/**
* Gets a textual representation of an attribute, and
* all of that attribute's types.
*
* @param type_datum Reference to sepol type_datum
* @param policydb Reference to a policy
*/
static PyObject* get_attr(const qpol_type_t * type_datum, const apol_policy_t * policydb)
{
PyObject *list = NULL;
const qpol_type_t *attr_datum = NULL;
qpol_iterator_t *iter = NULL;
const char *attr_name = NULL, *type_name = NULL;
qpol_policy_t *q = apol_policy_get_qpol(policydb);
unsigned char isattr;
int error = 0;
int rt = 0;
PyObject *dict = PyDict_New();
if (!dict) goto err;
if (qpol_type_get_name(q, type_datum, &attr_name))
goto err;
if (py_insert_string(dict, "name", attr_name))
goto err;
/* get an iterator over all types this attribute has */
if (qpol_type_get_isattr(q, type_datum, &isattr))
goto err;
if (isattr) { /* sanity check */
if (qpol_type_get_type_iter(q, type_datum, &iter))
goto err;
list = PyList_New(0);
if (!list) goto err;
for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) {
if (qpol_iterator_get_item(iter, (void **)&attr_datum))
goto err;
if (qpol_type_get_name(q, attr_datum, &type_name))
goto err;
if (py_append_string(list, type_name))
goto err;
}
qpol_iterator_destroy(&iter);
rt = PyDict_SetItemString(dict, "types", list);
Py_DECREF(list); list = NULL;
if (rt) goto err;
} else /* this should never happen */
goto err;
goto cleanup;
err:
error = errno;
PyErr_SetString(PyExc_RuntimeError,strerror(errno));
py_decref(dict); dict = NULL;
py_decref(list);
cleanup:
qpol_iterator_destroy(&iter);
errno = error;
return dict;
}
/**
* Get a textual representation of a type, and
* all of that type's attributes.
*
* @param type_datum Reference to sepol type_datum
* @param policydb Reference to a policy
*/
static PyObject* get_type_attrs(const qpol_type_t * type_datum, const apol_policy_t * policydb)
{
qpol_iterator_t *iter = NULL;
const char *attr_name = NULL;
const qpol_type_t *attr_datum = NULL;
qpol_policy_t *q = apol_policy_get_qpol(policydb);
int error = 0;
PyObject *list = PyList_New(0);
if (!list) goto err;
if (qpol_type_get_attr_iter(q, type_datum, &iter))
goto err;
for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) {
if (qpol_iterator_get_item(iter, (void **)&attr_datum))
goto err;
if (qpol_type_get_name(q, attr_datum, &attr_name))
goto err;
if (py_append_string(list, attr_name))
goto err;
}
goto cleanup;
err:
error = errno;
PyErr_SetString(PyExc_RuntimeError,strerror(errno));
py_decref(list); list = NULL;
cleanup:
qpol_iterator_destroy(&iter);
errno = error;
return list;
}
char *apol_role_trans_render(const apol_policy_t * policy, const qpol_role_trans_t * rule)
{
char *tmp = NULL;
const char *source_name = NULL, *target_name = NULL, *default_name = NULL;
const qpol_role_t *role = NULL;
const qpol_type_t *type = NULL;
if (!policy || !rule) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return NULL;
}
/* source role */
if (qpol_role_trans_get_source_role(policy->p, rule, &role)) {
ERR(policy, "%s", strerror(errno));
return NULL;
}
if (qpol_role_get_name(policy->p, role, &source_name)) {
ERR(policy, "%s", strerror(errno));
return NULL;
}
/* target type */
if (qpol_role_trans_get_target_type(policy->p, rule, &type)) {
ERR(policy, "%s", strerror(errno));
return NULL;
}
if (qpol_type_get_name(policy->p, type, &target_name)) {
ERR(policy, "%s", strerror(errno));
return NULL;
}
/* default role */
if (qpol_role_trans_get_default_role(policy->p, rule, &role)) {
ERR(policy, "%s", strerror(errno));
return NULL;
}
if (qpol_role_get_name(policy->p, role, &default_name)) {
ERR(policy, "%s", strerror(errno));
return NULL;
}
if (asprintf(&tmp, "role_transition %s %s %s;", source_name, target_name, default_name) < 0) {
ERR(policy, "%s", strerror(errno));
return NULL;
}
return tmp;
}
static PyObject* get_type( const qpol_type_t * type_datum, const apol_policy_t * policydb) {
PyObject *obj;
qpol_policy_t *q = apol_policy_get_qpol(policydb);
const char *type_name = NULL;
int error = 0;
int rt;
unsigned char isalias, ispermissive, isattr;
PyObject *dict = PyDict_New();
if (!dict) goto err;
if (qpol_type_get_name(q, type_datum, &type_name))
goto err;
if (qpol_type_get_isalias(q, type_datum, &isalias))
goto err;
if (qpol_type_get_isattr(q, type_datum, &isattr))
goto err;
if (qpol_type_get_ispermissive(q, type_datum, &ispermissive))
goto err;
if (py_insert_string(dict, "name", type_name))
goto err;
if (py_insert_bool(dict, "permissive", ispermissive))
goto err;
if (!isattr && !isalias) {
obj = get_type_attrs(type_datum, policydb);
rt = py_insert_obj(dict, "attributes", obj);
Py_DECREF(obj);
if (rt) goto err;
}
obj = get_type_aliases(type_datum, policydb);
rt = py_insert_obj(dict, "aliases", obj);
Py_DECREF(obj);
if (rt) goto err;
goto cleanup;
err:
error = errno;
PyErr_SetString(PyExc_RuntimeError,strerror(error));
py_decref(dict); dict = NULL;
cleanup:
errno = error;
return dict;
}
/**
* Get the alias of a type.
*
* @param fp Reference to a file to which to get type information
* @param type_datum Reference to sepol type_datum
* @param policydb Reference to a policy
* attributes
*/
static PyObject* get_type_aliases(const qpol_type_t * type_datum, const apol_policy_t * policydb)
{
qpol_iterator_t *iter = NULL;
size_t alias_size;
unsigned char isattr, isalias;
const char *type_name = NULL;
const char *alias_name;
int error = 0;
qpol_policy_t *q = apol_policy_get_qpol(policydb);
PyObject *list = PyList_New(0);
if (!list) goto err;
if (qpol_type_get_name(q, type_datum, &type_name))
goto cleanup;
if (qpol_type_get_isattr(q, type_datum, &isattr))
goto cleanup;
if (qpol_type_get_isalias(q, type_datum, &isalias))
goto cleanup;
if (qpol_type_get_alias_iter(q, type_datum, &iter))
goto cleanup;
if (qpol_iterator_get_size(iter, &alias_size))
goto cleanup;
if (alias_size > 0) {
for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) {
if (qpol_iterator_get_item(iter, (void **)&alias_name))
goto err;
if (py_append_string(list, alias_name))
goto err;
}
}
goto cleanup;
err:
error = errno;
PyErr_SetString(PyExc_RuntimeError,strerror(errno));
py_decref(list); list = NULL;
cleanup:
qpol_iterator_destroy(&iter);
errno = error;
return list;
}
apol_context_t *apol_context_create_from_qpol_context(const apol_policy_t * p, const qpol_context_t * context)
{
apol_context_t *c = NULL;
const qpol_user_t *user;
const qpol_role_t *role;
const qpol_type_t *type;
const qpol_mls_range_t *range;
const char *user_name, *role_name, *type_name;
apol_mls_range_t *apol_range = NULL;
if ((c = apol_context_create()) == NULL) {
ERR(p, "%s", strerror(ENOMEM));
goto err;
}
if (qpol_context_get_user(p->p, context, &user) < 0 ||
qpol_context_get_role(p->p, context, &role) < 0 ||
qpol_context_get_type(p->p, context, &type) < 0 || qpol_context_get_range(p->p, context, &range) < 0) {
goto err;
}
if (qpol_user_get_name(p->p, user, &user_name) < 0 ||
qpol_role_get_name(p->p, role, &role_name) < 0 || qpol_type_get_name(p->p, type, &type_name) < 0) {
goto err;
}
if (qpol_policy_has_capability(p->p, QPOL_CAP_MLS)) {
/* if the policy is MLS then convert the range, else
* rely upon the default value of NULL */
if ((apol_range = apol_mls_range_create_from_qpol_mls_range(p, range)) == NULL) {
goto err;
}
}
if (apol_context_set_user(p, c, user_name) < 0 ||
apol_context_set_role(p, c, role_name) < 0 ||
apol_context_set_type(p, c, type_name) < 0 || apol_context_set_range(p, c, apol_range) < 0) {
goto err;
}
return c;
err:
apol_mls_range_destroy(&apol_range);
apol_context_destroy(&c);
return NULL;
}
static PyObject* get_av_results(const apol_policy_t * policy, const apol_vector_t * v, PyObject *output)
{
PyObject *obj, *dict=NULL;
PyObject *permlist = NULL;
PyObject *boollist = NULL;
uint32_t rule_type = 0;
int rt;
int error = 0;
qpol_policy_t *q;
size_t i, num_rules = 0;
const qpol_avrule_t *rule = NULL;
char *tmp = NULL, *rule_str = NULL;
qpol_cond_expr_node_t *expr = NULL;
qpol_iterator_t *iter = NULL;
const qpol_cond_t *cond = NULL;
uint32_t enabled = 0;
const qpol_type_t *type;
const char *tmp_name;
const qpol_class_t *obj_class = NULL;
if (!policy || !v) {
errno = EINVAL;
goto err;
}
if (!(num_rules = apol_vector_get_size(v)))
return NULL;
q = apol_policy_get_qpol(policy);
for (i = 0; i < num_rules; i++) {
if (!(rule = apol_vector_get_element(v, i)))
goto err;
dict = PyDict_New();
if (!dict) goto err;
if (qpol_avrule_get_rule_type(q, rule, &rule_type))
goto err;
if (!(tmp_name = apol_rule_type_to_str(rule_type))) {
PyErr_SetString(PyExc_RuntimeError, "Could not get TE rule type's string");
errno = EINVAL;
goto err;
}
if (py_insert_string(dict, "type", tmp_name))
goto err;
if (qpol_avrule_get_source_type(q, rule, &type)) {
goto err;
}
if (qpol_type_get_name(q, type, &tmp_name)) {
goto err;
}
if (py_insert_string(dict, "source", tmp_name))
goto err;
if (qpol_avrule_get_target_type(q, rule, &type)) {
goto err;
}
if (qpol_type_get_name(q, type, &tmp_name)) {
goto err;
}
if (py_insert_string(dict, "target", tmp_name))
goto err;
if (qpol_avrule_get_object_class(q, rule, &obj_class)) {
goto err;
}
if (qpol_class_get_name(q, obj_class, &tmp_name)) {
goto err;
}
if (py_insert_string(dict, "class", tmp_name))
goto err;
if (qpol_avrule_get_perm_iter(q, rule, &iter)) {
goto err;
}
permlist = PyList_New(0);
if (! permlist) goto err;
for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) {
const char *perm_name = NULL;
if (qpol_iterator_get_item(iter, (void **)&perm_name))
goto err;
if (py_append_string(permlist, perm_name))
goto err;
}
rt = PyDict_SetItemString(dict, "permlist", permlist);
py_decref(permlist); permlist=NULL;
if (rt) goto err;
if (qpol_avrule_get_cond(q, rule, &cond))
goto err;
if (qpol_avrule_get_is_enabled(q, rule, &enabled))
goto err;
obj = PyBool_FromLong(enabled);
rt = PyDict_SetItemString(dict, "enabled", obj);
py_decref(obj);
if (cond) {
obj = get_bool(q, cond, enabled);
if (!obj) goto err;
rt = PyDict_SetItemString(dict, "boolean", obj);
py_decref(obj);
}
rt = py_append_obj(output, dict);
py_decref(dict); dict=NULL;
if (rt) goto err;
free(rule_str); rule_str = NULL;
free(expr); expr = NULL;
}
goto cleanup;
err:
error = errno;
PyErr_SetString(PyExc_RuntimeError,strerror(errno));
py_decref(dict);
py_decref(permlist);
py_decref(boollist);
cleanup:
free(tmp);
free(rule_str);
free(expr);
errno = error;
return output;
}
static PyObject* get_ft_results(const apol_policy_t * policy, const apol_vector_t * v, PyObject *list)
{
PyObject *dict = NULL;
size_t i, num_filename_trans = 0;
const char *tmp_name;
int error = 0;
int rt;
const qpol_filename_trans_t *filename_trans = NULL;
const qpol_class_t *obj_class = NULL;
char *tmp = NULL, *filename_trans_str = NULL, *expr = NULL;
qpol_policy_t *q;
const qpol_type_t *type = NULL;
if (!policy || !v) {
errno = EINVAL;
goto err;
}
if (!(num_filename_trans = apol_vector_get_size(v)))
return NULL;
q = apol_policy_get_qpol(policy);
for (i = 0; i < num_filename_trans; i++) {
if (!(filename_trans = apol_vector_get_element(v, i)))
goto err;
dict = PyDict_New();
if (!dict) goto err;
if (py_insert_string(dict, "type", "type_transition"))
goto err;
/* source type */
if (qpol_filename_trans_get_source_type(q, filename_trans, &type)) {
goto err;
}
if (qpol_type_get_name(q, type, &tmp_name)) {
goto err;
}
if (py_insert_string(dict, "source", tmp_name))
goto err;
if (qpol_filename_trans_get_target_type(q, filename_trans, &type))
goto err;
if (qpol_type_get_name(q, type, &tmp_name))
goto err;
if (py_insert_string(dict, "target", tmp_name))
goto err;
if (qpol_filename_trans_get_object_class(q, filename_trans, &obj_class))
goto err;
if (qpol_class_get_name(q, obj_class, &tmp_name))
goto err;
if (py_insert_string(dict, "class", tmp_name))
goto err;
if (qpol_filename_trans_get_default_type(q, filename_trans, &type))
goto err;
if (qpol_type_get_name(q, type, &tmp_name))
goto err;
if (py_insert_string(dict, "transtype", tmp_name))
goto err;
if (! qpol_filename_trans_get_filename(q, filename_trans, &tmp_name)) {
if (py_insert_string(dict, "filename", tmp_name))
goto err;
}
rt = py_append_obj(list, dict);
dict = NULL;
if (rt) goto err;
free(filename_trans_str); filename_trans_str = NULL;
free(expr); expr = NULL;
}
goto cleanup;
err:
error = errno;
PyErr_SetString(PyExc_RuntimeError,strerror(errno));
py_decref(dict);
cleanup:
free(tmp);
free(filename_trans_str);
free(expr);
errno = error;
return list;
}
static PyObject* get_te_results(const apol_policy_t * policy, const apol_vector_t * v, PyObject *output)
{
int error = 0;
int rt = 0;
PyObject *obj, *dict=NULL, *tuple = NULL;
qpol_policy_t *q;
uint32_t rule_type = 0;
const qpol_type_t *type;
size_t i, num_rules = 0;
const qpol_terule_t *rule = NULL;
char *tmp = NULL, *rule_str = NULL, *expr = NULL;
const qpol_cond_t *cond = NULL;
uint32_t enabled = 0;
const char *tmp_name;
const qpol_class_t *obj_class = NULL;
if (!policy || !v) {
errno = EINVAL;
goto err;
}
if (!(num_rules = apol_vector_get_size(v)))
return NULL;
q = apol_policy_get_qpol(policy);
for (i = 0; i < num_rules; i++) {
dict = PyDict_New();
if (!dict) goto err;
if (!(rule = apol_vector_get_element(v, i)))
goto err;
if (qpol_terule_get_cond(q, rule, &cond))
goto err;
if (qpol_terule_get_is_enabled(q, rule, &enabled))
goto err;
if (cond) {
obj = get_bool(q, cond, enabled);
if (!obj) goto err;
rt = PyDict_SetItemString(dict, "boolean", obj);
py_decref(obj);
}
if (qpol_terule_get_rule_type(q, rule, &rule_type))
goto err;
if (!(rule_type &= (QPOL_RULE_TYPE_TRANS | QPOL_RULE_TYPE_CHANGE | QPOL_RULE_TYPE_MEMBER))) {
PyErr_SetString(PyExc_RuntimeError,"Invalid TE rule type");
errno = EINVAL;
goto err;
}
if (!(tmp_name = apol_rule_type_to_str(rule_type))) {
PyErr_SetString(PyExc_RuntimeError, "Could not get TE rule type's string");
errno = EINVAL;
goto err;
}
if (py_insert_string(dict, "type", tmp_name))
goto err;
if (qpol_terule_get_source_type(q, rule, &type))
goto err;
if (qpol_type_get_name(q, type, &tmp_name))
goto err;
if (py_insert_string(dict, "source", tmp_name))
goto err;
if (qpol_terule_get_target_type(q, rule, &type))
goto err;
if (qpol_type_get_name(q, type, &tmp_name))
goto err;
if (py_insert_string(dict, "target", tmp_name))
goto err;
if (qpol_terule_get_object_class(q, rule, &obj_class))
goto err;
if (qpol_class_get_name(q, obj_class, &tmp_name))
goto err;
if (py_insert_string(dict, "class", tmp_name))
goto err;
if (qpol_terule_get_default_type(q, rule, &type))
goto err;
if (qpol_type_get_name(q, type, &tmp_name))
goto err;
if (py_insert_string(dict, "transtype", tmp_name))
goto err;
rt = py_append_obj(output, dict);
dict = NULL;
if(rt) goto err;
free(rule_str); rule_str = NULL;
free(expr); expr = NULL;
}
goto cleanup;
err:
error = errno;
py_decref(dict);
py_decref(tuple);
PyErr_SetString(PyExc_RuntimeError,strerror(error));
cleanup:
free(tmp);
free(rule_str);
free(expr);
errno = error;
return output;
}
/**
* get a textual representation of a role, and
* all of that role's types.
*
* @param type_datum Reference to sepol type_datum
* @param policydb Reference to a policy
* types
*/
static PyObject* get_role(const qpol_role_t * role_datum, const apol_policy_t * policydb)
{
const char *role_name = NULL, *type_name = NULL;
const qpol_role_t *dom_datum = NULL;
const qpol_type_t *type_datum = NULL;
qpol_iterator_t *iter = NULL;
qpol_policy_t *q = apol_policy_get_qpol(policydb);
size_t n_dom = 0, n_types = 0;
int error = 0;
int rt;
PyObject *list = NULL;
PyObject *dict = PyDict_New();
if (!dict) goto err;
if (qpol_role_get_name(q, role_datum, &role_name))
goto err;
if (py_insert_string(dict, "name", role_name))
goto err;
if (qpol_role_get_dominate_iter(q, role_datum, &iter))
goto err;
if (qpol_iterator_get_size(iter, &n_dom))
goto err;
if ((int)n_dom > 0) {
list = PyList_New(0);
if (!list) goto err;
for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) {
if (qpol_iterator_get_item(iter, (void **)&dom_datum))
goto err;
if (qpol_role_get_name(q, dom_datum, &role_name))
goto err;
if (py_append_string(list, role_name))
goto err;
}
rt = py_insert_obj(dict, "roles", list);
Py_DECREF(list); list = NULL;
if (rt) goto err;
}
qpol_iterator_destroy(&iter);
if (qpol_role_get_type_iter(q, role_datum, &iter))
goto err;
if (qpol_iterator_get_size(iter, &n_types))
goto err;
if ((int)n_types > 0) {
list = PyList_New(0);
if (!list) goto err;
for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) {
if (qpol_iterator_get_item(iter, (void **)&type_datum))
goto err;
if (qpol_type_get_name(q, type_datum, &type_name))
goto err;
if (py_append_string(list, type_name))
goto err;
}
rt = py_insert_obj(dict, "types", list);
Py_DECREF(list); list = NULL;
if (rt) goto err;
}
goto cleanup;
err:
error = errno;
PyErr_SetString(PyExc_RuntimeError,strerror(errno));
py_decref(list); list = NULL;
py_decref(dict); dict = NULL;
cleanup:
qpol_iterator_destroy(&iter);
errno = error;
return dict;
}
char *apol_filename_trans_render(const apol_policy_t * policy, const qpol_filename_trans_t * filename_trans)
{
char *tmp = NULL;
const char *tmp_name = NULL;
int error = 0;
size_t tmp_sz = 0;
const qpol_type_t *type = NULL;
const qpol_class_t *obj_class = NULL;
if (!policy || !filename_trans) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return NULL;
}
/* source type */
if (qpol_filename_trans_get_source_type(policy->p, filename_trans, &type)) {
error = errno;
goto err;
}
if (qpol_type_get_name(policy->p, type, &tmp_name)) {
error = errno;
goto err;
}
if (apol_str_appendf(&tmp, &tmp_sz, "type_transition %s ", tmp_name)) {
error = errno;
ERR(policy, "%s", strerror(error));
goto err;
}
/* target type */
if (qpol_filename_trans_get_target_type(policy->p, filename_trans, &type)) {
error = errno;
goto err;
}
if (qpol_type_get_name(policy->p, type, &tmp_name)) {
error = errno;
goto err;
}
if (apol_str_appendf(&tmp, &tmp_sz, "%s : ", tmp_name)) {
error = errno;
ERR(policy, "%s", strerror(error));
goto err;
}
/* object class */
if (qpol_filename_trans_get_object_class(policy->p, filename_trans, &obj_class)) {
error = errno;
goto err;
}
if (qpol_class_get_name(policy->p, obj_class, &tmp_name)) {
error = errno;
goto err;
}
if (apol_str_appendf(&tmp, &tmp_sz, "%s ", tmp_name)) {
error = errno;
ERR(policy, "%s", strerror(error));
goto err;
}
/* default type */
if (qpol_filename_trans_get_default_type(policy->p, filename_trans, &type)) {
error = errno;
goto err;
}
if (qpol_type_get_name(policy->p, type, &tmp_name)) {
error = errno;
goto err;
}
if (apol_str_appendf(&tmp, &tmp_sz, "%s", tmp_name)) {
error = errno;
ERR(policy, "%s", strerror(error));
goto err;
}
/* filename */
if (qpol_filename_trans_get_filename(policy->p, filename_trans, &tmp_name)) {
error = errno;
goto err;
}
if (apol_str_appendf(&tmp, &tmp_sz, " \"%s\";", tmp_name)) {
error = errno;
ERR(policy, "%s", strerror(error));
goto err;
}
return tmp;
err:
free(tmp);
errno = error;
return NULL;
}
