From 97bd46865e12246c00517d1e07aabca530a305ac Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 17 Jun 2020 13:34:19 +0200 Subject: [PATCH] Support old boolean names in policy queries Translate old boolean names based on /etc/selinux/*/booleans.subs_dist file. The translation is only attempted when "policy" was not specified to avoid influencing queries of policies from other systems. Signed-off-by: Vit Mojzis --- seinfo | 6 +++++- sesearch | 7 ++++++- setools/policyrep/selinux.pxd | 1 + setools/policyrep/util.pxi | 22 ++++++++++++++++++++++ 4 files changed, 34 insertions(+), 2 deletions(-) diff --git a/seinfo b/seinfo index d2caf7c..bc33e12 100755 --- a/seinfo +++ b/seinfo @@ -125,7 +125,11 @@ try: if args.boolquery or args.all: q = setools.BoolQuery(p) if isinstance(args.boolquery, str): - q.name = args.boolquery + if args.policy: + q.name = args.boolquery + else: + # try to find substitutions for old boolean names + q.name = setools.policyrep.lookup_boolean_name_sub(args.boolquery) components.append(("Booleans", q, lambda x: x.statement())) diff --git a/sesearch b/sesearch index c4b1d38..733f3d3 100755 --- a/sesearch +++ b/sesearch @@ -189,7 +189,12 @@ try: if args.boolean_regex: q.boolean = args.boolean else: - q.boolean = args.boolean.split(",") + if args.policy: + q.boolean = args.boolean.split(",") + else: + # try to find substitutions for old boolean names + q.boolean = map(setools.policyrep.lookup_boolean_name_sub, + args.boolean.split(",")) for r in sorted(q.results()): print(r) diff --git a/setools/policyrep/selinux.pxd b/setools/policyrep/selinux.pxd index a2e8af0..1686831 100644 --- a/setools/policyrep/selinux.pxd +++ b/setools/policyrep/selinux.pxd @@ -24,3 +24,4 @@ cdef extern from "": bint selinuxfs_exists() const char* selinux_current_policy_path() const char* selinux_binary_policy_path() + char* selinux_boolean_sub(const char *boolean_name); diff --git a/setools/policyrep/util.pxi b/setools/policyrep/util.pxi index 40f21a7..abc7be8 100644 --- a/setools/policyrep/util.pxi +++ b/setools/policyrep/util.pxi @@ -230,3 +230,25 @@ cdef flatten_list(input_list): ret.append(i) return ret + + +def lookup_boolean_name_sub(name): + """ + Read the /etc/selinux/TYPE/booleans.subs_dist file looking + for a record with 'name'. + Return the translated name if a corresponding substitution exists, + otherwise return the original name. + """ + cdef: + char *_name = selinux.selinux_boolean_sub(name) + str new_name = name + + if _name == NULL: + raise MemoryError + # cast "char *" to "str" and free + try: + new_name = _name + finally: + free(_name) + + return new_name -- 2.25.4