1#! /usr/bin/python -Es
2# Copyright (C) 2012 Red Hat
3# see file 'COPYING' for use and warranty information
4#
5# setrans is a tool for analyzing process transistions in SELinux policy
6#
7#    This program is free software; you can redistribute it and/or
8#    modify it under the terms of the GNU General Public License as
9#    published by the Free Software Foundation; either version 2 of
10#    the License, or (at your option) any later version.
11#
12#    This program is distributed in the hope that it will be useful,
13#    but WITHOUT ANY WARRANTY; without even the implied warranty of
14#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15#    GNU General Public License for more details.
16#
17#    You should have received a copy of the GNU General Public License
18#    along with this program; if not, write to the Free Software
19#    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
20#                                        02111-1307  USA
21#
22#
23import sepolicy
24
25
26def get_types(src, tclass, perm, check_bools=False):
27    allows = sepolicy.search([sepolicy.ALLOW], {sepolicy.SOURCE: src, sepolicy.CLASS: tclass, sepolicy.PERMS: perm})
28    nlist = []
29    if allows:
30        for i in map(lambda y: y[sepolicy.TARGET], filter(lambda x: set(perm).issubset(x[sepolicy.PERMS]) and (not check_bools or x["enabled"]), allows)):
31            if i not in nlist:
32                nlist.append(i)
33    return nlist
34
35
36def get_network_connect(src, protocol, perm, check_bools=False):
37    portrecs, portrecsbynum = sepolicy.gen_port_dict()
38    d = {}
39    tlist = get_types(src, "%s_socket" % protocol, [perm], check_bools)
40    if len(tlist) > 0:
41        d[(src, protocol, perm)] = []
42        for i in tlist:
43            if i == "ephemeral_port_type":
44                if "unreserved_port_type" in tlist:
45                    continue
46                i = "ephemeral_port_t"
47            if i == "unreserved_port_t":
48                if "unreserved_port_type" in tlist:
49                    continue
50                if "port_t" in tlist:
51                    continue
52            if i == "port_t":
53                d[(src, protocol, perm)].append((i, ["all ports with out defined types"]))
54            if i == "port_type":
55                d[(src, protocol, perm)].append((i, ["all ports"]))
56            elif i == "unreserved_port_type":
57                d[(src, protocol, perm)].append((i, ["all ports > 1024"]))
58            elif i == "reserved_port_type":
59                d[(src, protocol, perm)].append((i, ["all ports < 1024"]))
60            elif i == "rpc_port_type":
61                d[(src, protocol, perm)].append((i, ["all ports > 500 and  < 1024"]))
62            else:
63                try:
64                    d[(src, protocol, perm)].append((i, portrecs[(i, protocol)]))
65                except KeyError:
66                    pass
67    return d
68