diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/access.py policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/access.py

--- nsasepolgen/src/sepolgen/access.py	2010-05-19 14:45:51.000000000 -0400

+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/access.py	2010-06-16 08:22:43.000000000 -0400

@@ -32,6 +32,7 @@

 """

 import refpolicy

+from selinux import audit2why

 def is_idparam(id):

     """Determine if an id is a paramater in the form $N, where N is

@@ -85,6 +86,8 @@

             self.obj_class = None

             self.perms = refpolicy.IdSet()

             self.audit_msgs = []

+            self.type = audit2why.TERULE

+            self.bools = []

         # The direction of the information flow represented by this

         # access vector - used for matching

@@ -253,20 +256,22 @@

         for av in l:

             self.add_av(AccessVector(av))

-    def add(self, src_type, tgt_type, obj_class, perms, audit_msg=None):

+    def add(self, src_type, tgt_type, obj_class, perms, audit_msg=None, avc_type=audit2why.TERULE, bools=[]):

         """Add an access vector to the set.

         """

         tgt = self.src.setdefault(src_type, { })

         cls = tgt.setdefault(tgt_type, { })

-        if cls.has_key(obj_class):

-            access = cls[obj_class]

+        if cls.has_key((obj_class, avc_type)):

+            access = cls[obj_class, avc_type]

         else:

             access = AccessVector()

             access.src_type = src_type

             access.tgt_type = tgt_type

             access.obj_class = obj_class

-            cls[obj_class] = access

+            access.bools = bools

+            access.type = avc_type

+            cls[obj_class, avc_type] = access

         access.perms.update(perms)

         if audit_msg:

diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/audit.py policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/audit.py

--- nsasepolgen/src/sepolgen/audit.py	2010-05-19 14:45:51.000000000 -0400

+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/audit.py	2010-06-16 08:22:43.000000000 -0400

@@ -68,6 +68,17 @@

                               stdout=subprocess.PIPE).communicate()[0]

     return output

+def get_log_msgs():

+    """Obtain all of the avc and policy load messages from /var/log/messages.

+

+    Returns:

+       string contain all of the audit messages returned by /var/log/messages.

+    """

+    import subprocess

+    output = subprocess.Popen(["/bin/grep", "avc",  "/var/log/messages"],

+                              stdout=subprocess.PIPE).communicate()[0]

+    return output

+

 # Classes representing audit messages

 class AuditMessage:

@@ -127,6 +138,9 @@

             if fields[0] == "path":

                 self.path = fields[1][1:-1]

                 return

+import selinux.audit2why as audit2why

+

+avcdict = {}

 class AVCMessage(AuditMessage):

     """AVC message representing an access denial or granted message.

@@ -167,6 +181,8 @@

         self.path = ""

         self.accesses = []

         self.denial = True

+        self.type = audit2why.TERULE

+        self.bools = []

     def __parse_access(self, recs, start):

         # This is kind of sucky - the access that is in a space separated

@@ -226,7 +242,31 @@

         if not found_src or not found_tgt or not found_class or not found_access:

             raise ValueError("AVC message in invalid format [%s]\n" % self.message)

-                

+        self.analyze()

+

+    def analyze(self):

+        tcontext = self.tcontext.to_string()

+        scontext = self.scontext.to_string()

+        access_tuple = tuple( self.accesses)

+        if (scontext, tcontext, self.tclass, access_tuple) in avcdict.keys():

+            self.type, self.bools = avcdict[(scontext, tcontext, self.tclass, access_tuple)]

+        else:

+            self.type, self.bools = audit2why.analyze(scontext, tcontext, self.tclass, self.accesses);

+            if self.type == audit2why.NOPOLICY:

+                self.type = audit2why.TERULE

+            if self.type == audit2why.BADTCON:

+                raise ValueError("Invalid Target Context %s\n" % tcontext)

+            if self.type == audit2why.BADSCON:

+                raise ValueError("Invalid Source Context %s\n" % scontext)

+            if self.type == audit2why.BADSCON:

+                raise ValueError("Invalid Type Class %s\n" % self.tclass)

+            if self.type == audit2why.BADPERM:

+                raise ValueError("Invalid permission %s\n" % " ".join(self.accesses))

+            if self.type == audit2why.BADCOMPUTE:

+                raise ValueError("Error during access vector computation")

+            

+            avcdict[(scontext, tcontext, self.tclass, access_tuple)] = (self.type, self.bools)

+

 class PolicyLoadMessage(AuditMessage):

     """Audit message indicating that the policy was reloaded."""

     def __init__(self, message):

@@ -469,10 +509,10 @@

             if avc_filter:

                 if avc_filter.filter(avc):

                     av_set.add(avc.scontext.type, avc.tcontext.type, avc.tclass,

-                               avc.accesses, avc)

+                               avc.accesses, avc, avc_type=avc.type, bools=avc.bools)

             else:

                 av_set.add(avc.scontext.type, avc.tcontext.type, avc.tclass,

-                           avc.accesses, avc)

+                           avc.accesses, avc, avc_type=avc.type, bools=avc.bools)

         return av_set

 class AVCTypeFilter:

diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/defaults.py policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/defaults.py

--- nsasepolgen/src/sepolgen/defaults.py	2010-05-19 14:45:51.000000000 -0400

+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/defaults.py	2010-06-16 08:22:43.000000000 -0400

@@ -30,6 +30,9 @@

 def interface_info():

     return data_dir() + "/interface_info"

+def attribute_info():

+    return data_dir() + "/attribute_info"

+

 def refpolicy_devel():

     return "/usr/share/selinux/devel"

diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/interfaces.py policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/interfaces.py

--- nsasepolgen/src/sepolgen/interfaces.py	2010-05-19 14:45:51.000000000 -0400

+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/interfaces.py	2010-06-16 08:22:43.000000000 -0400

@@ -29,6 +29,8 @@

 from sepolgeni18n import _

+import copy

+

 class Param:

     """

     Object representing a paramater for an interface.

@@ -197,10 +199,48 @@

                 ret = 1

     return ret

-            

+

+class AttributeVector:

+    def __init__(self):

+        self.name = ""

+        self.access = access.AccessVectorSet()

+

+    def add_av(self, av):

+        self.access.add_av(av)

+

+class AttributeSet:

+    def __init__(self):

+        self.attributes = { }

+

+    def add_attr(self, attr):

+        self.attributes[attr.name] = attr

+

+    def from_file(self, fd):

+        def parse_attr(line):

+            fields = line[1:-1].split()

+            if len(fields) != 2 or fields[0] != "Attribute":

+                raise SyntaxError("Syntax error Attribute statement %s" % line)

+            a = AttributeVector()

+            a.name = fields[1]

+

+            return a

+

+        a = None

+        for line in fd:

+            line = line[:-1]

+            if line[0] == "[":

+                if a:

+                    self.add_attr(a)

+                a = parse_attr(line)

+            elif a:

+                l = line.split(",")

+                av = access.AccessVector(l)

+                a.add_av(av)

+        if a:

+            self.add_attr(a)

 class InterfaceVector:

-    def __init__(self, interface=None):

+    def __init__(self, interface=None, attributes={}):

         # Enabled is a loose concept currently - we are essentially

         # not enabling interfaces that we can't handle currently.

         # See InterfaceVector.add_ifv for more information.

@@ -214,10 +254,10 @@

         # value: Param object).

         self.params = { }

         if interface:

-            self.from_interface(interface)

+            self.from_interface(interface, attributes)

         self.expanded = False

-    def from_interface(self, interface):

+    def from_interface(self, interface, attributes={}):

         self.name = interface.name

         # Add allow rules

@@ -232,6 +272,23 @@

             for av in avs:

                 self.add_av(av)

+        # Add typeattribute access

+        if attributes != None:

+            for typeattribute in interface.typeattributes():

+                for attr in typeattribute.attributes:

+                    if not attributes.attributes.has_key(attr):

+                        # print "missing attribute " + attr

+                        continue

+                    attr_vec = attributes.attributes[attr]

+                    for a in attr_vec.access:

+                        av = copy.copy(a)

+                        if av.src_type == attr_vec.name:

+                            av.src_type = typeattribute.type

+                        if av.tgt_type == attr_vec.name:

+                            av.tgt_type = typeattribute.type

+                        self.add_av(av)

+

+

         # Extract paramaters from roles

         for role in interface.roles():

             if role_extract_params(role, self.params):

@@ -346,13 +403,13 @@

                 l = self.tgt_type_map.setdefault(type, [])

                 l.append(ifv)

-    def add(self, interface):

-        ifv = InterfaceVector(interface)

+    def add(self, interface, attributes={}):

+        ifv = InterfaceVector(interface, attributes)

         self.add_ifv(ifv)

-    def add_headers(self, headers, output=None):

+    def add_headers(self, headers, output=None, attributes={}):

         for i in itertools.chain(headers.interfaces(), headers.templates()):

-            self.add(i)

+            self.add(i, attributes)

         self.expand_ifcalls(headers)

         self.index()

diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/matching.py policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/matching.py

--- nsasepolgen/src/sepolgen/matching.py	2010-05-19 14:45:51.000000000 -0400

+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/matching.py	2010-06-16 08:22:43.000000000 -0400

@@ -50,7 +50,7 @@

                 return 1

 class MatchList:

-    DEFAULT_THRESHOLD = 120

+    DEFAULT_THRESHOLD = 150

     def __init__(self):

         # Match objects that pass the threshold

         self.children = []

@@ -63,14 +63,15 @@

     def best(self):

         if len(self.children):

             return self.children[0]

-        else:

-            return None

+        if len(self.bastards):

+            return self.bastards[0]

+        return None

     def __len__(self):

         # Only return the length of the matches so

         # that this can be used to test if there is

         # a match.

-        return len(self.children)

+        return len(self.children) + len(self.bastards)

     def __iter__(self):

         return iter(self.children)

diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/policygen.py policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/policygen.py

--- nsasepolgen/src/sepolgen/policygen.py	2010-05-19 14:45:51.000000000 -0400

+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/policygen.py	2010-06-21 10:10:01.000000000 -0400

@@ -29,6 +29,8 @@

 import access

 import interfaces

 import matching

+import selinux.audit2why as audit2why

+from setools import *

 # Constants for the level of explanation from the generation

 # routines

@@ -77,6 +79,7 @@

         self.dontaudit = False

+        self.domains = None

     def set_gen_refpol(self, if_set=None, perm_maps=None):

         """Set whether reference policy interfaces are generated.

@@ -151,8 +154,41 @@

             rule = refpolicy.AVRule(av)

             if self.dontaudit:

                 rule.rule_type = rule.DONTAUDIT

+            rule.comment = ""

             if self.explain:

-                rule.comment = refpolicy.Comment(explain_access(av, verbosity=self.explain))

+                rule.comment = str(refpolicy.Comment(explain_access(av, verbosity=self.explain)))

+            if av.type == audit2why.ALLOW:

+                rule.comment += "#!!!! This avc is allowed in the current policy\n" 

+            if av.type == audit2why.DONTAUDIT:

+                rule.comment += "#!!!! This avc has a dontaudit rule in the current policy\n" 

+

+            if av.type == audit2why.BOOLEAN:

+                if len(av.bools) > 1:

+                    rule.comment += "#!!!! This avc can be allowed using one of the these booleans:\n#     %s\n" % ", ".join(map(lambda x: x[0], av.bools))

+                else:

+                    rule.comment += "#!!!! This avc can be allowed using the boolean '%s'\n" % av.bools[0][0]

+

+            if av.type == audit2why.CONSTRAINT:

+                rule.comment += "#!!!! This avc is a constraint violation.  You will need to add an attribute to either the source or target type to make it work.\n" 

+                rule.comment += "#Contraint rule: "

+

+            if av.type == audit2why.TERULE:

+                if "write" in av.perms:

+                    if "dir" in av.obj_class or "open" in av.perms:

+                        if not self.domains:

+                            self.domains = seinfo(ATTRIBUTE, name="domain")[0]["types"]

+                        types=[]

+                        

+                        try:

+                            for i in map(lambda x: x[TCONTEXT], sesearch([ALLOW], {SCONTEXT: av.src_type, CLASS: av.obj_class, PERMS: av.perms})):

+                                if i not in self.domains:

+                                    types.append(i)

+                            if len(types) == 1:

+                                rule.comment += "#!!!! The source type '%s' can write to a '%s' of the following type:\n# %s\n" % ( av.src_type, av.obj_class, ", ".join(types))

+                            elif len(types) >= 1:

+                                rule.comment += "#!!!! The source type '%s' can write to a '%s' of the following types:\n# %s\n" % ( av.src_type, av.obj_class, ", ".join(types))

+                        except:

+                            pass

             self.module.children.append(rule)

diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/refparser.py policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/refparser.py

--- nsasepolgen/src/sepolgen/refparser.py	2010-05-19 14:45:51.000000000 -0400

+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/sepolgen/refparser.py	2010-06-16 08:22:43.000000000 -0400

@@ -1044,7 +1044,7 @@

         # of misc_macros. We are just going to pretend that this is an interface

         # to make the expansion work correctly.

         can_exec = refpolicy.Interface("can_exec")

-        av = access.AccessVector(["$1","$2","file","execute_no_trans","read",

+        av = access.AccessVector(["$1","$2","file","execute_no_trans","open", "read",

                                   "getattr","lock","execute","ioctl"])

         can_exec.children.append(refpolicy.AVRule(av))

diff --exclude-from=exclude -N -u -r nsasepolgen/src/share/perm_map policycoreutils-2.0.83/sepolgen-1.0.23/src/share/perm_map

--- nsasepolgen/src/share/perm_map	2010-05-19 14:45:51.000000000 -0400

+++ policycoreutils-2.0.83/sepolgen-1.0.23/src/share/perm_map	2010-06-16 08:22:43.000000000 -0400

@@ -124,7 +124,7 @@

           quotamod     w           1

           quotaget     r           1

-class file 20

+class file 21

   execute_no_trans     r           1

         entrypoint     r           1

            execmod     n           1

@@ -141,48 +141,50 @@

             unlink     w           1

               link     w           1

             rename     w           5

-           execute     r           100

+           execute     r           10

             swapon     b           1

            quotaon     b           1

            mounton     b           1

+	      open     r	   1

-class dir 22

-          add_name     w           5

+class dir 23

+          add_name     w           1

        remove_name     w           1

           reparent     w           1

             search     r           1

              rmdir     b           1

              ioctl     n           1

-              read     r          10

-             write     w          10

+              read     r           1

+             write     w           1

             create     w           1

-           getattr     r           7

-           setattr     w           7

+           getattr     r           1

+           setattr     w           1

               lock     n           1

-       relabelfrom     r           10

-         relabelto     w           10

+       relabelfrom     r           1

+         relabelto     w           1

             append     w           1

             unlink     w           1

               link     w           1

-            rename     w           5

+            rename     w           1

            execute     r           1

             swapon     b           1

            quotaon     b           1

            mounton     b           1

+	      open     r	   1

 class fd 1

                use     b           1

-class lnk_file 17

+class lnk_file 18

              ioctl     n           1

-              read     r          10

-             write     w          10

+              read     r           1

+             write     w           1

             create     w           1

-           getattr     r           7

-           setattr     w           7

+           getattr     r           1

+           setattr     w           1

               lock     n           1

-       relabelfrom     r           10

-         relabelto     w           10

+       relabelfrom     r           1

+         relabelto     w           1

             append     w           1

             unlink     w           1

               link     w           1

@@ -191,8 +193,9 @@

             swapon     b           1

            quotaon     b           1

            mounton     b           1

+	      open     r	   1

-class chr_file 20

+class chr_file 21

   execute_no_trans     r           1

         entrypoint     r           1

            execmod     n           1

@@ -213,8 +216,9 @@

             swapon     b           1

            quotaon     b           1

            mounton     b           1

+	      open     r	   1

-class blk_file 17

+class blk_file 18

              ioctl     n           1

               read     r          10

              write     w          10

@@ -232,8 +236,9 @@

             swapon     b           1

            quotaon     b           1

            mounton     b           1

+	      open     r	   1

-class sock_file 17

+class sock_file 18

              ioctl     n           1

               read     r          10

              write     w          10

@@ -251,8 +256,9 @@

             swapon     b           1

            quotaon     b           1

            mounton     b           1

+	      open     r	   1

-class fifo_file 17

+class fifo_file 18

              ioctl     n           1

               read     r          10

              write     w          10

@@ -270,6 +276,7 @@

             swapon     b           1

            quotaon     b           1

            mounton     b           1

+	      open     r	   1

 class socket 22

              ioctl     n           1