1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
|
#!/usr/bin/env python3
# Author: Chris PeBenito <cpebenito@tresys.com>
#
# Copyright (C) 2006 Tresys Technology, LLC
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, version 2.
import sys,getopt,re
NETPORT = re.compile(r"^network_port\(\s*\w+\s*(\s*,\s*\w+\s*,\s*\w+\s*,\s*\w+\s*)+\s*\)\s*(#|$)")
DEFAULT_INPUT_PACKET = "server_packet_t"
DEFAULT_OUTPUT_PACKET = "client_packet_t"
DEFAULT_MCS = "s0"
DEFAULT_MLS = "s0"
PACKET_INPUT = "_server_packet_t"
PACKET_OUTPUT = "_client_packet_t"
class Port:
def __init__(self, proto, num, mls_sens):
# protocol of the port
self.proto = proto
# port number
self.num = num
# MLS sensitivity
self.mls_sens = mls_sens
# MCS categories
# not currently supported, so we always get s0
self.mcs_cats = DEFAULT_MCS
class Packet:
def __init__(self, prefix, ports):
# prefix
self.prefix = prefix
# A list of Ports
self.ports = ports
def print_input_rules(packets,mls,mcs):
line = "base -A selinux_new_input -j SECMARK --selctx system_u:object_r:"+DEFAULT_INPUT_PACKET
if mls:
line += ":"+DEFAULT_MLS
elif mcs:
line += ":"+DEFAULT_MCS
print(line)
for i in packets:
for j in i.ports:
line="base -A selinux_new_input -p "+j.proto+" --dport "+j.num+" -j SECMARK --selctx system_u:object_r:"+i.prefix+PACKET_INPUT
if mls:
line += ":"+j.mls_sens
elif mcs:
line += ":"+j.mcs_cats
print(line)
print("post -A selinux_new_input -j CONNSECMARK --save")
print("post -A selinux_new_input -j RETURN")
def print_output_rules(packets,mls,mcs):
line = "base -A selinux_new_output -j SECMARK --selctx system_u:object_r:"+DEFAULT_OUTPUT_PACKET
if mls:
line += ":"+DEFAULT_MLS
elif mcs:
line += ":"+DEFAULT_MCS
print(line)
for i in packets:
for j in i.ports:
line = "base -A selinux_new_output -p "+j.proto+" --dport "+j.num+" -j SECMARK --selctx system_u:object_r:"+i.prefix+PACKET_OUTPUT
if mls:
line += ":"+j.mls_sens
elif mcs:
line += ":"+j.mcs_cats
print(line)
print("post -A selinux_new_output -j CONNSECMARK --save")
print("post -A selinux_new_output -j RETURN")
def parse_corenet(file_name):
packets = []
corenet_te_in = open(file_name, "r")
while True:
corenet_line = corenet_te_in.readline()
# If EOF has been reached:
if not corenet_line:
break
if NETPORT.match(corenet_line):
corenet_line = corenet_line.strip()
# parse out the parameters
openparen = corenet_line.find('(')+1
closeparen = corenet_line.find(')',openparen)
parms = re.split(r'\W+',corenet_line[openparen:closeparen])
name = parms[0]
del parms[0]
ports = []
while len(parms) > 0:
# add a port combination.
ports.append(Port(parms[0],parms[1],parms[2]))
del parms[:3]
packets.append(Packet(name,ports))
corenet_te_in.close()
return packets
def print_netfilter_config(packets,mls,mcs):
print("pre *mangle")
print("pre :PREROUTING ACCEPT [0:0]")
print("pre :INPUT ACCEPT [0:0]")
print("pre :FORWARD ACCEPT [0:0]")
print("pre :OUTPUT ACCEPT [0:0]")
print("pre :POSTROUTING ACCEPT [0:0]")
print("pre :selinux_input - [0:0]")
print("pre :selinux_output - [0:0]")
print("pre :selinux_new_input - [0:0]")
print("pre :selinux_new_output - [0:0]")
print("pre -A INPUT -j selinux_input")
print("pre -A OUTPUT -j selinux_output")
print("pre -A selinux_input -m state --state NEW -j selinux_new_input")
print("pre -A selinux_input -m state --state RELATED,ESTABLISHED -j CONNSECMARK --restore")
print("pre -A selinux_output -m state --state NEW -j selinux_new_output")
print("pre -A selinux_output -m state --state RELATED,ESTABLISHED -j CONNSECMARK --restore")
print_input_rules(packets,mls,mcs)
print_output_rules(packets,mls,mcs)
print("post COMMIT")
mls = False
mcs = False
try:
opts, paths = getopt.getopt(sys.argv[1:],'mc',['mls','mcs'])
except getopt.GetoptError:
print("Invalid options.")
sys.exit(1)
for o, a in opts:
if o in ("-c","--mcs"):
mcs = True
if o in ("-m","--mls"):
mls = True
if len(paths) == 0:
sys.stderr.write("Need a path for corenetwork.te.in!\n")
sys.exit(1)
elif len(paths) > 1:
sys.stderr.write("Ignoring extra specified paths\n")
packets=parse_corenet(paths[0])
print_netfilter_config(packets,mls,mcs)
|
GitWeb