path: root/src/lib/Bcfg2/Client/Tools/SELinux.py

import os
import re
import sys
import copy
import glob
import struct
import socket
import selinux
import seobject
import Bcfg2.Client.XML
import Bcfg2.Client.Tools
import Bcfg2.Client.Tools.POSIX

def pack128(int_val):
    """ pack a 128-bit integer in big-endian format """
    max_int = 2 ** (128) - 1
    max_word_size = 2 ** 32 - 1
    
    if int_val <= max_word_size:
        return struct.pack('>L', int_val)
    
    words = []
    for i in range(4):
        word = int_val & max_word_size
        words.append(int(word))
        int_val >>= 32
    words.reverse()
    return struct.pack('>4I', *words)

def netmask_itoa(netmask, proto="ipv4"):
    """ convert an integer netmask (e.g., /16) to dotted-quad
    notation (255.255.0.0) or IPv6 prefix notation (ffff::) """
    if proto == "ipv4":
        size = 32
        family = socket.AF_INET
    else: # ipv6
        size = 128
        family = socket.AF_INET6
    try:
        int(netmask)
    except ValueError:
        return netmask
    
    if netmask > size:
        raise ValueError("Netmask too large: %s" % netmask)
    
    res = 0L
    for n in range(netmask):
        res |= 1 << (size - n - 1)
    netmask = socket.inet_ntop(family, pack128(res))
    return netmask


class SELinux(Bcfg2.Client.Tools.Tool):
    """ SELinux boolean and module support """
    name = 'SELinux'
    __handles__ = [('SELinux', 'boolean'),
                   ('SELinux', 'port'),
                   ('SELinux', 'fcontext'),
                   ('SELinux', 'node'),
                   ('SELinux', 'login'),
                   ('SELinux', 'user'),
                   ('SELinux', 'interface'),
                   ('SELinux', 'permissive'),
                   ('SELinux', 'module')]
    __req__ = dict(SELinux=dict(boolean=['name', 'value'],
                                module=['name'],
                                port=['name', 'selinuxtype'],
                                fcontext=['name', 'selinuxtype'],
                                node=['name', 'selinuxtype', 'proto'],
                                login=['name', 'selinuxuser'],
                                user=['name', 'roles', 'prefix'],
                                interface=['name', 'selinuxtype'],
                                permissive=['name']))

    def __init__(self, logger, setup, config):
        Bcfg2.Client.Tools.Tool.__init__(self, logger, setup, config)
        self.handlers = {}
        for handles in self.__handles__:
            etype = handles[1]
            self.handlers[etype] = \
                globals()["SELinux%sHandler" % etype.title()](self, logger,
                                                              setup, config)

    def BundleUpdated(self, _, states):
        for handler in self.handlers.values():
            handler.BundleUpdated(states)

    def FindExtra(self):
        extra = []
        for handler in self.handlers.values():
            extra.extend(handler.FindExtra())
        return extra

    def canInstall(self, entry):
        return (Bcfg2.Client.Tools.Tool.canInstall(self, entry) and
                self.handlers[entry.get('type')].canInstall(entry))

    def primarykey(self, entry):
        """ return a string that should be unique amongst all entries
        in the specification """
        return self.handlers[entry.get('type')].primarykey(entry)

    def Install(self, entries, states):
        # start a transaction
        sr = seobject.semanageRecords("")
        if hasattr(sr, "start"):
            self.logger.debug("Starting SELinux transaction")
            sr.start()
        else:
            self.logger.debug("SELinux transactions not supported; this may "
                              "slow things down considerably")
        Bcfg2.Client.Tools.Tool.Install(self, entries, states)
        if hasattr(sr, "finish"):
            self.logger.debug("Committing SELinux transaction")
            sr.finish()

    def InstallSELinux(self, entry):
        """Dispatch install to the proper method according to type"""
        return self.handlers[entry.get('type')].Install(entry)

    def VerifySELinux(self, entry, _):
        """Dispatch verify to the proper method according to type"""
        rv = self.handlers[entry.get('type')].Verify(entry)
        if entry.get('qtext') and self.setup['interactive']:
            entry.set('qtext',
                      '%s\nInstall SELinux %s %s: (y/N) ' %
                      (entry.get('qtext'),
                       entry.get('type'),
                       self.handlers[entry.get('type')].tostring(entry)))
        return rv

    def Remove(self, entries):
        """Dispatch verify to the proper removal method according to type"""
        # sort by type
        types = list()
        for entry in entries:
            if entry.get('type') not in types:
                types.append(entry.get('type'))

        for etype in types:
            self.handlers[entry.get('type')].Remove([e for e in entries
                                                     if e.get('type') == etype])

        
class SELinuxEntryHandler(object):
    etype = None
    key_format = ("name",)
    value_format = ()
    str_format = '%(name)s'
    custom_re = re.compile(' (?P<name>\S+)$')
    custom_format = None
    
    def __init__(self, tool, logger, setup, config):
        self.tool = tool
        self.logger = logger
        self._records = None
        self._all = None
        if not self.custom_format:
            self.custom_format = self.key_format

    @property
    def records(self):
        if self._records is None:
            self._records = getattr(seobject, "%sRecords" % self.etype)("")
        return self._records

    @property
    def all_records(self):
        if self._all is None:
            self._all = self.records.get_all()
        return self._all

    @property
    def custom_records(self):
        if hasattr(self.records, "customized") and self.custom_re:
            return dict([(k, self.all_records[k]) for k in self.custom_keys])
        else:
            # ValueError is really a pretty dumb exception to raise,
            # but that's what the seobject customized() method raises
            # if it's defined but not implemented.  yeah, i know, wtf.
            raise ValueError("custom_records")

    @property
    def custom_keys(self):
        keys = []
        for cmd in self.records.customized():
            match = self.custom_re.search(cmd)
            if match:
                if (len(self.custom_format) == 1 and
                    self.custom_format[0] == "name"):
                    keys.append(match.group("name"))
                else:
                    keys.append(tuple([match.group(k)
                                       for k in self.custom_format]))
        return keys

    def tostring(self, entry):
        return self.str_format % entry.attrib

    def keytostring(self, key):
        return self.str_format % self._key2attrs(key)

    def _key(self, entry):
        if len(self.key_format) == 1 and self.key_format[0] == "name":
            return entry.get("name")
        else:
            rv = []
            for key in self.key_format:
                rv.append(entry.get(key))
            return tuple(rv)

    def _key2attrs(self, key):
        if isinstance(key, tuple):
            rv = dict((self.key_format[i], key[i])
                      for i in range(len(self.key_format))
                      if self.key_format[i])
        else:
            rv = dict(name=key)
        if self.value_format:
            vals = self.all_records[key]
            rv.update(dict((self.value_format[i], vals[i])
                           for i in range(len(self.value_format))
                           if self.value_format[i]))
        return rv

    def key2entry(self, key):
        attrs = self._key2attrs(key)
        attrs["type"] = self.etype
        return Bcfg2.Client.XML.Element("SELinux", **attrs)

    def _args(self, entry, method):
        if hasattr(self, "_%sargs" % method):
            return getattr(self, "_%sargs" % method)(entry)
        elif hasattr(self, "_defaultargs"):
            # default args
            return self._defaultargs(entry)
        else:
            raise NotImplementedError

    def _deleteargs(self, entry):
        return (self._key(entry))

    def canInstall(self, entry):
        return bool(self._key(entry))
    
    def primarykey(self, entry):
        return ":".join([entry.tag, entry.get("type"), entry.get("name")])

    def exists(self, entry):
        if self._key(entry) not in self.all_records:
            self.logger.debug("SELinux %s %s does not exist" %
                              (self.etype, self.tostring(entry)))
            return False
        return True

    def Verify(self, entry):
        if not self.exists(entry):
            entry.set('current_exists', 'false')
            return False

        errors = []
        current_attrs = self._key2attrs(self._key(entry))
        desired_attrs = entry.attrib
        for attr in self.value_format:
            if not attr:
                continue
            if current_attrs[attr] != desired_attrs[attr]:
                entry.set('current_%s' % attr, current_attrs[attr])
                errors.append("SELinux %s %s has wrong %s: %s, should be %s" %
                              (self.etype, self.tostring(entry), attr,
                               current_attrs[attr], desired_attrs[attr]))

        if errors:
            for error in errors:
                self.logger.debug(error)
            entry.set('qtext', "\n".join([entry.get('qtext', '')] + errors))
            return False
        else:
            return True

    def Install(self, entry, method=None):
        if not method:
            if self.exists(entry):
                method = "modify"
            else:
                method = "add"
        self.logger.debug("%s SELinux %s %s" %
                          (method.title(), self.etype, self.tostring(entry)))

        try:
            getattr(self.records, method)(*self._args(entry, method))
            self._all = None
            return True
        except ValueError:
            err = sys.exc_info()[1]
            self.logger.debug("Failed to %s SELinux %s %s: %s" %
                              (method, self.etype, self.tostring(entry), err))
            return False

    def Remove(self, entries):
        for entry in entries:
            try:
                self.records.delete(*self._args(entry, "delete"))
                self._all = None
            except ValueError:
                err = sys.exc_info()[1]
                self.logger.info("Failed to remove SELinux %s %s: %s" %
                                 (self.etype, self.tostring(entry), err))

    def FindExtra(self):
        specified = [self._key(e)
                     for e in self.tool.getSupportedEntries()
                     if e.get("type") == self.etype]
        try:
            records = self.custom_records
        except ValueError:
            records = self.all_records
        return [self.key2entry(key)
                for key in records.keys()
                if key not in specified]

    def BundleUpdated(self, states):
        pass


class SELinuxBooleanHandler(SELinuxEntryHandler):
    etype = "boolean"
    value_format = ("value",)

    @property
    def all_records(self):
        # older versions of selinux return a single 0/1 value for each
        # bool, while newer versions return a list of three 0/1 values
        # representing various states. we don't care about the latter
        # two values, but it's easier to coerce the older format into
        # the newer format as far as interoperation with the rest of
        # SELinuxEntryHandler goes
        rv = SELinuxEntryHandler.all_records.fget(self)
        if rv.values()[0] in [0, 1]:
            for key, val in rv.items():
                rv[key] = [val, val, val]
        return rv

    def _key2attrs(self, key):
        rv = SELinuxEntryHandler._key2attrs(self, key)
        status = self.all_records[key][0]
        if status:
            rv['value'] = "on"
        else:
            rv['value'] = "off"
        return rv

    def _defaultargs(self, entry):
        # the only values recognized by both new and old versions of
        # selinux are the strings "0" and "1".  old selinux accepts
        # ints or bools as well, new selinux accepts "on"/"off"
        if entry.get("value").lower() == "on":
            value = "1"
        else:
            value = "0"
        return (entry.get("name"), value)

    def canInstall(self, entry):
        if entry.get("value").lower() not in ["on", "off"]:
            self.logger.debug("SELinux %s %s has a bad value: %s" %
                              (self.etype, self.tostring(entry),
                               entry.get("value")))
            return False
        return (self.exists(entry) and
                SELinuxEntryHandler.canInstall(self, entry))
    

class SELinuxPortHandler(SELinuxEntryHandler):
    etype = "port"
    value_format = ('selinuxtype', None)
    custom_re = re.compile(r'-p (?P<proto>tcp|udp).*? (?P<start>\d+)(?:-(?P<end>\d+))?$')

    @property
    def custom_keys(self):
        keys = []
        for cmd in self.records.customized():
            match = self.custom_re.search(cmd)
            if match:
                if match.group('end'):
                    keys.append((int(match.group('start')),
                                 int(match.group('end')),
                                 match.group('proto')))
                else:
                    keys.append((int(match.group('start')),
                                 int(match.group('start')),
                                 match.group('proto')))
        return keys

    @property
    def all_records(self):
        if self._all is None:
            # older versions of selinux use (startport, endport) as
            # they key for the ports.get_all() dict, and (type, proto,
            # level) as the value; this is obviously broken, so newer
            # versions use (startport, endport, proto) as the key, and
            # (type, level) as the value.  abstracting around this
            # sucks.
            ports = self.records.get_all()
            if len(ports.keys()[0]) == 3:
                self._all = ports
            else:
                # uglist list comprehension ever?
                self._all = dict([((k[0], k[1], v[1]), (v[0], v[2]))
                                  for k, v in ports.items()])
        return self._all

    def _key(self, entry):
        try:
            (port, proto) = entry.get("name").split("/")
        except ValueError:
            self.logger.error("Invalid SELinux node %s: no protocol specified" %
                              entry.get("name"))
            return
        if "-" in port:
            start, end = port.split("-")
        else:
            start = port
            end = port
        return (int(start), int(end), proto)
    
    def _key2attrs(self, key):
        if key[0] == key[1]:
            port = str(key[0])
        else:
            port = "%s-%s" % (key[0], key[1])
        vals = self.all_records[key]
        return dict(name="%s/%s" % (port, key[2]), selinuxtype=vals[0])

    def _defaultargs(self, entry):
        (port, proto) = entry.get("name").split("/")
        return (port, proto, '', entry.get("selinuxtype"))

    def _deleteargs(self, entry):
        return tuple(entry.get("name").split("/"))


class SELinuxFcontextHandler(SELinuxEntryHandler):
    etype = "fcontext"
    key_format = ("name", "filetype")
    value_format = (None, None, "selinuxtype", None)
    filetypeargs = dict(all="",
                        regular="--",
                        directory="-d",
                        symlink="-l",
                        pipe="-p",
                        socket="-s",
                        block="-b",
                        char="-c",
                        door="-D")
    filetypenames = dict(all="all files",
                        regular="regular file",
                        directory="directory",
                        symlink="symbolic link",
                        pipe="named pipe",
                        socket="socket",
                        block="block device",
                        char="character device",
                        door="door")
    filetypeattrs = dict([v, k] for k, v in filetypenames.iteritems())
    custom_re = re.compile(r'-f \'(?P<filetype>[a-z ]+)\'.*? \'(?P<name>.*)\'')

    @property
    def all_records(self):
        if self._all is None:
            # on older selinux, fcontextRecords.get_all() returns a
            # list of tuples of (filespec, filetype, seuser, serole,
            # setype, level); on newer selinux, get_all() returns a
            # dict of (filespec, filetype) => (seuser, serole, setype,
            # level).
            fcontexts = self.records.get_all()
            if isinstance(fcontexts, dict):
                self._all = fcontexts
            else:
                self._all = dict([(f[0:2], f[2:]) for f in fcontexts])
        return self._all

    def _key(self, entry):
        ftype = entry.get("filetype", "all")
        return (entry.get("name"),
                self.filetypenames.get(ftype, ftype))

    def _key2attrs(self, key):
        rv = dict(name=key[0], filetype=self.filetypeattrs[key[1]])
        vals = self.all_records[key]
        # in older versions of selinux, an fcontext with no selinux
        # type is the single value None; in newer versions, it's a
        # tuple whose 0th (and only) value is None.
        if vals and vals[0]:
            rv["selinuxtype"] = vals[2]
        else:
            rv["selinuxtype"] = "<<none>>"
        return rv

    def canInstall(self, entry):
        return (entry.get("filetype", "all") in self.filetypeargs and
                SELinuxEntryHandler.canInstall(self, entry))

    def _defaultargs(self, entry):
        return (entry.get("name"), entry.get("selinuxtype"),
                self.filetypeargs[entry.get("filetype", "all")],
                '', '')

    def primarykey(self, entry):
        return ":".join([entry.tag, entry.get("type"), entry.get("name"),
                         entry.get("filetype", "all")])
        

class SELinuxNodeHandler(SELinuxEntryHandler):
    etype = "node"
    value_format = (None, None, "selinuxtype", None)
    str_format = '%(name)s (%(proto)s)'
    custom_re = re.compile(r'-M (?P<netmask>\S+).*?-p (?P<proto>ipv\d).*? (?P<addr>\S+)$')
    custom_format = ('addr', 'netmask', 'proto')

    def _key(self, entry):
        try:
            (addr, netmask) = entry.get("name").split("/")
        except ValueError:
            self.logger.error("Invalid SELinux node %s: no netmask specified" %
                              entry.get("name"))
            return
        netmask = netmask_itoa(netmask, proto=entry.get("proto"))
        return (addr, netmask, entry.get("proto"))
    
    def _key2attrs(self, key):
        vals = self.all_records[key]
        return dict(name="%s/%s" % (key[0], key[1]), proto=key[2],
                    selinuxtype=vals[2])

    def _defaultargs(self, entry):
        (addr, netmask) = entry.get("name").split("/")
        return (addr, netmask, entry.get("proto"), "", entry.get("selinuxtype"))


class SELinuxLoginHandler(SELinuxEntryHandler):
    etype = "login"
    value_format = ("selinuxuser", None)

    def _defaultargs(self, entry):
        return (entry.get("name"), entry.get("selinuxuser"), "")


class SELinuxUserHandler(SELinuxEntryHandler):
    etype = "user"
    value_format = ("prefix", None, None, "roles")

    def __init__(self, tool, logger, setup, config):
        SELinuxEntryHandler.__init__(self, tool, logger, setup, config)
        self.needs_prefix = False

    @property
    def records(self):
        if self._records is None:
            self._records = seobject.seluserRecords()
        return self._records

    def Install(self, entry):
        # in older versions of selinux, modify() is broken if you
        # provide a prefix _at all_, so we try to avoid giving the
        # prefix.  however, in newer versions, prefix is _required_,
        # so we a) try without a prefix; b) catch TypeError, which
        # indicates that we had the wrong number of args (ValueError
        # is thrown by the bug in older versions of selinux); and c)
        # try with prefix.
        try:
            SELinuxEntryHandler.Install(self, entry)
        except TypeError:
            self.needs_prefix = True
            SELinuxEntryHandler.Install(self, entry)

    def _defaultargs(self, entry):
        # in older versions of selinux, modify() is broken if you
        # provide a prefix _at all_, so we try to avoid giving the
        # prefix.  see the comment in Install() above for more
        # details.
        rv = [entry.get("name"),
              entry.get("roles", "").replace(" ", ",").split(",")]
        if self.needs_prefix:
            rv.extend(['', '', entry.get("prefix")])
        else:
            key = self._key(entry)
            if key in self.all_records:
                attrs = self._key2attrs(key)
                if attrs['prefix'] != entry.get("prefix"):
                    rv.extend(['', '', entry.get("prefix")])
        return tuple(rv)


class SELinuxInterfaceHandler(SELinuxEntryHandler):
    etype = "interface"
    value_format = (None, None, "selinuxtype", None)

    def _defaultargs(self, entry):
        return (entry.get("name"), '', entry.get("selinuxtype"))


class SELinuxPermissiveHandler(SELinuxEntryHandler):
    etype = "permissive"
    
    @property
    def records(self):
        try:
            return SELinuxEntryHandler.records.fget(self)
        except AttributeError:
            self.logger.info("Permissive domains not supported by this version "
                             "of SELinux")
            self._records = False
            return self._records

    @property
    def all_records(self):
        if self._all is None:
            if self.records == False:
                self._all = dict()
            else:
                # permissiveRecords.get_all() returns a list, so we just
                # make it into a dict so that the rest of
                # SELinuxEntryHandler works
                self._all = dict([(d, d) for d in self.records.get_all()])
        return self._all

    def _defaultargs(self, entry):
        return (entry.get("name"),)


class SELinuxModuleHandler(SELinuxEntryHandler):
    etype = "module"
    value_format = (None, "disabled")

    def __init__(self, tool, logger, setup, config):
        SELinuxEntryHandler.__init__(self, tool, logger, setup, config)
        self.posixtool = Bcfg2.Client.Tools.POSIX.POSIX(logger, setup, config)
        try:
            self.setype = selinux.selinux_getpolicytype()[1]
        except IndexError:
            self.logger.error("Unable to determine SELinux policy type")
            self.setype = None

    @property
    def all_records(self):
        if self._all is None:
            # we get a list of tuples back; coerce it into a dict
            self._all = dict([(m[0], (m[1], m[2]))
                             for m in self.records.get_all()])
        return self._all

    def _key2attrs(self, key):
        rv = SELinuxEntryHandler._key2attrs(self, key)
        status = self.all_records[key][1]
        if status:
            rv['disabled'] = "false"
        else:
            rv['disabled'] = "true"
        return rv

    def _filepath(self, entry):
        return os.path.join("/usr/share/selinux", self.setype,
                            "%s.pp" % entry.get("name"))

    def _pathentry(self, entry):
        pathentry = copy.deepcopy(entry)
        pathentry.set("name", self._filepath(pathentry))
        pathentry.set("perms", "0644")
        pathentry.set("owner", "root")
        pathentry.set("group", "root")
        pathentry.set("secontext", "__default__")
        return pathentry

    def Verify(self, entry):
        if not entry.get("disabled"):
            entry.set("disabled", "false")
        return (SELinuxEntryHandler.Verify(self, entry) and
                self.posixtool.Verifyfile(self._pathentry(entry), None))

    def canInstall(self, entry):
        return (entry.text and self.setype and
                SELinuxEntryHandler.canInstall(self, entry))

    def Install(self, entry):
        rv = self.posixtool.Installfile(self._pathentry(entry))
        try:
            rv = rv and SELinuxEntryHandler.Install(self, entry)
        except NameError:
            # some versions of selinux have a bug in seobject that
            # makes modify() calls fail.  add() seems to have the same
            # effect as modify, but without the bug
            if self.exists(entry):
                rv = rv and SELinuxEntryHandler.Install(self, entry,
                                                        method="add")

        if entry.get("disabled", "false").lower() == "true":
            method = "disable"
        else:
            method = "enable"
        return rv and SELinuxEntryHandler.Install(self, entry, method=method)

    def _addargs(self, entry):
        return (self._filepath(entry),)

    def _defaultargs(self, entry):
        return (entry.get("name"),)

    def FindExtra(self):
        specified = [self._key(e)
                     for e in self.tool.getSupportedEntries()
                     if e.get("type") == self.etype]
        return [self.key2entry(os.path.basename(f)[:-3])
                for f in glob.glob(os.path.join("/usr/share/selinux",
                                                self.setype, "*.pp"))
                if f not in specified]