\f|j^|j`ff
|_1tejfd�|�st
td����|thk(rd�|z|_5n||_5||_6g|_7g|_8||_9d�|_:d|_;d�d�d�gg|_<d�d�d�gg|_=d�d�d�gg|_>d�d�d�gg|_?d�|_@d�|_Ad�|_Bd�|_Cd�|_Dd�|_Ed�|_Fd�|_Gd�|_H|jrt�t�fv|_K|jrt�t�fv|_L|jrt�t�fv|_Md�|_Nd�|_Oi|_Pi|_Qi|_Rg|_Sg|_Td�|_Ud�|_Vg|_Wg|_Xg|_Yg|_Zg|_[y#t$r}td�Yd}~�	��d}~wt$r}td|�Yd}~�	��d}~wwxYw)�Nz"You must enter a valid policy typez;You must enter a name for your policy module for your '%s'.z9Can not get port types, must be root for this informationzCan not get port typeszset_use_kerberos(True)�openlogzset_use_kerb_rcache(True)zset_use_syslog(True)zset_use_resolve(True)�	gethostby�getaddrinfo�getnameinfo�krbzset_manage_krb5_rcache(True)�gss_accept_sec_context�krb5_verify_init_creds�krb5_rd_req�__syslog_chkzset_use_uid(True)�getpwnam�getpwuidzset_use_dbus(True)�dbus_zset_use_pam(True)�pam_zset_use_audit(True)zadd_process('fork')�forkzadd_process('transition')�
transitionzadd_process('sigchld')�sigchldzadd_process('sigkill')�sigkillzadd_process('sigstop')�sigstopzadd_process('signull')�signullzadd_process('ptrace')�ptracezadd_process('getsched')�getschedzadd_process('setsched')�setschedzadd_process('getsession')�
getsessionzadd_process('getpgid')�getpgidzadd_process('setpgid')�setpgidzadd_process('getcap')�getcapzadd_process('setcap')�setcapzadd_process('share')�sharezadd_process('getattr')�getattrzadd_process('setexec')�setexeczadd_process('setfscreate')�setfscreatezadd_process('noatsecure')�
noatsecurezadd_process('siginh')�siginhzadd_process('signal_perms')�killzadd_process('setrlimit')�	setrlimitzadd_process('rlimitinh')�	rlimitinhzadd_process('dyntransition')�
dyntransitionzadd_process('setcurrent')�
setcurrentzadd_process('execmem')�execmemzadd_process('execstack')�	execstackzadd_process('execheap')�execheapzadd_process('setkeycreate')�setkeycreatezadd_process('setsockcreate')�
setsockcreatezadd_capability('chown')�chownzadd_capability('dac_override')�dac_overridez!add_capability('dac_read_search')�dac_read_searchzadd_capability('fowner')�fownerzadd_capability('fsetid')�fsetidzadd_capability('setgid')�setgid�setegid�	setresgid�setregidzadd_capability('setuid')�	setresuid�setuid�seteuid�setreuidzadd_capability('setpcap')�setpcapz!add_capability('linux_immutable')�linux_immutablez"add_capability('net_bind_service')�net_bind_servicezadd_capability('net_broadcast')�
net_broadcastzadd_capability('net_admin')�	net_adminzadd_capability('net_raw')�net_rawzadd_capability('ipc_lock')�ipc_lockzadd_capability('ipc_owner')�	ipc_ownerzadd_capability('sys_module')�
sys_modulezadd_capability('sys_rawio')�	sys_rawiozadd_capability('sys_chroot')�chroot�
sys_chrootzadd_capability('sys_ptrace')�
sys_ptracezadd_capability('sys_pacct')�	sys_pacctzadd_capability('sys_admin')�mount�unshare�	sys_adminzadd_capability('sys_boot')�sys_bootzadd_capability('sys_nice')�sys_nicezadd_capability('sys_resource')�sys_resourcezadd_capability('sys_time')�sys_timez add_capability('sys_tty_config')�sys_tty_configzadd_capability('mknod')�mknodzadd_capability('lease')�leasezadd_capability('audit_write')�audit_writezadd_capability('audit_control')�
audit_controlzadd_capability('setfcap')�setfcapr	�/etcr�/tmprr
�/usr/lib/systemd/system�/lib/systemd/system�/etc/systemd/systemr�
/var/cacher
�/var/libr�/var/logr�/var/runr�
/var/spool�_tmp_t�_unit_file_t�_var_cache_t�
_var_lib_t�
_var_log_t�
_var_run_t�_var_spool_t�_port_t)r�r�r�r�rr�r�r�r�r�r�z^[a-zA-Z0-9-_]+$zOName must be alphanumeric with no spaces. Consider using option "-n MODULENAME"zhttpd_%s_scriptraF)\�rpmsrgr�	all_roles�typesr[rdrrDr-�RuntimeError�symbols�DEFAULT_DIRSr	rrr
rr
rrr�DEFAULT_EXTr�DEFAULT_KEYS�generate_daemon_types�generate_daemon_rules�generate_dbusd_types�generate_dbusd_rules�generate_inetd_types�generate_inetd_rules�generate_cgi_types�generate_cgi_rules�generate_sandbox_types�generate_sandbox_rules�generate_userapp_types�generate_userapp_rules�generate_existing_user_types�generate_existing_user_rules�generate_min_login_user_types�generate_login_user_rules�generate_x_login_user_types�generate_x_login_user_rules�generate_login_user_types�generate_admin_user_types�generate_root_user_types�generate_root_user_rules�generate_new_types�generate_new_rules�
DEFAULT_TYPES�re�match�CGIr�	file_name�capabilities�	processesr4�
initscript�program�in_tcp�in_udp�out_tcp�out_udp�use_resolve�use_tmp�use_uid�
use_syslog�use_kerberos�manage_krb5_rcache�use_pam�use_dbus�	use_audit�EUSER�NEWTYPE�use_etc�use_localization�use_fd�use_terminal�use_mail�booleans�files�dirs�found_tcp_ports�found_udp_ports�
need_tcp_type�
need_udp_type�
admin_domains�existing_domains�transition_domains�transition_users�roles)�selfrr4�es    r%�__init__zpolicy.__init__�s�	����	���
�&������
��w���Q�C�D�E�E���Q�\�]�`g�hl�`m�m�n�n�	/�&��D�J����":����Y��"=����Y��"8����Y��$;����[�!�&=����]�#�&=����]�#�6����U��1O����-�.�1O����-�.�&D����]�#�'=����^�$�#6����Z� �#6����Z� � 4����W��2����V��4����V��4����V��%@����\�"�":����Y��":����Y��":����Y��":����Y��!8����X��#<����Z� �#<����Z� �%@����\�"�":����Y��":����Y��!8����X��!8����X�� 6����W��":����Y��":����Y��&B����]�#�%@����\�"�!8����X��<����V��$>����[�!�$>����[�!�(F����_�%�%@����\�"�":����Y��$>����[�!�#<����Z� �'D����^�$�(F����_�%� 9����W��'G����^�$�*M����&�'�!;����X��!;����X��!;����X��"<����Y��$>����[�!�#=����Z� �$>����[�!�!;����X��"<����Y��#=����Z� �$>����[�!�"=����Y��*M����&�'�+O����'�(�(I����_�%�$A����[�!�"=����Y��#?����Z� �$A����[�!�%C����\�"�$A����[�!�!?����X��%C����\�"�%C����\�"�$A����[�!� =����W��"?����Y��$A����[�!�#?����Z� �#?����Z� �'G����^�$�#?����Z� �)K����%�&� 9����W�� 9����W��&E����]�#�(I����_�%�"=����Y�����%-�r�6�$:����&�!�%*�B��$4����&�!�#'��R�.����$��8C�R��7S����3�4�4?��Y�3O����/�0�4?��Y�3O����/�0�+6��I�*F����,�'�)2�B��(@����*�%�)2�B��(@����*�%�)2�B��(@����*�%�+6��I�*F����,�'����%(�����"�+4�����(�+4�����(�)0�����&�)0�����&�)0�����&�+4�����(�&-�����#�|����
'�
'��)C�)C�D�
�
&�
&��(A�(A�B�
�
&�
&��(A�(A�B�
�
$�
$�d�&=�&=�>�
�
(�
(�$�*E�*E�F�
�
(�
(�$�*E�*E�F�
�
.�
.��0Q�0Q�R�
�
/�
/��1O�1O�P�
�
-�
-�t�/O�/O�P�
�
+�
+�T�-K�-K�L�
�
+�
+�T�-K�-K�L�
�
*�
*�D�,I�,I�J�
�
$�
$�d�&=�&=�>�
@����x�x�+�T�2��Q�r�s�t�t��3�;�)�D�0�D�I��D�I������������	��������e�U�B�/����e�U�B�/����u�e�R�0����u�e�R�0��� ������������!���"'��������
�����y�y���(8�8��� $�	�	�%��1A� A����i�i��w�'7�7���!�����
���
���
���	�!���!���"���"������ "���"$��� "�����
��e�	O��M�N�N���	/��*�A�.�.��	/�s$�"g8�8	h5�h�h5�h0�0h5c�n�|txs+|txs |txst|t�dkDS�Nr)�ALL�RESERVED�
UNRESERVEDrc�PORTS)r �ls  r%�
__isnetsetzpolicy.__isnetset�s0����v�J��8��J��*�
�J��Q�u�X���9J�Jr'c��||_y�N)r)r rs  r%�set_admin_domainszpolicy.set_admin_domains�s
��*��r'c��||_yr,)r)r rs  r%�set_existing_domainszpolicy.set_existing_domains��
�� 0��r'c��||_yr,)r)r rs  r%�set_admin_roleszpolicy.set_admin_roles��	����
r'c��||_yr,)r)r rs  r%�set_transition_domainszpolicy.set_transition_domains�s
��"4��r'c��||_yr,)r)r rs  r%�set_transition_userszpolicy.set_transition_users�r0r'c�8�|j|j�Sr,)�_policy__isnetsetr�r s r%�
use_in_udpzpolicy.use_in_udp�������t�{�{�+�+r'c�8�|j|j�Sr,)r9rr:s r%�use_out_udpzpolicy.use_out_udp�������t�|�|�,�,r'c�F�|j�xs|j�Sr,)r;r>r:s r%�use_udpzpolicy.use_udp������� �6�D�$4�$4�$6�6r'c�8�|j|j�Sr,)r9rr:s r%�
use_in_tcpzpolicy.use_in_tcp�r<r'c�8�|j|j�Sr,)r9rr:s r%�use_out_tcpzpolicy.use_out_tcp�r?r'c�F�|j�xs|j�Sr,)rDrFr:s r%�use_tcpzpolicy.use_tcp�rBr'c�F�|j�xs|j�Sr,)rHrAr:s r%�use_networkzpolicy.use_network�s���|�|�~�/�����/r'c��|jj�D]+\}}}||k\s�
||ks�||k(s�|j|||fcSyr,)rgr\)r �portr=rlrmrCs      r%�	find_portzpolicy.find_port�sK��!�Z�Z�_�_�.�M�E�3���u�}�����Q���z�z�%��h�"6�7�7�/�r'c�^�|jtvrttd���||_y)Nz0User Role types can not be assigned executables.)r4�APPLICATIONSrdrr�)r r�s  r%�set_programzpolicy.set_program�s&���9�9�L�(��Q�Q�R�S�S���r'c�`�|jtk7rttd���||_y)Nz(Only Daemon apps can use an init script.)r4�DAEMONrdrr�)r r�s  r%�set_init_scriptzpolicy.set_init_script�s&���9�9����Q�I�J�K�K�$��r'c�,�|||t|�g|_yr,)rnr�r �all�reserved�
unreservedrgs     r%�
set_in_tcpzpolicy.set_in_tcp�����H�j�,�u�2E�F��r'c�,�|||t|�g|_yr,)rnrrUs     r%�
set_in_udpzpolicy.set_in_udp�rZr'c�,�|ddt|�g|_y�NF)rnr�r rVrgs   r%�set_out_tcpzpolicy.set_out_tcp�����U�E�<��+>�?��r'c�,�|ddt|�g|_yr^)rnrr_s   r%�set_out_udpzpolicy.set_out_udp�rar'c�\�t|�turttd���||_y)Nz$use_resolve must be a boolean value )r4�boolrdrr�r �vals  r%�set_use_resolvezpolicy.set_use_resolve�s'����9�D� ��Q�E�F�G�G���r'c�\�t|�turttd���||_y)Nz#use_syslog must be a boolean value )r4rerdrrrfs  r%�set_use_syslogzpolicy.set_use_syslog�s&����9�D� ��Q�D�E�F�F���r'c�\�t|�turttd���||_y)Nz%use_kerberos must be a boolean value )r4rerdrrrfs  r%�set_use_kerberoszpolicy.set_use_kerberos�s'����9�D� ��Q�F�G�H�H���r'c�\�t|�turttd���||_y)Nz+manage_krb5_rcache must be a boolean value )r4rerdrr	rfs  r%�set_manage_krb5_rcachezpolicy.set_manage_krb5_rcache�s'����9�D� ��Q�L�M�N�N�"%��r'c��|du|_y�NT)r
rfs  r%�set_use_pamzpolicy.set_use_pam��
���t���r'c��|du|_yrp)rrfs  r%�set_use_dbuszpolicy.set_use_dbus��
������
r'c��|du|_yrp)rrfs  r%�
set_use_auditzpolicy.set_use_audit�s
����+��r'c��|du|_yrp)rrfs  r%�set_use_etczpolicy.set_use_etc�rrr'c��|du|_yrp)rrfs  r%�set_use_localizationzpolicy.set_use_localization�s��!$����r'c��|du|_yrp)rrfs  r%�
set_use_fdzpolicy.set_use_fd�s
���d�{��r'c��|du|_yrp)rrfs  r%�set_use_terminalzpolicy.set_use_terminal�s�� �D�[��r'c��|du|_yrp)rrfs  r%�set_use_mailzpolicy.set_use_mail�rur'c��|jtvrttd���|r"|jddjd�yg|jdd<y)Nz'USER Types automatically get a tmp typer�r)r4�USERSrdrr�rfrfs  r%�set_use_tmpzpolicy.set_use_tmp�sU���9�9����Q�H�I�J�J�����f�%�a�(�/�/��7�+-�D���f�%�a�(r'c��|du|_yrp)rrfs  r%�set_use_uidzpolicy.set_use_uidrrr'c�z�|jr/tjd|jtj
�Sy�N�TEMPLATETYPEra)rr��subrr�te_uid_rulesr:s r%�generate_uid_ruleszpolicy.generate_uid_ruless)���<�<��6�6�.�$�)�)�Z�5L�5L�M�M�r'c�z�|jr/tjd|jtj
�Syr�)rr�r�rr�te_syslog_rulesr:s r%�generate_syslog_ruleszpolicy.generate_syslog_ruless)���?�?��6�6�.�$�)�)�Z�5O�5O�P�P�r'c�z�|jr/tjd|jtj
�Syr�)rr�r�rr�te_resolve_rulesr:s r%�generate_resolve_ruleszpolicy.generate_resolve_ruless+������6�6�.�$�)�)�Z�5P�5P�Q�Q�r'c�z�|jr/tjd|jtj
�Syr�)rr�r�rr�te_kerberos_rulesr:s r%�generate_kerberos_ruleszpolicy.generate_kerberos_ruless+������6�6�.�$�)�)�Z�5Q�5Q�R�R�r'c�z�|jr/tjd|jtj
�Syr�)r	r�r�rr�te_manage_krb5_rcache_rulesr:s r%�!generate_manage_krb5_rcache_rulesz(policy.generate_manage_krb5_rcache_rules s+���"�"��6�6�.�$�)�)�Z�5[�5[�\�\�r'c��d}|jr/tjd|jtj
�}|S�Nrar�)r
r�r�rr�te_pam_rules�r �newtes  r%�generate_pam_ruleszpolicy.generate_pam_rules&�/�����<�<��F�F�>�4�9�9�j�6M�6M�N�E��r'c��d}|jr/tjd|jtj
�}|Sr�)rr�r�rr�te_audit_rulesr�s  r%�generate_audit_ruleszpolicy.generate_audit_rules,s/�����>�>��F�F�>�4�9�9�j�6O�6O�P�E��r'c��d}|jr/tjd|jtj
�}|Sr�)rr�r�rr�te_etc_rulesr�s  r%�generate_etc_ruleszpolicy.generate_etc_rules2r�r'c��d}|jr/tjd|jtj
�}|Sr�)rr�r�rr�te_fd_rulesr�s  r%�generate_fd_ruleszpolicy.generate_fd_rules8s/�����;�;��F�F�>�4�9�9�j�6L�6L�M�E��r'c��d}|jr/tjd|jtj
�}|Sr�)rr�r�rr�te_localization_rulesr�s  r%�generate_localization_rulesz"policy.generate_localization_rules>s1����� � ��F�F�>�4�9�9�j�6V�6V�W�E��r'c��d}|jtk7r;|jr/tjd|j
tj�}|Sr�)r4�DBUSrr�r�rr�
te_dbus_rulesr�s  r%�generate_dbus_ruleszpolicy.generate_dbus_rulesDs:�����9�9�������F�F�>�4�9�9�j�6N�6N�O�E��r'c��d}|jr/tjd|jtj
�}|Sr�)rr�r�rr�
te_mail_rulesr�s  r%�generate_mail_ruleszpolicy.generate_mail_rulesJ�/�����=�=��F�F�>�4�9�9�j�6N�6N�O�E��r'c��d}d|�d|�d|��}|tj�vr|�d|j�d�}|Sd|�d|j�d|�d	|�d
|�d�}|S)Nra�corenet_r�(z_t)
z
gen_require(`
    type z
_t;
')
allow z_t z_t:z
_socket name_z;
)r>�get_methodsr)r r=�action�	port_name�line�methods      r%�generate_network_actionzpolicy.generate_network_actionPs]����'/���C���X�)�)�+�+�#)�4�9�9�5�D���,��$�)�)�Y��&�:�D��r'c��|jtD]l}|jt|�d�}|�d|_�(|ddd}|jdd|�}||jvs�R|jj|��n|jtD]l}|jt|�d�}|�d|_�(|ddd}|jdd|�}||jvs�R|jj|��n|jtD]l}|jt|�d�}|�d|_
�(|ddd}|jdd|�}||jvs�R|jj|��n|jdus|jdur/tjd|jtj �Sy	)
N�tcpTr����bind�connect�udpr�ra)rr(rMrerr�rrfrrrrr�r�rr�te_types)r �i�recr�r�s     r%�generate_network_typeszpolicy.generate_network_types^s������U�#�A��.�.��Q���/�C��{�%)��"���F�3�B�K�	��3�3�E�6�9�M���t�3�3�3��(�(�/�/��5�$����e�$�A��.�.��Q���/�C��{�%)��"���F�3�B�K�	��3�3�E�9�i�P���t�3�3�3��(�(�/�/��5�%����U�#�A��.�.��Q���/�C��{�%)��"���F�3�B�K�	��3�3�E�6�9�M���t�3�3�3��(�(�/�/��5�$�����%��);�);�t�)C��6�6�.�$�)�)�W�5E�5E�F�F�r'c��|jD]H}|j|�dk(s�|j|dj|�|j|cS|jddj|�|jdS)Nrrr)r��findrf)r �file�ds   r%�__find_pathzpolicy.__find_path�s����"�"�A��y�y��|�q� ��!�!�!�$�Q�'�.�.�t�4��(�(��+�+�#�	
���$���"�)�)�$�/�� � ��&�&r'c�X�||jvr|jj|�yyr,)r�rf)r �
capabilitys  r%�add_capabilityzpolicy.add_capability�s)���T�.�.�.����$�$�Z�0�/r'c��||_yr,)r�)r r�s  r%�	set_typeszpolicy.set_types�r3r'c�X�||jvr|jj|�yyr,)r�rf)r �processs  r%�add_processzpolicy.add_process�s%���$�.�.�(��N�N�!�!�'�*�)r'c�"�||j|<yr,)r)r r�descriptions   r%�add_booleanzpolicy.add_boolean�s��)��
�
�d�r'c�@�|j|�|j|<yr,)�_policy__find_pathr�r r�s  r%�add_filezpolicy.add_file�s���+�+�D�1��
�
�4�r'c�@�|j|�|j|<yr,)r�rr�s  r%�add_dirzpolicy.add_dir�s���*�*�4�0��	�	�$�r'c���d}|jj�t|j�dkDr,d|j�ddj	|j��d�}|S)Nrar�allow z_t self:capability { � � };
)r�rJrcr�joinr�s  r%�generate_capabilitieszpolicy.generate_capabilities�sO��������� ��t� � �!�A�%�>B�i�i����RV�Rc�Rc�Id�e�E��r'c���d}|jj�t|j�dkDr,d|j�ddj	|j��d�}|S)Nrarr�z_t self:process { r�r�)r�rJrcrr�r�s  r%�generate_processzpolicy.generate_process�sH�����������t�~�~���"�;?�9�9�c�h�h�t�~�~�F^�_�E��r'c��	�d}|j��r�d}|tjd|jtj
�z
}|j
��r�|dz
}|tjd|jtj�z
}|j�r�|tjd|jtj�z
}|jrQt|jt�dkDr2|tjd|jtj�z
}|jrQt|jt�dkDr2|tjd|jtj �z
}|jt"r2|tjd|jtj$�z
}|jt&r2|tjd|jtj(�z
}|jt*r2|tjd|jtj,�z
}|jt"r2|tjd|jtj.�z
}|jt&r2|tjd|jtj0�z
}|jt*r2|tjd|jtj2�z
}|j4D]}||z
}�	|j7��r�|dz
}|tjd|jtj8�z
}|j:r2|tjd|jtj<�z
}|j?�r2|tjd|jtj@�z
}|jBt"r2|tjd|jtjD�z
}|jBt&r2|tjd|jtjF�z
}|jBt*r2|tjd|jtjH�z
}|jJD]}||z
}�	|S)NrarZr�r)&rJr�r�rr�
te_networkrH�te_tcprD�	te_in_tcprrcrr(�te_in_need_port_tcpr�te_out_need_port_tcpr%�te_in_all_ports_tcpr&�te_in_reserved_ports_tcpr'�te_in_unreserved_ports_tcp�te_out_all_ports_tcp�te_out_reserved_ports_tcp�te_out_unreserved_ports_tcprrA�te_udpr�te_in_need_port_udpr;�	te_in_udpr�te_in_all_ports_udp�te_in_reserved_ports_udp�te_in_unreserved_ports_udpr)r r�r�s   r%�generate_network_ruleszpolicy.generate_network_rules�sg���������E��R�V�V�N�D�I�I�w�7I�7I�J�J�E��|�|�~���
��������	�	�7�>�>�J�J���?�?�$��R�V�V�N�D�I�I�w�?P�?P�Q�Q�E��)�)�c�$�+�+�e�2D�.E��.I�������	�	�7�C^�C^�!_�_���%�%�#�d�l�l�5�.A�*B�Q�*F��R�V�V�N�D�I�I�w�?[�?[�\�\�E��;�;�s�#��R�V�V�N�D�I�I�w�?Z�?Z�[�[�E��;�;�x�(��R�V�V�N�D�I�I�w�?_�?_�`�`�E��;�;�z�*��R�V�V�N�D�I�I�w�?a�?a�b�b�E��<�<��$��R�V�V�N�D�I�I�w�?[�?[�\�\�E��<�<��)��R�V�V�N�D�I�I�w�?`�?`�a�a�E��<�<�
�+��R�V�V�N�D�I�I�w�?b�?b�c�c�E��-�-�A��Q�J�E�.��|�|�~���
��������	�	�7�>�>�J�J���%�%��R�V�V�N�D�I�I�w�?Z�?Z�[�[�E��?�?�$��R�V�V�N�D�I�I�w�?P�?P�Q�Q�E��;�;�s�#��R�V�V�N�D�I�I�w�?Z�?Z�[�[�E��;�;�x�(��R�V�V�N�D�I�I�w�?_�?_�`�`�E��;�;�z�*��R�V�V�N�D�I�I�w�?a�?a�b�b�E��-�-�A��Q�J�E�.��r'c��d}|jD]K}tjd|jtj
�}|tjd||�z
}�M|jtk(rl|jD]]}tjd|jtj�}|tjd|jd�d|�z
}�_|S)Nrar��APPLICATIONrH�_ur)rr�r�rr�te_transition_rulesr4rHrr�te_run_rulesr!)r r��appr�uris      r%�generate_transition_rulesz policy.generate_transition_rules�s������*�*�C��&�&�����D�4L�4L�M�C��R�V�V�M�3��4�4�E�+��9�9����*�*���v�v�n�d�i�i��9P�9P�Q�����������
�a�(8�$�?�?��+��r'c��d}|jtk(r�|jD]�}|jd�d}|dz}|jD]f}tjd|tj�}||jvrtj|d|�}|tjd||�z
}�h��|S|jtk(�r|tjd|jtj�z
}|jD]K}tjd|jtj�}|tjd||�z
}�M|jD]q}|jd�d}|dz|jvs�)tjd|jtj�}|tjd	||�z
}�s|S)
Nra�_tr�_rr��system_rr�r�rH)r4r
rr!rr�r�r�te_admin_domain_rulesr��RUSERr�te_admin_rulesr�te_admin_trans_rules)r r�r�r�roler�rr�s        r%�generate_admin_ruleszpolicy.generate_admin_rules�s������9�9����*�*���w�w�t�}�Q�'���d�{���-�-�C��&�&���t�7Q�7Q�R�C��4�>�>�1� �f�f�T�:�s�;���R�V�V�M�3��<�<�E�.�+��L��9�9����R�V�V�N�D�I�I�t�7J�7J�K�K�E��)�)���f�f�^�T�Y�Y��8R�8R�S������
�s�C�8�8��*��*�*���w�w�t�}�Q�'���4�K�D�N�N�2��&�&�����D�<U�<U�V�C��R�V�V�F�D�#�6�6�E�+��r'c��d}|jr/tjd|jtj
�}|Sr�)rr�r�rr�
if_dbus_rules�r �newifs  r%�generate_dbus_ifzpolicy.generate_dbus_ifr�r'c��d}|jtk7r|Stjd|jt
j�}|Sr�)r4�SANDBOXr�r�rr�if_sandbox_rulesrs  r%�generate_sandbox_ifzpolicy.generate_sandbox_ifs9�����9�9����L����~�t�y�y�*�2M�2M�N���r'c��d}d}|jdk7rd|tjd|jtj
�z
}|tjd|jtj�z
}|jD]�}t|j|d�dkDs�"|tjd|j|j|dj�z
}|tjd|j|j|dj�z
}��|dk7r�tjd|jtj�}||z
}|tjd|jtj�z
}||z
}|tjd|jtj�z
}|Sy�Nrar�rrrN)r�r�r�rr�if_initscript_admin_types�if_initscript_adminr�rcr��if_admin_types�if_admin_rules�if_begin_admin�if_middle_admin�if_end_admin)r r
�newtypesr��rets     r%�generate_admin_ifzpolicy.generate_admin_ifsm�������?�?�b� �����~�t�y�y�*�:^�:^�_�_�H��R�V�V�N�D�I�I�z�7U�7U�V�V�E��"�"�A��4�$�$�Q�'��*�+�a�/��B�F�F�>�4�9�9�d�>O�>O�PQ�>R�ST�>U�>d�>d�e�e��������	�	�4�;L�;L�Q�;O�PQ�;R�;a�;a�b�b��#�
�B�;��&�&�����J�4M�4M�N�C��8�O�C��2�6�6�.�$�)�)�Z�5O�5O�P�P�C��5�L�C��2�6�6�.�$�)�)�Z�5L�5L�M�M�C��J�r'c�`�tjd|jtj�S�Nr�)r�r�r�r�te_cgi_typesr:s r%r�zpolicy.generate_cgi_types5s���v�v�n�d�n�n�j�6M�6M�N�Nr'c�`�tjd|jtj�Sr )r�r�r�r�te_sandbox_typesr:s r%r�zpolicy.generate_sandbox_types8s���v�v�n�d�n�n�j�6Q�6Q�R�Rr'c�`�tjd|jtj�Sr )r�r�rr�te_userapp_typesr:s r%r�zpolicy.generate_userapp_types;����v�v�n�d�i�i��1L�1L�M�Mr'c�`�tjd|jtj�Sr )r�r�rr�te_inetd_typesr:s r%r�zpolicy.generate_inetd_types>����v�v�n�d�i�i��1J�1J�K�Kr'c�`�tjd|jtj�Sr )r�r�rr�te_dbusd_typesr:s r%r�zpolicy.generate_dbusd_typesAr)r'c�`�tjd|jtj�Sr )r�r�rr�te_min_login_user_typesr:s r%r�z$policy.generate_min_login_user_typesDs���v�v�n�d�i�i��1M�1M�N�Nr'c�`�tjd|jtj�Sr )r�r�rr�te_login_user_typesr:s r%r�z policy.generate_login_user_typesG����v�v�n�d�i�i��1I�1I�J�Jr'c�`�tjd|jtj�Sr )r�r�rr�te_admin_user_typesr:s r%r�z policy.generate_admin_user_typesJr0r'c��t|j�dk(r(ttd�t|j
z��t
jd|jtj�}|dz
}|jD]8}|d|zz
}|jd�ddz}||jvs�1|d|zz
}�:|d	z
}|S)
Nrz,'%s' policy modules require existing domainsr�z
gen_require(`z
        type %s;rrz

	role %s;z
')
)
rcrrdrr[r4r�r�rr�te_existing_user_typesr!r�)r r�r�rs    r%r�z#policy.generate_existing_user_typesMs����t�$�$�%��*��Q�M�N�QX�Y]�Yb�Yb�Qc�c�d�d����~�t�y�y�$�2M�2M�N��
�$�$���&�&�A�����
�E��7�7�4�=��#�d�*�D��t�~�~�%��
�����'�	��	���r'c�`�tjd|jtj�Sr )r�r�rr�te_x_login_user_typesr:s r%r�z"policy.generate_x_login_user_types_����v�v�n�d�i�i��1K�1K�L�Lr'c�`�tjd|jtj�Sr )r�r�rr�te_root_user_typesr:s r%r�zpolicy.generate_root_user_typesbs���v�v�n�d�i�i��1H�1H�I�Ir'c�$�d}t|j�dk(rttd���|jD]}}|jD]l}|j|�s�t
||dt|��|tjd|dt|�|j|j�z
}�}�trO|dk(rJg}|jD]}|j|��ttd�dj|�z��|S)NrarzType field requiredr�z3You need to define a new type which ends with: 
 %sz
 )
rcr�rdrr��endswithr-r�r�r�rrfr�)r r��tr��default_exts     r%r�zpolicy.generate_new_typeses������t�z�z�?�a���Q�4�5�6�6����A��%�%���:�:�a�=��!�Q�x��Q���[�)��R�V�V�N�A�h��A��w�K��AQ�AQ�RS�AT�A]�A]�^�^�E��	&���u��{��K��%�%���"�"�1�%�&��Q�U�V�Y^�Yc�Yc�do�Yp�p�q�q��r'c��y)Nra�r:s r%r�zpolicy.generate_new_rulesys��r'c���tjd|jtj�}|j
dk7r2|tjd|jtj�z
}|Sr�)r�r�rr�te_daemon_typesr��te_initscript_typesr�s  r%r�zpolicy.generate_daemon_types|sP�����~�t�y�y�*�2L�2L�M���?�?�b� ��R�V�V�N�D�I�I�z�7U�7U�V�V�E��r'c�z�|jr/tjd|jtj
�Syr�)rr�r�rrr�r:s r%�generate_tmp_typeszpolicy.generate_tmp_types��'���<�<��6�6�.�$�)�)�S�\�\�B�B�r'c���d}|jD]N}tjd|tj�}|tjd|j||�z
}�P|S)Nra�BOOLEAN�DESCRIPTION)rr�r�r�
te_boolean)r r��brs    r%�generate_booleanszpolicy.generate_booleans�sT�������A��&�&��A�w�'9�'9�:�C��R�V�V�M�4�=�=��+;�S�A�A�E���r'c�|�d}|jD]*}|tjd|tj�z
}�,|S)NrarG)rr�r�r�te_rules)r r�rJs   r%�generate_boolean_ruleszpolicy.generate_boolean_rules�s7�������A��R�V�V�I�q�'�*:�*:�;�;�E���r'c�`�tjd|jtj�Sr )r�r�rrr#r:s r%�generate_sandbox_tezpolicy.generate_sandbox_te�r&r'c�`�tjd|jtj�Sr )r�r�rrr!r:s r%�generate_cgi_tezpolicy.generate_cgi_te�s���v�v�n�d�i�i��1H�1H�I�Ir'c�d�tjd|jtj�}|Sr )r�r�rr�te_daemon_rulesrs  r%r�zpolicy.generate_daemon_rules�s#�����~�t�y�y�*�2L�2L�M���r'c��d}|jD]v}|jD]e}|j|�s�|dt|�dz}|t	j
d|dt|�|j|j�z
}�v�x|S)Nrarr�)r�r�r;rcr�r��if_rules)r r
r<r��reqtypes     r%�generate_new_type_ifzpolicy.generate_new_type_if�s��������A��%�%���:�:�a�=���#�a�&��k�D�0�G��R�V�V�N�A�h��A��w�K��AQ�AQ�RS�AT�A]�A]�^�^�E��	&���r'c�`�tjd|jtj�Sr )r�r�rr�te_login_user_rulesr:s r%r�z policy.generate_login_user_rules�r0r'c�d�tjd|jtj�}|Sr )r�r�rr�te_existing_user_rules)r �neruless  r%r�z#policy.generate_existing_user_rules�s#���&�&�����D�4O�4O�P���r'c�`�tjd|jtj�Sr )r�r�rr�te_x_login_user_rulesr:s r%r�z"policy.generate_x_login_user_rules�r7r'c�d�tjd|jtj�}|Sr )r�r�rr�te_root_user_rulesr�s  r%r�zpolicy.generate_root_user_rules�s#�����~�t�y�y�$�2I�2I�J���r'c�`�tjd|jtj�Sr )r�r�rr�te_userapp_rulesr:s r%r�zpolicy.generate_userapp_rules�r&r'c�`�tjd|jtj�Sr )r�r�rr�te_inetd_rulesr:s r%r�zpolicy.generate_inetd_rules�r)r'c�`�tjd|jtj�Sr )r�r�rr�te_dbusd_rulesr:s r%r�zpolicy.generate_dbusd_rules�r)r'c�z�|jr/tjd|jtj
�Syr�)rr�r�rrrMr:s r%�generate_tmp_ruleszpolicy.generate_tmp_rules�rEr'c�n�d}|tjd|jtj�z
}|Sr�)r�r�rr�te_cgi_rulesr�s  r%r�zpolicy.generate_cgi_rules�s-����
������	�	�:�3J�3J�K�K���r'c�n�d}|tjd|jtj�z
}|Sr�)r�r�rr�te_sandbox_rulesr�s  r%r�zpolicy.generate_sandbox_rules�s-����
������	�	�:�3N�3N�O�O���r'c�N�d}|js|jtk(r/tjd|j
tj�}|jttttfvr2|tjd|j
tj�z
}|Sr�)
rr4rHr�r�rr�if_user_program_rules�TUSER�XUSER�AUSER�LUSER�if_role_change_rulesrs  r%�generate_user_ifzpolicy.generate_user_if�sr��������	�	�T� 1��F�F�>�4�9�9�j�6V�6V�W�E��9�9���u�e�4�4��R�V�V�N�D�I�I�z�7V�7V�W�W�E��r'c	��d}|tjd|jtj�z
}|j
r2|tjd|jtj�z
}|jdk7r2|tjd|jtj�z
}|jD�]}t|j|d�dkDs�#|tjd|j|j|dj�z
}|j|dD]�}tjj|�s�#t!j"tj |�t j$�s�]|tjd|j|j|dj&�z
}����||j)�z
}||j+�z
}||j-�z
}||j/�z
}||j1�z
}||j3�z
}|Sr)r�r�rr�if_heading_rulesr��if_program_rulesr��if_initscript_rulesr�rcr�rV�os�path�exists�stat�S_ISSOCK�ST_MODE�if_stream_rulesrurrrrXr�)r r
r�r�s    r%�generate_ifzpolicy.generate_if�s�����
������	�	�:�3N�3N�O�O���<�<��R�V�V�N�D�I�I�z�7R�7R�S�S�E��?�?�b� ��R�V�V�N�D�I�I�z�7U�7U�V�V�E��"�"�A��4�$�$�Q�'��*�+�a�/�������	�	�4�;L�;L�Q�;O�PQ�;R�;[�;[�\�\���*�*�1�-�a�0�A��w�w�~�~�a�(�T�]�]�2�7�7�1�:�d�l�l�;S�-T�������	�	�4�CT�CT�UV�CW�XY�CZ�Cj�Cj�!k�k���1�#�	��&�&�(�(��
��&�&�(�(��
��'�'�)�)��
��)�)�+�+��
��*�*�,�,��
��(�(�*�*���r'c�D�|j|jd�Sr$�r�r4r:s r%�generate_default_typeszpolicy.generate_default_types�s!��/�t�!�!�$�)�)�,�Q�/�1�1r'c�~�|j|jdr!|j|jd�Sy)Nrrar�r:s r%�generate_default_ruleszpolicy.generate_default_rules�s;�����d�i�i�(��+�3�4�%�%�d�i�i�0��3�5�5�r'c��d}|jttttfvr�d}t|j�dkDr�|tjd|jtj�z
}|tjd|jtj�z
}|jD]K}tjd|jtj�}|tjd||�z
}�M|S)Nrarr��ROLE)r4rprqrrrsrcrr�r�rr�
te_sudo_rules�te_newrole_rules�te_roles_rules)r r�rrrs     r%�generate_roles_ruleszpolicy.generate_roles_rules�s������9�9���u�e�4�4��E��4�:�:���"�������	�	�4�;M�;M�N�N��������	�	�4�;P�;P�Q�Q�� �J�J�D��&�&�����D�<O�<O�P�C��R�V�V�F�D�#�6�6�E�'��r'c
�	�|j�}|jD]x}t|j|d�dkDs�"|jt
k7s|dk7s�;|t
jd|j|j|dj�z
}�z|jtk7r|d|jzz
}||j�z
}||j�z
}||j�z
}||j�z
}||j�z
}||j!�z
}||j#�z
}|jD�]�}t|j|d�dkDs�#|jtk(rud}|j$D]c}|t
jd|dd	d
z|j|dj&�z
}|t
jd|jdz|�z
}�en>|t
jd|j|j|dj&�z
}|j|dD]�}t(j*j-|�s�#t/j0t)j.|�t.j2�s�]|jtk(rI|j$D]9}|t
jd|dd	|j|dj4�z
}�;n>|t
jd|j|j|dj4�z
}������||j7�z
}||j9�z
}||j;�z
}||j=�z
}||j?�z
}||jA�z
}||jC�z
}||jE�z
}||jG�z
}||jI�z
}||jK�z
}||jM�z
}||jO�z
}||jQ�z
}||jS�z
}||jU�z
}||jW�z
}|S)
Nrrrr�rNz@
########################################
#
# %s local policy
#
ra�TEMPLATETYPE_tr�r�TEMPLATETYPE_rw_t�_rw_t),r�r�rcr�r4r�r�r�rr�r
r�r�r�rDrKr�rNrrMrzr{r|r}r~r�te_stream_rulesrir�r�r�r�r�r�r�r�r�r�r�r�r	r�r�r�)r r�r��	newte_tmp�domainr�s      r%�generate_tezpolicy.generate_tes/���+�+�-���"�"�A��4�$�$�Q�'��*�+�a�/��9�9��#�q�D�y��R�V�V�N�D�I�I�t�?P�?P�QR�?S�TU�?V�?_�?_�`�`�E�	#��9�9�����
�i�i��
�E�	��+�+�-�-��
��&�&�(�(��
��,�,�.�.��
��(�(�*�*��
��'�'�)�)��
��,�,�.�.��
��,�,�.�.���"�"�A��4�$�$�Q�'��*�+�a�/��9�9��%� "�I�"&�"7�"7��!�R�V�V�,<�f�S�b�k�D�>P�RV�Rc�Rc�de�Rf�gh�Ri�Rr�Rr�%s�s�	�����(;�T�Y�Y��=P�R[�!\�\��#8��R�V�V�N�D�I�I�t�?P�?P�QR�?S�TU�?V�?_�?_�`�`�E��*�*�1�-�a�0�A��w�w�~�~�a�(�T�]�]�2�7�7�1�:�d�l�l�;S�-T��9�9��-�*.�*?�*?�� %������s���T�M^�M^�_`�Ma�bc�Md�Mt�Mt�)u� u��+@�"�R�V�V�N�D�I�I�t�GX�GX�YZ�G[�\]�G^�Gn�Gn�%o�o�E��1�#�&	��(�(�*�*��
��,�,�.�.��
��'�'�)�)��
��(�(�*�*��
��(�(�*�*��
��(�(�*�*��
��*�*�,�,��
��+�+�-�-��
��1�1�3�3��
��,�,�.�.��
��*�*�,�,��
��)�)�+�+��
��/�/�1�1��
��*�*�,�,��
��)�)�+�+��
��-�-�/�/��
��7�7�9�9���r'c���d}g}|jj�D�]}tjj	|�rutjtj
|�t
j�r<tjd|j|j|dj�}n;tjd|j|j|dj�}tjd||�}|jtjd|j|d|����"|jj�D]�}tjd|j|j|dj�}tjd||�}|jtjd|j|d|����|j t"t$gzvrt'|�dk(rt(j*S|j t"t$t,t.gzvr |j0st3t5d���|j0r_tjd|j0t(j6�}|jtjd|j|��|j8dk7r_tjd|j8t(j:�}|jtjd|j|��|j=�d	j?|�}|S)
Nrar�rN�FILENAME�FILETYPErz<You must enter the executable path for your confined process�
EXECUTABLErZ) rr\rzr{r|r}r~rr�r�r�fc_sock_file�fc_filerfr�fc_dirr4r�rrcr�fc_userr
rr�rdr�
fc_programr��
fc_initscriptrJr�)r �newfc�fclistr��t1�t2s      r%�generate_fczpolicy.generate_fcDsJ�����������"�A��w�w�~�~�a� �T�]�]�2�7�7�1�:�d�l�l�3K�%L��V�V�N�D�I�I�t�z�z�!�}�Q�7G�7T�7T�U���V�V�N�D�I�I�t�z�z�!�}�Q�7G�7O�7O�P�����
�A�r�*�B��M�M�"�&�&��T�Z�Z��]�1�-=�r�B�C�
#������!�A������	�	�4�9�9�Q�<��?�3I�3I�J�B����
�A�r�*�B��M�M�"�&�&��T�Y�Y�q�\�!�_�b�A�B�"�
�9�9���	�)�)��6�{�a��!�)�)�)��9�9�E�W�e�W�$=�=�=�d�l�l��Q�]�^�_�_��<�<�����d�l�l�J�4I�4I�J�B��M�M�"�&�&�����B�?�@��?�?�b� �����d�o�o�z�7O�7O�P�B��M�M�"�&�&�����B�?�@����
��	�	�&�!���r'c�*�d}|jttttt
fvr|Sd}|jD]
}|d|zz
}�|dk7r|dz
}tjd|jtj�}|tjd||�z
}|jt
k(s|jtk(rZ|jD]K}tjd|jtj�}|tjd||�z
}�M|jtk(r4|tjd|jtj�z
}|S|tjd|jtj�z
}|S)Nraz %s_rz	 system_rr��ROLESrH)r4rprqrrrsrrr�r�rrrLr�admin_trans�min_login_user_default_context�x_login_user_default_context)r �newshrrrr�s      r%�generate_user_shzpolicy.generate_user_shgs>�����9�9�U�E�5�%��?�?��L����J�J�D��W�t�^�#�E���B�;��[� �E��f�f�^�T�Y�Y����=��
�������,�,���9�9������e�!3��*�*���f�f�^�T�Y�Y��8J�8J�K��������3�/�/��+��9�9����R�V�V�N�D�I�I�v�7\�7\�]�]�E���
�R�V�V�N�D�I�I�v�7Z�7Z�[�[�E��r'c�d�tjd|jtj�}tjd|j
|�}|jtk(r%tjdd|jz|�}nStjd|j|�}|tjd|j
tj�z
}|jr2|tjd|jtj�z
}|jdk7r2|tjd|jtj�z
}|jj�D]*}|tjd|tj�z
}�,|jj�D]*}|tjd|tj�z
}�,|jt |j"t zD]a}|j%|d���tjdd	|ztj&�}|tjd|j
|�z
}�c|j(t D]a}|j%|d
���tjdd	|ztj*�}|tjd|j
|�z
}�c||j-�z
}|tjd|jtj.�z
}|S)Nr��
DOMAINTYPE�TEMPLATEFILEz%sr�rar��PORTNUMz%dr�)r�r�r�r�compilerr4r
�manpager��
restoreconr�rr\rrr(rrM�	tcp_portsr�	udp_portsr�r))r rir�r�r�s     r%�generate_shzpolicy.generate_sh�sJ���v�v�n�d�n�n�f�n�n�E���v�v�l�D�I�I�t�4���9�9����F�F�>�4�$�.�.�+@�$�G�E��F�F�>�4�>�>�4�@�E��R�V�V�L�$�)�)�V�^�^�D�D�E��<�<��R�V�V�J����f�6G�6G�H�H�E��?�?�b� ��R�V�V�J�����9J�9J�K�K�E������"�A��R�V�V�J��6�+<�+<�=�=�E�#������!�A��R�V�V�J��6�+<�+<�=�=�E�"����U�#�d�l�l�5�&9�9�A��~�~�a��'�/��V�V�I�t�a�x��1A�1A�B��������	�	�2�>�>��:�
���U�#�A��~�~�a��'�/��V�V�I�t�a�x��1A�1A�B��������	�	�2�>�>��$�
	��&�&�(�(��
���������
�
�C�C���r'c�V�d}td�}|�d}n|d}|tjz
}|jtv�r |tj
z
}|jr2|tjd|jtj�z
}|jdk7r2|tjd|jtj�z
}|jj�D]*}|tjd|tj�z
}�,|jj�D]*}|tjd|tj�z
}�,|tjd|tj�z
}tjd|j|�}tjd|j |�}t#|j$�d	kDr!|d
dj'|j$�zz
}|tjd|jtj(�z
}tjd|j |�}tjdt+j,d
�|�}|jtvrtjdd|�}|jt.k(r$tjd|j zd|�}|jt0t2t4t6t8fvr$tjd|j zd|�}|S)Nrazselinux-policyz0.0.0rr��VERSION�
MODULENAME�
DOMAINNAMErzRequires(post): %s
z, �
TODAYSDATEz%a %b %e %Yz%relabel_filesz.*%s_selinux.8.*z.*%s_u.*)r2r�header_comment_sectionr4rO�define_relabel_files_beginr�r�r��define_relabel_files_endr�rr\r�base_sectionr�rrcr�r��mid_section�time�strftimer
rprqrrrsr)r �newspec�selinux_policynvr�selinux_policyverr�s     r%�
generate_speczpolicy.generate_spec�sZ����,�-=�>���$� '�� 1�!� 4���4�.�.�.���9�9��$��t�6�6�6�G��|�|��2�6�6�*�d�l�l�D�<Y�<Y�Z�Z�����"�$��2�6�6�*�d�o�o�t�?\�?\�]�]���Z�Z�_�_�&���2�6�6�*�a��1N�1N�O�O��'��Y�Y�^�^�%���2�6�6�*�a��1N�1N�O�O��&�	�2�6�6�)�%6��8I�8I�J�J���&�&��t�~�~�w�?���&�&��t�y�y�'�:���t�y�y�>�A���-��	�	�$�)�)�0D�D�D�G��2�6�6�,�����8H�8H�I�I���&�&��t�y�y�'�:���&�&��t�}�}�]�'C�W�M���9�9�L�(��f�f�-�r�7�;�G��9�9����f�f�/�$�)�)�;�R��I�G��9�9�U�E�5�%��?�?��f�f�Z�$�)�)�3�R��A�G��r'c��|�d|j�d�}t|d�}|j|j��|j	�|S)N�/z
_selinux.spec�w)r��open�writer��close)r �out_dir�specfile�fds    r%�
write_speczpolicy.write_spec�s?��+2�D�N�N�C��
�(�C�
 ��
����#�#�%�&�
���
��r'c��|�d|j�d�}t|d�}|j|j��|j	�|S)Nr�z.ter�)r�r�r�r�r�)r r��tefiler�s    r%�write_tezpolicy.write_te��?��&����7��
�&�#�
��
����!�!�#�$�
���
��
r'c���|�d|j�d�}t|d�}|j|j��|j	�tj|d�|S)Nr�z.shr�i�)r�r�r�r�r�rz�chmod)r r��shfiler�s    r%�write_shzpolicy.write_sh�sM��&����7��
�&�#�
��
����!�!�#�$�
���
�
�������
r'c��|�d|j�d�}t|d�}|j|j��|j	�|S)Nr�z.ifr�)r�r�r�r�r�)r r��iffiler�s    r%�write_ifzpolicy.write_if�r�r'c��|�d|j�d�}t|d�}|j|j��|j	�|S)Nr�z.fcr�)r�r�r�r�r�)r r��fcfiler�s    r%�write_fczpolicy.write_fc�r�r'c��	ddl}|j�y#t$r(	ddl}|j	�Yy#t$rYYywxYwwxYwr$)�libdnf5�_policy__extract_rpms_dnf5�ImportError�dnf�_policy__extract_rpms_dnf4)r r�r�s   r%�__extract_rpmszpolicy.__extract_rpms�sK��	���$�$�&���	�
���(�(�*���
��
��		�s$��	A�7�	A�A�A�Ac�~�ddl}|jj�}|j�|j	�|j�}|j
�|j�|jj|�}|j|jg�|j�|D�]�}|jj|j��|j!�}|D]m}|j"D]\}|dk(r�	|j%|�s�t&j(j+|�r|j-|��L|j/|��^�o|jj|�}	|	j1|j3�g�|	j�|	D]�}
|
j!�}|D]m}|j"D]\}|dk(r�	|j%|�s�t&j(j+|�r|j-|��L|j/|��^�o�����y)Nrr�)r��base�Base�load_config�setup�
get_repo_sack�&create_repos_from_system_configuration�
load_reposr)�PackageQuery�filter_filer��filter_availabler�rf�get_name�	get_filesr��
startswithrzr{�isfiler�r��filter_provides�get_source_name)r r�r��	repo_sack�query�pkgr�fnamerJ�	src_query�bpkgs           r%�__extract_rpms_dnf5zpolicy.__extract_rpms_dnf5�s�����|�|� � �"�������
�
���&�&�(�	��8�8�:��������(�(��.��
���4�<�<�.�)�
��� ��C��I�I���S�\�\�^�,��M�M�O�E����*�*�A��F�{� ��'�'��*��7�7�>�>�%�0� �M�M�%�0� �L�L��/�+�� ���0�0��6�I��%�%�s�':�':�'<�&=�>��&�&�(�!�����(��"�E�!�.�.����;�$� �+�+�A�.�!�w�w�~�~�e�4� $�
�
�e� 4� $���U� 3�/�#�"�#r'c�<�ddl}|j�5}|jjj	d�|j�|j
d��|jj�}|j|j��}|j�D�]a}|jj|j�|jD]m}|j D]\}|dk(r�	|j#|�s�t$j&j)|�r|j+|��L|j-|��^�o|j/�}|j|j0��}|j�D]~}	|	jD]m}|j D]\}|dk(r�	|j#|�s�t$j&j)|�r|j+|��L|j-|��^�o����d	ddd�y#1swYyxYw)Nrr�T)�load_system_repo)r�r�)�provides)r�r��conf�
substitutions�update_from_etc�read_all_repos�	fill_sack�sackr��filterr��runr�rfrrr�r�rzr{r�r�r��	available�source_name)
r r�r�r��pqr�r�rJ�sqr�s
          r%�__extract_rpms_dnf4zpolicy.__extract_rpms_dnf4+s����
�X�X�Z�4��I�I�#�#�3�3�C�8����!��N�N�D�N�1��I�I�O�O�%�E����4�<�<��0�B��v�v�x���	�	� � ����*� �Y�Y�E�!�.�.����;�$� �+�+�A�.�!�w�w�~�~�e�4� $�
�
�e� 4� $���U� 3�/�'��_�_�&���Y�Y����Y�8���F�F�H�D�!%����!%�!2�!2�A� �F�{� (�$�/�/��2�#%�7�7�>�>�%�#8�$(�M�M�%�$8�$(�L�L��$7�"3�",�%� ��Z�Z�s�C,H�B:H�=AH�Hc�"�	|j�tjj	d|j
z�r|j
d|j
z�tjjd|j
z�r|jd|j
z�tjjd|j
z�r|jd|j
z�tjj	d|j
z�r|j
d|j
z�tjjd|j
z�r|jd|j
z�tjj	d|j
z�r|jd|j
z�g}|jj�D�]}g}	|j|dd	d
z}|j|dD]%}|j|�r|j|��&�'t|�d	k7s�h|D]V}||j j�vr|j |=�-||j"j�vr|j"|=�W�Xt%t'|j|d�t'|�z
�|j|d<��y#t$rY���wxYw#t$rY��#wxYw)Nz/var/run/%s.pidz/var/run/%sz/var/log/%sz/var/log/%s.logz/var/lib/%sz/etc/rc.d/init.d/%sz/etc/rc\.d/init\.d/%srrr�)�_policy__extract_rpmsr�rzr{r�rr��isdirr�rSr�r\�
IndexErrorr�rfrcrr�list�set)r �
temp_basepathrC�	temp_dirsr�s     r%�
gen_writeablezpolicy.gen_writeableOsl��	����!��7�7�>�>�+�d�i�i�7�8��M�M�+�d�i�i�7�8�
�7�7�=�=�����2�3��L�L�����2�3�
�7�7�=�=�����2�3��L�L�����2�3�
�7�7�>�>�+�d�i�i�7�8��M�M�+�d�i�i�7�8�
�7�7�=�=�����2�3��L�L�����2�3�
�7�7�>�>�/�$�)�)�;�<�� � �!9�D�I�I�!E�F��
��"�"�'�'�)�A��I�
� $� 1� 1�!� 4�Q� 7�� :�S� @�
��&�&�q�)�!�,���<�<�
�.��$�$�Q�'��	-��9�~��"�"�A��D�I�I�N�N�,�,� �I�I�a�L��d�j�j�o�o�/�/� �J�J�q�M� �
#�+/�s�4�3D�3D�Q�3G��3J�/K�c�R[�n�/\�*]��!�!�!�$�Q�'�-*��1�	��	��8�
��
�s#�K1�1L�1	K>�=K>�	L�
Lc��|jtvrytjj	|j
�s-tjjd|j
z�ytjd|j
z�}|j�j�D]@}|jD]/}|j|�s�td|j|z��1�B|j�y)Nzl
***************************************
Warning %s does not exist
***************************************

znm -D %s | grep Uzself.%s)r4rOrzr{r|r��sys�stderrr��popen�readr!r�r��execr�)r r��srJs    r%�gen_symbolszpolicy.gen_symbols�s����9�9�L�(���w�w�~�~�d�l�l�+��J�J����
�l�l��
�
�
�X�X�)�D�L�L�8�
9��������"�A��\�\���<�<��?���T�\�\�!�_�4�5�"�#�	���
r'c��td�}||j|��dtd��d�z
}||j|��dtd��d�z
}||j|��dtd��d�z
}|jt
k7rF||j
|��dtd��d�z
}||j|��dtd��d�z
}|S)	NzCreated the following files:
z # zType Enforcement filerZzInterface filezFile Contexts filez	Spec filezSetup Script)rr�r�r�r4rr�r�)r r��outs   r%�generatezpolicy.generate�s����0�1���d�m�m�G�4�a�8O�6P�Q�Q���d�m�m�G�4�a�8H�6I�J�J���d�m�m�G�4�a�8L�6M�N�N���9�9����$�/�/�'�":�A�k�N�K�K�C��$�-�-��"8�!�N�:K�L�L�C��
r'N)r�)y�__name__�
__module__�__qualname__r"r9r-r/r2r5r7r;r>rArDrFrHrJrMrPrSrYr\r`rcrhrjrlrnrqrtrwryr{r}rr�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r	rrrr�r�r�r�r�r�r�r�r�r�r�r�r�r�rDrKrNrPrRr�rXr�r�r�r�r�r�r�rir�r�rur�r�r�r�r�r�r�r�r�r�r�r�r�r�r
r�r�rrrz�getcwdrr?r'r%rprp�su���BK�+�1��5�1�,�-�7�,�-�7�0���%�G�G�@�@��� �&�%�&�'�%�.�$�*�&�.�%��������������$�L'�1��+�*�2�1���6�p��>���,O�S�N�L�L�O�K�K��$M�J��(�����N�J��
�K��M��N�L�L���
�
��02��

�<�|!�F�2!�F(�T�����
�+4�Z"8�H1^�f�$ )�r�y�y�{�r'rp)Grzrr}r�r>rrrr��	templatesrrr	r
rrr
rrrrrrrr�sepolgen.interfaces�
interfaces�sepolgen.defaults�defaults�PROGNAME�gettext�kwargs�version_info�translationr<r�builtins�str�__dict__r��__builtin__rr&r2rDrMr%r&r'r(�ADMIN_TRANSITION_INTERFACE�USER_TRANSITION_INTERFACErRr��INETDr�rrHr
rprqrsrrrrr[r_rOr�rnrpr?r'r%�<module>r5sq��,
�
��	��E�E��!��� � � ����������(�$�
��,��
�F�
���$�� ��y������H�	#�1�	#��	#�"�	#�A�	
�	�	�A�/�
� 
������
�
�	��&��$��	
����	����
����	��	��	��	��
��
��
��
���*�+�����&�'���
��-�.�����/�0�����Y�<�����$�%���
��)�*�����5�6�����6�7�����,�-�����2�3�����5�6�����8�9�������e�T�3�/��	��u�e�U�+��c�:X�X��M,�,��!$����#����,��$+����S�!�,��s0�?F-�-G%�0G�G%�G�G%�G�G%