o

�N�gD`�	@s�
dZd
dl
Z
d
dlZd
dlm
mZ
d
dlZd
dlZd
dl	Zd
dl
Zd
dlmZm
Z

dddddd	d
dd�Zd
d�Zejdd��
Zdd�Zdd�Zdd�Zdd�ZdIdd�
ZdIdd�
Zdd�Zd d!�Zd"d#�Zd$d%�Zd&d'�Zd(d)�Zd*d+�Zd,d-�Zd.d/�Z d0d1�Z!dJd3d4�
Z"	dKd5d6�
Z#	dKd7d8�
Z$	dKd9d:�
Z%	dKd;d<�
Z&dId=d>�
Z'dId?d@�
Z(dLdAdB�
Z)dKdCdD�
Z*dMdEdF�
Z+	dKdGdH�
Z,dS)Na�

Execute calls on selinux

.. note::
    This module requires the ``semanage``, ``setsebool``, and ``semodule``
    commands to be available on the minion. On RHEL-based distributions,
    ensure that the ``policycoreutils`` and ``policycoreutils-python``
    packages are installed. If not on a Fedora or RHEL-based distribution,
    consult the selinux documentation for your distribution to ensure that the
    proper packages are installed.
�N)�CommandExecutionError�SaltInvocationErrorz	all fileszregular file�	directoryzcharacter devicezblock device�socketz
symbolic linkz
named pipe)�
a�
f�
d�
c�
b�
s�
l�
pcCs@d
}|D]}
tj
j�|
�
sd|
df
SqtddkrdSdS)zg
    Check if the os is Linux, and then if selinux is running in permissive or
    enforcing mode.
    )Zsemanage�	setseboolZsemoduleFz is not in the pathZkernel�LinuxZselinux)Fz1Module only works on Linux with selinux installed)�salt�utils�path�whichZ
__grains__)Z
required_cmds�cmd�r�H/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/selinux.py�__virtual__#s

�

rc
CsRzd
D]}tj
�|�
rtj
�tj
�|d��
r|
WSqWdSty(


YdSw)z�
    Return the location of the SELinux VFS directory

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.selinux_fs_path
    )z/sys/fs/selinuxz/selinux�enforceN)�osr�isdir�isfile�join�AttributeError)
rrrr�selinux_fs_path6s





�

�rc	Cs�t�}|d
ur	dSz<t
j�|d�}
tjj�|
d��"}tjj�	|�
��
��dkr1	Wd
�
WdS	Wd
�
WdS1s>w



Y
Wd
Stt
fyQ


YdSw)z�
    Return the mode selinux is running in

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.getenforce
    N�Disabledr�
r�
0Z
PermissiveZ	Enforcing)rrrrrr�files�fopen�stringutils�
to_unicode�readline�strip�OSErrorr)Z_selinux_fs_pathr�_fprrr�
getenforceNs







�(�
�r*c	Cs�zGd
}tj
j�|d��2}
|
D]%}tj
j�|�
}|���d�
r3|�d�
d�	���
Wd�
WSqWd�
WdS1s@w



Y
WdSt
tfyS


YdSw)z�
    Return the selinux mode from the config file

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.getconfig
    �/etc/selinux/configr zSELINUX=�
=�
N)rrr"r#r$r%r'�
startswith�split�
capitalizer(r)�configr)�linerrr�	getconfigfs"






�����
�r3c
	
Cst|t
�r+|��d
krd}d
}
n-|��dkrd}d}
n"|��dkr&d}d}
nd|��St|t�r8|r5d}nd}nd|��St�dkr�tj�t�d�}z$t	j
j�|d	��}|�
t	j
j�|�
�

Wd
�
n1shw



Y
Wnty�
}
z	d}t|�|�
�
�
d
}~w
wd}zit	j
j�|d
��}|��}Wd
�
n1s�w



Y
z7t	j
j�|d	��}t�dd|
d|�}|�
t	j
j�|�
�

Wd
�
n
1s�w



Y
WWt�SWWt�Sty�
}
z	d}t|�|�
�
�
d
}~w
wt�
y
}
z	d}t|�|�
�
�
d
}~w
w)z�
    Set the SELinux enforcing mode

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.setenforce enforcing
    Z	enforcing�
1Z
permissiver!�disabledz
Invalid mode rr�
wNz)Could not write SELinux enforce file: {0}r+r z\nSELINUX=.*\nz	
SELINUX=�

z(Could not write SELinux config file: {0}z'Could not read SELinux config file: {0})�
isinstance�str�lower�intr*rrrrrrr"r#�writer$Zto_strr(r�format�read�re�sub)	�modeZ
modestringrr)�exc�msgr1Z_cfZconfrrr�
setenforce|sf





















��

��



�


 �
�
�

��

��rDc

C�t��
|i�S)
z�
    Return the information on a specific selinux boolean

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.getsebool virt_use_usb
    )�list_sebool�get)
�booleanrrr�	getsebool�s
rIFcCs8|rd
|�d|
��}nd|�d|
��}td|dd�S)z�
    Set the value for a boolean

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.setsebool virt_use_usb off
    �
setsebool -P �
 �
setsebool �cmd.retcodeF�
Zpython_shell�
�__salt__)rH�value�persistrrrrr�s


rcCsTt|t
�siS|
rd
}nd}|��D]\}}|�d|�d|��}qtd|dd�S)z�
    Set the value of multiple booleans

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.setsebools '{virt_use_usb: on, squid_use_tproxy: off}'
    rJrLrKr,rMFrN)r8�dict�itemsrP)�pairsrRrrHrQrrr�
setsebools�s







rVcCsvtd
d�
�
�}i}
|dd�D](}|��sq|��}|ddd�|ddd�d�|dd��
d	�|
|d
<q|
S)z�
    Return a structure listing all of the selinux booleans on the system and
    what state they are in

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.list_sebool
    �cmd.runzsemanage boolean -lr-N����rK�)�StateZDefaultZDescriptionr
)rP�
splitlinesr'r/r)Zbdata�retr2�compsrrrrF�s






�rFc

CrE)
z�
    Return the information on a specific selinux module

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.getsemod mysql

    .. versionadded:: 2016.3.0
    )�
list_semodrG)
�modulerrr�getsemod
sracCs<|
��d
krd|��}n|
��dkrd|��}t
d|�
S)z�
    Enable or disable an SELinux module.

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.setsemod nagios Enabled

    .. versionadded:: 2016.3.0
    �enabledzsemodule -e r5zsemodule -d rM)r:rP)r`�staterrrr�setsemod
s





rdc
Cs2|�d
�
dkr
t
d|�
}d|��}
t
d|
�
S)z�
    Install custom SELinux module from file

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.install_semod [salt://]path/to/module.pp

    .. versionadded:: 2016.11.6
    zsalt://r
z
cp.cache_filezsemodule -i rM)�findrP)Zmodule_pathrrrr�
install_semod$
s



rfc
Csd
|��}
td|
�
S)z�
    Remove SELinux module

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.remove_semod module_name

    .. versionadded:: 2016.11.6
    zsemodule -r rMrO)r`rrrr�remove_semod6
s

rgcCs
td
d�
�
�}d}
|D]}|���d�
rd}
q|
dkrOtd
d�
�
�}i}|D]$}|��s/q(|��}t|�
dkrCdd	d
�||d<q(dd	d
�||d<q(|Std
d
�
�
�}i}|D](}|��sbq[|��}t|�
dkrxd|dd
�||d<q[d|dd
�||d<q[|S)z�
    Return a structure listing all of the selinux modules on the system and
    what state they are in

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.list_semod

    .. versionadded:: 2016.3.0
    rWzsemodule -h��full�newzsemodule -lfullrZFN)ZEnabledZVersionr-Tzsemodule -lrXr
)rPr\r'r.r/�len)ZhelptextZsemodule_versionr2Zmdatar]r^rrrr_F
s6




�







�







r_c

Cs|tv
rt
d
|���
�
dS)z�
    .. versionadded:: 2017.7.0

    Checks if the given filetype is a valid SELinux filetype
    specification. Throws an SaltInvocationError if it isn't.
    zInvalid filetype given: T)�_SELINUX_FILETYPESr�
�filetyperrr�_validate_filetyper
s

rocCsTd
}t�
||�}|st�
||
�d|���}|s td�||
|��
�
|�d�
|�d�
fS)a

    .. versionadded:: 2019.2.0

    Validates and parses the protocol and port/port range from the name
    if both protocol and port are not provided.

    If the name is in a valid format, the protocol and port are ignored if provided

    Examples: tcp/8080 or udp/20-21
    z^(tcp|udp)\/(([\d]+)\-?[\d]+)$�
/zRInvalid name "{}" format and protocol and port not provided or invalid: "{}" "{}".r-�)r?�matchrr=�group)�name�protocol�portZprotocol_port_patternZ
name_partsrrr�_parse_protocol_port~
s







�rwc

Csd
jdi|�
�
S)zc
    .. versionadded:: 2017.7.0

    Converts an SELinux file context from a dict to a string.
    z,{sel_user}:{sel_role}:{sel_type}:{sel_level}Nr)
r=)
�contextrrr�_context_dict_to_string�
sryc
CsJt�
d
|�s
td�
�
|�dd�}
i}tgd�
�
D]
\}}|
|||<q|S)z_
    .. versionadded:: 2017.7.0

    Converts an SELinux file context from string to dict.
    z[^:]+:[^:]+:[^:]+:[^:]+$zTInvalid SELinux context string: {0}. Expected "sel_user:sel_role:sel_type:sel_level"�
:rX)�sel_user�sel_role�sel_type�	sel_level)r?rrrr/�	enumerate)rxZcontext_listr]�indexrQrrr�_context_string_to_dict�
s

�



r�rc

Cst|�

t
�|d
�S)z�
    .. versionadded:: 2017.7.0

    Translates SELinux filetype single-letter representation to a more
    human-readable version (which is also used in `semanage fcontext
    -l`).
    �error)rorlrGrmrrr�filetype_id_to_string�
s
r�c	Cs�|
rt|
�

d
}d}||t
�|�
|pdd|pd|pdd�}|
dur#dnt|
�
|d<dd	jdi|�
�
}td
|dd�}	|	d
krAdSt
�djdidt
�|�
i
�
�
|	�}
|
�d�
��|
�d�
��d�}|�	t
|
�d�
���
�

|S)a�
    .. versionadded:: 2017.7.0

    Returns the current entry in the SELinux policy list as a
    dictionary. Returns None if no exact match was found.

    Returned keys are:

    * filespec (the name supplied and matched)
    * filetype (the descriptive name of the filetype supplied)
    * sel_user, sel_role, sel_type, sel_level (the selinux context)

    For a more in-depth explanation of the selinux context, go to
    https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/chap-Security-Enhanced_Linux-SELinux_Contexts.html

    name
        filespec of the file or directory. Regex syntax is allowed.

    filetype
        The SELinux filetype specification. Use one of [a, f, d, c, b,
        s, l, p]. See also `man semanage-fcontext`. Defaults to 'a'
        (all files).

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.fcontext_get_policy my-policy
    �[ ]+z[ |	]*z[^:]+)�spacerZospacer�filespecr{r|r}r~Nz
[[:alpha:] ]+rnzsemanage fcontext -l | grep -E z]'^{filespec}{spacer}{filetype}{spacer}{sel_user}:{sel_role}:{sel_type}:{sel_level}{ospacer}$'�	cmd.shellT�
Zignore_retcoderhz^({filespec}) +([a-z ]+) (.*)$r�r-rq)r�rnrXr)ror?�escaper�r=rPrrrsr'�updater�)rtrnr}r{r~�	re_spacerZre_optional_spacer�
cmd_kwargsr�current_entry_text�partsr]rrr�fcontext_get_policy�
s@ 








�
�

���



�
�r�cC�td
||
|||�S)a�
    .. versionadded:: 2019.2.0

    Adds the SELinux policy for a given filespec and other optional parameters.

    Returns the result of the call to semanage.

    Note that you don't have to remove an entry before setting a new
    one for a given filespec and filetype, as adding one with semanage
    automatically overwrites a previously configured SELinux context.

    name
        filespec of the file or directory. Regex syntax is allowed.

    file_type
        The SELinux filetype specification. Use one of [a, f, d, c, b,
        s, l, p]. See also ``man semanage-fcontext``. Defaults to 'a'
        (all files).

    sel_type
        SELinux context type. There are many.

    sel_user
        SELinux user. Use ``semanage login -l`` to determine which ones
        are available to you.

    sel_level
        The MLS range of the SELinux context.

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.fcontext_add_policy my-policy
    �add�
�_fcontext_add_or_delete_policy�rtrnr}r{r~rrr�fcontext_add_policy�&
�r�cCr�)a�
    .. versionadded:: 2019.2.0

    Deletes the SELinux policy for a given filespec and other optional parameters.

    Returns the result of the call to semanage.

    Note that you don't have to remove an entry before setting a new
    one for a given filespec and filetype, as adding one with semanage
    automatically overwrites a previously configured SELinux context.

    name
        filespec of the file or directory. Regex syntax is allowed.

    file_type
        The SELinux filetype specification. Use one of [a, f, d, c, b,
        s, l, p]. See also ``man semanage-fcontext``. Defaults to 'a'
        (all files).

    sel_type
        SELinux context type. There are many.

    sel_user
        SELinux user. Use ``semanage login -l`` to determine which ones
        are available to you.

    sel_level
        The MLS range of the SELinux context.

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.fcontext_delete_policy my-policy
    �deleter�r�rrr�fcontext_delete_policy.r�r�c	Cs�|d
v
rtd|�d��
�
d|kr)t
�|
�
}d|�d�}td|dd	�}|d
kr)d}d|��}|d
u
rA|dkrAt|�

|d|��7}|d
u
rL|d|��7}|d
u
rW|d|��7}|d
u
rb|d|��7}|dt
�|
�
7}td|�
S)z�
    .. versionadded:: 2019.2.0

    Performs the action as called from ``fcontext_add_policy`` or ``fcontext_delete_policy``.

    Returns the result of the call to semanage.
    �r�r��/Actions supported are "add" and "delete", not "�".r�z semanage fcontext -l | grep -E 'z 'r�Tr�rh�modifyzsemanage fcontext --Nrz	 --ftype � --type z
 --seuser �	 --range rK�cmd.run_all)rr?r�rPro)	�actionrtrnr}r{r~r�rr�rrrr�Ys,



�















r�cCs0d
}|
r|d7}|t�
|�
7}td|�
�d�
S)a�

    .. versionadded:: 2017.7.0

    Returns an empty string if the SELinux policy for a given filespec
    is applied, returns string with differences in policy and actual
    situation otherwise.

    name
        filespec of the file or directory. Regex syntax is allowed.

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.fcontext_policy_is_applied my-policy
    zrestorecon -n -v �-R r��stdout)r?r�rPrG)rt�	recursiverrrr�fcontext_policy_is_applied�s




r�cCs>
i}t||
�}d
}|
r|d7}|t
�|�
7}td|�
}|�|�

|ddkr�g}|�d�
r7t
�d|t
j�}n|�d�
rEt
�d	|t
j�}n
d
|d<d|d<|S|rX|�d
ii
�

|D]B}|d}t|d
�
}	t|d�
}
i}|	�	�D]\}}
|
�
|�
|
kr�|�||
i
�

qr|D]}|	|=|
|=q�|d
�||	|
d�i
�

qZ|S)a�

    .. versionadded:: 2017.7.0

    Applies SElinux policies to filespec using `restorecon [-R]
    filespec`. Returns dict with changes if successful, the output of
    the restorecon command otherwise.

    name
        filespec of the file or directory. Regex syntax is allowed.

    recursive
        Recursively apply SELinux policies.

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.fcontext_apply_policy my-policy
    zrestorecon -v -F r�r��retcoder
z
Would relabelz%Would relabel (.*) from (.*) to (.*)$zrestorecon resetz)restorecon reset (.*) context (.*)->(.*)$r-z.Unrecognized response from restorecon command.r�Zchangesrq)�oldrj)r�r?r�rPr�r.�findall�
Mr�rTrG)rtr�r]Zchanges_textrZ	apply_retZchanges_list�itemr�r�rjZ	intersect�keyrQrrr�fcontext_apply_policy�sJ














�


�











�




r�c
Cs�t|||�\}}d
}|
r|
n
d}||||d�}ddj
di|�
�
}td|dd�}|d	kr/d
St�d|�}	|	�d�
��|	�d
�
��|	�d�
��d�S)a
    .. versionadded:: 2019.2.0

    Returns the current entry in the SELinux policy list as a
    dictionary. Returns None if no exact match was found.

    Returned keys are:

    * sel_type (the selinux type)
    * proto (the protocol)
    * port (the port(s) and/or port range(s))

    name
        The protocol and port spec. Can be formatted as ``(tcp|udp)/(port|port-range)``.

    sel_type
        The SELinux Type.

    protocol
        The protocol for the port, ``tcp`` or ``udp``. Required if name is not formatted.

    port
        The port or port range. Required if name is not formatted.

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.port_get_policy tcp/80
        salt '*' selinux.port_get_policy foobar protocol=tcp port=80
    r�z\w+)r�r}rurvzsemanage port -l | grep -E z<'^{sel_type}{spacer}{protocol}{spacer}((.*)*)[ ]{port}($|,)'r�Tr�rhNz^(\w+)[ ]+(\w+)[ ]+([\d\-, ]+)r-rqrX)r}rurvr)rwr=rPr?rrrsr')
rtr}rurvr�Zre_sel_typer�rZport_policyr�rrr�port_get_policy�s, 




�

���



�r�cCr�)a�
    .. versionadded:: 2019.2.0

    Adds the SELinux policy for a given protocol and port.

    Returns the result of the call to semanage.

    name
        The protocol and port spec. Can be formatted as ``(tcp|udp)/(port|port-range)``.

    sel_type
        The SELinux Type. Required.

    protocol
        The protocol for the port, ``tcp`` or ``udp``. Required if name is not formatted.

    port
        The port or port range. Required if name is not formatted.

    sel_range
        The SELinux MLS/MCS Security Range.

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.port_add_policy add tcp/8080 http_port_t
        salt '*' selinux.port_add_policy add foobar http_port_t protocol=tcp port=8091
    r��
�_port_add_or_delete_policy)rtr}rurv�	sel_rangerrr�port_add_policysr�cCstd
|d|
|d�S)aX
    .. versionadded:: 2019.2.0

    Deletes the SELinux policy for a given protocol and port.

    Returns the result of the call to semanage.

    name
        The protocol and port spec. Can be formatted as ``(tcp|udp)/(port|port-range)``.

    protocol
        The protocol for the port, ``tcp`` or ``udp``. Required if name is not formatted.

    port
        The port or port range. Required if name is not formatted.

    CLI Example:

    .. code-block:: bash

        salt '*' selinux.port_delete_policy tcp/8080
        salt '*' selinux.port_delete_policy foobar protocol=tcp port=8091
    r�Nr�)rtrurvrrr�port_delete_policy/sr�cCs�|d
v
rtd|�d��
�
|dkr|std�
�
t
|
||�\}}d|�d|��}|r/|d|��7}|r8|d	|��7}|d
|��7}td|�
S)z�
    .. versionadded:: 2019.2.0

    Performs the action as called from ``port_add_policy`` or ``port_delete_policy``.

    Returns the result of the call to semanage.
    r�r�r�r�z(SELinux Type is required to add a policyzsemanage port --z	 --proto r�r�rKr�)rrwrP)r�rtr}rurvr�rrrrr�Js



�








r�)
F)
r)NNNN)NNN)NN)-�__doc__rr?Zsalt.utils.decoratorsrZ
decoratorsZsalt.utils.filesrZsalt.utils.pathZsalt.utils.stringutilsZsalt.utils.versionsZsalt.exceptionsrrrlrZmemoizerr*r3rDrIrrVrFrardrfrgr_rorwryr�r�r�r�r�r�r�r�r�r�r�r�rrrr�<module>
sj












�

:

,	

�H
�,
�,
�
'

;
;
!�