diff --git selinux-python-2.8/Makefile selinux-python-2.8/Makefile

index 80bc124..891bdee 100644

--- selinux-python-2.8/Makefile

+++ selinux-python-2.8/Makefile

@@ -1,4 +1,4 @@

-SUBDIRS = sepolicy audit2allow semanage sepolgen chcat

+SUBDIRS = sepolicy audit2allow semanage sepolgen chcat po

 all install relabel clean indent:

 	@for subdir in $(SUBDIRS); do \

diff --git selinux-python-2.8/audit2allow/audit2allow selinux-python-2.8/audit2allow/audit2allow

index 37ab23a..195f151 100644

--- selinux-python-2.8/audit2allow/audit2allow

+++ selinux-python-2.8/audit2allow/audit2allow

@@ -86,6 +86,8 @@ class AuditToPolicy:

                           dest="type")

         parser.add_option("--perm-map", dest="perm_map", help="file name of perm map")

         parser.add_option("--interface-info", dest="interface_info", help="file name of interface information")

+        parser.add_option("-x", "--xperms", action="store_true", dest="xperms",

+                          default=False, help="generate extended permission rules")

         parser.add_option("--debug", dest="debug", action="store_true", default=False,

                           help="leave generated modules for -M")

         parser.add_option("-w", "--why", dest="audit2why", action="store_true", default=(os.path.basename(sys.argv[0]) == "audit2why"),

@@ -314,6 +316,10 @@ class AuditToPolicy:

             ifs, perm_maps = self.__load_interface_info()

             g.set_gen_refpol(ifs, perm_maps)

+        # Extended permissions

+        if self.__options.xperms:

+            g.set_gen_xperms(True)

+

         # Explanation

         if self.__options.verbose:

             g.set_gen_explain(policygen.SHORT_EXPLANATION)

diff --git selinux-python-2.8/audit2allow/audit2allow.1 selinux-python-2.8/audit2allow/audit2allow.1

index 21d286b..c61067b 100644

--- selinux-python-2.8/audit2allow/audit2allow.1

+++ selinux-python-2.8/audit2allow/audit2allow.1

@@ -85,6 +85,9 @@ This is the default behavior.

 Generate reference policy using installed macros.

 This attempts to match denials against interfaces and may be inaccurate.

 .TP

+.B "\-x" | "\-\-xperms"

+Generate extended permission access vector rules

+.TP

 .B "\-w" | "\-\-why"

 Translates SELinux audit messages into a description of why the access was denied

diff --git selinux-python-2.8/audit2allow/test.log selinux-python-2.8/audit2allow/test.log

index 05249dc..718aca7 100644

--- selinux-python-2.8/audit2allow/test.log

+++ selinux-python-2.8/audit2allow/test.log

@@ -34,3 +34,4 @@ node=mary.example.com type=AVC msg=audit(1166023021.373:910): avc:  denied  { re

 node=lilly.example.com type=AVC_PATH msg=audit(1164783469.561:109):  path="/linuxtest/LVT/lvt/log.current"

 node=lilly.example.com type=SYSCALL msg=audit(1164783469.561:109): arch=14 syscall=11 success=yes exit=0 a0=10120520 a1=10120a78 a2=10120970 a3=118 items=0 ppid=8310 pid=8311 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="smbd" exe="/usr/sbin/smbd" subj=root:system_r:smbd_t:s0 key=(null)

 node=lilly.example.com type=AVC msg=audit(1164783469.561:109): avc:  denied  { append } for  pid=8311 comm="smbd" name="log.current" dev=dm-0 ino=130930 scontext=root:system_r:smbd_t:s0 tcontext=root:object_r:default_t:s0 tclass=dir

+node=lilly.example.com type=AVC msg=audit(1164783469.561:109): avc:  denied  { ioctl } for  pid=8311 comm="smbd" name="log.current" ioctlcmd=0x2a scontext=root:system_r:smbd_t:s0 tcontext=root:object_r:default_t:s0 tclass=tcp_socket

diff --git selinux-python-2.8/audit2allow/test_audit2allow.py selinux-python-2.8/audit2allow/test_audit2allow.py

index a826a9f..4427dea 100644

--- selinux-python-2.8/audit2allow/test_audit2allow.py

+++ selinux-python-2.8/audit2allow/test_audit2allow.py

@@ -47,5 +47,14 @@ class Audit2allowTests(unittest.TestCase):

             print(out, err)

         self.assertSuccess("audit2why", p.returncode, err)

+    def test_xperms(self):

+        "Verify that xperms generation works"

+        p = Popen(['python', './audit2allow', "-x", "-i", "test.log"], stdout=PIPE)

+        out, err = p.communicate()

+        if err:

+            print(out, err)

+        self.assertTrue(b"allowxperm" in out)

+        self.assertSuccess("xperms", p.returncode, err)

+

 if __name__ == "__main__":

     unittest.main()

diff --git selinux-python-2.8/chcat/chcat selinux-python-2.8/chcat/chcat

index 4bd9fc6..edfe571 100755

--- selinux-python-2.8/chcat/chcat

+++ selinux-python-2.8/chcat/chcat

@@ -34,7 +34,7 @@ import getopt

 import selinux

 import seobject

-PROGNAME = "policycoreutils"

+PROGNAME = "selinux-python"

 try:

     import gettext

     kwargs = {}

diff --git selinux-python-2.8/po/Makefile selinux-python-2.8/po/Makefile

new file mode 100644

index 0000000..4e052d5

--- /dev/null

+++ selinux-python-2.8/po/Makefile

@@ -0,0 +1,83 @@

+#

+# Makefile for the PO files (translation) catalog

+#

+

+PREFIX ?= /usr

+

+# What is this package?

+NLSPACKAGE	= python

+POTFILE		= $(NLSPACKAGE).pot

+INSTALL		= /usr/bin/install -c -p

+INSTALL_DATA	= $(INSTALL) -m 644

+INSTALL_DIR	= /usr/bin/install -d

+

+# destination directory

+INSTALL_NLS_DIR = $(PREFIX)/share/locale

+

+# PO catalog handling

+MSGMERGE	= msgmerge

+MSGMERGE_FLAGS	= -q

+XGETTEXT	= xgettext --default-domain=$(NLSPACKAGE)

+MSGFMT		= msgfmt

+

+# All possible linguas

+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po)))

+

+# Only the files matching what the user has set in LINGUAS

+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS))

+

+# if no valid LINGUAS, build all languages

+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))

+

+POFILES		= $(patsubst %,%.po,$(USE_LINGUAS))

+MOFILES		= $(patsubst %.po,%.mo,$(POFILES))

+POTFILES  = $(shell cat POTFILES)

+

+#default:: clean

+

+all::  $(MOFILES)

+

+$(POTFILE): $(POTFILES) 

+	$(XGETTEXT) -L Python --keyword=_ --keyword=N_ $(POTFILES)

+	$(XGETTEXT) -j --keyword=_ --keyword=N_ ../sepolicy/sepolicy/sepolicy.glade

+	@if cmp -s $(NLSPACKAGE).po $(POTFILE); then \

+	    rm -f $(NLSPACKAGE).po; \

+	else \

+	    mv -f $(NLSPACKAGE).po $(POTFILE); \

+	fi; \

+

+

+refresh-po: Makefile

+	for cat in $(POFILES); do \

+		lang=`basename $$cat .po`; \

+		if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \

+			mv -f $$lang.pot $$lang.po ; \

+			echo "$(MSGMERGE) of $$lang succeeded" ; \

+		else \

+			echo "$(MSGMERGE) of $$lang failed" ; \

+			rm -f $$lang.pot ; \

+		fi \

+	done

+

+clean:

+	@rm -fv *mo *~ .depend

+	@rm -rf tmp

+

+install: $(MOFILES)

+	@for n in $(MOFILES); do \

+	    l=`basename $$n .mo`; \

+	    $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \

+	    $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \

+	done

+

+%.mo: %.po

+	$(MSGFMT) -o $@ $<

+report:

+	@for cat in $(wildcard *.po); do \

+                echo -n "$$cat: "; \

+                msgfmt -v --statistics -o /dev/null $$cat; \

+        done

+

+.PHONY: missing depend

+

+relabel:

diff --git selinux-python-2.8/po/POTFILES selinux-python-2.8/po/POTFILES

new file mode 100644

index 0000000..128eb87

--- /dev/null

+++ selinux-python-2.8/po/POTFILES

@@ -0,0 +1,10 @@

+../audit2allow/audit2allow

+../chcat/chcat

+../semanage/semanage

+../semanage/seobject.py

+../sepolgen/src/sepolgen/interfaces.py

+../sepolicy/sepolicy/generate.py

+../sepolicy/sepolicy/gui.py

+../sepolicy/sepolicy/__init__.py

+../sepolicy/sepolicy/interface.py

+../sepolicy/sepolicy.py

diff --git selinux-python-2.8/semanage/semanage selinux-python-2.8/semanage/semanage

index 8d8a086..8fd9395 100644

--- selinux-python-2.8/semanage/semanage

+++ selinux-python-2.8/semanage/semanage

@@ -27,7 +27,7 @@ import traceback

 import argparse

 import seobject

 import sys

-PROGNAME = "policycoreutils"

+PROGNAME = "selinux-python"

 try:

     import gettext

     kwargs = {}

diff --git selinux-python-2.8/semanage/semanage.8 selinux-python-2.8/semanage/semanage.8

index 0bdb90f..0cdcfcc 100644

--- selinux-python-2.8/semanage/semanage.8

+++ selinux-python-2.8/semanage/semanage.8

@@ -57,9 +57,8 @@ to SELinux user identities (which controls the initial security context

 assigned to Linux users when they login and bounds their authorized role set)

 as well as security context mappings for various kinds of objects, such

 as network ports, interfaces, infiniband pkeys and endports, and nodes (hosts)

-as well as the file context mapping. See the EXAMPLES section below for some

-examples of common usage.  Note that the semanage login command deals with the

-mapping from Linux usernames (logins) to SELinux user identities,

+as well as the file context mapping. Note that the semanage login command deals

+with the mapping from Linux usernames (logins) to SELinux user identities,

 while the semanage user command deals with the mapping from SELinux

 user identities to authorized role sets.  In most cases, only the

 former mapping needs to be adjusted by the administrator; the latter

diff --git selinux-python-2.8/semanage/seobject.py selinux-python-2.8/semanage/seobject.py

index c76dce8..26f3376 100644

--- selinux-python-2.8/semanage/seobject.py

+++ selinux-python-2.8/semanage/seobject.py

@@ -30,7 +30,7 @@ import sys

 import stat

 import socket

 from semanage import *

-PROGNAME = "policycoreutils"

+PROGNAME = "selinux-python"

 import sepolicy

 import setools

 from IPy import IP

@@ -101,6 +101,8 @@ ftype_to_audit = {"": "any",

 try:

     import audit

+    #test if audit module is enabled

+    audit.audit_close(audit.audit_open())

     class logger:

@@ -138,7 +140,7 @@ try:

             self.log_list = []

             self.log_change_list = []

-except:

+except (OSError, ImportError):

     class logger:

         def __init__(self):

@@ -593,7 +595,6 @@ class loginRecords(semanageRecords):

         semanage_seuser_key_free(k)

         semanage_seuser_free(u)

-        self.mylog.log("login", name, sename=sename, serange=serange, serole=",".join(serole), oldserole=",".join(oldserole), oldsename=self.oldsename, oldserange=self.oldserange)

     def add(self, name, sename, serange):

         try:

@@ -601,7 +602,6 @@ class loginRecords(semanageRecords):

             self.__add(name, sename, serange)

             self.commit()

         except ValueError as error:

-            self.mylog.commit(0)

             raise error

     def __modify(self, name, sename="", serange=""):

@@ -653,7 +653,6 @@ class loginRecords(semanageRecords):

         semanage_seuser_key_free(k)

         semanage_seuser_free(u)

-        self.mylog.log("login", name, sename=self.sename, serange=self.serange, serole=",".join(serole), oldserole=",".join(oldserole), oldsename=self.oldsename, oldserange=self.oldserange)

     def modify(self, name, sename="", serange=""):

         try:

@@ -661,7 +660,6 @@ class loginRecords(semanageRecords):

             self.__modify(name, sename, serange)

             self.commit()

         except ValueError as error:

-            self.mylog.commit(0)

             raise error

     def __delete(self, name):

@@ -694,8 +692,6 @@ class loginRecords(semanageRecords):

         rec, self.sename, self.serange = selinux.getseuserbyname("__default__")

         range, (rc, serole) = userrec.get(self.sename)

-        self.mylog.log_remove("login", name, sename=self.sename, serange=self.serange, serole=",".join(serole), oldserole=",".join(oldserole), oldsename=self.oldsename, oldserange=self.oldserange)

-

     def delete(self, name):

         try:

             self.begin()

@@ -703,7 +699,6 @@ class loginRecords(semanageRecords):

             self.commit()

         except ValueError as error:

-            self.mylog.commit(0)

             raise error

     def deleteall(self):

@@ -717,7 +712,6 @@ class loginRecords(semanageRecords):

                 self.__delete(semanage_seuser_get_name(u))

             self.commit()

         except ValueError as error:

-            self.mylog.commit(0)

             raise error

     def get_all_logins(self):

@@ -1087,7 +1081,7 @@ class portRecords(semanageRecords):

         if type == "":

             raise ValueError(_("Type is required"))

-        if type not in self.valid_types:

+        if sepolicy.get_real_type_name(type) not in self.valid_types:

             raise ValueError(_("Type %s is invalid, must be a port type") % type)

         (k, proto_d, low, high) = self.__genkey(port, proto)

@@ -1151,7 +1145,7 @@ class portRecords(semanageRecords):

             else:

                 raise ValueError(_("Requires setype"))

-        if setype and setype not in self.valid_types:

+        if setype and sepolicy.get_real_type_name(setype) not in self.valid_types:

             raise ValueError(_("Type %s is invalid, must be a port type") % setype)

         (k, proto_d, low, high) = self.__genkey(port, proto)

@@ -1355,7 +1349,7 @@ class ibpkeyRecords(semanageRecords):

         if type == "":

             raise ValueError(_("Type is required"))

-        if type not in self.valid_types:

+        if sepolicy.get_real_type_name(type) not in self.valid_types:

             raise ValueError(_("Type %s is invalid, must be a ibpkey type") % type)

         (k, subnet_prefix, low, high) = self.__genkey(pkey, subnet_prefix)

@@ -1417,7 +1411,7 @@ class ibpkeyRecords(semanageRecords):

             else:

                 raise ValueError(_("Requires setype"))

-        if setype and setype not in self.valid_types:

+        if setype and sepolicy.get_real_type_name(setype) not in self.valid_types:

             raise ValueError(_("Type %s is invalid, must be a ibpkey type") % setype)

         (k, subnet_prefix, low, high) = self.__genkey(pkey, subnet_prefix)

@@ -1603,7 +1597,7 @@ class ibendportRecords(semanageRecords):

         if type == "":

             raise ValueError(_("Type is required"))

-        if type not in self.valid_types:

+        if sepolicy.get_real_type_name(type) not in self.valid_types:

             raise ValueError(_("Type %s is invalid, must be an ibendport type") % type)

         (k, ibendport, port) = self.__genkey(ibendport, ibdev_name)

@@ -1664,7 +1658,7 @@ class ibendportRecords(semanageRecords):

             else:

                 raise ValueError(_("Requires setype"))

-        if setype and setype not in self.valid_types:

+        if setype and sepolicy.get_real_type_name(setype) not in self.valid_types:

             raise ValueError(_("Type %s is invalid, must be an ibendport type") % setype)

         (k, ibdev_name, port) = self.__genkey(ibendport, ibdev_name)

@@ -1853,7 +1847,7 @@ class nodeRecords(semanageRecords):

         if ctype == "":

             raise ValueError(_("SELinux node type is required"))

-        if ctype not in self.valid_types:

+        if sepolicy.get_real_type_name(ctype) not in self.valid_types:

             raise ValueError(_("Type %s is invalid, must be a node type") % ctype)

         (rc, k) = semanage_node_key_create(self.sh, addr, mask, proto)

@@ -1922,7 +1916,7 @@ class nodeRecords(semanageRecords):

         if serange == "" and setype == "":

             raise ValueError(_("Requires setype or serange"))

-        if setype and setype not in self.valid_types:

+        if setype and sepolicy.get_real_type_name(setype) not in self.valid_types:

             raise ValueError(_("Type %s is invalid, must be a node type") % setype)

         (rc, k) = semanage_node_key_create(self.sh, addr, mask, proto)

@@ -2241,7 +2235,6 @@ class fcontextRecords(semanageRecords):

     try:

         valid_types = list(list(sepolicy.info(sepolicy.ATTRIBUTE, "file_type"))[0]["types"])

         valid_types += list(list(sepolicy.info(sepolicy.ATTRIBUTE, "device_node"))[0]["types"])

-        valid_types.append("<<none>>")

     except RuntimeError:

         valid_types = []

@@ -2369,7 +2362,7 @@ class fcontextRecords(semanageRecords):

         if type == "":

             raise ValueError(_("SELinux Type is required"))

-        if type not in self.valid_types:

+        if type != "<<none>>" and sepolicy.get_real_type_name(type) not in self.valid_types:

             raise ValueError(_("Type %s is invalid, must be a file or device type") % type)

         (rc, k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])

@@ -2432,7 +2425,7 @@ class fcontextRecords(semanageRecords):

     def __modify(self, target, setype, ftype, serange, seuser):

         if serange == "" and setype == "" and seuser == "":

             raise ValueError(_("Requires setype, serange or seuser"))

-        if setype and setype not in self.valid_types:

+        if setype not in ["",  "<<none>>"] and sepolicy.get_real_type_name(setype) not in self.valid_types:

             raise ValueError(_("Type %s is invalid, must be a file or device type") % setype)

         self.validate(target)

diff --git selinux-python-2.8/sepolgen/src/sepolgen/access.py selinux-python-2.8/sepolgen/src/sepolgen/access.py

index a5d8698..ba80f93 100644

--- selinux-python-2.8/sepolgen/src/sepolgen/access.py

+++ selinux-python-2.8/sepolgen/src/sepolgen/access.py

@@ -78,6 +78,7 @@ class AccessVector(util.Comparison):

      .obj_class - The object class to which access is allowed. [String or None]

      .perms - The permissions allowed to the object class. [IdSet]

      .audit_msgs - The audit messages that generated this access vector [List of strings]

+     .xperms - Extended permissions attached to the AV. [Dictionary {operation: xperm set}]

     """

     def __init__(self, init_list=None):

         if init_list:

@@ -87,9 +88,11 @@ class AccessVector(util.Comparison):

             self.tgt_type = None

             self.obj_class = None

             self.perms = refpolicy.IdSet()

-            self.audit_msgs = []

-            self.type = audit2why.TERULE

-            self.data = []

+

+        self.audit_msgs = []

+        self.type = audit2why.TERULE

+        self.data = []

+        self.xperms = {}

         # when implementing __eq__ also __hash__ is needed on py2

         # if object is muttable __hash__ should be None

         self.__hash__ = None

@@ -131,6 +134,15 @@ class AccessVector(util.Comparison):

         l.extend(sorted(self.perms))

         return l

+    def merge(self, av):

+        """Add permissions and extended permissions from AV"""

+        self.perms.update(av.perms)

+

+        for op in av.xperms:

+            if op not in self.xperms:

+                self.xperms[op] = refpolicy.XpermSet()

+            self.xperms[op].extend(av.xperms[op])

+

     def __str__(self):

         return self.to_string()

@@ -260,28 +272,28 @@ class AccessVectorSet:

     def add(self, src_type, tgt_type, obj_class, perms, audit_msg=None, avc_type=audit2why.TERULE, data=[]):

         """Add an access vector to the set.

         """

-        tgt = self.src.setdefault(src_type, { })

-        cls = tgt.setdefault(tgt_type, { })

-        

-        if (obj_class, avc_type) in cls:

-            access = cls[obj_class, avc_type]

-        else:

-            access = AccessVector()

-            access.src_type = src_type

-            access.tgt_type = tgt_type

-            access.obj_class = obj_class

-            access.data = data

-            access.type = avc_type

-            cls[obj_class, avc_type] = access

-

-        access.perms.update(perms)

-        if audit_msg:

-            access.audit_msgs.append(audit_msg)

+        av = AccessVector()

+        av.src_type = src_type

+        av.tgt_type = tgt_type

+        av.obj_class = obj_class

+        av.perms = perms

+        av.data = data

+        av.type = avc_type

+

+        self.add_av(av, audit_msg)

     def add_av(self, av, audit_msg=None):

         """Add an access vector to the set."""

-        self.add(av.src_type, av.tgt_type, av.obj_class, av.perms)

+        tgt = self.src.setdefault(av.src_type, { })

+        cls = tgt.setdefault(av.tgt_type, { })

+        if (av.obj_class, av.type) in cls:

+            cls[av.obj_class, av.type].merge(av)

+        else:

+            cls[av.obj_class, av.type] = av

+

+        if audit_msg:

+            cls[av.obj_class, av.type].audit_msgs.append(audit_msg)

 def avs_extract_types(avs):

     types = refpolicy.IdSet()

diff --git selinux-python-2.8/sepolgen/src/sepolgen/audit.py selinux-python-2.8/sepolgen/src/sepolgen/audit.py

index 26ce6c9..daed58c 100644

--- selinux-python-2.8/sepolgen/src/sepolgen/audit.py

+++ selinux-python-2.8/sepolgen/src/sepolgen/audit.py

@@ -152,6 +152,7 @@ class AVCMessage(AuditMessage):

        access - list of accesses that were allowed or denied

        denial - boolean indicating whether this was a denial (True) or granted

           (False) message.

+       ioctlcmd - ioctl 'request' parameter

     An example audit message generated from the audit daemon looks like (line breaks

     added):

@@ -178,6 +179,7 @@ class AVCMessage(AuditMessage):

         self.name = ""

         self.accesses = []

         self.denial = True

+        self.ioctlcmd = None

         self.type = audit2why.TERULE

     def __parse_access(self, recs, start):

@@ -237,6 +239,11 @@ class AVCMessage(AuditMessage):

                 self.exe = fields[1][1:-1]

             elif fields[0] == "name":

                 self.name = fields[1][1:-1]

+            elif fields[0] == "ioctlcmd":

+                try:

+                    self.ioctlcmd = int(fields[1], 16)

+                except ValueError:

+                    pass

         if not found_src or not found_tgt or not found_class or not found_access:

             raise ValueError("AVC message in invalid format [%s]\n" % self.message)

@@ -522,13 +529,20 @@ class AuditParser:

         for avc in self.avc_msgs:

             if avc.denial != True and only_denials:

                 continue

-            if avc_filter:

-                if avc_filter.filter(avc):

-                    av_set.add(avc.scontext.type, avc.tcontext.type, avc.tclass,

-                               avc.accesses, avc, avc_type=avc.type, data=avc.data)

-            else:

-                av_set.add(avc.scontext.type, avc.tcontext.type, avc.tclass,

-                           avc.accesses, avc, avc_type=avc.type, data=avc.data)

+

+            if not avc_filter or avc_filter.filter(avc):

+                av = access.AccessVector([avc.scontext.type, avc.tcontext.type,

+                                         avc.tclass] + avc.accesses)

+                av.data = avc.data

+                av.type = avc.type

+

+                if avc.ioctlcmd:

+                    xperm_set = refpolicy.XpermSet()

+                    xperm_set.add(avc.ioctlcmd)

+                    av.xperms["ioctl"] = xperm_set

+

+                av_set.add_av(av, audit_msg=avc)

+

         return av_set

 class AVCTypeFilter:

diff --git selinux-python-2.8/sepolgen/src/sepolgen/policygen.py selinux-python-2.8/sepolgen/src/sepolgen/policygen.py

index ee664fb..319da15 100644

--- selinux-python-2.8/sepolgen/src/sepolgen/policygen.py

+++ selinux-python-2.8/sepolgen/src/sepolgen/policygen.py

@@ -50,10 +50,11 @@ class PolicyGenerator:

     in the form of access vectors.

     It generates allow rules and optionally module require

-    statements and reference policy interfaces. By default

-    only allow rules are generated. The methods .set_gen_refpol

-    and .set_gen_requires turns on interface generation and

-    requires generation respectively.

+    statements, reference policy interfaces, and extended

+    permission access vector rules. By default only allow rules

+    are generated. The methods .set_gen_refpol, .set_gen_requires

+    and .set_gen_xperms turns on interface generation,

+    requires generation, and xperms rules genration respectively.

     PolicyGenerator can also optionally add comments explaining

     why a particular access was allowed based on the audit

@@ -82,6 +83,7 @@ class PolicyGenerator:

             self.module = refpolicy.Module()

         self.dontaudit = False

+        self.xperms = False

         self.domains = None

     def set_gen_refpol(self, if_set=None, perm_maps=None):

@@ -120,6 +122,12 @@ class PolicyGenerator:

     def set_gen_dontaudit(self, dontaudit):

         self.dontaudit = dontaudit

+    def set_gen_xperms(self, xperms):

+        """Set whether extended permission access vector rules

+        are generated.

+        """

+        self.xperms = xperms

+

     def __set_module_style(self):

         if self.ifgen:

             refpolicy = True

@@ -153,51 +161,69 @@ class PolicyGenerator:

         """Return the generated module"""

         return self.module

-    def __add_allow_rules(self, avs):

-        for av in avs:

-            rule = refpolicy.AVRule(av)

+    def __add_av_rule(self, av):

+        """Add access vector rule.

+        """

+        rule = refpolicy.AVRule(av)

+

+        if self.dontaudit:

+            rule.rule_type = rule.DONTAUDIT

+        rule.comment = ""

+        if self.explain:

+            rule.comment = str(refpolicy.Comment(explain_access(av, verbosity=self.explain)))

+

+        if av.type == audit2why.ALLOW:

+            rule.comment += "\n#!!!! This avc is allowed in the current policy"

+

+            if av.xperms:

+                rule.comment += "\n#!!!! This av rule may have been overridden by an extended permission av rule"

+

+        if av.type == audit2why.DONTAUDIT:

+            rule.comment += "\n#!!!! This avc has a dontaudit rule in the current policy"

+

+        if av.type == audit2why.BOOLEAN:

+            if len(av.data) > 1:

+                rule.comment += "\n#!!!! This avc can be allowed using one of the these booleans:\n#     %s" % ", ".join([x[0] for x in av.data])

+            else:

+                rule.comment += "\n#!!!! This avc can be allowed using the boolean '%s'" % av.data[0][0]

+

+        if av.type == audit2why.CONSTRAINT:

+            rule.comment += "\n#!!!! This avc is a constraint violation.  You would need to modify the attributes of either the source or target types to allow this access."

+            rule.comment += "\n#Constraint rule: "

+            rule.comment += "\n#\t" + av.data[0]

+            for reason in av.data[1:]:

+                rule.comment += "\n#\tPossible cause is the source %s and target %s are different." % reason

+

+        try:

+            if ( av.type == audit2why.TERULE and

+                 "write" in av.perms and

+                 ( "dir" in av.obj_class or "open" in av.perms )):

+                if not self.domains:

+                    self.domains = seinfo(ATTRIBUTE, name="domain")[0]["types"]

+                types=[]

+

+                for i in [x[TCONTEXT] for x in sesearch([ALLOW], {SCONTEXT: av.src_type, CLASS: av.obj_class, PERMS: av.perms})]:

+                    if i not in self.domains:

+                        types.append(i)

+                if len(types) == 1:

+                    rule.comment += "\n#!!!! The source type '%s' can write to a '%s' of the following type:\n# %s\n" % ( av.src_type, av.obj_class, ", ".join(types))

+                elif len(types) >= 1:

+                    rule.comment += "\n#!!!! The source type '%s' can write to a '%s' of the following types:\n# %s\n" % ( av.src_type, av.obj_class, ", ".join(types))

+        except:

+            pass

+

+        self.module.children.append(rule)

+

+    def __add_ext_av_rules(self, av):

+        """Add extended permission access vector rules.

+        """

+        for op in av.xperms.keys():

+            extrule = refpolicy.AVExtRule(av, op)

+

             if self.dontaudit:

-                rule.rule_type = rule.DONTAUDIT

-            rule.comment = ""

-            if self.explain:

-                rule.comment = str(refpolicy.Comment(explain_access(av, verbosity=self.explain)))

-            if av.type == audit2why.ALLOW:

-                rule.comment += "\n#!!!! This avc is allowed in the current policy"

-            if av.type == audit2why.DONTAUDIT:

-                rule.comment += "\n#!!!! This avc has a dontaudit rule in the current policy"

-

-            if av.type == audit2why.BOOLEAN:

-                if len(av.data) > 1:

-                    rule.comment += "\n#!!!! This avc can be allowed using one of the these booleans:\n#     %s" % ", ".join([x[0] for x in av.data])

-                else:

-                    rule.comment += "\n#!!!! This avc can be allowed using the boolean '%s'" % av.data[0][0]

-

-            if av.type == audit2why.CONSTRAINT:

-                rule.comment += "\n#!!!! This avc is a constraint violation.  You would need to modify the attributes of either the source or target types to allow this access."

-                rule.comment += "\n#Constraint rule: "

-                rule.comment += "\n#\t" + av.data[0]

-                for reason in av.data[1:]:

-                    rule.comment += "\n#\tPossible cause is the source %s and target %s are different." % reason

-

-            try:

-                if ( av.type == audit2why.TERULE and

-                     "write" in av.perms and

-                     ( "dir" in av.obj_class or "open" in av.perms )):

-                    if not self.domains:

-                        self.domains = seinfo(ATTRIBUTE, name="domain")[0]["types"]

-                    types=[]

-

-                    for i in [x[TCONTEXT] for x in sesearch([ALLOW], {SCONTEXT: av.src_type, CLASS: av.obj_class, PERMS: av.perms})]:

-                        if i not in self.domains:

-                            types.append(i)

-                    if len(types) == 1:

-                        rule.comment += "\n#!!!! The source type '%s' can write to a '%s' of the following type:\n# %s\n" % ( av.src_type, av.obj_class, ", ".join(types))

-                    elif len(types) >= 1:

-                        rule.comment += "\n#!!!! The source type '%s' can write to a '%s' of the following types:\n# %s\n" % ( av.src_type, av.obj_class, ", ".join(types))

-            except:

-                pass

-            self.module.children.append(rule)

+                extrule.rule_type = extrule.DONTAUDITXPERM

+            self.module.children.append(extrule)

     def add_access(self, av_set):

         """Add the access from the access vector set to this

@@ -215,7 +241,10 @@ class PolicyGenerator:

             raw_allow = av_set

         # Generate the raw allow rules from the filtered list