o

�N�g�I�@s�dZd
d�Z
dd�Zdd�Zdd�Zd	d
�Zd"dd
�
Zd#dd�
Zdd�Zdd�Z		d$dd�
Z
	d%dd�
Zd"dd�
Zd&dd�
Z
d&d d!�
ZdS)'a�

Management of SELinux rules
===========================

If SELinux is available for the running system, the mode can be managed and
booleans can be set.

.. code-block:: yaml

    enforcing:
        selinux.mode

    samba_create_home_dirs:
        selinux.boolean:
          - value: True
          - persist: True

    nginx:
        selinux.module:
          - enabled: False

.. note::
    Use of these states require that the :mod:`selinux <salt.modules.selinux>`
    execution module is available.
cCsd
tvrdSdS)zL
    Only make this state available if the selinux module is available.
    �selinux.getenforceZselinux)Fz"selinux module could not be loaded�
�__salt__�rr�G/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/selinux.py�__virtual__s

rc

Csdt|�
�
�}t|�d
�
|dk|dkg�
rdSt|�d�
|dk|dkg�
r&dSt|�d	�
g
�
r0d
SdS)z1
    Return a mode value that is predictable
    �
e�
1�onZ	Enforcing�
p�
0�offZ
Permissive�
d�Disabled�unknown)�str�lower�any�
startswith)
�moderrr�_refine_mode%s






rc

C�(t|�
�
�}|d
vrdS|dvrdSdS)z@
    Return a yes/no value, or None if the input is invalid
    )rr	�yes�truer	)rr�no�falserN�rr)
�valuerrr�
_refine_value3s




rc

Cr)z]
    Return a predictable value, or allow us to error out
    .. versionadded:: 2016.3.0
    )rr	rr�enabledr)rrrr�disabledrrr)
�module_staterrr�_refine_module_state?s




r!c
Cs"
|d
did�}
t|�
}|dkr|�d�|
d<|
St
d�}t
d�}||kr0||kr0||kr0|}||krBd	|
d
<d|�d�|
d<|
Std
rZd|��|
d<d|
d
<||d�|
d<|
S|t
d|�
}}||ksr|dkr�t
d�|kr�d	|
d
<d|�d�|
d<||d�|
d<|
Sd|�d�|
d<|
S)a<

    Verifies the mode SELinux is running in, can be set to enforcing,
    permissive, or disabled

    .. note::
        A change to or from disabled mode requires a system reboot. You will
        need to perform this yourself.

    name
        The mode to run SELinux in, permissive, enforcing, or disabled.
    F���name�result�comment�changesrz is not an accepted moder&r
zselinux.getconfigTr%zSELinux is already in z mode�testz%SELinux mode is set to be changed to N��old�newr'zselinux.setenforcerzSELinux has been set to zFailed to set SELinux to )rr�__opts__)r$�retZtmoderZconfigZoldmoderrrrLs6





















rFcCsl
|d
did�}td�}||v
rd|�d�|d<d|d	<|St
|
�
}|d
ur3|
�d�|d<d|d	<|S||d|k}||d
|k}|rP|rO|rOd|d<|Sn|rXd|d<|Stdrld
|d	<d|�d|��|d<|Std|||�|d	<|d	r�d|�d|��|d<|d�d||d|d�i
�

|r�|s�|d�d
||d
|d�i
�

|Sd|�d|��|d<|S)z�
    Set up an SELinux boolean

    name
        The name of the boolean to set

    value
        The value to set on the boolean

    persist
        Defaults to False, set persist to true to make the boolean apply on a
        reboot
    Tr"r#zselinux.list_seboolzBoolean � is not availabler&Fr%Nz% is not a valid value for the boolean�StateZDefaultzBoolean is in the correct stater(z is set to be changed to zselinux.setsebool� has been set to r'r)zFailed to set the boolean � to )rrr,�update)r$rZpersistr-ZboolsZrvalue�state�defaultrrr�boolean|sH
















�







 



�

r5�Enabledrc
Ks�
|d
did�}|�dd�r|�dd�rd|d<d|d	<|S|�dd�r4|�d
|�}t
|�
}|ds3|Sn
|�dd�r>t|�
Std�}||v
rUd|�d
�|d	<d|d<|St|
�
}|dkrkd�|
t�|d	<d|d<|S|dkr�||d}||ks�d�||�|d	<d|d<|St||d�
}	||	kr�d|�d�|d	<|Stdr�d|d<d�||
�|d	<|Std||�r�d|�d|
��|d	<|Sd|d<d|�d|
��|d	<|S)a;
    Enable/Disable and optionally force a specific version for an SELinux module

    name
        The name of the module to control

    module_state
        Should the module be enabled or disabled?

    version
        Defaults to no preference, set to a specified value if required.
        Currently can only alert if the version is incorrect.

    install
        Setting to True installs module

    source
        Points to module source file, used only when install is True

    remove
        Setting to True removes module

    .. versionadded:: 2016.3.0
    Tr"r#�installF�remover%z*Cannot install and remove at the same timer&�source�selinux.list_semod�Module r.rz*{} is not a valid state for the {} module.rZVersionzbModule version is {} and does not match the desired version of {} or you are using semodule >= 2.4r6z is in the desired stater(Nz$Module {} is set to be toggled to {}zselinux.setsemodr0zFailed to set the Module r1)�get�module_install�
module_removerr!�format�moduler,)
r$r �version�optsr-Zmodule_path�modulesZ
rmodule_stateZinstalled_versionZcurrent_module_staterrrr@�sb








�










�



�








�




r@c
CsH|d
did�}
td|�
rd|�d�|
d<|
Sd|
d	<d
|��|
d<|
S)z�
    Installs custom SELinux module from given file

    name
        Path to file with module to install

    .. versionadded:: 2016.11.6
    Tr"r#zselinux.install_semodr;z has been installedr&Fr%zFailed to install module r)r$r-rrrr=�s	





r=c
Csv|d
did�}
td�}||v
rd|�d�|
d<d|
d	<|
Std
|�
r.d|�d�|
d<|
Sd|
d	<d|��|
d<|
S)
zt
    Removes SELinux module

    name
        The name of the module to remove

    .. versionadded:: 2016.11.6
    Tr"r#r:r;r.r&Fr%zselinux.remove_semodz has been removedzFailed to remove module r)r$r-rCrrrr>
s	











r>�
aNcCs�
|d
idd�}i}i}td|�
}td|||
||d�}	|	sU|||
d�i
}t
dr1|�d	d
i
�

n�td|||
||d�}
|
dd
krM|�dd|
��i
�

nf|�d	di
�

n^|	d|
krp|�|d|	di
i
�

|�|d|
i
i
�

n|�dd|�d�d�||
�d��

|St
dr�|�d	d
i
�

n#td|||
||d�}|dd
kr�|�dd|��i
�

n|�d	di
�

|d	r�|s�|r�|d�||d��

|S)a"
    .. versionadded:: 2017.7.0

    Makes sure a SELinux policy for a given filespec (name), filetype
    and SELinux context type is present.

    name
        filespec of the file or directory. Regex syntax is allowed.

    sel_type
        SELinux context type. There are many.

    filetype
        The SELinux filetype specification. Use one of [a, f, d, c, b,
        s, l, p]. See also `man semanage-fcontext`. Defaults to 'a'
        (all files).

    sel_user
        The SELinux user.

    sel_level
        The SELinux MLS range.
    Fr"�r$r%r'r&zselinux.filetype_id_to_string�selinux.fcontext_get_policy�r$�filetype�sel_type�sel_user�	sel_level)rHrIr(r%Nzselinux.fcontext_add_policy�retcode�r&zError adding new rule: TrI�SELinux policy for "�" already present �/with specified filetype "{}" and sel_type "{}".�r%r&r'r))rr,r2r?)r$rIrHrJrKr-�	new_state�	old_stateZfiletype_str�
current_state�add_retZ
change_retrrr�fcontext_policy_present(
sj








�







�






����	





�



rVc
Cs�|d
idd�}i}i}td||
|||d�}|s,|�
dd|�d�d	�|
|�d
��

|S|�
||i
�

|d�
||d��

td
rJ|�
ddi
�

|Std||
|pT|d||d�}	|	ddkrk|�
dd|	��i
�

|S|�
ddi
�

|S)a3
    .. versionadded:: 2017.7.0

    Makes sure an SELinux file context policy for a given filespec
    (name), filetype and SELinux context type is absent.

    name
        filespec of the file or directory. Regex syntax is allowed.

    filetype
        The SELinux filetype specification. Use one of [a, f, d, c, b,
        s, l, p]. See also `man semanage-fcontext`. Defaults to 'a'
        (all files).

    sel_type
        The SELinux context type. There are many.

    sel_user
        The SELinux user.

    sel_level
        The SELinux MLS range.
    Fr"rErFrGTrN�" already absent rPrQr'r)r(r%Nzselinux.fcontext_delete_policyrIrLrMr&zError removing policy: �rr2r?r,)
r$rHrIrJrKr-rRrSrTZ
remove_retrrr�fcontext_policy_absent�
sL







�




����	



�





�
�
rYcCs�|d
idd�}td||
�}|dkr|�
dd�|�
d��

|Stdr,|�
d	d
i
�

|Std||
�}|dd
krB|�
d|i
�

|S|�
d	di
�

|�
d|�d�
i
�

|S)zz
    .. versionadded:: 2017.7.0

    Checks and makes sure the SELinux policies for a given filespec are
    applied.
    Fr"rEz"selinux.fcontext_policy_is_appliedTz6SElinux policies are already applied for filespec "{}"rQr(r%Nzselinux.fcontext_apply_policyrLrMr&r')rr2r?r,r<)r$�	recursiver-Zchanges_textZ	apply_retrrr�fcontext_policy_applied�
s*


���


�

�

r[c		Cs�|d
idd�}td||
||d�}|r(|�
dd|�d�d	�|
||�d
��

|Stdr5|�
dd
i
�

|Std||
|||d�}|ddkrR|�
dd|��i
�

|S|�
ddi
�

td||
||d�}|d�
||d��

|S)a
    .. versionadded:: 2019.2.0

    Makes sure an SELinux port policy for a given port, protocol and SELinux context type is present.

    name
        The protocol and port spec. Can be formatted as ``(tcp|udp)/(port|port-range)``.

    sel_type
        The SELinux Type.

    protocol
        The protocol for the port, ``tcp`` or ``udp``. Required if name is not formatted.

    port
        The port or port range. Required if name is not formatted.

    sel_range
        The SELinux MLS/MCS Security Range.
    Fr"rE�selinux.port_get_policy�r$rI�protocol�portTrNrO�:with specified sel_type "{}", protocol "{}" and port "{}".rQr(r%Nzselinux.port_add_policy)r$rIr^r_�	sel_rangerLrMr&zError adding new policy: r'r)rX)	r$rIr^r_rar-rSrUrRrrr�port_policy_present�
sP




�




����	

�




�

�




�
rbc	Cs�|d
idd�}td||
||d�}|s(|�
dd|�d�d	�|
||�d
��

|Stdr5|�
dd
i
�

|Std|||d�}|ddkrP|�
dd|��i
�

|S|�
ddi
�

td||
||d�}|d�
||d��

|S)a4
    .. versionadded:: 2019.2.0

    Makes sure an SELinux port policy for a given port, protocol and SELinux context type is absent.

    name
        The protocol and port spec. Can be formatted as ``(tcp|udp)/(port|port-range)``.

    sel_type
        The SELinux Type. Optional; can be used in determining if policy is present,
        ignored by ``semanage port --delete``.

    protocol
        The protocol for the port, ``tcp`` or ``udp``. Required if name is not formatted.

    port
        The port or port range. Required if name is not formatted.
    Fr"rEr\r]TrNrWr`rQr(r%Nzselinux.port_delete_policy)r$r^r_rLrMr&zError deleting policy: r'r)rX)r$rIr^r_r-rSZ
delete_retrRrrr�port_policy_absent&sL




�




����	

�


�

�




�
rc)
F)r6r)rDNN)rDNNN)NNN)�__doc__rrrr!rr5r@r=r>rVrYr[rbrcrrrr�<module>
s"	
0
5N
�[
�
C
"?