semodrequire

#!/usr/bin/env python3
from pathlib import Path
from re import search
from sys import argv

#############
### USAGE ###
#############
def usage():
    # Name of this script without any paths
    name = Path(argv[0]).name
    print(f"NAME\n\t{name} - python script to generate the 'require' section within a SELinux policy module file\n")
    print(f"SYNOPSIS\n\t{name} <module>.te\n")
    print(f"DESCRIPTION\n\t{name} is a Python script provided by the HardHat project to generate the 'require' section for SELinux policy modules. The only argument this script takes is the path to the <module>.te file.\n")
    print(f"EXAMPLE\n\t1. {name} chromium-browser.te\n")
    print("\n")

#################
### FUNCTIONS ###
#################
def args():
    # Check if the user has specified the help flag (any argument)
    if any([True for arg in argv if arg == '-h']):
        # If so, then display the usage information
        usage()
        # Exit
        exit(0)
    try:
        # Argument 1: Path to the SELinux module file
        filename = Path(argv[1]).resolve().expanduser()
    except IndexError:
        # Display the usage information
        usage()
        # If no arguments were specified, then display an error message to stdout
        print("ERROR: Argument 1: Specify the SELinux '.te' file")
        # Exit with an error
        exit(1)
    # Return the $filename
    return(filename)

def verify(filename):
    if Path(filename).is_file():
        # If the $filename is an existing file, return True
        return(True)
    else:
        # Otherwise, display an error message to stdout
        print(f"ERROR: Unable to locate file: '{filename}'")
        # Exit with an error
        exit(1)

def read(filename):
    # Open and read the contents of $filename
    with open(filename, 'r') as f: contents = f.readlines()
    # Remove extraneous spaces
    contents = [x.strip() for x in contents]
    # Return $contents
    return(contents)

def classes(contents_allow):
    # Define the set to contain the SELinux classes used in $filename
    classes = set()
    # Iterate through each entry in the $contents_allow list
    for entry in contents_allow:
        # The first part of the entry will be the type, and the last part will be the class
        name = entry.split(':')[-1].split(' ')[0]
        # Define only the class name
        classes.add(name) 
    # Define a new set to contain only the classes and permissions required for the current $filename
    all_classes = set()
    # Iterate through each class in $classes
    for c in classes:
        # For the current class, define only the permissions (eg. '{ create getattr read write }')
        permissions = [perm for entry in contents_allow if f":{c}" in entry for perm in entry.split(f":{c}", 1)[-1].split(' ')]
        # Iterate though each entry in $c_entries, and then only select the text that contains valid characters
        permissions = [search(r'[a-zA-Z_ ]+', p) for p in permissions]
        # Only use permissions that are valid (i.e. are not Nonetype) and sort the $permissions set
        permissions = sorted(set([p.group().strip() for p in permissions if p]))
        # Define the proper format and add it to the $all_classes set
        all_classes.add('class %s { %s };' % (c, ' '.join(permissions)))
    # Join $all_classes via newline
    all_classes = '\n'.join(sorted(all_classes))
    # Return the $all_classes set
    return(all_classes)

def roles(contents):
    # Find all entries in $contents that start with 'role' AND does not contain the string 'types', which is the SELinux permission string
    contents_role = [entry for entry in contents if entry.startswith('role') and ('types' not in entry)]
    # Define the set to contain the SELinux roles used in $filename
    roles = set()
    # Iterate through each entry in the $contents_role list
    for entry in contents_role:
        # Split via the specified text in order to obtain only the name of the current role
        name = entry.split('role ')[-1]
        try:
            # Define only the alphabetical characters and underscore as the name (eg. 'user_r;' will become 'user_r')
            name = search('[a-zA-Z_]+', name).group()
        except AttributeError:
            # If there are no roles, then return an empty string
            return('')
        # Define the proper format and add it to the $roles set
        roles.add(f"role {name};")
    # Sort alphabetically and join all entries via newline to create one string that contains all roles
    roles = '\n'.join(sorted(roles))
    # Return the $roles string
    return(roles)

def types(contents_allow):
    # Define the set to contain the SELinux types used in $filename
    types = set()
    # Iterate through each entry in the $contents_allow list
    for entry in contents_allow:
        # The first part of the entry will be the type, and the last part will be the class. Keep only the part with the type (eg. 'allow test_t named_t') and then split this via spaces (eg. ['allow', 'test_t', 'named_t'])
        entry_s = entry.split(':')[0].split(' ')
        # For every entry in $entry_s that ends with the string '_t', add to the $types set
        [types.add(t) for t in entry_s if t.endswith('_t')]
    # For each type in $types, except for 'self' that isn't a proper type, create the string 'type $name;' where $name is the current entry. Finally, join the entire list via the newline delimiter 
    types = '\n'.join([f"type {t};" for t in sorted(types) if t not in ('self')])
    # Return the string containing all types
    return(types)

############
### MAIN ###
############
def main(filename):
    # Verify the $filename is a valid file
    verify(filename)
    # Read and obtain $filename contents
    contents = read(filename)
    # Define a string containing all requires roles for $filename
    all_roles = roles(contents)
    # Find all entries in $contents that start with 'allow', which will contain the classes and types that will need to be added to the require section
    contents_allow = [entry for entry in contents if entry.startswith('allow')]
    # Define a string containing all required classes and permissions for $filename
    all_classes = classes(contents_allow)
    # Define a string containing all required types for $filename
    all_types = types(contents_allow)
    # Display all classes to stdout
    print(all_classes)
    # If applicable, display the roles to stdout
    if all_roles: print(all_roles)
    # Display all types to stdout
    print(all_types)

#############
### START ###
#############
if __name__ == '__main__':
    # Obtain the SELinux module file
    filename = args()
    # Start the script
    main(filename)