f24b457dd0
In general, it appears that libselinux and libsepol interpret paths and contexts as bytes. For instance, selabel_file(5) mentions about the path field of file_contexts: Strings representing paths are processed as bytes (as opposed to Unicode), meaning that non-ASCII characters are not matched by a single wildcard. libsepol also uses primitives such as strchr[1], which explicitly operate at the byte level (see strchr(3)). However, practically, Android paths and contexts all uses ASCII characters. Use the str type (i.e., Unicode) for all Python code to avoid a larger refactoring. Ensure we convert to bytes for inputs and outputs of libsepolwrap.so. The encoding "ascii" is used, which will raise an error should a context or type contain non-ASCII characters. Update headers to match development/docs/copyright-templates. [1] https://cs.android.com/android/platform/superproject/+/master:external/selinux/libsepol/src/context_record.c;l=224;drc=454466e2e49fd99f36db78396e604962b8682cb4 Bug: 200119288 Test: lunch aosp_bramble-userdebug && m Test: atest --host fc_sort_test Test: manually run searchpolicy Change-Id: I72d41a35f90b2d4112e481cd8d7408764a6c8132
87 lines
2.9 KiB
Python
87 lines
2.9 KiB
Python
#!/usr/bin/env python3
|
|
#
|
|
# Copyright 2021 The Android Open Source Project
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
import argparse
|
|
import policy
|
|
|
|
parser = argparse.ArgumentParser(
|
|
description="SELinux policy rule search tool. Intended to have a similar "
|
|
+ "API as sesearch, but simplified to use only code availabe in AOSP")
|
|
parser.add_argument("policy", help="Path to the SELinux policy to search.", nargs="?")
|
|
parser.add_argument("--libpath", dest="libpath", help="Path to the libsepolwrap.so", nargs="?")
|
|
tertypes = parser.add_argument_group("TE Rule Types")
|
|
tertypes.add_argument("--allow", action="append_const",
|
|
const="allow", dest="tertypes",
|
|
help="Search allow rules.")
|
|
expr = parser.add_argument_group("Expressions")
|
|
expr.add_argument("-s", "--source",
|
|
help="Source type/role of the TE/RBAC rule.")
|
|
expr.add_argument("-t", "--target",
|
|
help="Target type/role of the TE/RBAC rule.")
|
|
expr.add_argument("-c", "--class", dest="tclass",
|
|
help="Comma separated list of object classes")
|
|
expr.add_argument("-p", "--perms", metavar="PERMS",
|
|
help="Comma separated list of permissions.")
|
|
|
|
args = parser.parse_args()
|
|
|
|
if not args.tertypes:
|
|
parser.error("Must specify \"--allow\"")
|
|
|
|
if not args.policy:
|
|
parser.error("Must include path to policy")
|
|
if not args.libpath:
|
|
parser.error("Must include path to libsepolwrap library")
|
|
|
|
if not (args.source or args.target or args.tclass or args.perms):
|
|
parser.error("Must something to filter on, e.g. --source, --target, etc.")
|
|
|
|
pol = policy.Policy(args.policy, None, args.libpath)
|
|
|
|
if args.source:
|
|
scontext = {args.source}
|
|
else:
|
|
scontext = set()
|
|
if args.target:
|
|
tcontext = {args.target}
|
|
else:
|
|
tcontext = set()
|
|
if args.tclass:
|
|
tclass = set(args.tclass.split(","))
|
|
else:
|
|
tclass = set()
|
|
if args.perms:
|
|
perms = set(args.perms.split(","))
|
|
else:
|
|
perms = set()
|
|
|
|
TERules = pol.QueryTERule(scontext=scontext,
|
|
tcontext=tcontext,
|
|
tclass=tclass,
|
|
perms=perms)
|
|
|
|
# format rules for printing
|
|
rules = []
|
|
for r in TERules:
|
|
if len(r.perms) > 1:
|
|
rules.append("allow " + r.sctx + " " + r.tctx + ":" + r.tclass + " { " +
|
|
" ".join(r.perms) + " };")
|
|
else:
|
|
rules.append("allow " + r.sctx + " " + r.tctx + ":" + r.tclass + " " +
|
|
" ".join(r.perms) + ";")
|
|
|
|
for r in sorted(rules):
|
|
print(r)
|