1#! /usr/bin/python -Es
2# Copyright (C) 2012 Red Hat
3# see file 'COPYING' for use and warranty information
4#
5# setrans is a tool for analyzing process transistions in SELinux policy
6#
7#    This program is free software; you can redistribute it and/or
8#    modify it under the terms of the GNU General Public License as
9#    published by the Free Software Foundation; either version 2 of
10#    the License, or (at your option) any later version.
11#
12#    This program is distributed in the hope that it will be useful,
13#    but WITHOUT ANY WARRANTY; without even the implied warranty of
14#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15#    GNU General Public License for more details.
16#
17#    You should have received a copy of the GNU General Public License
18#    along with this program; if not, write to the Free Software
19#    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
20#                                        02111-1307  USA
21#
22#
23import sepolicy
24search = sepolicy.search
25info = sepolicy.info
26
27
28def get_types(src, tclass, perm):
29    allows = search([sepolicy.ALLOW], {sepolicy.SOURCE: src, sepolicy.CLASS: tclass, sepolicy.PERMS: perm})
30    nlist = []
31    if allows:
32        for i in map(lambda y: y[sepolicy.TARGET], filter(lambda x: set(perm).issubset(x[sepolicy.PERMS]), allows)):
33            if i not in nlist:
34                nlist.append(i)
35    return nlist
36
37
38def get_network_connect(src, protocol, perm):
39    portrecs, portrecsbynum = sepolicy.gen_port_dict()
40    d = {}
41    tlist = get_types(src, "%s_socket" % protocol, [perm])
42    if len(tlist) > 0:
43        d[(src, protocol, perm)] = []
44        for i in tlist:
45            if i == "ephemeral_port_type":
46                if "unreserved_port_type" in tlist:
47                    continue
48                i = "ephemeral_port_t"
49            if i == "unreserved_port_t":
50                if "unreserved_port_type" in tlist:
51                    continue
52                if "port_t" in tlist:
53                    continue
54            if i == "port_t":
55                d[(src, protocol, perm)].append((i, ["all ports with out defined types"]))
56            if i == "port_type":
57                d[(src, protocol, perm)].append((i, ["all ports"]))
58            elif i == "unreserved_port_type":
59                d[(src, protocol, perm)].append((i, ["all ports > 1024"]))
60            elif i == "reserved_port_type":
61                d[(src, protocol, perm)].append((i, ["all ports < 1024"]))
62            elif i == "rpc_port_type":
63                d[(src, protocol, perm)].append((i, ["all ports > 500 and  < 1024"]))
64            else:
65                try:
66                    d[(src, protocol, perm)].append((i, portrecs[(i, protocol)]))
67                except KeyError:
68                    pass
69    return d
70