policycoreutils/policycoreutils-sepolgen.patch

diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/access.py policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/access.py
--- nsasepolgen/src/sepolgen/access.py	2010-05-19 14:45:51.000000000 -0400
+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/access.py	2010-06-16 08:22:43.000000000 -0400
@@ -32,6 +32,7 @@
 """
 
 import refpolicy
+from selinux import audit2why
 
 def is_idparam(id):
     """Determine if an id is a paramater in the form $N, where N is
@@ -85,6 +86,8 @@
             self.obj_class = None
             self.perms = refpolicy.IdSet()
             self.audit_msgs = []
+            self.type = audit2why.TERULE
+            self.bools = []
 
         # The direction of the information flow represented by this
         # access vector - used for matching
@@ -253,20 +256,22 @@
         for av in l:
             self.add_av(AccessVector(av))
 
-    def add(self, src_type, tgt_type, obj_class, perms, audit_msg=None):
+    def add(self, src_type, tgt_type, obj_class, perms, audit_msg=None, avc_type=audit2why.TERULE, bools=[]):
         """Add an access vector to the set.
         """
         tgt = self.src.setdefault(src_type, { })
         cls = tgt.setdefault(tgt_type, { })
         
-        if cls.has_key(obj_class):
-            access = cls[obj_class]
+        if cls.has_key((obj_class, avc_type)):
+            access = cls[obj_class, avc_type]
         else:
             access = AccessVector()
             access.src_type = src_type
             access.tgt_type = tgt_type
             access.obj_class = obj_class
-            cls[obj_class] = access
+            access.bools = bools
+            access.type = avc_type
+            cls[obj_class, avc_type] = access
 
         access.perms.update(perms)
         if audit_msg:
diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/audit.py policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/audit.py
--- nsasepolgen/src/sepolgen/audit.py	2010-05-19 14:45:51.000000000 -0400
+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/audit.py	2010-06-16 08:22:43.000000000 -0400
@@ -68,6 +68,17 @@
                               stdout=subprocess.PIPE).communicate()[0]
     return output
 
+def get_log_msgs():
+    """Obtain all of the avc and policy load messages from /var/log/messages.
+
+    Returns:
+       string contain all of the audit messages returned by /var/log/messages.
+    """
+    import subprocess
+    output = subprocess.Popen(["/bin/grep", "avc",  "/var/log/messages"],
+                              stdout=subprocess.PIPE).communicate()[0]
+    return output
+
 # Classes representing audit messages
 
 class AuditMessage:
@@ -127,6 +138,9 @@
             if fields[0] == "path":
                 self.path = fields[1][1:-1]
                 return
+import selinux.audit2why as audit2why
+
+avcdict = {}
 
 class AVCMessage(AuditMessage):
     """AVC message representing an access denial or granted message.
@@ -167,6 +181,8 @@
         self.path = ""
         self.accesses = []
         self.denial = True
+        self.type = audit2why.TERULE
+        self.bools = []
 
     def __parse_access(self, recs, start):
         # This is kind of sucky - the access that is in a space separated
@@ -226,7 +242,31 @@
 
         if not found_src or not found_tgt or not found_class or not found_access:
             raise ValueError("AVC message in invalid format [%s]\n" % self.message)
-                
+        self.analyze()
+
+    def analyze(self):
+        tcontext = self.tcontext.to_string()
+        scontext = self.scontext.to_string()
+        access_tuple = tuple( self.accesses)
+        if (scontext, tcontext, self.tclass, access_tuple) in avcdict.keys():
+            self.type, self.bools = avcdict[(scontext, tcontext, self.tclass, access_tuple)]
+        else:
+            self.type, self.bools = audit2why.analyze(scontext, tcontext, self.tclass, self.accesses);
+            if self.type == audit2why.NOPOLICY:
+                self.type = audit2why.TERULE
+            if self.type == audit2why.BADTCON:
+                raise ValueError("Invalid Target Context %s\n" % tcontext)
+            if self.type == audit2why.BADSCON:
+                raise ValueError("Invalid Source Context %s\n" % scontext)
+            if self.type == audit2why.BADSCON:
+                raise ValueError("Invalid Type Class %s\n" % self.tclass)
+            if self.type == audit2why.BADPERM:
+                raise ValueError("Invalid permission %s\n" % " ".join(self.accesses))
+            if self.type == audit2why.BADCOMPUTE:
+                raise ValueError("Error during access vector computation")
+            
+            avcdict[(scontext, tcontext, self.tclass, access_tuple)] = (self.type, self.bools)
+
 class PolicyLoadMessage(AuditMessage):
     """Audit message indicating that the policy was reloaded."""
     def __init__(self, message):
@@ -469,10 +509,10 @@
             if avc_filter:
                 if avc_filter.filter(avc):
                     av_set.add(avc.scontext.type, avc.tcontext.type, avc.tclass,
-                               avc.accesses, avc)
+                               avc.accesses, avc, avc_type=avc.type, bools=avc.bools)
             else:
                 av_set.add(avc.scontext.type, avc.tcontext.type, avc.tclass,
-                           avc.accesses, avc)
+                           avc.accesses, avc, avc_type=avc.type, bools=avc.bools)
         return av_set
 
 class AVCTypeFilter:
diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/defaults.py policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/defaults.py
--- nsasepolgen/src/sepolgen/defaults.py	2010-05-19 14:45:51.000000000 -0400
+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/defaults.py	2010-06-16 08:22:43.000000000 -0400
@@ -30,6 +30,9 @@
 def interface_info():
     return data_dir() + "/interface_info"
 
+def attribute_info():
+    return data_dir() + "/attribute_info"
+
 def refpolicy_devel():
     return "/usr/share/selinux/devel"
 
diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/interfaces.py policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/interfaces.py
--- nsasepolgen/src/sepolgen/interfaces.py	2010-05-19 14:45:51.000000000 -0400
+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/interfaces.py	2010-06-16 08:22:43.000000000 -0400
@@ -29,6 +29,8 @@
 
 from sepolgeni18n import _
 
+import copy
+
 class Param:
     """
     Object representing a paramater for an interface.
@@ -197,10 +199,48 @@
                 ret = 1
 
     return ret
-            
+
+class AttributeVector:
+    def __init__(self):
+        self.name = ""
+        self.access = access.AccessVectorSet()
+
+    def add_av(self, av):
+        self.access.add_av(av)
+
+class AttributeSet:
+    def __init__(self):
+        self.attributes = { }
+
+    def add_attr(self, attr):
+        self.attributes[attr.name] = attr
+
+    def from_file(self, fd):
+        def parse_attr(line):
+            fields = line[1:-1].split()
+            if len(fields) != 2 or fields[0] != "Attribute":
+                raise SyntaxError("Syntax error Attribute statement %s" % line)
+            a = AttributeVector()
+            a.name = fields[1]
+
+            return a
+
+        a = None
+        for line in fd:
+            line = line[:-1]
+            if line[0] == "[":
+                if a:
+                    self.add_attr(a)
+                a = parse_attr(line)
+            elif a:
+                l = line.split(",")
+                av = access.AccessVector(l)
+                a.add_av(av)
+        if a:
+            self.add_attr(a)
 
 class InterfaceVector:
-    def __init__(self, interface=None):
+    def __init__(self, interface=None, attributes={}):
         # Enabled is a loose concept currently - we are essentially
         # not enabling interfaces that we can't handle currently.
         # See InterfaceVector.add_ifv for more information.
@@ -214,10 +254,10 @@
         # value: Param object).
         self.params = { }
         if interface:
-            self.from_interface(interface)
+            self.from_interface(interface, attributes)
         self.expanded = False
 
-    def from_interface(self, interface):
+    def from_interface(self, interface, attributes={}):
         self.name = interface.name
 
         # Add allow rules
@@ -232,6 +272,23 @@
             for av in avs:
                 self.add_av(av)
 
+        # Add typeattribute access
+        if attributes != None:
+            for typeattribute in interface.typeattributes():
+                for attr in typeattribute.attributes:
+                    if not attributes.attributes.has_key(attr):
+                        # print "missing attribute " + attr
+                        continue
+                    attr_vec = attributes.attributes[attr]
+                    for a in attr_vec.access:
+                        av = copy.copy(a)
+                        if av.src_type == attr_vec.name:
+                            av.src_type = typeattribute.type
+                        if av.tgt_type == attr_vec.name:
+                            av.tgt_type = typeattribute.type
+                        self.add_av(av)
+
+
         # Extract paramaters from roles
         for role in interface.roles():
             if role_extract_params(role, self.params):
@@ -346,13 +403,13 @@
                 l = self.tgt_type_map.setdefault(type, [])
                 l.append(ifv)
 
-    def add(self, interface):
-        ifv = InterfaceVector(interface)
+    def add(self, interface, attributes={}):
+        ifv = InterfaceVector(interface, attributes)
         self.add_ifv(ifv)
 
-    def add_headers(self, headers, output=None):
+    def add_headers(self, headers, output=None, attributes={}):
         for i in itertools.chain(headers.interfaces(), headers.templates()):
-            self.add(i)
+            self.add(i, attributes)
 
         self.expand_ifcalls(headers)
         self.index()
diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/matching.py policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/matching.py
--- nsasepolgen/src/sepolgen/matching.py	2010-05-19 14:45:51.000000000 -0400
+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/matching.py	2010-06-16 08:22:43.000000000 -0400
@@ -50,7 +50,7 @@
                 return 1
 
 class MatchList:
-    DEFAULT_THRESHOLD = 120
+    DEFAULT_THRESHOLD = 150
     def __init__(self):
         # Match objects that pass the threshold
         self.children = []
@@ -63,14 +63,15 @@
     def best(self):
         if len(self.children):
             return self.children[0]
-        else:
-            return None
+        if len(self.bastards):
+            return self.bastards[0]
+        return None
 
     def __len__(self):
         # Only return the length of the matches so
         # that this can be used to test if there is
         # a match.
-        return len(self.children)
+        return len(self.children) + len(self.bastards)
 
     def __iter__(self):
         return iter(self.children)
diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/policygen.py policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/policygen.py
--- nsasepolgen/src/sepolgen/policygen.py	2010-05-19 14:45:51.000000000 -0400
+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/policygen.py	2010-06-21 10:10:01.000000000 -0400
@@ -29,6 +29,8 @@
 import access
 import interfaces
 import matching
+import selinux.audit2why as audit2why
+from setools import *
 
 # Constants for the level of explanation from the generation
 # routines
@@ -77,6 +79,7 @@
 
         self.dontaudit = False
 
+        self.domains = None
     def set_gen_refpol(self, if_set=None, perm_maps=None):
         """Set whether reference policy interfaces are generated.
 
@@ -151,8 +154,41 @@
             rule = refpolicy.AVRule(av)
             if self.dontaudit:
                 rule.rule_type = rule.DONTAUDIT
+            rule.comment = ""
             if self.explain:
-                rule.comment = refpolicy.Comment(explain_access(av, verbosity=self.explain))
+                rule.comment = str(refpolicy.Comment(explain_access(av, verbosity=self.explain)))
+            if av.type == audit2why.ALLOW:
+                rule.comment += "#!!!! This avc is allowed in the current policy\n" 
+            if av.type == audit2why.DONTAUDIT:
+                rule.comment += "#!!!! This avc has a dontaudit rule in the current policy\n" 
+
+            if av.type == audit2why.BOOLEAN:
+                if len(av.bools) > 1:
+                    rule.comment += "#!!!! This avc can be allowed using one of the these booleans:\n#     %s\n" % ", ".join(map(lambda x: x[0], av.bools))
+                else:
+                    rule.comment += "#!!!! This avc can be allowed using the boolean '%s'\n" % av.bools[0][0]
+
+            if av.type == audit2why.CONSTRAINT:
+                rule.comment += "#!!!! This avc is a constraint violation.  You will need to add an attribute to either the source or target type to make it work.\n" 
+                rule.comment += "#Contraint rule: "
+
+            if av.type == audit2why.TERULE:
+                if "write" in av.perms:
+                    if "dir" in av.obj_class or "open" in av.perms:
+                        if not self.domains:
+                            self.domains = seinfo(ATTRIBUTE, name="domain")[0]["types"]
+                        types=[]
+                        
+                        try:
+                            for i in map(lambda x: x[TCONTEXT], sesearch([ALLOW], {SCONTEXT: av.src_type, CLASS: av.obj_class, PERMS: av.perms})):
+                                if i not in self.domains:
+                                    types.append(i)
+                            if len(types) == 1:
+                                rule.comment += "#!!!! The source type '%s' can write to a '%s' of the following type:\n# %s\n" % ( av.src_type, av.obj_class, ", ".join(types))
+                            elif len(types) >= 1:
+                                rule.comment += "#!!!! The source type '%s' can write to a '%s' of the following types:\n# %s\n" % ( av.src_type, av.obj_class, ", ".join(types))
+                        except:
+                            pass
             self.module.children.append(rule)
 
 
diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/refparser.py policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/refparser.py
--- nsasepolgen/src/sepolgen/refparser.py	2010-05-19 14:45:51.000000000 -0400
+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/refparser.py	2010-06-16 08:22:43.000000000 -0400
@@ -1044,7 +1044,7 @@
         # of misc_macros. We are just going to pretend that this is an interface
         # to make the expansion work correctly.
         can_exec = refpolicy.Interface("can_exec")
-        av = access.AccessVector(["$1","$2","file","execute_no_trans","read",
+        av = access.AccessVector(["$1","$2","file","execute_no_trans","open", "read",
                                   "getattr","lock","execute","ioctl"])
 
         can_exec.children.append(refpolicy.AVRule(av))
diff --exclude-from=exclude -N -u -r nsasepolgen/src/share/perm_map policycoreutils-2.0.83/sepolgen-1.0.23/src/share/perm_map
--- nsasepolgen/src/share/perm_map	2010-05-19 14:45:51.000000000 -0400
+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/share/perm_map	2010-06-16 08:22:43.000000000 -0400
@@ -124,7 +124,7 @@
           quotamod     w           1
           quotaget     r           1
 
-class file 20
+class file 21
   execute_no_trans     r           1
         entrypoint     r           1
            execmod     n           1
@@ -141,48 +141,50 @@
             unlink     w           1
               link     w           1
             rename     w           5
-           execute     r           100
+           execute     r           10
             swapon     b           1
            quotaon     b           1
            mounton     b           1
+	      open     r	   1
 
-class dir 22
-          add_name     w           5
+class dir 23
+          add_name     w           1
        remove_name     w           1
           reparent     w           1
             search     r           1
              rmdir     b           1
              ioctl     n           1
-              read     r          10
-             write     w          10
+              read     r           1
+             write     w           1
             create     w           1
-           getattr     r           7
-           setattr     w           7
+           getattr     r           1
+           setattr     w           1
               lock     n           1
-       relabelfrom     r           10
-         relabelto     w           10
+       relabelfrom     r           1
+         relabelto     w           1
             append     w           1
             unlink     w           1
               link     w           1
-            rename     w           5
+            rename     w           1
            execute     r           1
             swapon     b           1
            quotaon     b           1
            mounton     b           1
+	      open     r	   1
 
 class fd 1
                use     b           1
 
-class lnk_file 17
+class lnk_file 18
              ioctl     n           1
-              read     r          10
-             write     w          10
+              read     r           1
+             write     w           1
             create     w           1
-           getattr     r           7
-           setattr     w           7
+           getattr     r           1
+           setattr     w           1
               lock     n           1
-       relabelfrom     r           10
-         relabelto     w           10
+       relabelfrom     r           1
+         relabelto     w           1
             append     w           1
             unlink     w           1
               link     w           1
@@ -191,8 +193,9 @@
             swapon     b           1
            quotaon     b           1
            mounton     b           1
+	      open     r	   1
 
-class chr_file 20
+class chr_file 21
   execute_no_trans     r           1
         entrypoint     r           1
            execmod     n           1
@@ -213,8 +216,9 @@
             swapon     b           1
            quotaon     b           1
            mounton     b           1
+	      open     r	   1
 
-class blk_file 17
+class blk_file 18
              ioctl     n           1
               read     r          10
              write     w          10
@@ -232,8 +236,9 @@
             swapon     b           1
            quotaon     b           1
            mounton     b           1
+	      open     r	   1
 
-class sock_file 17
+class sock_file 18
              ioctl     n           1
               read     r          10
              write     w          10
@@ -251,8 +256,9 @@
             swapon     b           1
            quotaon     b           1
            mounton     b           1
+	      open     r	   1
 
-class fifo_file 17
+class fifo_file 18
              ioctl     n           1
               read     r          10
              write     w          10
@@ -270,6 +276,7 @@
             swapon     b           1
            quotaon     b           1
            mounton     b           1
+	      open     r	   1
 
 class socket 22
              ioctl     n           1