11dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris// Author: Thomas Liu <tliu@redhat.com> 21dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 31dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris/** 41dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * @file 51dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * Python bindings used to search TE rules. 61dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * 71dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * @author Thomas Liu <tliu@redhat.com> 81dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * @author Dan Walsh <dwalsh@redhat.com> 91dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * Copyright (C) 2012-2013 Red Hat, inc 101dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * 111dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * Sections copied from sesearch.c in setools package 121dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * @author Frank Mayer mayerf@tresys.com 131dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * @author Jeremy A. Mowery jmowery@tresys.com 141dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * @author Paul Rosenfeld prosenfeld@tresys.com 151dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * Copyright (C) 2003-2008 Tresys Technology, LLC 161dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * 171dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * This program is free software; you can redistribute it and/or modify 181dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * it under the terms of the GNU General Public License as published by 191dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * the Free Software Foundation; either version 2 of the License, or 201dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * (at your option) any later version. 211dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * 221dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * This program is distributed in the hope that it will be useful, 231dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * but WITHOUT ANY WARRANTY; without even the implied warranty of 241dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 251dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * GNU General Public License for more details. 261dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * 271dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * You should have received a copy of the GNU General Public License 281dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * along with this program; if not, write to the Free Software 291dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 301dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris */ 311dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 321dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris/** 331dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * This is a modified version of sesearch to be used as part of a sepython library for 341dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris * Python bindings. 351dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris */ 361dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 371dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include "common.h" 381dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include "policy.h" 391dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 401dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris/* libapol */ 411dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include <apol/policy-query.h> 421dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include <apol/render.h> 431dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include <apol/util.h> 441dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include <apol/vector.h> 451dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 461dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris/* libqpol*/ 471dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include <qpol/policy.h> 481dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include <qpol/policy_extend.h> 491dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include <qpol/syn_rule_query.h> 501dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include <qpol/util.h> 511dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 521dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris/* other */ 531dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include <errno.h> 541dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include <stdlib.h> 551dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include <stdio.h> 561dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include <assert.h> 571dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include <getopt.h> 581dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include <string.h> 591dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#include <stdbool.h> 601dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 611dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris#define COPYRIGHT_INFO "Copyright (C) 2012 Red Hat, Inc, Tresys Technology, LLC" 621dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 631dce0bf16d6300d4858d611cb29de336bfd85f9aEric Parisenum opt_values 641dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris{ 651dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris RULE_NEVERALLOW = 256, RULE_AUDIT, RULE_AUDITALLOW, RULE_DONTAUDIT, 661dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris RULE_ROLE_ALLOW, RULE_ROLE_TRANS, RULE_RANGE_TRANS, RULE_ALL, 671dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris EXPR_ROLE_SOURCE, EXPR_ROLE_TARGET 681dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris}; 691dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 701dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris; 711dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 721dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paristypedef struct options 731dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris{ 741dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris char *src_name; 751dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris char *tgt_name; 761dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris char *src_role_name; 771dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris char *tgt_role_name; 781dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris char *class_name; 791dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris char *permlist; 801dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris char *bool_name; 811dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_vector_t *class_vector; 821dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool all; 831dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool lineno; 841dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool semantic; 851dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool indirect; 861dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool allow; 871dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool nallow; 881dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool auditallow; 891dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool dontaudit; 901dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool type; 911dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool rtrans; 921dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool role_allow; 931dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool role_trans; 941dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool useregex; 951dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool show_cond; 961dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_vector_t *perm_vector; 971dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris} options_t; 981dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 991dce0bf16d6300d4858d611cb29de336bfd85f9aEric Parisstatic int py_tuple_insert_obj(PyObject *tuple, int pos, PyObject *obj) 1001dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris{ 1011dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int rt; 1021dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!obj) return -1; 1031dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris rt = PyTuple_SetItem(tuple, pos, obj); 1041dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return rt; 1051dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris} 1061dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 1071dce0bf16d6300d4858d611cb29de336bfd85f9aEric Parisstatic int perform_ra_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v) 1081dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris{ 1091dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_role_allow_query_t *raq = NULL; 1101dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int error = 0; 1111dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 1121dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!policy || !opt || !v) { 1131dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris ERR(policy, "%s", strerror(EINVAL)); 1141dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = EINVAL; 1151dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return -1; 1161dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 1171dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 1181dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!opt->role_allow && !opt->all) { 1191dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris *v = NULL; 1201dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return 0; /* no search to do */ 1211dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 1221dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 1231dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris raq = apol_role_allow_query_create(); 1241dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!raq) { 1251dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris ERR(policy, "%s", strerror(ENOMEM)); 1261dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = ENOMEM; 1271dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return -1; 1281dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 1291dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 1301dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_role_allow_query_set_regex(policy, raq, opt->useregex); 1311dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->src_role_name) { 1321dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_role_allow_query_set_source(policy, raq, opt->src_role_name)) { 1331dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris error = errno; 1341dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 1351dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 1361dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 1371dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->tgt_role_name) 1381dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_role_allow_query_set_target(policy, raq, opt->tgt_role_name)) { 1391dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris error = errno; 1401dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 1411dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 1421dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 1431dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_role_allow_get_by_query(policy, raq, v)) { 1441dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris error = errno; 1451dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 1461dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 1471dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_role_allow_query_destroy(&raq); 1481dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return 0; 1491dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 1501dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris err: 1511dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_vector_destroy(v); 1521dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_role_allow_query_destroy(&raq); 1531dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris ERR(policy, "%s", strerror(error)); 1541dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = error; 1551dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return -1; 1561dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris} 1571dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 1581dce0bf16d6300d4858d611cb29de336bfd85f9aEric Parisstatic PyObject* get_ra_results(const apol_policy_t * policy, const apol_vector_t * v, PyObject *output) 1591dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris{ 1601dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris size_t i, num_rules = 0; 1611dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris qpol_policy_t *q; 1621dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const qpol_role_allow_t *rule = NULL; 1631dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const char *tmp; 1641dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyObject *obj, *dict=NULL; 1651dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const qpol_role_t *role = NULL; 1661dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int error = 0; 1671dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = EINVAL; 1681dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int rt; 1691dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 1701dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!policy || !v) { 1711dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = EINVAL; 1721dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 1731dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 1741dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 1751dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!(num_rules = apol_vector_get_size(v))) 1761dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return NULL; 1771dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 1781dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris q = apol_policy_get_qpol(policy); 1791dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 1801dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris for (i = 0; i < num_rules; i++) { 1811dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris dict = PyDict_New(); 1821dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!dict) goto err; 1831dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!(rule = apol_vector_get_element(v, i))) 1841dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 1851dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 1861dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_role_allow_get_source_role(q, rule, &role)) { 1871dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 1881dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 1891dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_role_get_name(q, role, &tmp)) { 1901dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 1911dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 1921dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris obj = PyString_FromString(tmp); 1931dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_obj(dict, "source", obj)) 1941dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 1951dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 1961dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_role_allow_get_target_role(q, rule, &role)) { 1971dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 1981dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 1991dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_role_get_name(q, role, &tmp)) { 2001dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 2011dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 2021dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris obj = PyString_FromString(tmp); 2031dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_obj(dict, "target", obj)) 2041dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 2051dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 2061dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris rt = py_append_obj(output, dict); 2071dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (rt) goto err; 2081dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(dict); dict=NULL; 2091dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 2101dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto cleanup; 2111dce0bf16d6300d4858d611cb29de336bfd85f9aEric Pariserr: 2121dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris error = errno; 2131dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,strerror(error)); 2141dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(dict); 2151dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 2161dce0bf16d6300d4858d611cb29de336bfd85f9aEric Pariscleanup: 2171dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = error; 2181dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return output; 2191dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris} 2201dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 2211dce0bf16d6300d4858d611cb29de336bfd85f9aEric Parisstatic int perform_te_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v) 2221dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris{ 2231dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_terule_query_t *teq = NULL; 2241dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris unsigned int rules = 0; 2251dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int error = 0; 2261dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris size_t i; 2271dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 2281dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!policy || !opt || !v) { 2291dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,strerror(EINVAL)); 2301dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = EINVAL; 2311dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return -1; 2321dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 2331dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 2341dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->all || opt->type) { 2351dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris rules = (QPOL_RULE_TYPE_TRANS | QPOL_RULE_TYPE_CHANGE | QPOL_RULE_TYPE_MEMBER); 2361dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } else { 2371dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris *v = NULL; 2381dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return 0; /* no search to do */ 2391dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 2401dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 2411dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris teq = apol_terule_query_create(); 2421dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!teq) { 2431dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,strerror(ENOMEM)); 2441dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = ENOMEM; 2451dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return -1; 2461dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 2471dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 2481dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_terule_query_set_rules(policy, teq, rules); 2491dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_terule_query_set_regex(policy, teq, opt->useregex); 2501dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 2511dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->src_name) 2521dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_terule_query_set_source(policy, teq, opt->src_name, opt->indirect); 2531dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->tgt_name) 2541dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_terule_query_set_target(policy, teq, opt->tgt_name, opt->indirect); 2551dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->bool_name) 2561dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_terule_query_set_bool(policy, teq, opt->bool_name); 2571dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->class_name) { 2581dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->class_vector == NULL) { 2591dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_terule_query_append_class(policy, teq, opt->class_name)) { 2601dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris error = errno; 2611dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 2621dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 2631dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } else { 2641dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris for (i = 0; i < apol_vector_get_size(opt->class_vector); ++i) { 2651dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris char *class_name; 2661dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris class_name = apol_vector_get_element(opt->class_vector, i); 2671dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!class_name) 2681dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris continue; 2691dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_terule_query_append_class(policy, teq, class_name)) { 2701dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris error = errno; 2711dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 2721dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 2731dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 2741dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 2751dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 2761dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 2771dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!(opt->semantic) && qpol_policy_has_capability(apol_policy_get_qpol(policy), QPOL_CAP_SYN_RULES)) { 2781dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_syn_terule_get_by_query(policy, teq, v)) { 2791dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 2801dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 2811dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } else { 2821dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_terule_get_by_query(policy, teq, v)) { 2831dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 2841dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 2851dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 2861dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 2871dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_terule_query_destroy(&teq); 2881dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return 0; 2891dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 2901dce0bf16d6300d4858d611cb29de336bfd85f9aEric Pariserr: 2911dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris error = errno; 2921dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,strerror(error)); 2931dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_vector_destroy(v); 2941dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_terule_query_destroy(&teq); 2951dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = error; 2961dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return -1; 2971dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris} 2981dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 2991dce0bf16d6300d4858d611cb29de336bfd85f9aEric Parisstatic PyObject* get_bool(const qpol_policy_t *q, const qpol_cond_t * cond, int enabled) 3001dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris{ 3011dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris qpol_iterator_t *iter = NULL; 3021dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris qpol_cond_expr_node_t *expr = NULL; 3031dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris char *tmp = NULL; 3041dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const char *bool_name = NULL; 3051dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int error = 0; 3061dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris uint32_t expr_type = 0; 3071dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris qpol_bool_t *cond_bool = NULL; 3081dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyObject *obj, *tuple = NULL; 3091dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyObject *boollist = NULL; 3101dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 3111dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!q || !cond) { 3121dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = EINVAL; 3131dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return NULL; 3141dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 3151dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_cond_get_expr_node_iter(q, cond, &iter) < 0) { 3161dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 3171dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 3181dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 3191dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris boollist = PyList_New(0); 3201dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (! boollist) goto err; 3211dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 3221dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { 3231dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_iterator_get_item(iter, (void **)&expr)) { 3241dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 3251dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 3261dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_cond_expr_node_get_expr_type(q, expr, &expr_type)) { 3271dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 3281dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 3291dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (expr_type != QPOL_COND_EXPR_BOOL) { 3301dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris obj = PyString_FromString(apol_cond_expr_type_to_str(expr_type)); 3311dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!obj) goto err; 3321dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_append_obj(boollist, obj)) 3331dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 3341dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } else { 3351dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris tuple = PyTuple_New(2); 3361dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!tuple) goto err; 3371dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 3381dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_cond_expr_node_get_bool(q, expr, &cond_bool)) { 3391dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 3401dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 3411dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_bool_get_name(q, cond_bool, &bool_name)) { 3421dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 3431dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 3441dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris obj = PyString_FromString(bool_name); 3451dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_tuple_insert_obj(tuple, 0, obj)) 3461dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 3471dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris obj = PyBool_FromLong(enabled); 3481dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_tuple_insert_obj(tuple, 1, obj)) 3491dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 3501dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_append_obj(boollist, tuple)) 3511dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 3521dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris tuple=NULL; 3531dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 3541dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 3551dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 3561dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris qpol_iterator_destroy(&iter); 3571dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return boollist; 3581dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 3591dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris err: 3601dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris error = errno; 3611dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris qpol_iterator_destroy(&iter); 3621dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(tuple); 3631dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(boollist); 3641dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(tmp); 3651dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = error; 3661dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return NULL; 3671dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris} 3681dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 3691dce0bf16d6300d4858d611cb29de336bfd85f9aEric Parisstatic PyObject* get_te_results(const apol_policy_t * policy, const apol_vector_t * v, PyObject *output) 3701dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris{ 3711dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int error = 0; 3721dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int rt = 0; 3731dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyObject *obj, *dict=NULL, *tuple = NULL; 3741dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris qpol_policy_t *q; 3751dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris uint32_t rule_type = 0; 3761dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const qpol_type_t *type; 3771dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris size_t i, num_rules = 0; 3781dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const qpol_terule_t *rule = NULL; 3791dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris char *tmp = NULL, *rule_str = NULL, *expr = NULL; 3801dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const qpol_cond_t *cond = NULL; 3811dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris uint32_t enabled = 0; 3821dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const char *tmp_name; 3831dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const qpol_class_t *obj_class = NULL; 3841dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 3851dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!policy || !v) { 3861dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = EINVAL; 3871dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 3881dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 3891dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 3901dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!(num_rules = apol_vector_get_size(v))) 3911dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return NULL; 3921dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 3931dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris q = apol_policy_get_qpol(policy); 3941dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 3951dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris for (i = 0; i < num_rules; i++) { 3961dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris dict = PyDict_New(); 3971dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!dict) goto err; 3981dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!(rule = apol_vector_get_element(v, i))) 3991dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4001dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_terule_get_cond(q, rule, &cond)) 4011dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4021dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_terule_get_is_enabled(q, rule, &enabled)) 4031dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4041dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 4051dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (cond) { 4061dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris obj = get_bool(q, cond, enabled); 4071dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!obj) goto err; 4081dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris rt = PyDict_SetItemString(dict, "boolean", obj); 4091dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(obj); 4101dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 4111dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 4121dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_terule_get_rule_type(q, rule, &rule_type)) 4131dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4141dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 4151dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!(rule_type &= (QPOL_RULE_TYPE_TRANS | QPOL_RULE_TYPE_CHANGE | QPOL_RULE_TYPE_MEMBER))) { 4161dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,"Invalid TE rule type"); 4171dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = EINVAL; 4181dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4191dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 4201dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!(tmp_name = apol_rule_type_to_str(rule_type))) { 4211dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError, "Could not get TE rule type's string"); 4221dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = EINVAL; 4231dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4241dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 4251dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 4261dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_string(dict, "type", tmp_name)) 4271dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4281dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 4291dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_terule_get_source_type(q, rule, &type)) 4301dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4311dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_type_get_name(q, type, &tmp_name)) 4321dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4331dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_string(dict, "source", tmp_name)) 4341dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4351dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 4361dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_terule_get_target_type(q, rule, &type)) 4371dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4381dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_type_get_name(q, type, &tmp_name)) 4391dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4401dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_string(dict, "target", tmp_name)) 4411dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4421dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 4431dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_terule_get_object_class(q, rule, &obj_class)) 4441dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4451dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_class_get_name(q, obj_class, &tmp_name)) 4461dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4471dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_string(dict, "class", tmp_name)) 4481dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4491dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 4501dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_terule_get_default_type(q, rule, &type)) 4511dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4521dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_type_get_name(q, type, &tmp_name)) 4531dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4541dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_string(dict, "transtype", tmp_name)) 4551dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 4561dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 4571dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris rt = py_append_obj(output, dict); 4581dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris dict = NULL; 4591dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if(rt) goto err; 4601dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 4611dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(rule_str); rule_str = NULL; 4621dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(expr); expr = NULL; 4631dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 4641dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto cleanup; 4651dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 4661dce0bf16d6300d4858d611cb29de336bfd85f9aEric Pariserr: 4671dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris error = errno; 4681dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(dict); 4691dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(tuple); 4701dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,strerror(error)); 4711dce0bf16d6300d4858d611cb29de336bfd85f9aEric Pariscleanup: 4721dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(tmp); 4731dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(rule_str); 4741dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(expr); 4751dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = error; 4761dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return output; 4771dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris} 4781dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 4791dce0bf16d6300d4858d611cb29de336bfd85f9aEric Parisstatic int perform_ft_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v) 4801dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris{ 4811dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_filename_trans_query_t *ftq = NULL; 4821dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris size_t i; 4831dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int error = 0; 4841dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 4851dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!policy || !opt || !v) { 4861dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,strerror(EINVAL)); 4871dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = EINVAL; 4881dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return -1; 4891dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 4901dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 4911dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!opt->type && !opt->all) { 4921dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris *v = NULL; 4931dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return 0; /* no search to do */ 4941dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 4951dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 4961dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris ftq = apol_filename_trans_query_create(); 4971dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!ftq) { 4981dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,strerror(ENOMEM)); 4991dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = ENOMEM; 5001dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return -1; 5011dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 5021dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5031dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_filename_trans_query_set_regex(policy, ftq, opt->useregex); 5041dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->src_name) { 5051dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_filename_trans_query_set_source(policy, ftq, opt->src_name, opt->indirect)) { 5061dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 5071dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 5081dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 5091dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5101dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->tgt_name) { 5111dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_filename_trans_query_set_target(policy, ftq, opt->tgt_name, opt->indirect)) { 5121dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 5131dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 5141dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 5151dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->class_name) { 5161dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->class_vector == NULL) { 5171dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_filename_trans_query_append_class(policy, ftq, opt->class_name)) { 5181dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 5191dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 5201dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } else { 5211dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris for (i = 0; i < apol_vector_get_size(opt->class_vector); ++i) { 5221dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris char *class_name; 5231dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris class_name = apol_vector_get_element(opt->class_vector, i); 5241dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!class_name) 5251dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris continue; 5261dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_filename_trans_query_append_class(policy, ftq, class_name)) { 5271dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 5281dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 5291dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 5301dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 5311dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 5321dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5331dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_filename_trans_get_by_query(policy, ftq, v)) 5341dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 5351dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5361dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_filename_trans_query_destroy(&ftq); 5371dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return 0; 5381dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5391dce0bf16d6300d4858d611cb29de336bfd85f9aEric Pariserr: 5401dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris error = errno; 5411dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,strerror(errno)); 5421dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_vector_destroy(v); 5431dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_filename_trans_query_destroy(&ftq); 5441dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = error; 5451dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return -1; 5461dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris} 5471dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5481dce0bf16d6300d4858d611cb29de336bfd85f9aEric Parisstatic PyObject* get_ft_results(const apol_policy_t * policy, const apol_vector_t * v, PyObject *list) 5491dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris{ 5501dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyObject *dict = NULL; 5511dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris size_t i, num_filename_trans = 0; 5521dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const char *tmp_name; 5531dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int error = 0; 5541dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int rt; 5551dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const qpol_filename_trans_t *filename_trans = NULL; 5561dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const qpol_class_t *obj_class = NULL; 5571dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris char *tmp = NULL, *filename_trans_str = NULL, *expr = NULL; 5581dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris qpol_policy_t *q; 5591dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const qpol_type_t *type = NULL; 5601dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5611dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!policy || !v) { 5621dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = EINVAL; 5631dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 5641dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 5651dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5661dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!(num_filename_trans = apol_vector_get_size(v))) 5671dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return NULL; 5681dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5691dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris q = apol_policy_get_qpol(policy); 5701dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5711dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris for (i = 0; i < num_filename_trans; i++) { 5721dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!(filename_trans = apol_vector_get_element(v, i))) 5731dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 5741dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5751dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris dict = PyDict_New(); 5761dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!dict) goto err; 5771dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5781dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_string(dict, "type", "type_transition")) 5791dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 5801dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5811dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris /* source type */ 5821dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_filename_trans_get_source_type(q, filename_trans, &type)) { 5831dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 5841dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 5851dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_type_get_name(q, type, &tmp_name)) { 5861dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 5871dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 5881dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5891dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_string(dict, "source", tmp_name)) 5901dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 5911dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5921dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_filename_trans_get_target_type(q, filename_trans, &type)) 5931dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 5941dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5951dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_type_get_name(q, type, &tmp_name)) 5961dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 5971dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 5981dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_string(dict, "target", tmp_name)) 5991dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 6001dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 6011dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_filename_trans_get_object_class(q, filename_trans, &obj_class)) 6021dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 6031dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 6041dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_class_get_name(q, obj_class, &tmp_name)) 6051dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 6061dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 6071dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_string(dict, "class", tmp_name)) 6081dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 6091dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 6101dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_filename_trans_get_default_type(q, filename_trans, &type)) 6111dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 6121dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_type_get_name(q, type, &tmp_name)) 6131dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 6141dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_string(dict, "transtype", tmp_name)) 6151dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 6161dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 6171dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (! qpol_filename_trans_get_filename(q, filename_trans, &tmp_name)) { 6181dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_string(dict, "filename", tmp_name)) 6191dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 6201dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 6211dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 6221dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris rt = py_append_obj(list, dict); 6231dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris dict = NULL; 6241dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (rt) goto err; 6251dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 6261dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(filename_trans_str); filename_trans_str = NULL; 6271dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(expr); expr = NULL; 6281dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 6291dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto cleanup; 6301dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 6311dce0bf16d6300d4858d611cb29de336bfd85f9aEric Pariserr: 6321dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris error = errno; 6331dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,strerror(errno)); 6341dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(dict); 6351dce0bf16d6300d4858d611cb29de336bfd85f9aEric Pariscleanup: 6361dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(tmp); 6371dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(filename_trans_str); 6381dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(expr); 6391dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = error; 6401dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return list; 6411dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris} 6421dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 6431dce0bf16d6300d4858d611cb29de336bfd85f9aEric Parisstatic int perform_av_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v) 6441dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris{ 6451dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_avrule_query_t *avq = NULL; 6461dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris unsigned int rules = 0; 6471dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int error = 0; 6481dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris char *tmp = NULL, *tok = NULL, *s = NULL; 6491dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 6501dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!policy || !opt || !v) { 6511dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,strerror(EINVAL)); 6521dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = EINVAL; 6531dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return -1; 6541dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 6551dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 6561dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!opt->all && !opt->allow && !opt->nallow && !opt->auditallow && !opt->dontaudit) { 6571dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris *v = NULL; 6581dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return 0; /* no search to do */ 6591dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 6601dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 6611dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris avq = apol_avrule_query_create(); 6621dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!avq) { 6631dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,strerror(ENOMEM)); 6641dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = ENOMEM; 6651dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return -1; 6661dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 6671dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 6681dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->allow || opt->all) 6691dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris rules |= QPOL_RULE_ALLOW; 6701dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->nallow || opt->all) // Add this regardless of policy capabilities 6711dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris rules |= QPOL_RULE_NEVERALLOW; 6721dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->auditallow || opt->all) 6731dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris rules |= QPOL_RULE_AUDITALLOW; 6741dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->dontaudit || opt->all) 6751dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris rules |= QPOL_RULE_DONTAUDIT; 6761dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (rules != 0) // Setting rules = 0 means you want all the rules 6771dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_avrule_query_set_rules(policy, avq, rules); 6781dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_avrule_query_set_regex(policy, avq, opt->useregex); 6791dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->src_name) 6801dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_avrule_query_set_source(policy, avq, opt->src_name, opt->indirect); 6811dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->tgt_name) 6821dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_avrule_query_set_target(policy, avq, opt->tgt_name, opt->indirect); 6831dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->bool_name) 6841dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_avrule_query_set_bool(policy, avq, opt->bool_name); 6851dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->class_name) { 6861dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->class_vector == NULL) { 6871dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_avrule_query_append_class(policy, avq, opt->class_name)) { 6881dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 6891dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 6901dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } else { 6911dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris size_t i; 6921dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris for (i = 0; i < apol_vector_get_size(opt->class_vector); ++i) { 6931dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris char *class_name; 6941dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris class_name = apol_vector_get_element(opt->class_vector, i); 6951dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!class_name) 6961dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris continue; 6971dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_avrule_query_append_class(policy, avq, class_name)) { 6981dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 6991dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 7001dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 7011dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 7021dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 7031dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 7041dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (opt->permlist) { 7051dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris tmp = strdup(opt->permlist); 7061dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris for (tok = strtok(tmp, ","); tok; tok = strtok(NULL, ",")) { 7071dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_avrule_query_append_perm(policy, avq, tok)) { 7081dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 7091dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 7101dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if ((s = strdup(tok)) == NULL || apol_vector_append(opt->perm_vector, s) < 0) { 7111dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 7121dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 7131dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris s = NULL; 7141dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 7151dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(tmp); 7161dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris tmp = NULL; 7171dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 7181dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 7191dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!(opt->semantic) && qpol_policy_has_capability(apol_policy_get_qpol(policy), QPOL_CAP_SYN_RULES)) { 7201dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_syn_avrule_get_by_query(policy, avq, v)) { 7211dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 7221dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 7231dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } else { 7241dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (apol_avrule_get_by_query(policy, avq, v)) { 7251dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 7261dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 7271dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 7281dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 7291dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_avrule_query_destroy(&avq); 7301dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return 0; 7311dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 7321dce0bf16d6300d4858d611cb29de336bfd85f9aEric Pariserr: 7331dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris error = errno; 7341dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,strerror(error)); 7351dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_vector_destroy(v); 7361dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_avrule_query_destroy(&avq); 7371dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(tmp); 7381dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(s); 7391dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = error; 7401dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return -1; 7411dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris} 7421dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 7431dce0bf16d6300d4858d611cb29de336bfd85f9aEric Parisstatic PyObject* get_av_results(const apol_policy_t * policy, const apol_vector_t * v, PyObject *output) 7441dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris{ 7451dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyObject *obj, *dict=NULL; 7461dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyObject *permlist = NULL; 7471dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyObject *boollist = NULL; 7481dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris uint32_t rule_type = 0; 7491dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int rt; 7501dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int error = 0; 7511dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris qpol_policy_t *q; 7521dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris size_t i, num_rules = 0; 7531dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const qpol_avrule_t *rule = NULL; 7541dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris char *tmp = NULL, *rule_str = NULL; 7551dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris qpol_cond_expr_node_t *expr = NULL; 7561dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris qpol_iterator_t *iter = NULL; 7571dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const qpol_cond_t *cond = NULL; 7581dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris uint32_t enabled = 0; 7591dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const qpol_type_t *type; 7601dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const char *tmp_name; 7611dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const qpol_class_t *obj_class = NULL; 7621dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 7631dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!policy || !v) { 7641dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = EINVAL; 7651dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 7661dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 7671dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 7681dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!(num_rules = apol_vector_get_size(v))) 7691dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return NULL; 7701dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 7711dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris q = apol_policy_get_qpol(policy); 7721dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 7731dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris for (i = 0; i < num_rules; i++) { 7741dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!(rule = apol_vector_get_element(v, i))) 7751dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 7761dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 7771dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris dict = PyDict_New(); 7781dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!dict) goto err; 7791dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 7801dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_avrule_get_rule_type(q, rule, &rule_type)) 7811dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 7821dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 7831dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!(tmp_name = apol_rule_type_to_str(rule_type))) { 7841dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError, "Could not get TE rule type's string"); 7851dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = EINVAL; 7861dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 7871dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 7881dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 7891dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_string(dict, "type", tmp_name)) 7901dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 7911dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 7921dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_avrule_get_source_type(q, rule, &type)) { 7931dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 7941dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 7951dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 7961dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_type_get_name(q, type, &tmp_name)) { 7971dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 7981dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 7991dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8001dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_string(dict, "source", tmp_name)) 8011dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 8021dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8031dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_avrule_get_target_type(q, rule, &type)) { 8041dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 8051dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 8061dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_type_get_name(q, type, &tmp_name)) { 8071dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 8081dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 8091dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8101dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_string(dict, "target", tmp_name)) 8111dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 8121dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8131dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_avrule_get_object_class(q, rule, &obj_class)) { 8141dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 8151dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 8161dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_class_get_name(q, obj_class, &tmp_name)) { 8171dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 8181dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 8191dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8201dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_insert_string(dict, "class", tmp_name)) 8211dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 8221dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8231dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_avrule_get_perm_iter(q, rule, &iter)) { 8241dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 8251dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 8261dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8271dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris permlist = PyList_New(0); 8281dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (! permlist) goto err; 8291dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8301dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { 8311dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const char *perm_name = NULL; 8321dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_iterator_get_item(iter, (void **)&perm_name)) 8331dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 8341dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (py_append_string(permlist, perm_name)) 8351dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 8361dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 8371dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8381dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris rt = PyDict_SetItemString(dict, "permlist", permlist); 8391dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(permlist); permlist=NULL; 8401dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (rt) goto err; 8411dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8421dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_avrule_get_cond(q, rule, &cond)) 8431dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 8441dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_avrule_get_is_enabled(q, rule, &enabled)) 8451dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto err; 8461dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8471dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris obj = PyBool_FromLong(enabled); 8481dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris rt = PyDict_SetItemString(dict, "enabled", obj); 8491dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(obj); 8501dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8511dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (cond) { 8521dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris obj = get_bool(q, cond, enabled); 8531dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!obj) goto err; 8541dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris rt = PyDict_SetItemString(dict, "boolean", obj); 8551dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(obj); 8561dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 8571dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8581dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris rt = py_append_obj(output, dict); 8591dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(dict); dict=NULL; 8601dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (rt) goto err; 8611dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8621dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(rule_str); rule_str = NULL; 8631dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(expr); expr = NULL; 8641dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 8651dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto cleanup; 8661dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8671dce0bf16d6300d4858d611cb29de336bfd85f9aEric Pariserr: 8681dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris error = errno; 8691dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,strerror(errno)); 8701dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(dict); 8711dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(permlist); 8721dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(boollist); 8731dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8741dce0bf16d6300d4858d611cb29de336bfd85f9aEric Pariscleanup: 8751dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(tmp); 8761dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(rule_str); 8771dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(expr); 8781dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris errno = error; 8791dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return output; 8801dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris} 8811dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8821dce0bf16d6300d4858d611cb29de336bfd85f9aEric ParisPyObject* search(bool allow, 8831dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool neverallow, 8841dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool auditallow, 8851dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool dontaudit, 8861dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool transition, 8871dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris bool role_allow, 8881dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const char *src_name, 8891dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const char *tgt_name, 8901dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const char *class_name, 8911dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const char *permlist 8921dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris ) 8931dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris{ 8941dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris options_t cmd_opts; 8951dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyObject *output = NULL; 8961dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_vector_t *v = NULL; 8971dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 8981dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris memset(&cmd_opts, 0, sizeof(cmd_opts)); 8991dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cmd_opts.indirect = true; 9001dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cmd_opts.show_cond = true; 9011dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cmd_opts.allow = allow; 9021dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cmd_opts.nallow = neverallow; 9031dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cmd_opts.auditallow = auditallow; 9041dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cmd_opts.dontaudit = dontaudit; 9051dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cmd_opts.type = transition; 9061dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cmd_opts.role_allow = role_allow; 9071dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (src_name) 9081dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cmd_opts.src_name = strdup(src_name); 9091dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (tgt_name) 9101dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cmd_opts.tgt_name = strdup(tgt_name); 9111dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (class_name) 9121dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cmd_opts.class_name = strdup(class_name); 9131dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (permlist){ 9141dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cmd_opts.perm_vector = apol_vector_create(free); 9151dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cmd_opts.permlist = strdup(permlist); 9161dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9171dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!cmd_opts.semantic && qpol_policy_has_capability(apol_policy_get_qpol(policy), QPOL_CAP_SYN_RULES)) { 9181dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (qpol_policy_build_syn_rule_table(apol_policy_get_qpol(policy))) { 9191dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,"Query failed"); 9201dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto cleanup; 9211dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9221dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9231dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 9241dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris /* if syntactic rules are not available always do semantic search */ 9251dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!qpol_policy_has_capability(apol_policy_get_qpol(policy), QPOL_CAP_SYN_RULES)) { 9261dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cmd_opts.semantic = 1; 9271dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9281dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 9291dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris /* supress line numbers if doing semantic search or not available */ 9301dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (cmd_opts.semantic || !qpol_policy_has_capability(apol_policy_get_qpol(policy), QPOL_CAP_LINE_NUMBERS)) { 9311dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cmd_opts.lineno = 0; 9321dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9331dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (perform_av_query(policy, &cmd_opts, &v)) { 9341dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto cleanup; 9351dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9361dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris output = PyList_New(0); 9371dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!output) 9381dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto cleanup; 9391dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 9401dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (v) { 9411dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris get_av_results(policy, v, output); 9421dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9431dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 9441dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_vector_destroy(&v); 9451dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (perform_te_query(policy, &cmd_opts, &v)) { 9461dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto cleanup; 9471dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9481dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (v) { 9491dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris get_te_results(policy, v, output); 9501dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9511dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 9521dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (cmd_opts.all || cmd_opts.type) { 9531dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_vector_destroy(&v); 9541dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (perform_ft_query(policy, &cmd_opts, &v)) { 9551dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto cleanup; 9561dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9571dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 9581dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (v) { 9591dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris get_ft_results(policy, v, output); 9601dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9611dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9621dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 9631dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (cmd_opts.all || cmd_opts.role_allow) { 9641dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_vector_destroy(&v); 9651dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (perform_ra_query(policy, &cmd_opts, &v)) { 9661dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris goto cleanup; 9671dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9681dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 9691dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (v) { 9701dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris get_ra_results(policy, v, output); 9711dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9721dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9731dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 9741dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_vector_destroy(&v); 9751dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 9761dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris cleanup: 9771dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(cmd_opts.src_name); 9781dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(cmd_opts.tgt_name); 9791dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(cmd_opts.class_name); 9801dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(cmd_opts.permlist); 9811dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(cmd_opts.bool_name); 9821dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(cmd_opts.src_role_name); 9831dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris free(cmd_opts.tgt_role_name); 9841dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_vector_destroy(&cmd_opts.perm_vector); 9851dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris apol_vector_destroy(&cmd_opts.class_vector); 9861dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 9871dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (output && PyList_GET_SIZE(output) == 0) { 9881dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris py_decref(output); 9891dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return Py_None; 9901dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 9911dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return output; 9921dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris} 9931dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 9941dce0bf16d6300d4858d611cb29de336bfd85f9aEric Parisstatic int Dict_ContainsInt(PyObject *dict, const char *key){ 9951dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyObject *item = PyDict_GetItemString(dict, key); 9961dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (item) 9971dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return PyInt_AsLong(item); 9981dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return false; 9991dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris} 10001dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 10011dce0bf16d6300d4858d611cb29de336bfd85f9aEric Parisstatic const char *Dict_ContainsString(PyObject *dict, const char *key){ 10021dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyObject *item = PyDict_GetItemString(dict, key); 10031dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (item) 10041dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return PyString_AsString(item); 10051dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return NULL; 10061dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris} 10071dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 10081dce0bf16d6300d4858d611cb29de336bfd85f9aEric ParisPyObject *wrap_search(PyObject *UNUSED(self), PyObject *args){ 10091dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyObject *dict; 10101dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!PyArg_ParseTuple(args, "O", &dict)) 10111dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return NULL; 10121dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int allow = Dict_ContainsInt(dict, "allow"); 10131dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int neverallow = Dict_ContainsInt(dict, "neverallow"); 10141dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int auditallow = Dict_ContainsInt(dict, "auditallow"); 10151dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int dontaudit = Dict_ContainsInt(dict, "dontaudit"); 10161dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int transition = Dict_ContainsInt(dict, "transition"); 10171dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris int role_allow = Dict_ContainsInt(dict, "role_allow"); 10181dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 10191dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris if (!policy) { 10201dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris PyErr_SetString(PyExc_RuntimeError,"Policy not loaded"); 10211dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return NULL; 10221dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris } 10231dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const char *src_name = Dict_ContainsString(dict, "source"); 10241dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const char *tgt_name = Dict_ContainsString(dict, "target"); 10251dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const char *class_name = Dict_ContainsString(dict, "class"); 10261dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris const char *permlist = Dict_ContainsString(dict, "permlist"); 10271dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris 10281dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris return search(allow, neverallow, auditallow, dontaudit, transition, role_allow, src_name, tgt_name, class_name, permlist); 10291dce0bf16d6300d4858d611cb29de336bfd85f9aEric Paris} 1030