1 #! /usr/bin/python -Es 2 # Copyright (C) 2011 Red Hat 3 # see file 'COPYING' for use and warranty information 4 # 5 # setrans is a tool for analyzing process transistions in SELinux policy 6 # 7 # This program is free software; you can redistribute it and/or 8 # modify it under the terms of the GNU General Public License as 9 # published by the Free Software Foundation; either version 2 of 10 # the License, or (at your option) any later version. 11 # 12 # This program is distributed in the hope that it will be useful, 13 # but WITHOUT ANY WARRANTY; without even the implied warranty of 14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 # GNU General Public License for more details. 16 # 17 # You should have received a copy of the GNU General Public License 18 # along with this program; if not, write to the Free Software 19 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 20 # 02111-1307 USA 21 # 22 # 23 import sepolicy 24 __all__ = ['setrans'] 25 26 27 def _entrypoint(src): 28 trans = sepolicy.search([sepolicy.ALLOW], {sepolicy.SOURCE: src}) 29 return map(lambda y: y[sepolicy.TARGET], filter(lambda x: "entrypoint" in x[sepolicy.PERMS], trans)) 30 31 32 def _get_trans(src): 33 src_list = [src] + list(filter(lambda x: x['name'] == src, sepolicy.get_all_types_info()))[0]['attributes'] 34 trans_list = list(filter(lambda x: x['source'] in src_list and x['class'] == 'process', sepolicy.get_all_transitions())) 35 return trans_list 36 37 38 class setrans: 39 40 def __init__(self, source, dest=None): 41 self.seen = [] 42 self.sdict = {} 43 self.source = source 44 self.dest = dest 45 self._process(self.source) 46 47 def _process(self, source): 48 if source in self.sdict: 49 return self.sdict[source] 50 self.sdict[source] = {} 51 trans = _get_trans(source) 52 if not trans: 53 return 54 self.sdict[source]["name"] = source 55 if not self.dest: 56 self.sdict[source]["map"] = trans 57 else: 58 self.sdict[source]["map"] = list(map(lambda y: y, filter(lambda x: x["transtype"] == self.dest, trans))) 59 self.sdict[source]["child"] = list(map(lambda y: y["transtype"], filter(lambda x: x["transtype"] not in [self.dest, source], trans))) 60 for s in self.sdict[source]["child"]: 61 self._process(s) 62 63 def out(self, name, header=""): 64 buf = "" 65 if name in self.seen: 66 return buf 67 self.seen.append(name) 68 69 if "map" in self.sdict[name]: 70 for t in self.sdict[name]["map"]: 71 cond = sepolicy.get_conditionals(t["source"], t["transtype"], "process", ["transition"]) 72 if cond: 73 buf += "%s%s @ %s --> %s %s\n" % (header, t["source"], t["target"], t["transtype"], sepolicy.get_conditionals_format_text(cond)) 74 else: 75 buf += "%s%s @ %s --> %s\n" % (header, t["source"], t["target"], t["transtype"]) 76 77 if "child" in self.sdict[name]: 78 for x in self.sdict[name]["child"]: 79 buf += self.out(x, "%s%s ... " % (header, name)) 80 return buf 81 82 def output(self): 83 self.seen = [] 84 print(self.out(self.source)) 85