policy-parser

#!/usr/bin/env python

import sys, getopt, re, os

"""
================================================================================
=
=   This file is part of seorigin
=  Copyright (C) 2012  Devan Franchini, Anthony G. Basile, Sven Vermeulen
=
=  seorigin is free software: you can redistribute it and/or modify
=  it under the terms of the GNU General Public License as published by
=  the Free Software Foundation, either version 3 of the License, or
=
=  seorigin is distributed in the hope that it will be useful,
=  but WITHOUT ANY WARRANTY; without even the implied warranty of
=  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
=  GNU General Public License for more details.
=
=  You should have received a copy of the GNU General Public License
=  along with seorigin.  If not, see <http://www.gnu.org/licenses/>.
=
=  ----
= policy-parser.py is the parsing component of seorigin, the SELinux Policy originator.
=
= Purpose:
= The parser takes the m4 marco expansion of SELinux policies and parses it into a suitable and
= useful manner for the workflow component of the policy originator to database.
= 
= See README for more information.
=
================================================================================
"""

"""
usage() is printed out in 2 cases:
1.) The -h flag is set in the execution of the script.
2.) There is an exception caught.
"""
def usage():
    print("Proper usage:\npolicy-parser -i(--input) [file to parse] -o(--output) [parsed file location]")
    sys.exit(0)

"""
parse_cmd_agrs() sets up the -i -o and -h flags for the policy-parser script. See usage for what each flag is.
"""
def parse_cmd_args():
    shortOpts = 'i:o:h'
    longOpts = ['input=','output=','help']

    opts, extraparams = getopt.getopt(sys.argv[1:], shortOpts, longOpts)
    
    inputCheck = False    # Boolean check to see if input location has been set.
    outputCheck = False   # Boolean check to see if output location has been set.
    defOutFile = os.path.join(os.environ["PWD"],'parsed_output.txt') # Default output location.

    #Set up arguement flags for script execution.
    for o, p in opts:
        if o in ['-i', '--input']:
            if os.path.exists(p):
                inputFile=p
                if not os.access(p, os.R_OK):
                    print("\nFile %s does not have read permissions!\n" % p)
                    sys.exit()
            else:
                print("\nFile %s does not exist!\nPlease specify new input file.\n" % p)
            inputCheck = True
        elif o in ['-o', '--output']:
            outputFile=p
            outputCheck= True
        elif o in ['-h', '--help']:
            usage()

# Sanity check to make sure the parsed information is getting written to some location.
    if not inputCheck and outputCheck:
        print ("\nInput location not specified, please specify input file or\ndefault to debug.log located in:")
        print ("refpolicy/debug.log")
        sys.exit()
    if not outputCheck and inputCheck:
        print ("\nOutput location not specified, please specify output file.")
        sys.exit()
    if not outputCheck and not inputCheck:
        print("\nInput file and output file both not specified. Please specify files.")
        sys.exit() 
    return( inputFile, outputFile )


"""
readInput( inputFile ) reads in the specified file. If a file does not exist it will shoot an exception and print out
usage().
"""
def readInput( inputFile ):
    try:
        f=open(inputFile, 'r') # This creates the function for opening the file, and assigns it to f.
    except Exception as err:
        print("\n\n Error: {0}".format(err),"\n\n")
        usage()
        
    fileLines = f.readlines()
    f.close()

    return fileLines
 
""" 
parseFile( lines ) the lines specified of raw SELinux m4 macro expansions and puts them into Source, & Definition records.
For our intents and purposes we'll be parsing entire input files.
"""
def parseFile( lines ):
    output = ''
    sourceCount = 0
    definitionCount = 0
    oldLine = 1208845
    multiLineCheck = False
    definitionLine = False
    gen_requireCheck = False
    sptMultiLineCheck = False
    for line in lines:
# Beginning of source record parsing.
        # Parse only if we have a .te line
        if re.search('\.te:', line):
            multiLineCheck = False
            line = re.sub('dnl.*$', '', line)    # Remove macro comments
            line = re.sub('\m4trace:','', line)
            line = re.sub(': \-\d+\-', '', line)
            # Take line and break the parts after the file location into the source expression
            sourceExpression = re.sub('^.*\d+ ', '',line)
            sourceExpression = re.sub('^policy.*$', '', sourceExpression)
            sourceExpression = re.sub('[ififn]def.*$', '', sourceExpression)
            sourceExpression = re.sub('ifelse.*$', '', sourceExpression)
            sourceExpression = re.sub('pushdef.*$', '', sourceExpression)
            sourceExpression = re.sub('popdef.*$', '', sourceExpression)
            sourceExpression = re.sub('^optional_policy.*', '', sourceExpression)
            sourceExpression = re.sub('^incr\(.*$', '', sourceExpression)
            sourceExpression = re.sub('gen_require.*$', '', sourceExpression) 
            sourceExpression = re.sub('gen_tunable.*$', '', sourceExpression) # gen_tunable omitted from source records
            sourceExpression = re.sub('incr\(\d+\)->\d+', '', sourceExpression)
            sourceExpression = re.sub('\->.*$', '', sourceExpression)
            sourceExpression = re.sub('_perms.*$', '', sourceExpression) 
            sourceExpression = re.sub('^.*regexp.*$', '', sourceExpression)
            sourceExpression = re.sub('^i$', '', sourceExpression)
            sourceExpression = re.sub('^if$', '', sourceExpression)
            sourceExpression = re.sub('\n', '', sourceExpression)
            sourceCall = re.sub('\(.*$', '', sourceExpression)
            sourceCallArgs = re.sub('^.*\(', '(', sourceExpression)
            # Greedily remove everything after line number and turn it into our source location
            sourceLocation = re.sub('\s+.*$', '', line)
            sourceLineNum = re.sub('\s+.*$', '', line)
            sourceLineNum = re.sub('\w+/', '', sourceLineNum) 
            sourceLineNum = re.sub('\w+\.te:', '', sourceLineNum)
            if re.search('^\w*$', sourceExpression):       # Skip lines that are all white space
                continue
            if re.search('^\w*$', line):
                continue
            if re.search('^\w*$', sourceLocation):
                continue
            if re.search(sourceLineNum, sourceLocation):
                currentLine = sourceLineNum
                if currentLine == oldLine:
                    continue
                else:
                    oldLine = currentLine
            if not re.search('tunable_policy', line):
                sourceLocation = re.sub(':\d+', '', sourceLocation)
                sourceCount += 1
                output += "\n"
                output += "## source record "
                output += str(sourceCount)  
                output += "\n"
                output += "# " + sourceLocation
                output += "\n"
                output += "# line: " + sourceLineNum
                output += "\n"
                output += sourceCall + sourceCallArgs
                output += "\n"
# End of the source record parsing. Beginning of the definition record parsing.
        # Parse out only if we have an "all_interfaces.conf:" line
        if re.search('\m4trace:tmp/all_interfaces.conf:', line):
            multiLineCheck = True 
            definitionCall = re.sub('^.*\- ', '', line)
            definitionCall = re.sub('dnl.*$', '', definitionCall)
            definitionCall = re.sub('divert\(-1\)','', definitionCall)
            definitionCall = re.sub('define\(','', definitionCall)
            definitionCall = re.sub(',', '', definitionCall)
            if re.search('^\w*$', definitionCall):
                continue

            # Skips any popdef() lines
            if re.search('popdef', line):
                multiLineCheck = False
        if multiLineCheck:
            # Bypasses any .fc files.
            if re.search('\.fc:.*$', line):
                continue
            definition = re.sub('\#.*$', '', line)
            definition = re.sub('^.*\d+\- ', '', definition)
            definition = re.sub('divert\(-1\)','', definition)
            definition = re.sub('[ififn]def.*$', '', definition)
            definition = re.sub('^.dnl*.$', '', definition)
            definition = re.sub('pushdef.*$', '', definition)
            definition = re.sub('popdef.*$', '', definition)
            definition = re.sub('tunable_policy.*', '', definition)
            definition = re.sub('optional_policy.*', '', definition)
            definition = re.sub('gen_tunable.*$', '', definition) # gen_tunable is omitted from all_interfaces.conf
            definition = re.sub('refpolicywarn.*$', '', definition)
            definition = re.sub('policy_m4_comment.*$', '', definition)
            if re.search('gen_require\(\`.*$', definition):
                gen_requireCheck = True
            elif re.search('^\t\w', definition):
                gen_requireCheck = False
            if gen_requireCheck:
                definition = re.sub('.*$', '', definition)
            definition = re.sub('\n', '', definition)
            definition = re.sub('\t', '', definition)
            definition = re.sub('^\)', '', definition)
            definition = re.sub('^\'\).*$', '', definition)
            if re.search('^\w*$', definition):
                continue

            if re.search('^define', definition):
                definitionLine = True
            else:
                definitionLine = False
            if definitionLine:
                definitionCount += 1
                output += "\n"
                output += "## definition record "
                output += str(definitionCount)
                output += "\n"
                output += "# " + definitionCall
            definition = re.sub('^define\(.*$', '', definition)
            if re.search('^\w*$', definition):
                continue

            output += definition
            output += '\n'
        if re.search('\.spt:', line):
            
            line = re.sub('^.*\- ', '', line)
            # SDC = .spt definition call
            SDC = re.sub('define\(', '', line)
            SDC = re.sub(',.*$', '', SDC)
            SDC = re.sub('\n', '', SDC)
            if re.search('.*_pattern', SDC):
                sptMultiLineCheck = True
            elif re.search('.*_perms', SDC):
                sptMultiLineCheck = True
            else:
                sptMultiLineCheck = False
        if sptMultiLineCheck:
            if re.search('\.fc:.*$', line):
                line = re.sub('\n', '', line)
                continue
            if re.search('\.m4.*$', line):
                continue

            if re.search('^define', line):
            # SDL = spt Definition Line
                SDL = True
            else:
                SDL = False
            sptDefinition = re.sub('\}\)', '}', line)
            sptDefinition = re.sub(' \)$', '', sptDefinition)
            sptDefinition = re.sub('^\)', '', sptDefinition)
            sptDefinition = re.sub(SDC + '\, ', '', sptDefinition)
            if re.search('gen_require\(\`.*$', sptDefinition):
                gen_requireCheck = True
            elif re.search('^\t\w', sptDefinition):
                gen_requireCheck = False
            if gen_requireCheck:
               sptDefinition = re.sub('.*$', '', sptDefinition)
            sptDefinition = re.sub('^\)', '', sptDefinition)
            sptDefinition = re.sub('/.*$', '', sptDefinition)
            if re.search('^\w*$', line):
                continue
            if SDL:
                definitionCount += 1
                output += '\n'
                output += "## definition record "
                output += str(definitionCount) 
                output += "\n"
                output += "# " + SDC
            sptDefinition = re.sub('^\s+', '', sptDefinition)
            sptDefinition = re.sub('\n', '', sptDefinition)
            sptDefinition = re.sub('^define\(', '', sptDefinition)
            if re.search('^\{.*$', sptDefinition ):
               output += '\n' 
               output += sptDefinition
               output += '\n\n'
            else:
               output += sptDefinition
               output += '\n'
    return output

"""
writeOut( outputFile, output) writes output to the file we want to have it outputted to.
"""
def writeOut( outputFile, output ):
    try:
        parsedOut = open(outputFile, 'w') # This assigns a new file to parsedOut
    except Exception as err:
        print("\nwriteOut() Error: {0}".format(err),"\n\n")
        usage()

    parsedOut.write(output)
    parsedOut.close()

"""
main(), this is where the magic happens.
"""
def main():
    print("Policy-parser v1.4.3: ")
    (inputFile, outputFile) = parse_cmd_args()
    lines = readInput( inputFile )
    output = parseFile( lines )
    writeOut( outputFile, output )
    print("Policy parsing complete! Enjoy :)\n")

"""
The main function is run below.
"""
if __name__ == "__main__":
    main()