VULN_CHECK_I913V6 /i~ddlZddlZddlZddlZddlmZddlmZddlmZddlmZddlm Z dZ id d d d d ddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*id+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLidMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdndodpdqZ drZ dsZ dtZduZdvZdwZdxZdyZdzZd{Zd|Zd}Zd~ZdZdZdZdZdZdZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'da(da)da*da+da,ddZ-dZ.dZ/dZ0dZ1dZ2dZ3dZ4dZ5dZ6dZ7dZ8dZ9dZ:dZ;dZdZ?dZ@dZAdZBdZCdZDdZEdZFdZGdZHdZIdZJdZKdZLdZMdZNdZOdZPdZQdZRdZSdZTdZUdZVdZWdZXdZYdZZdZ[dZ\dZ]dZ^d„Z_dÄZ`dĄZadńZbdƄZcdDŽZddȄZedɄZfdʄZgd˄Zhd̄Zid̈́Zjd΄ZkdτZldЄZmdфZnd҄ZodӄZpdԄZqdՄZrdքZsdׄZtdaudavd؄ZwddلZxdڄZyddۄZzy)N)access)defaults)lex) refpolicy)yacc)JTICKSQUOTEOBRACECBRACESEMICOLONOPARENCPARENCOMMAMINUSTILDEASTERISKAMPBAREXPLEQUALFILENAME IDENTIFIERNUMBERPATH IPV6_ADDRMODULE POLICY_MODULEREQUIRESIDGENFSCON FS_USE_XATTR FS_USE_TRANS FS_USE_TASKPORTCONNODECONNETIFCONPIRQCONIOMEMCON IOPORTCON PCIDEVICECON DEVICETREECONCLASS TYPEATTRIBUTE ROLEATTRIBUTETYPE ATTRIBUTEATTRIBUTE_ROLEALIAS TYPEALIASBOOLTRUEFALSEIFELSEROLETYPESALLOW DONTAUDIT AUDITALLOW NEVERALLOW PERMISSIVE TYPEBOUNDSTYPE_TRANSITION TYPE_CHANGE TYPE_MEMBERRANGE_TRANSITIONROLE_TRANSITION OPT_POLICY INTERFACETUNABLE_POLICYGEN_REQTEMPLATE GEN_CONTEXT GEN_TUNABLEIFELSEIFDEFIFNDEFDEFINEmoduler policy_modulerrequirer sidr!genfsconr" fs_use_xattrr# fs_use_transr$ fs_use_taskr%portconr&nodeconr'netifconr(pirqconr)iomemconr* ioportconr+ pcideviceconr, devicetreeconr-classr. typeattributer/ roleattributer0typer1 attributer2attribute_roler3aliasr4 typealiasr5boolr6truer7falser8ifr9elser:roler;typesr<allowr= dontauditr> auditallowr? neverallowr@ permissiverA typeboundsrBtype_transitionrC type_changerD type_memberrErange_transitionrFrole_transitionrGoptional_policyrH interfacerItunable_policyrJ gen_requirerKtemplaterL gen_contextrM gen_tunablerNifelserOifndefrQrPrR)ifdefdefinez\`z\'z\{z\}z\;+z\:z\(z\)z\,z\-z\~z\*z\&z\|z\!z\=z[0-9\.]+z/[a-zA-Z0-9)_\.\*/\$]*z c|S)z2[a-fA-F0-9]{0,4}:[a-fA-F0-9]{0,4}:([a-fA-F0-9]|:)*ts 7/usr/lib/python3.12/site-packages/sepolgen/refparser.py t_IPV6_ADDRrs  HcB|jxjdz c_y)zdnl.*\nrNlexerlinenors r t_m4commentrGGNNaNrc&|jdy)zdefine.*refpolicywarn\(.*\nrN)skiprs rt_refpolicywarn1rsFF1IrcB|jxjdz c_y)zrefpolicywarn\(.*\nrNrrs rt_refpolicywarnrsGGNNaNrcPtj|jd|_|S)z#[a-zA-Z_\$][a-zA-Z0-9_\-\+\.\$\*~]*rreservedgetvaluerfrs r t_IDENTIFIERrs\\!'', /AF HrcPtj|jd|_|S)z"\"[a-zA-Z0-9_\-\+\.\$\*~ :\[\]]+\"rrrs r t_FILENAMErs\\!''* -AF HrcB|jxjdz c_y)z\#.*\nrNrrs r t_commentr rrc\td|jdz|jdy)NzIllegal character '%s'rr)printrrrs rt_errorrs# "QWWQZ /0FF1Irch|jxjt|jz c_y)z\n+N)rrlenrrs r t_newlinersGGNNc!''l"NrTc|y|D]I}|||_||jjd||f.|jjd|Ky)Nr)parentchildreninsert)stmtsrvalss rcollectr/sT }  9  ? OO " "1sAh / OO " "1a (rc|D]M}tj|r%|jtj|=|j |OyN)spthas_keyupdateby_nameadd)idsrids rexpandr;s6 ;;r? HHS[[_ % EE"I rct|dk(r(|dr#tjj|dyt|dkDr)|dr#tjj|dyyy)z^statements : statement | statements statement | empty rN)rmrappendps r p_statementsrCsY  1v{qt !A$ Q!! !A$rc|d|d<y)zstatement : interface | template | obj_perm_set | policy | policy_module_stmt | module_stmt rrNrrs r p_statementrM Q4AaDrcy)zempty :Nrrs rp_emptyrWrcltj}|d|_|d|_d|_||d<y)zHpolicy_module_stmt : POLICY_MODULE OPAREN IDENTIFIER COMMA NUMBER CPARENTrNrModuleDeclarationnameversionrrs rp_policy_module_stmtrbs6##%A qTAF!AIAK AaDrc\tj|d}t|d|||d<y)zainterface : INTERFACE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN rN)r Interfacerrxs r p_interfacerjs/ AaD!A AaD! AaDrc\tj|d}t|d|||d<y)ztemplate : TEMPLATE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN | DEFINE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN rrrN)rTemplaterrs r p_templaterqs/ 1Q4 A AaD! AaDrcd|d<y)z4define : DEFINE OPAREN TICK IDENTIFIER SQUOTE CPARENNrrrs rp_definerys AaDrct|dk(r|dr |d|d<yt|dkDr1|ds|dr |d|d<yy|ds |d|d<y|d|dz|d<yy)zlinterface_stmts : policy | interface_stmts policy | empty rrrNrrs rp_interface_stmtsrs{  1v{qtt! Q!ttt!1Q4AaDQ4!A$;AaD rctj}t|d|dt|dkDrt|d|d|g|d<y) zoptional_policy : OPT_POLICY OPAREN TICK interface_stmts SQUOTE CPAREN | OPT_POLICY OPAREN TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN rTrrFrN)rOptionalPolicyrr)ros rp_optional_policyrsH   "A AaD! 1vz!aU# 3AaDrctj}|d|_t|d|dt |dkDrt|d|d|g|d<y ) ztunable_policy : TUNABLE_POLICY OPAREN TICK cond_expr SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN | TUNABLE_POLICY OPAREN TICK cond_expr SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN rrTr FrN)r TunablePolicy cond_exprrrrs rp_tunable_policyrsS !AA$AK AaD! 1v{"qe$ 3AaDrc<t|dk(r |d|d<yd|d<y)zifelse_compare_value : TICK IDENTIFIER SQUOTE | TICK TRUE SQUOTE | TICK FALSE SQUOTE | TICK SQUOTE | empty rrrNrrs rp_ifelse_compare_valuers% 1v{t!!rcbtj|d}t|d|d|g|d<y)ziifelse_section : TICK IDENTIFIER SQUOTE COMMA ifelse_compare_value COMMA TICK interface_stmts SQUOTE rrTrrNrIfElserrs rp_ifelse_sectionrs3 1A AaD! 3AaDrcNt|dk(r|d|dz|d<y|d|d<y)zcifelse_sections : ifelse_sections COMMA ifelse_section | ifelse_section rrrrNrrs rp_ifelse_sectionsrs1 1v{tad{!t!rctj|d}t|d|dt|d|d|g|d<y)zbifelse : IFELSE OPAREN ifelse_sections COMMA TICK interface_stmts SQUOTE CPAREN optional_semi rTrFrNrrs rp_ifelsersC 1A AaD! AaD! 3AaDrctj|d}|ddk(rd}nd}t|d||t|dkDrt|d|d|g|d <y ) aJifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi rrrTFrrrrN)rIfDefrr)rrvs rp_ifdefrsa !Atw   AaD! 1v{"qe$ 3AaDrctj|d}t|dkDr|jj |d||d<y)zinterface_call : IDENTIFIER OPAREN interface_call_param_list CPAREN | IDENTIFIER OPAREN CPAREN | IDENTIFIER OPAREN interface_call_param_list CPAREN SEMIr)ifnamerrrN)r InterfaceCallrargsextend)ris rp_interface_callrs@ qt,A 1vz  ad AaDrct|dk(r |d|d<yt|dk(r d|dz|d<y|dd|dzg|d<y)a0interface_call_param : IDENTIFIER | IDENTIFIER MINUS IDENTIFIER | MINUS IDENTIFIER | nested_id_set | TRUE | FALSE | quoted_filename rrrr-Nrrs rp_interface_call_paramrsR 1v{t! Q1QqTz!!cAaDj!!rcRt|dk(r |dg|d<y|d|dgz|d<y)zinterface_call_param_list : interface_call_param | interface_call_param_list COMMA interface_call_param rrrrNrrs rp_interface_call_param_listrs5 1v{!v!tqtf}!rcRtj|d}|d|_||d<y)zRobj_perm_set : DEFINE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK names SQUOTE CPARENrrrN)r ObjPermSetpermsrrs rp_obj_perm_setr s*QqT"AdAG AaDrc|d|d<y)zpolicy : policy_stmt | optional_policy | tunable_policy | ifdef | ifelse | conditional rrNrrs rp_policyrrrc"|dr |dg|d<yy)apolicy_stmt : gen_require | avrule_def | typerule_def | typebound_def | typeattribute_def | roleattribute_def | interface_call | role_def | role_allow | permissive | type_def | typealias_def | attribute_def | attribute_role_def | range_transition_def | role_transition_def | bool | gen_tunable | define | initial_sid | genfscon | fs_use | portcon | nodecon | netifcon | pirqcon | iomemcon | ioportcon | pcidevicecon | devicetreecon rrNrrs r p_policy_stmtrs @ t!v! rcltj}|d|_|d|_d|_||d<y)z+module_stmt : MODULE IDENTIFIER NUMBER SEMIrrFrNrrs r p_module_stmtr5s6##%A qTAF!AIAK AaDrcy)zlgen_require : GEN_REQ OPAREN TICK requires SQUOTE CPAREN | REQUIRE OBRACE requires CBRACENrrs r p_gen_requirer=s  rcy)zrequires : require | requires require | ifdef | requires ifdef | ifelse | requires ifelse Nrrs r p_requiresrE rcy)zrequire : TYPE comma_list SEMI | ROLE comma_list SEMI | ATTRIBUTE comma_list SEMI | ATTRIBUTE_ROLE comma_list SEMI | CLASS comma_list SEMI | BOOL comma_list SEMI Nrrs r p_requirerOrrctj}|d|_|d|_|d|_t |dkDr |d|_||d<y)zsecurity_context : IDENTIFIER COLON IDENTIFIER COLON IDENTIFIER | IDENTIFIER COLON IDENTIFIER COLON IDENTIFIER COLON mls_range_defrrrrrrN)rSecurityContextuserrprfrlevelr s rp_security_contextrYsR !!#A qTAF qTAF qTAF 1vzA$ AaDrc,|d}|d|_||d<y)zQgen_context : GEN_CONTEXT OPAREN security_context COMMA mls_range_def CPAREN rrrN)rr s r p_gen_contextr!fs! !AdAG AaDrc|d|d<y)ztj|d}||d<y)z)attribute_def : ATTRIBUTE IDENTIFIER SEMIrrN)r Attributeras rp_attribute_defrmsAaD!A AaDrc>tj|d}||d<y)z3attribute_role_def : ATTRIBUTE_ROLE IDENTIFIER SEMIrrN)rAttribute_Rolerks rp_attribute_role_defrps  1&A AaDrc^tj}|d|_|d|_||d<y)z5typealias_def : TYPEALIAS IDENTIFIER ALIAS names SEMIrrrN)r TypeAliasrfrfrgs rp_typealias_defrss/A qTAF!AI AaDrctj}|d|_t|dkDr|jj |d||d<y)zWrole_def : ROLE IDENTIFIER TYPES comma_list SEMI | ROLE IDENTIFIER SEMIrrrN)rRolerprrqrrrs r p_role_defrx&sC A qTAF 1vz qt AaDrc^tj}|d|_|d|_||d<y)z#role_allow : ALLOW names names SEMIrrrN)r RoleAllow src_roles tgt_rolesrvs r p_role_allowr}/s/AA$AKA$AK AaDrcy)z"permissive : PERMISSIVE names SEMINrrs r p_permissiver6rrcttj}|ddk(r tjj|_nO|ddk(r tjj|_n'|ddk(rtjj |_|d|_|d|_|d|_|d|_ ||d <y ) zavrule_def : ALLOW names names COLON names names SEMI | DONTAUDIT names names COLON names names SEMI | AUDITALLOW names names COLON names names SEMI | NEVERALLOW names names COLON names names SEMI rrsrtrurrrrrN) rAVRuler> rule_typer?r@ src_types tgt_types obj_classesr rks r p_avrule_defr:s At{&&00 1 &&11 1 &&11 A$AKA$AKaDAMdAG AaDrc8tj}|ddk(r tjj|_n'|ddk(rtjj|_|d|_|d|_|d|_|d|_|d|_ ||d <y ) atyperule_def : TYPE_TRANSITION names names COLON names IDENTIFIER SEMI | TYPE_TRANSITION names names COLON names IDENTIFIER FILENAME SEMI | TYPE_TRANSITION names names COLON names IDENTIFIER IDENTIFIER SEMI | TYPE_CHANGE names names COLON names IDENTIFIER SEMI | TYPE_MEMBER names names COLON names IDENTIFIER SEMI rryrzrrrrrrN) rTypeRulerDrrErrr dest_type file_namergs rp_typerule_defrMs At}((44 1 ((44 A$AKA$AKaDAMA$AKA$AK AaDrctj}|d|_|jj |d||d<y)z5typebound_def : TYPEBOUNDS IDENTIFIER comma_list SEMIrrrN)r TypeBoundrfrrrgs rp_typebound_defr`s:A qTAFKKqt AaDrcxtj}|d|_|ddk(rd|_nd|_||d<y)zIbool : BOOL IDENTIFIER TRUE SEMI | BOOL IDENTIFIER FALSE SEMIrrrlTFrN)rBoolrstate)rbs rp_boolrgs= A qTAFtv~ AaDrctj}t|dk(rd}d}nd}d}|||_||dk(rd|_nd|_||d<y ) a&gen_tunable : GEN_TUNABLE OPAREN IDENTIFIER COMMA TRUE CPAREN | GEN_TUNABLE OPAREN IDENTIFIER COMMA FALSE CPAREN | GEN_TUNABLE OPAREN TICK IDENTIFIER SQUOTE COMMA TRUE CPAREN | GEN_TUNABLE OPAREN TICK IDENTIFIER SQUOTE COMMA FALSE CPARENrrrrrlTFrN)rrrrr)rrid_pos state_poss r p_gen_tunablerrs] A 1v{  vYAF|v AaDrctj}|d|_t|d|dt |dkDrt|d|d|g|d<y ) z conditional : IF OPAREN cond_expr CPAREN OBRACE interface_stmts CBRACE | IF OPAREN cond_expr CPAREN OBRACE interface_stmts CBRACE ELSE OBRACE interface_stmts CBRACE rrTrr FrN)r Conditionalrrrr:s r p_conditionalrsS AA$AK AaD! 1vz"qe$ 3AaDrctj}|d|_|jj |d||d<y)zR>R>TTUsA B#*BBc g}d}tj|D]\}}}|D]}tjj|}tjj ||}|ddk(rB|dk(r|}Rt t jd|dsu|j|d|f|ddk(s|j|d|f||fS)Nrz.sptzobj_perm_sets.sptpatternsrz.if) oswalkr,splitextrarrefindallr) rootmodulessupport_macrosdirpathdirnames filenamesrmodnamefilenames r list_headersrEsGN(* $9Dgg&&t,Gww||GT2HqzV#..%-NJ ;<NNGAJ#9:u$ H56)6 ^ $$rcddlm}tj}g}d}tj j |rtj j|d}|dk(rtd|ztj j|} |j| d|fttj\} }nt|\}}|r |s tdfddfd } d} |rd |ztj} | || |jj| tj d } t#j$gd }| jjtj&||jj| d r=s;|j)t*j,t/| }|j1dg}|D]n}tj2}|d|_ |r| |d|| n | |d||jj|s\r_j9pt/|rddj;|z|S#t$r2}t7|dz|j|dYd}~d}~wwxYw)Nr)utilrzInvalid file name %srz1could not find support macros (obj_perm_sets.spt)c.rj|yyr)write)routputs rrzparse_headers..ons  LL  rc r d|z t|}|j}|j|at |||y#t $r }Yd}~yd}~wt $r}t d|dt|d}~wwxYw)Nzparsing file %s zerror parsing file z: )openreadcloserrIOErrorrr)r4rSrfdtxtrrrs rrz!parse_headers..parse_filers|  !A% & HaB'')C HHJJ #vsE *   HAs1vFG G Hs;A B B&BBzParsing support macros (%s): can_exec) z$1z$2fileexecute_no_transrrgetattrlockexecuteioctlzdone. )stepszParsing interface filesrz!failed to parse some headers: %s z, r)rrrHeadersrr,isfilesplitrrrrrheadersrrrr AccessVectorrConsoleProgressBarsysstdoutrr?rrrstepra)rrrrrrrrrr all_modulesrrravstatusfailuresrrrrs ` ` @r parse_headersrYsm!GGN ww~~dww}}T"1% 2:3d:; ;''""4( D)*&283C3C3E&F# ^".t"4 nLMM H C )N :;%%'>3'$ &&z2  "FG   !1!1"!56) )  e((3w<(H ./H     1 1Q4C(1Q4# " % KKM" 8} .81D DE N  c!ftm  OOAaD !  sJ K(K  Kr)NNF)NTF){rrrrrrrrrrtokensrt_TICKt_SQUOTEt_OBRACEt_CBRACEt_SEMIt_COLONt_OPARENt_CPARENt_COMMAt_MINUSt_TILDE t_ASTERISKt_AMPt_BARt_EXPLt_EQUALt_NUMBERt_PATHt_ignorerrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr rrrrrrrr!r#r(r.r5r<rCrHrLrPrTrXr[r]rbrhrmrprsrxr}rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr$s@ V t?  x? o?  ?   E ? ? ^? ^? M?  ?  ? ?  ? ?  +!? "^#? $o%? ( g)? ,o-? .o/? 0 V1? 2+3? 4'5? 6 g7? 8+9? < V=? > V?? @ gA? B 4C? D VE? H VI? J gK? N gO? P+Q? R