0fd1802
From 287f507657e162bc09b5c186bbd580901fbc942a Mon Sep 17 00:00:00 2001
0fd1802
From: Dan Walsh <dwalsh@redhat.com>
0fd1802
Date: Tue, 20 Sep 2011 15:47:28 -0400
0fd1802
Subject: [PATCH 6/6] Changes to support named file_trans rules
0fd1802
0fd1802
---
0fd1802
 libapol/include/apol/ftrule-query.h |  198 +++++++++++++++++++
0fd1802
 libapol/include/apol/policy-query.h |    1 +
0fd1802
 libapol/src/Makefile.am             |    1 +
0fd1802
 libapol/src/ftrule-query.c          |  363 +++++++++++++++++++++++++++++++++++
0fd1802
 libapol/src/libapol.map             |    1 +
0fd1802
 libqpol/include/qpol/ftrule_query.h |  116 +++++++++++
0fd1802
 libqpol/include/qpol/policy.h       |    1 +
0fd1802
 libqpol/src/Makefile.am             |    1 +
0fd1802
 libqpol/src/ftrule_query.c          |  277 ++++++++++++++++++++++++++
0fd1802
 libqpol/src/libqpol.map             |    1 +
0fd1802
 libqpol/src/module_compiler.c       |   12 ++
0fd1802
 libqpol/src/policy_define.c         |  186 ++++++++++++++++++-
0fd1802
 libqpol/src/policy_parse.y          |   13 +-
0fd1802
 libqpol/src/policy_scan.l           |    1 +
0fd1802
 secmds/sesearch.c                   |  101 ++++++++++
0fd1802
 15 files changed, 1270 insertions(+), 3 deletions(-)
0fd1802
 create mode 100644 libapol/include/apol/ftrule-query.h
0fd1802
 create mode 100644 libapol/src/ftrule-query.c
0fd1802
 create mode 100644 libqpol/include/qpol/ftrule_query.h
0fd1802
 create mode 100644 libqpol/src/ftrule_query.c
0fd1802
0fd1802
diff --git a/libapol/include/apol/ftrule-query.h b/libapol/include/apol/ftrule-query.h
0fd1802
new file mode 100644
0fd1802
index 0000000..119c52f
0fd1802
--- /dev/null
0fd1802
+++ b/libapol/include/apol/ftrule-query.h
0fd1802
@@ -0,0 +1,198 @@
0fd1802
+/**
0fd1802
+ * @file
0fd1802
+ *
0fd1802
+ * Routines to query filename_transition rules of a
0fd1802
+ * policy.  
0fd1802
+ *
0fd1802
+ * @author Jeremy A. Mowery jmowery@tresys.com
0fd1802
+ * @author Jason Tang  jtang@tresys.com
0fd1802
+ *
0fd1802
+ * Copyright (C) 2006-2007 Tresys Technology, LLC
0fd1802
+ *
0fd1802
+ *  This library is free software; you can redistribute it and/or
0fd1802
+ *  modify it under the terms of the GNU Lesser General Public
0fd1802
+ *  License as published by the Free Software Foundation; either
0fd1802
+ *  version 2.1 of the License, or (at your option) any later version.
0fd1802
+ *
0fd1802
+ *  This library is distributed in the hope that it will be useful,
0fd1802
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
0fd1802
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
0fd1802
+ *  Lesser General Public License for more details.
0fd1802
+ *
0fd1802
+ *  You should have received a copy of the GNU Lesser General Public
0fd1802
+ *  License along with this library; if not, write to the Free Software
0fd1802
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
0fd1802
+ */
0fd1802
+
0fd1802
+#ifndef APOL_FILENAMERULE_QUERY_H
0fd1802
+#define APOL_FILENAMERULE_QUERY_H
0fd1802
+
0fd1802
+#ifdef	__cplusplus
0fd1802
+extern "C"
0fd1802
+{
0fd1802
+#endif
0fd1802
+
0fd1802
+#include "policy.h"
0fd1802
+#include "vector.h"
0fd1802
+#include <qpol/policy.h>
0fd1802
+
0fd1802
+	typedef struct apol_filename_trans_query apol_filename_trans_query_t;
0fd1802
+
0fd1802
+
0fd1802
+/******************** filename_transition queries ********************/
0fd1802
+
0fd1802
+/**
0fd1802
+ * Execute a query against all filename_transition rules within the
0fd1802
+ * policy.
0fd1802
+ *
0fd1802
+ * @param p Policy within which to look up filename_transition rules.
0fd1802
+ * @param r Structure containing parameters for query.	If this is
0fd1802
+ * NULL then return all filename_transition rules.
0fd1802
+ * @param v Reference to a vector of qpol_filename_trans_t.  The vector
0fd1802
+ * will be allocated by this function.  The caller must call
0fd1802
+ * apol_vector_destroy() afterwards.  This will be set to NULL upon no
0fd1802
+ * results or upon error.
0fd1802
+ *
0fd1802
+ * @return 0 on success (including none found), negative on error.
0fd1802
+ */
0fd1802
+	extern int apol_filename_trans_get_by_query(const apol_policy_t * p, const apol_filename_trans_query_t * r, apol_vector_t ** v);
0fd1802
+
0fd1802
+/**
0fd1802
+ * Allocate and return a new filename trans query structure.  All fields
0fd1802
+ * are initialized, such that running this blank query results in
0fd1802
+ * returning all filename_transitions within the policy.  The caller must
0fd1802
+ * call apol_filename_trans_query_destroy() upon the return value
0fd1802
+ * afterwards.
0fd1802
+ *
0fd1802
+ * @return An initialized filename trans query structure, or NULL upon
0fd1802
+ * error.
0fd1802
+ */
0fd1802
+	extern apol_filename_trans_query_t *apol_filename_trans_query_create(void);
0fd1802
+
0fd1802
+/**
0fd1802
+ * Deallocate all memory associated with the referenced filename trans
0fd1802
+ * query, and then set it to NULL.  This function does nothing if the
0fd1802
+ * query is already NULL.
0fd1802
+ *
0fd1802
+ * @param r Reference to a filename trans query structure to destroy.
0fd1802
+ */
0fd1802
+	extern void apol_filename_trans_query_destroy(apol_filename_trans_query_t ** r);
0fd1802
+
0fd1802
+/**
0fd1802
+ * Set a filename_trans query to return rules whose source symbol matches
0fd1802
+ * symbol.  Symbol may be a type or attribute; if it is an alias then
0fd1802
+ * the query will convert it to its primary prior to searching.  If
0fd1802
+ * is_indirect is non-zero then the search will be done indirectly.
0fd1802
+ * If the symbol is a type, then the query matches rules with one of
0fd1802
+ * the type's attributes.  If the symbol is an attribute, then it
0fd1802
+ * matches rule with any of the attribute's types.
0fd1802
+ *
0fd1802
+ * @param p Policy handler, to report errors.
0fd1802
+ * @param t TE rule query to set.
0fd1802
+ * @param symbol Limit query to rules with this symbol as their
0fd1802
+ * source, or NULL to unset this field.
0fd1802
+ * @param is_indirect If non-zero, perform indirect matching.
0fd1802
+ *
0fd1802
+ * @return 0 on success, negative on error.
0fd1802
+ */
0fd1802
+	extern int apol_filename_trans_query_set_source(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *symbol,
0fd1802
+						int is_indirect);
0fd1802
+
0fd1802
+/**
0fd1802
+ * Set a filename trans query to return rules with a particular target
0fd1802
+ * symbol.  Symbol may be a type or attribute; if it is an alias then
0fd1802
+ * the query will convert it to its primary prior to searching.  If
0fd1802
+ * is_indirect is non-zero then the search will be done indirectly.
0fd1802
+ * If the symbol is a type, then the query matches rules with one of
0fd1802
+ * the type's attributes.  If the symbol is an attribute, then it
0fd1802
+ * matches rule with any of the attribute's types.
0fd1802
+ *
0fd1802
+ * @param p Policy handler, to report errors.
0fd1802
+ * @param r Role trans query to set.
0fd1802
+ * @param symbol Limit query to rules with this type or attribute as
0fd1802
+ * their target, or NULL to unset this field.
0fd1802
+ * @param is_indirect If non-zero, perform indirect matching.
0fd1802
+ *
0fd1802
+ * @return 0 on success, negative on error.
0fd1802
+ */
0fd1802
+	extern int apol_filename_trans_query_set_target(const apol_policy_t * p, apol_filename_trans_query_t * r, const char *symbol,
0fd1802
+						    int is_indirect);
0fd1802
+
0fd1802
+/**
0fd1802
+ * Set a filename trans query to return rules with a particular default
0fd1802
+ * filename.  This field is ignored if
0fd1802
+ * apol_filename_trans_query_set_source_any() is set to non-zero.
0fd1802
+ *
0fd1802
+ * @param p Policy handler, to report errors.
0fd1802
+ * @param r Role trans query to set.
0fd1802
+ * @param filename Limit query to rules with this filename as their default, or
0fd1802
+ * NULL to unset this field.
0fd1802
+ *
0fd1802
+ * @return 0 on success, negative on error.
0fd1802
+ */
0fd1802
+	extern int apol_filename_trans_query_set_default(const apol_policy_t * p, apol_filename_trans_query_t * r, const char *filename);
0fd1802
+
0fd1802
+/**
0fd1802
+ * Set at filename_trans query to return rules with this object (non-common)
0fd1802
+ * class.  If more than one class are appended to the query, the
0fd1802
+ * rule's class must be one of those appended.  (I.e., the rule's
0fd1802
+ * class must be a member of the query's classes.)  Pass a NULL to
0fd1802
+ * clear all classes.  Note that this performs straight string
0fd1802
+ * comparison, ignoring the regex flag.
0fd1802
+
0fd1802
+ *
0fd1802
+ * @param p Policy handler, to report errors.
0fd1802
+ * @param t TE rule query to set.
0fd1802
+ * @param obj_class Name of object class to add to search set.
0fd1802
+ *
0fd1802
+ * @return 0 on success, negative on error.
0fd1802
+ */
0fd1802
+	extern int apol_filename_trans_query_append_class(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *obj_class);
0fd1802
+
0fd1802
+/**
0fd1802
+ * Set a filename trans query to treat the source filename as any.  That is,
0fd1802
+ * use the same symbol for either source or default of a
0fd1802
+ * filename_transition rule.  This flag does nothing if the source filename is
0fd1802
+ * not set.  Note that a filename_transition's target is a type, so thus
0fd1802
+ * this flag does not affect its searching.
0fd1802
+ *
0fd1802
+ * @param p Policy handler, to report errors.
0fd1802
+ * @param r Role trans query to set.
0fd1802
+ * @param is_any Non-zero to use source symbol for source or default
0fd1802
+ * field, 0 to keep source as only source.
0fd1802
+ *
0fd1802
+ * @return Always 0.
0fd1802
+ */
0fd1802
+	extern int apol_filename_trans_query_set_source_any(const apol_policy_t * p, apol_filename_trans_query_t * r, int is_any);
0fd1802
+
0fd1802
+/**
0fd1802
+ * Set a filename trans query to use regular expression searching for
0fd1802
+ * source, target, and default fields.  Strings will be treated as
0fd1802
+ * regexes instead of literals.  For the target type, matching will
0fd1802
+ * occur against the type name or any of its aliases.
0fd1802
+ *
0fd1802
+ * @param p Policy handler, to report errors.
0fd1802
+ * @param r Role trans query to set.
0fd1802
+ * @param is_regex Non-zero to enable regex searching, 0 to disable.
0fd1802
+ *
0fd1802
+ * @return Always 0.
0fd1802
+ */
0fd1802
+	extern int apol_filename_trans_query_set_regex(const apol_policy_t * p, apol_filename_trans_query_t * r, int is_regex);
0fd1802
+
0fd1802
+/**
0fd1802
+ *  Render a filename_transition rule to a string.
0fd1802
+ *
0fd1802
+ *  @param policy Policy handler, to report errors.
0fd1802
+ *  @param rule The rule to render.
0fd1802
+ *
0fd1802
+ *  @return A newly malloc()'d string representation of the rule, or NULL on
0fd1802
+ *  failure; if the call fails, errno will be set. The caller is responsible
0fd1802
+ *  for calling free() on the returned string.
0fd1802
+ */
0fd1802
+	extern char *apol_filename_trans_render(const apol_policy_t * policy, const qpol_filename_trans_t * rule);
0fd1802
+
0fd1802
+#ifdef	__cplusplus
0fd1802
+}
0fd1802
+#endif
0fd1802
+
0fd1802
+#endif
0fd1802
diff --git a/libapol/include/apol/policy-query.h b/libapol/include/apol/policy-query.h
0fd1802
index 315f70e..665e4cb 100644
0fd1802
--- a/libapol/include/apol/policy-query.h
0fd1802
+++ b/libapol/include/apol/policy-query.h
0fd1802
@@ -71,6 +71,7 @@ extern "C"
0fd1802
 #include "terule-query.h"
0fd1802
 #include "condrule-query.h"
0fd1802
 #include "rbacrule-query.h"
0fd1802
+#include "ftrule-query.h"
0fd1802
 #include "range_trans-query.h"
0fd1802
 #include "constraint-query.h"
0fd1802
 
0fd1802
diff --git a/libapol/src/Makefile.am b/libapol/src/Makefile.am
0fd1802
index 3fa4f06..baaa4f6 100644
0fd1802
--- a/libapol/src/Makefile.am
0fd1802
+++ b/libapol/src/Makefile.am
0fd1802
@@ -40,6 +40,7 @@ libapol_a_SOURCES = \
0fd1802
 	render.c \
0fd1802
 	role-query.c \
0fd1802
 	terule-query.c \
0fd1802
+	ftrule-query.c \
0fd1802
 	type-query.c \
0fd1802
 	types-relation-analysis.c \
0fd1802
 	user-query.c \
0fd1802
diff --git a/libapol/src/ftrule-query.c b/libapol/src/ftrule-query.c
0fd1802
new file mode 100644
0fd1802
index 0000000..dc248de
0fd1802
--- /dev/null
0fd1802
+++ b/libapol/src/ftrule-query.c
0fd1802
@@ -0,0 +1,363 @@
0fd1802
+/**
0fd1802
+ * @file
0fd1802
+ *
0fd1802
+ * Provides a way for setools to make queries about type enforcement
0fd1802
+ * filename_transs within a policy.  The caller obtains a query object, fills in
0fd1802
+ * its parameters, and then runs the query; it obtains a vector of
0fd1802
+ * results.  Searches are conjunctive -- all fields of the search
0fd1802
+ * query must match for a datum to be added to the results query.
0fd1802
+ *
0fd1802
+ * @author Jeremy A. Mowery jmowery@tresys.com
0fd1802
+ * @author Jason Tang  jtang@tresys.com
0fd1802
+ *
0fd1802
+ * Copyright (C) 2006-2007 Tresys Technology, LLC
0fd1802
+ *
0fd1802
+ *  This library is free software; you can redistribute it and/or
0fd1802
+ *  modify it under the terms of the GNU Lesser General Public
0fd1802
+ *  License as published by the Free Software Foundation; either
0fd1802
+ *  version 2.1 of the License, or (at your option) any later version.
0fd1802
+ *
0fd1802
+ *  This library is distributed in the hope that it will be useful,
0fd1802
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
0fd1802
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
0fd1802
+ *  Lesser General Public License for more details.
0fd1802
+ *
0fd1802
+ *  You should have received a copy of the GNU Lesser General Public
0fd1802
+ *  License along with this library; if not, write to the Free Software
0fd1802
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
0fd1802
+ */
0fd1802
+
0fd1802
+#include "policy-query-internal.h"
0fd1802
+
0fd1802
+#include <errno.h>
0fd1802
+#include <string.h>
0fd1802
+
0fd1802
+struct apol_filename_trans_query
0fd1802
+{
0fd1802
+	char *source, *target, *default_type, *name;
0fd1802
+	apol_vector_t *classes;
0fd1802
+	unsigned int flags;
0fd1802
+};
0fd1802
+
0fd1802
+
0fd1802
+/******************** filename_transition queries ********************/
0fd1802
+
0fd1802
+int apol_filename_trans_get_by_query(const apol_policy_t * p, const apol_filename_trans_query_t * t, apol_vector_t ** v)
0fd1802
+{
0fd1802
+	apol_vector_t *source_list = NULL, *target_list = NULL, *class_list = NULL, *default_list = NULL;
0fd1802
+	int retval = -1, source_as_any = 0, is_regex = 0, append_filename_trans;
0fd1802
+	char *bool_name = NULL;
0fd1802
+	*v = NULL;
0fd1802
+	unsigned int flags = 0;
0fd1802
+	qpol_iterator_t *iter = NULL, *type_iter = NULL;
0fd1802
+
0fd1802
+	if (t != NULL) {
0fd1802
+		flags = t->flags;
0fd1802
+		is_regex = t->flags & APOL_QUERY_REGEX;
0fd1802
+		if (t->source != NULL &&
0fd1802
+		    (source_list =
0fd1802
+		     apol_query_create_candidate_type_list(p, t->source, is_regex,
0fd1802
+							   t->flags & APOL_QUERY_SOURCE_INDIRECT,
0fd1802
+							   ((t->flags & (APOL_QUERY_SOURCE_TYPE | APOL_QUERY_SOURCE_ATTRIBUTE)) /
0fd1802
+							    APOL_QUERY_SOURCE_TYPE))) == NULL) {
0fd1802
+			goto cleanup;
0fd1802
+		}
0fd1802
+
0fd1802
+		if ((t->flags & APOL_QUERY_SOURCE_AS_ANY) && t->source != NULL) {
0fd1802
+			default_list = target_list = source_list;
0fd1802
+			source_as_any = 1;
0fd1802
+		} else {
0fd1802
+			if (t->target != NULL &&
0fd1802
+			    (target_list =
0fd1802
+			     apol_query_create_candidate_type_list(p, t->target, is_regex,
0fd1802
+								   t->flags & APOL_QUERY_TARGET_INDIRECT,
0fd1802
+								   ((t->
0fd1802
+								     flags & (APOL_QUERY_TARGET_TYPE | APOL_QUERY_TARGET_ATTRIBUTE))
0fd1802
+								    / APOL_QUERY_TARGET_TYPE))) == NULL) {
0fd1802
+				goto cleanup;
0fd1802
+			}
0fd1802
+			if (t->default_type != NULL &&
0fd1802
+			    (default_list =
0fd1802
+			     apol_query_create_candidate_type_list(p, t->default_type, is_regex, 0,
0fd1802
+								   APOL_QUERY_SYMBOL_IS_TYPE)) == NULL) {
0fd1802
+				goto cleanup;
0fd1802
+			}
0fd1802
+		}
0fd1802
+		if (t->classes != NULL &&
0fd1802
+		    apol_vector_get_size(t->classes) > 0 &&
0fd1802
+		    (class_list = apol_query_create_candidate_class_list(p, t->classes)) == NULL) {
0fd1802
+			goto cleanup;
0fd1802
+		}
0fd1802
+	}
0fd1802
+
0fd1802
+	if (qpol_policy_get_filename_trans_iter(p->p, &iter) < 0) {
0fd1802
+		return -1;
0fd1802
+	}
0fd1802
+
0fd1802
+	if ((*v = apol_vector_create(NULL)) == NULL) {
0fd1802
+		ERR(p, "%s", strerror(errno));
0fd1802
+		goto cleanup;
0fd1802
+	}
0fd1802
+
0fd1802
+	for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) {
0fd1802
+		qpol_filename_trans_t *filename_trans;
0fd1802
+		if (qpol_iterator_get_item(iter, (void **)&filename_trans) < 0) {
0fd1802
+			goto cleanup;
0fd1802
+		}
0fd1802
+		int match_source = 0, match_target = 0, match_default = 0, match_bool = 0;
0fd1802
+		size_t i;
0fd1802
+
0fd1802
+		if (source_list == NULL) {
0fd1802
+			match_source = 1;
0fd1802
+		} else {
0fd1802
+			const qpol_type_t *source_type;
0fd1802
+			if (qpol_filename_trans_get_source_type(p->p, filename_trans, &source_type) < 0) {
0fd1802
+				goto cleanup;
0fd1802
+			}
0fd1802
+			if (apol_vector_get_index(source_list, source_type, NULL, NULL, &i) == 0) {
0fd1802
+				match_source = 1;
0fd1802
+			}
0fd1802
+		}
0fd1802
+
0fd1802
+		/* if source did not match, but treating source symbol
0fd1802
+		 * as any field, then delay rejecting this filename_trans until
0fd1802
+		 * the target and default have been checked */
0fd1802
+		if (!source_as_any && !match_source) {
0fd1802
+			continue;
0fd1802
+		}
0fd1802
+
0fd1802
+		if (target_list == NULL || (source_as_any && match_source)) {
0fd1802
+			match_target = 1;
0fd1802
+		} else {
0fd1802
+			const qpol_type_t *target_type;
0fd1802
+			if (qpol_filename_trans_get_target_type(p->p, filename_trans, &target_type) < 0) {
0fd1802
+				goto cleanup;
0fd1802
+			}
0fd1802
+			if (apol_vector_get_index(target_list, target_type, NULL, NULL, &i) == 0) {
0fd1802
+				match_target = 1;
0fd1802
+			}
0fd1802
+		}
0fd1802
+
0fd1802
+		if (!source_as_any && !match_target) {
0fd1802
+			continue;
0fd1802
+		}
0fd1802
+
0fd1802
+		if (default_list == NULL || (source_as_any && match_source) || (source_as_any && match_target)) {
0fd1802
+			match_default = 1;
0fd1802
+		} else {
0fd1802
+			const qpol_type_t *default_type;
0fd1802
+			if (qpol_filename_trans_get_default_type(p->p, filename_trans, &default_type) < 0) {
0fd1802
+				goto cleanup;
0fd1802
+			}
0fd1802
+			if (apol_vector_get_index(default_list, default_type, NULL, NULL, &i) == 0) {
0fd1802
+				match_default = 1;
0fd1802
+			}
0fd1802
+		}
0fd1802
+
0fd1802
+		if (!source_as_any && !match_default) {
0fd1802
+			continue;
0fd1802
+		}
0fd1802
+		/* at least one thing must match if source_as_any was given */
0fd1802
+		if (source_as_any && (!match_source && !match_target && !match_default)) {
0fd1802
+			continue;
0fd1802
+		}
0fd1802
+
0fd1802
+		if (class_list != NULL) {
0fd1802
+			const qpol_class_t *obj_class;
0fd1802
+			if (qpol_filename_trans_get_object_class(p->p, filename_trans, &obj_class) < 0) {
0fd1802
+				goto cleanup;
0fd1802
+			}
0fd1802
+			if (apol_vector_get_index(class_list, obj_class, NULL, NULL, &i) < 0) {
0fd1802
+				continue;
0fd1802
+			}
0fd1802
+		}
0fd1802
+
0fd1802
+		if (apol_vector_append(*v, filename_trans)) {
0fd1802
+			ERR(p, "%s", strerror(ENOMEM));
0fd1802
+			goto cleanup;
0fd1802
+		}
0fd1802
+	}
0fd1802
+
0fd1802
+	retval = 0;
0fd1802
+      cleanup:
0fd1802
+	if (retval != 0) {
0fd1802
+		apol_vector_destroy(v);
0fd1802
+	}
0fd1802
+	apol_vector_destroy(&source_list);
0fd1802
+	if (!source_as_any) {
0fd1802
+		apol_vector_destroy(&target_list);
0fd1802
+		apol_vector_destroy(&default_list);
0fd1802
+	}
0fd1802
+	apol_vector_destroy(&class_list);
0fd1802
+	return retval;
0fd1802
+}
0fd1802
+
0fd1802
+apol_filename_trans_query_t *apol_filename_trans_query_create(void)
0fd1802
+{
0fd1802
+	apol_filename_trans_query_t *t = calloc(1, sizeof(apol_filename_trans_query_t));
0fd1802
+	if (t != NULL) {
0fd1802
+		t->flags =
0fd1802
+			(APOL_QUERY_SOURCE_TYPE | APOL_QUERY_SOURCE_ATTRIBUTE | APOL_QUERY_TARGET_TYPE |
0fd1802
+			 APOL_QUERY_TARGET_ATTRIBUTE);
0fd1802
+	}
0fd1802
+	return t;
0fd1802
+}
0fd1802
+
0fd1802
+void apol_filename_trans_query_destroy(apol_filename_trans_query_t ** r)
0fd1802
+{
0fd1802
+	if (r != NULL && *r != NULL) {
0fd1802
+		free((*r)->source);
0fd1802
+		free((*r)->target);
0fd1802
+		free((*r)->default_type);
0fd1802
+		free((*r)->name);
0fd1802
+		free(*r);
0fd1802
+		*r = NULL;
0fd1802
+	}
0fd1802
+}
0fd1802
+
0fd1802
+int apol_filename_trans_query_set_source(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *filename, int is_indirect)
0fd1802
+{
0fd1802
+	apol_query_set_flag(p, &t->flags, is_indirect, APOL_QUERY_TARGET_INDIRECT);
0fd1802
+	return apol_query_set(p, &t->source, NULL, filename);
0fd1802
+}
0fd1802
+
0fd1802
+int apol_filename_trans_query_set_target(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *type, int is_indirect)
0fd1802
+{
0fd1802
+	apol_query_set_flag(p, &t->flags, is_indirect, APOL_QUERY_TARGET_INDIRECT);
0fd1802
+	return apol_query_set(p, &t->target, NULL, type);
0fd1802
+}
0fd1802
+
0fd1802
+int apol_filename_trans_query_set_default(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *symbol)
0fd1802
+{
0fd1802
+	return apol_query_set(p, &t->default_type, NULL, symbol);
0fd1802
+}
0fd1802
+
0fd1802
+int apol_filename_trans_query_append_class(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *obj_class)
0fd1802
+{
0fd1802
+	char *s = NULL;
0fd1802
+	if (obj_class == NULL) {
0fd1802
+		apol_vector_destroy(&t->classes);
0fd1802
+	} else if ((s = strdup(obj_class)) == NULL || (t->classes == NULL && (t->classes = apol_vector_create(free)) == NULL)
0fd1802
+		   || apol_vector_append(t->classes, s) < 0) {
0fd1802
+		ERR(p, "%s", strerror(errno));
0fd1802
+		free(s);
0fd1802
+		return -1;
0fd1802
+	}
0fd1802
+	return 0;
0fd1802
+}
0fd1802
+
0fd1802
+int apol_filename_trans_query_set_name(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *filename)
0fd1802
+{
0fd1802
+	return apol_query_set(p, &t->name, NULL, filename);
0fd1802
+}
0fd1802
+
0fd1802
+int apol_filename_trans_query_set_source_any(const apol_policy_t * p, apol_filename_trans_query_t * t, int is_any)
0fd1802
+{
0fd1802
+	return apol_query_set_flag(p, &t->flags, is_any, APOL_QUERY_SOURCE_AS_ANY);
0fd1802
+}
0fd1802
+
0fd1802
+int apol_filename_trans_query_set_regex(const apol_policy_t * p, apol_filename_trans_query_t * t, int is_regex)
0fd1802
+{
0fd1802
+	return apol_query_set_regex(p, &t->flags, is_regex);
0fd1802
+}
0fd1802
+
0fd1802
+char *apol_filename_trans_render(const apol_policy_t * policy, const qpol_filename_trans_t * filename_trans)
0fd1802
+{
0fd1802
+	char *tmp = NULL;
0fd1802
+	const char *tmp_name = NULL;
0fd1802
+	const char *filename_trans_type_str;
0fd1802
+	int error = 0;
0fd1802
+	size_t tmp_sz = 0;
0fd1802
+	uint32_t filename_trans_type = 0;
0fd1802
+	const qpol_type_t *type = NULL;
0fd1802
+	const qpol_class_t *obj_class = NULL;
0fd1802
+
0fd1802
+	if (!policy || !filename_trans) {
0fd1802
+		ERR(policy, "%s", strerror(EINVAL));
0fd1802
+		errno = EINVAL;
0fd1802
+		return NULL;
0fd1802
+	}
0fd1802
+
0fd1802
+	/* source type */
0fd1802
+	if (qpol_filename_trans_get_source_type(policy->p, filename_trans, &type)) {
0fd1802
+		error = errno;
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+	if (qpol_type_get_name(policy->p, type, &tmp_name)) {
0fd1802
+		error = errno;
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+	if (apol_str_appendf(&tmp, &tmp_sz, "transition_type %s ", tmp_name)) {
0fd1802
+		error = errno;
0fd1802
+		ERR(policy, "%s", strerror(error));
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+
0fd1802
+	/* target type */
0fd1802
+	if (qpol_filename_trans_get_target_type(policy->p, filename_trans, &type)) {
0fd1802
+		error = errno;
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+	if (qpol_type_get_name(policy->p, type, &tmp_name)) {
0fd1802
+		error = errno;
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+	if (apol_str_appendf(&tmp, &tmp_sz, "%s : ", tmp_name)) {
0fd1802
+		error = errno;
0fd1802
+		ERR(policy, "%s", strerror(error));
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+
0fd1802
+	/* object class */
0fd1802
+	if (qpol_filename_trans_get_object_class(policy->p, filename_trans, &obj_class)) {
0fd1802
+		error = errno;
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+	if (qpol_class_get_name(policy->p, obj_class, &tmp_name)) {
0fd1802
+		error = errno;
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+	if (apol_str_appendf(&tmp, &tmp_sz, "%s ", tmp_name)) {
0fd1802
+		error = errno;
0fd1802
+		ERR(policy, "%s", strerror(error));
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+
0fd1802
+	/* default type */
0fd1802
+	if (qpol_filename_trans_get_default_type(policy->p, filename_trans, &type)) {
0fd1802
+		error = errno;
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+	if (qpol_type_get_name(policy->p, type, &tmp_name)) {
0fd1802
+		error = errno;
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+	if (apol_str_appendf(&tmp, &tmp_sz, "%s", tmp_name)) {
0fd1802
+		error = errno;
0fd1802
+		ERR(policy, "%s", strerror(error));
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+
0fd1802
+	if (qpol_filename_trans_get_filename(policy->p, filename_trans, &tmp_name)) {
0fd1802
+		error = errno;
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+
0fd1802
+	if (apol_str_appendf(&tmp, &tmp_sz, " %s", tmp_name)) {
0fd1802
+		error = errno;
0fd1802
+		ERR(policy, "%s", strerror(error));
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+
0fd1802
+	if (apol_str_appendf(&tmp, &tmp_sz, ";")) {
0fd1802
+		error = errno;
0fd1802
+		ERR(policy, "%s", strerror(error));
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+	return tmp;
0fd1802
+
0fd1802
+      err:
0fd1802
+	free(tmp);
0fd1802
+	errno = error;
0fd1802
+	return NULL;
0fd1802
+}
0fd1802
diff --git a/libapol/src/libapol.map b/libapol/src/libapol.map
0fd1802
index 4894374..7657a2d 100644
0fd1802
--- a/libapol/src/libapol.map
0fd1802
+++ b/libapol/src/libapol.map
0fd1802
@@ -34,6 +34,7 @@ VERS_4.0{
0fd1802
 		apol_protocol_to_str;
0fd1802
 		apol_qpol_context_render;
0fd1802
 		apol_range_trans_*;
0fd1802
+		apol_filename_trans_*;
0fd1802
 		apol_relabel_*;
0fd1802
 		apol_role_*;
0fd1802
 		apol_role_allow_*;
0fd1802
diff --git a/libqpol/include/qpol/ftrule_query.h b/libqpol/include/qpol/ftrule_query.h
0fd1802
new file mode 100644
0fd1802
index 0000000..1f533a4
0fd1802
--- /dev/null
0fd1802
+++ b/libqpol/include/qpol/ftrule_query.h
0fd1802
@@ -0,0 +1,116 @@
0fd1802
+/**
0fd1802
+ *  @file
0fd1802
+ *  Defines public interface for iterating over FTRULE rules.
0fd1802
+ *
0fd1802
+ *  @author Kevin Carr kcarr@tresys.com
0fd1802
+ *  @author Jeremy A. Mowery jmowery@tresys.com
0fd1802
+ *  @author Jason Tang jtang@tresys.com
0fd1802
+ *
0fd1802
+ *  Copyright (C) 2006-2007 Tresys Technology, LLC
0fd1802
+ *
0fd1802
+ *  This library is free software; you can redistribute it and/or
0fd1802
+ *  modify it under the terms of the GNU Lesser General Public
0fd1802
+ *  License as published by the Free Software Foundation; either
0fd1802
+ *  version 2.1 of the License, or (at your option) any later version.
0fd1802
+ *
0fd1802
+ *  This library is distributed in the hope that it will be useful,
0fd1802
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
0fd1802
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
0fd1802
+ *  Lesser General Public License for more details.
0fd1802
+ *
0fd1802
+ *  You should have received a copy of the GNU Lesser General Public
0fd1802
+ *  License along with this library; if not, write to the Free Software
0fd1802
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
0fd1802
+ */
0fd1802
+
0fd1802
+#ifndef QPOL_FTRULERULE_QUERY
0fd1802
+#define QPOL_FTRULERULE_QUERY
0fd1802
+
0fd1802
+#ifdef	__cplusplus
0fd1802
+extern "C"
0fd1802
+{
0fd1802
+#endif
0fd1802
+
0fd1802
+#include <qpol/policy.h>
0fd1802
+#include <qpol/iterator.h>
0fd1802
+
0fd1802
+	typedef struct qpol_filename_trans qpol_filename_trans_t;
0fd1802
+
0fd1802
+/**
0fd1802
+ *  Get an iterator over all filename transition rules in the policy.
0fd1802
+ *  @param policy Policy from which to create the iterator.
0fd1802
+ *  @param iter Iterator over items of type qpol_filename_trans_t returned.
0fd1802
+ *  The caller is responsible for calling qpol_iterator_destroy()
0fd1802
+ *  to free memory used by this iterator.
0fd1802
+ *  It is important to note that this iterator is only valid as long as
0fd1802
+ *  the policy is unmodifed.
0fd1802
+ *  @returm 0 on success and < 0 on failure; if the call fails,
0fd1802
+ *  errno will be set and *iter will be NULL.
0fd1802
+ */
0fd1802
+	extern int qpol_policy_get_filename_trans_iter(const qpol_policy_t * policy, qpol_iterator_t ** iter);
0fd1802
+
0fd1802
+/**
0fd1802
+ *  Get the source type from a filename transition rule.
0fd1802
+ *  @param policy The policy from which the rule comes.
0fd1802
+ *  @param rule The rule from which to get the source type.
0fd1802
+ *  @param source Pointer in which to store the source type.
0fd1802
+ *  The caller should not free this pointer.
0fd1802
+ *  @return 0 on success and < 0 on failure; if the call fails,
0fd1802
+ *  errno will be set and *source will be NULL.
0fd1802
+ */
0fd1802
+	extern int qpol_filename_trans_get_source_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
0fd1802
+						   const qpol_type_t ** source);
0fd1802
+
0fd1802
+/**
0fd1802
+ *  Get the target type from a filename transition rule.
0fd1802
+ *  @param policy The policy from which the rule comes.
0fd1802
+ *  @param rule The rule from which to get the target type.
0fd1802
+ *  @param target Pointer in which to store the target type.
0fd1802
+ *  The caller should not free this pointer.
0fd1802
+ *  @return 0 on success and < 0 on failure; if the call fails,
0fd1802
+ *  errno will be set and *target will be NULL.
0fd1802
+ */
0fd1802
+	extern int qpol_filename_trans_get_target_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
0fd1802
+						   const qpol_type_t ** target);
0fd1802
+
0fd1802
+/**
0fd1802
+ *  Get the default type from a type rule.
0fd1802
+ *  @param policy Policy from which the rule comes.
0fd1802
+ *  @param rule The rule from which to get the default type.
0fd1802
+ *  @param dflt Pointer in which to store the default type.
0fd1802
+ *  The caller should not free this pointer.
0fd1802
+ *  @returm 0 on success and < 0 on failure; if the call fails,
0fd1802
+ *  errno will be set and *dflt will be NULL.
0fd1802
+ */
0fd1802
+	extern int qpol_filename_trans_get_default_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
0fd1802
+						const qpol_type_t ** dflt);
0fd1802
+
0fd1802
+/**
0fd1802
+ *  Get the object class from a type rule.
0fd1802
+ *  @param policy Policy from which the rule comes.
0fd1802
+ *  @param rule The rule from which to get the object class.
0fd1802
+ *  @param obj_class Pointer in which to store the object class.
0fd1802
+ *  The caller should not free this pointer.
0fd1802
+ *  @returm 0 on success and < 0 on failure; if the call fails,
0fd1802
+ *  errno will be set and *obj_class will be NULL.
0fd1802
+ */
0fd1802
+	extern int qpol_filename_trans_get_object_class(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
0fd1802
+						const qpol_class_t ** obj_class);
0fd1802
+
0fd1802
+/**
0fd1802
+ *  Get the transition filename type from a type rule.
0fd1802
+ *  @param policy Policy from which the rule comes.
0fd1802
+ *  @param rule The rule from which to get the transition filename.
0fd1802
+ *  @param target Pointer in which to store the transition filename.
0fd1802
+ *  The caller should not free this pointer.
0fd1802
+ *  @returm 0 on success and < 0 on failure; if the call fails,
0fd1802
+ *  errno will be set and *target will be NULL.
0fd1802
+ */
0fd1802
+	extern int qpol_filename_trans_get_filename(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
0fd1802
+						       const char ** name);
0fd1802
+
0fd1802
+#ifdef	__cplusplus
0fd1802
+}
0fd1802
+#endif
0fd1802
+
0fd1802
+#endif				       /* QPOL_FTRULERULE_QUERY */
0fd1802
diff --git a/libqpol/include/qpol/policy.h b/libqpol/include/qpol/policy.h
0fd1802
index ae4ea08..bf85718 100644
0fd1802
--- a/libqpol/include/qpol/policy.h
0fd1802
+++ b/libqpol/include/qpol/policy.h
0fd1802
@@ -55,6 +55,7 @@ extern "C"
0fd1802
 #include <qpol/polcap_query.h>
0fd1802
 #include <qpol/portcon_query.h>
0fd1802
 #include <qpol/rbacrule_query.h>
0fd1802
+#include <qpol/ftrule_query.h>
0fd1802
 #include <qpol/role_query.h>
0fd1802
 #include <qpol/syn_rule_query.h>
0fd1802
 #include <qpol/terule_query.h>
0fd1802
diff --git a/libqpol/src/Makefile.am b/libqpol/src/Makefile.am
0fd1802
index 34d87a6..0889a61 100644
0fd1802
--- a/libqpol/src/Makefile.am
0fd1802
+++ b/libqpol/src/Makefile.am
0fd1802
@@ -48,6 +48,7 @@ libqpol_a_SOURCES = \
0fd1802
 	syn_rule_internal.h \
0fd1802
 	syn_rule_query.c \
0fd1802
 	terule_query.c \
0fd1802
+	ftrule_query.c \
0fd1802
 	type_query.c \
0fd1802
 	user_query.c \
0fd1802
 	util.c \
0fd1802
diff --git a/libqpol/src/ftrule_query.c b/libqpol/src/ftrule_query.c
0fd1802
new file mode 100644
0fd1802
index 0000000..d6db848
0fd1802
--- /dev/null
0fd1802
+++ b/libqpol/src/ftrule_query.c
0fd1802
@@ -0,0 +1,277 @@
0fd1802
+/**
0fd1802
+ *  @file
0fd1802
+ *  Defines public interface for iterating over RBAC rules.
0fd1802
+ *
0fd1802
+ *  @author Jeremy A. Mowery jmowery@tresys.com
0fd1802
+ *  @author Jason Tang jtang@tresys.com
0fd1802
+ *
0fd1802
+ *  Copyright (C) 2006-2007 Tresys Technology, LLC
0fd1802
+ *
0fd1802
+ *  This library is free software; you can redistribute it and/or
0fd1802
+ *  modify it under the terms of the GNU Lesser General Public
0fd1802
+ *  License as published by the Free Software Foundation; either
0fd1802
+ *  version 2.1 of the License, or (at your option) any later version.
0fd1802
+ *
0fd1802
+ *  This library is distributed in the hope that it will be useful,
0fd1802
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
0fd1802
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
0fd1802
+ *  Lesser General Public License for more details.
0fd1802
+ *
0fd1802
+ *  You should have received a copy of the GNU Lesser General Public
0fd1802
+ *  License along with this library; if not, write to the Free Software
0fd1802
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
0fd1802
+ */
0fd1802
+
0fd1802
+#include <qpol/iterator.h>
0fd1802
+#include <qpol/policy.h>
0fd1802
+#include <qpol/ftrule_query.h>
0fd1802
+#include <stdlib.h>
0fd1802
+#include "iterator_internal.h"
0fd1802
+#include "qpol_internal.h"
0fd1802
+#include <sepol/policydb/policydb.h>
0fd1802
+
0fd1802
+typedef struct filename_trans_state
0fd1802
+{
0fd1802
+	filename_trans_t *head;
0fd1802
+	filename_trans_t *cur;
0fd1802
+} filename_trans_state_t;
0fd1802
+
0fd1802
+static int filename_trans_state_end(const qpol_iterator_t * iter)
0fd1802
+{
0fd1802
+	filename_trans_state_t *fts = NULL;
0fd1802
+
0fd1802
+	if (!iter || !(fts = qpol_iterator_state(iter))) {
0fd1802
+		errno = EINVAL;
0fd1802
+		return STATUS_ERR;
0fd1802
+	}
0fd1802
+
0fd1802
+	return fts->cur ? 0 : 1;
0fd1802
+}
0fd1802
+
0fd1802
+static void *filename_trans_state_get_cur(const qpol_iterator_t * iter)
0fd1802
+{
0fd1802
+	filename_trans_state_t *fts = NULL;
0fd1802
+	const policydb_t *db = NULL;
0fd1802
+
0fd1802
+	if (!iter || !(fts = qpol_iterator_state(iter)) || !(db = qpol_iterator_policy(iter)) || filename_trans_state_end(iter)) {
0fd1802
+		errno = EINVAL;
0fd1802
+		return NULL;
0fd1802
+	}
0fd1802
+
0fd1802
+	return fts->cur;
0fd1802
+}
0fd1802
+
0fd1802
+static int filename_trans_state_next(qpol_iterator_t * iter)
0fd1802
+{
0fd1802
+	filename_trans_state_t *fts = NULL;
0fd1802
+	const policydb_t *db = NULL;
0fd1802
+
0fd1802
+	if (!iter || !(fts = qpol_iterator_state(iter)) || !(db = qpol_iterator_policy(iter))) {
0fd1802
+		errno = EINVAL;
0fd1802
+		return STATUS_ERR;
0fd1802
+	}
0fd1802
+
0fd1802
+	if (filename_trans_state_end(iter)) {
0fd1802
+		errno = ERANGE;
0fd1802
+		return STATUS_ERR;
0fd1802
+	}
0fd1802
+
0fd1802
+	fts->cur = fts->cur->next;
0fd1802
+
0fd1802
+	return STATUS_SUCCESS;
0fd1802
+}
0fd1802
+
0fd1802
+static size_t filename_trans_state_size(const qpol_iterator_t * iter)
0fd1802
+{
0fd1802
+	filename_trans_state_t *fts = NULL;
0fd1802
+	const policydb_t *db = NULL;
0fd1802
+	filename_trans_t *tmp = NULL;
0fd1802
+	size_t count = 0;
0fd1802
+
0fd1802
+	if (!iter || !(fts = qpol_iterator_state(iter)) || !(db = qpol_iterator_policy(iter))) {
0fd1802
+		errno = EINVAL;
0fd1802
+		return STATUS_ERR;
0fd1802
+	}
0fd1802
+
0fd1802
+	for (tmp = fts->head; tmp; tmp = tmp->next)
0fd1802
+		count++;
0fd1802
+
0fd1802
+	return count;
0fd1802
+}
0fd1802
+
0fd1802
+int qpol_policy_get_filename_trans_iter(const qpol_policy_t * policy, qpol_iterator_t ** iter)
0fd1802
+{
0fd1802
+	policydb_t *db = NULL;
0fd1802
+	filename_trans_state_t *fts = NULL;
0fd1802
+	int error = 0;
0fd1802
+
0fd1802
+	if (iter)
0fd1802
+		*iter = NULL;
0fd1802
+
0fd1802
+	if (!policy || !iter) {
0fd1802
+		ERR(policy, "%s", strerror(EINVAL));
0fd1802
+		errno = EINVAL;
0fd1802
+		return STATUS_ERR;
0fd1802
+	}
0fd1802
+
0fd1802
+	db = &policy->p->p;
0fd1802
+
0fd1802
+	fts = calloc(1, sizeof(filename_trans_state_t));
0fd1802
+	if (!fts) {
0fd1802
+		/* errno set by calloc */
0fd1802
+		ERR(policy, "%s", strerror(errno));
0fd1802
+		return STATUS_ERR;
0fd1802
+	}
0fd1802
+	fts->head = fts->cur = db->filename_trans;
0fd1802
+
0fd1802
+	if (qpol_iterator_create
0fd1802
+	    (policy, (void *)fts, filename_trans_state_get_cur, filename_trans_state_next, filename_trans_state_end, filename_trans_state_size,
0fd1802
+	     free, iter)) {
0fd1802
+		error = errno;
0fd1802
+		free(fts);
0fd1802
+		errno = error;
0fd1802
+		return STATUS_ERR;
0fd1802
+	}
0fd1802
+
0fd1802
+	return STATUS_SUCCESS;
0fd1802
+}
0fd1802
+
0fd1802
+int qpol_filename_trans_get_source_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** source)
0fd1802
+{
0fd1802
+	policydb_t *db = NULL;
0fd1802
+	filename_trans_t *ft = NULL;
0fd1802
+
0fd1802
+	if (source) {
0fd1802
+		*source = NULL;
0fd1802
+	}
0fd1802
+
0fd1802
+	if (!policy || !rule || !source) {
0fd1802
+		ERR(policy, "%s", strerror(EINVAL));
0fd1802
+		errno = EINVAL;
0fd1802
+		return STATUS_ERR;
0fd1802
+	}
0fd1802
+
0fd1802
+	db = &policy->p->p;
0fd1802
+	ft = (filename_trans_t *) rule;
0fd1802
+
0fd1802
+	*source = (qpol_type_t *) db->type_val_to_struct[ft->stype - 1];
0fd1802
+
0fd1802
+	return STATUS_SUCCESS;
0fd1802
+}
0fd1802
+
0fd1802
+int qpol_filename_trans_get_target_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** target)
0fd1802
+{
0fd1802
+	policydb_t *db = NULL;
0fd1802
+	filename_trans_t *ft = NULL;
0fd1802
+
0fd1802
+	if (target) {
0fd1802
+		*target = NULL;
0fd1802
+	}
0fd1802
+
0fd1802
+	if (!policy || !rule || !target) {
0fd1802
+		ERR(policy, "%s", strerror(EINVAL));
0fd1802
+		errno = EINVAL;
0fd1802
+		return STATUS_ERR;
0fd1802
+	}
0fd1802
+
0fd1802
+	db = &policy->p->p;
0fd1802
+	ft = (filename_trans_t *) rule;
0fd1802
+
0fd1802
+	*target = (qpol_type_t *) db->type_val_to_struct[ft->ttype - 1];
0fd1802
+
0fd1802
+	return STATUS_SUCCESS;
0fd1802
+}
0fd1802
+
0fd1802
+int qpol_filename_trans_get_object_class(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
0fd1802
+						const qpol_class_t ** obj_class)
0fd1802
+{
0fd1802
+	policydb_t *db = NULL;
0fd1802
+	filename_trans_t *ft = NULL;
0fd1802
+
0fd1802
+	if (obj_class) {
0fd1802
+		*obj_class = NULL;
0fd1802
+	}
0fd1802
+
0fd1802
+	if (!policy || !rule || !obj_class) {
0fd1802
+		ERR(policy, "%s", strerror(EINVAL));
0fd1802
+		errno = EINVAL;
0fd1802
+		return STATUS_ERR;
0fd1802
+	}
0fd1802
+
0fd1802
+	db = &policy->p->p;
0fd1802
+	ft = (filename_trans_t *) rule;
0fd1802
+
0fd1802
+	*obj_class = (qpol_class_t *) db->class_val_to_struct[ft->tclass - 1];
0fd1802
+
0fd1802
+	return STATUS_SUCCESS;
0fd1802
+}
0fd1802
+
0fd1802
+int qpol_filename_trans_get_trans_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** output_type)
0fd1802
+{
0fd1802
+	policydb_t *db = NULL;
0fd1802
+	filename_trans_t *ft = NULL;
0fd1802
+
0fd1802
+	if (output_type) {
0fd1802
+		*output_type = NULL;
0fd1802
+	}
0fd1802
+
0fd1802
+	if (!policy || !rule || !output_type) {
0fd1802
+		ERR(policy, "%s", strerror(EINVAL));
0fd1802
+		errno = EINVAL;
0fd1802
+		return STATUS_ERR;
0fd1802
+	}
0fd1802
+
0fd1802
+	db = &policy->p->p;
0fd1802
+	ft = (filename_trans_t *) rule;
0fd1802
+
0fd1802
+	*output_type = (qpol_type_t *) db->type_val_to_struct[ft->otype - 1];
0fd1802
+
0fd1802
+	return STATUS_SUCCESS;
0fd1802
+}
0fd1802
+
0fd1802
+int qpol_filename_trans_get_default_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** dflt)
0fd1802
+{
0fd1802
+	policydb_t *db = NULL;
0fd1802
+	filename_trans_t *ft = NULL;
0fd1802
+
0fd1802
+	if (dflt) {
0fd1802
+		*dflt = NULL;
0fd1802
+	}
0fd1802
+
0fd1802
+	if (!policy || !rule || !dflt) {
0fd1802
+		ERR(policy, "%s", strerror(EINVAL));
0fd1802
+		errno = EINVAL;
0fd1802
+		return STATUS_ERR;
0fd1802
+	}
0fd1802
+
0fd1802
+	db = &policy->p->p;
0fd1802
+	ft = (filename_trans_t *) rule;
0fd1802
+
0fd1802
+	*dflt = (qpol_type_t *) db->type_val_to_struct[ft->otype - 1];
0fd1802
+
0fd1802
+	return STATUS_SUCCESS;
0fd1802
+}
0fd1802
+
0fd1802
+int qpol_filename_trans_get_filename(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const char ** name)
0fd1802
+{
0fd1802
+	policydb_t *db = NULL;
0fd1802
+	filename_trans_t *ft = NULL;
0fd1802
+
0fd1802
+	if (name) {
0fd1802
+		*name = NULL;
0fd1802
+	}
0fd1802
+
0fd1802
+	if (!policy || !rule || !name) {
0fd1802
+		ERR(policy, "%s", strerror(EINVAL));
0fd1802
+		errno = EINVAL;
0fd1802
+		return STATUS_ERR;
0fd1802
+	}
0fd1802
+
0fd1802
+	db = &policy->p->p;
0fd1802
+	ft = (filename_trans_t *) rule;
0fd1802
+
0fd1802
+	*name = ft->name;
0fd1802
+
0fd1802
+	return STATUS_SUCCESS;
0fd1802
+}
0fd1802
+
0fd1802
diff --git a/libqpol/src/libqpol.map b/libqpol/src/libqpol.map
0fd1802
index dd293bc..6973cca 100644
0fd1802
--- a/libqpol/src/libqpol.map
0fd1802
+++ b/libqpol/src/libqpol.map
0fd1802
@@ -34,6 +34,7 @@ VERS_1.2 {
0fd1802
 		qpol_policy_reevaluate_conds;
0fd1802
 		qpol_portcon_*;
0fd1802
 		qpol_range_trans_*;
0fd1802
+		qpol_filename_trans_*;
0fd1802
 		qpol_role_*;
0fd1802
 		qpol_syn_avrule_*;
0fd1802
 		qpol_syn_terule_*;
0fd1802
diff --git a/libqpol/src/module_compiler.c b/libqpol/src/module_compiler.c
0fd1802
index dc19798..b06e285 100644
0fd1802
--- a/libqpol/src/module_compiler.c
0fd1802
+++ b/libqpol/src/module_compiler.c
0fd1802
@@ -1247,6 +1247,18 @@ void append_role_allow(role_allow_rule_t * role_allow_rules)
0fd1802
 }
0fd1802
 
0fd1802
 /* this doesn't actually append, but really prepends it */
0fd1802
+void append_filename_trans(filename_trans_rule_t * filename_trans_rules)
0fd1802
+{
0fd1802
+	avrule_decl_t *decl = stack_top->decl;
0fd1802
+
0fd1802
+	/* filename transitions are not allowed within conditionals */
0fd1802
+	assert(stack_top->type == 1);
0fd1802
+
0fd1802
+	filename_trans_rules->next = decl->filename_trans_rules;
0fd1802
+	decl->filename_trans_rules = filename_trans_rules;
0fd1802
+}
0fd1802
+
0fd1802
+/* this doesn't actually append, but really prepends it */
0fd1802
 void append_range_trans(range_trans_rule_t * range_tr_rules)
0fd1802
 {
0fd1802
 	avrule_decl_t *decl = stack_top->decl;
0fd1802
diff --git a/libqpol/src/policy_define.c b/libqpol/src/policy_define.c
0fd1802
index c94f7aa..0f3a45a 100644
0fd1802
--- a/libqpol/src/policy_define.c
0fd1802
+++ b/libqpol/src/policy_define.c
0fd1802
@@ -2133,7 +2133,7 @@ int define_role_trans(void)
0fd1802
 
0fd1802
 	/* This ebitmap business is just to ensure that there are not conflicting role_trans rules */
0fd1802
 #ifdef HAVE_SEPOL_USER_ROLE_MAPPING
0fd1802
-	if (role_set_expand(&roles, &e_roles, policydbp, NULL))
0fd1802
+	if (role_set_expand(&roles, &e_roles, policydbp, NULL, NULL))
0fd1802
 #else
0fd1802
 	if (role_set_expand(&roles, &e_roles, policydbp))
0fd1802
 #endif
0fd1802
@@ -2226,6 +2226,190 @@ int define_role_allow(void)
0fd1802
 	return 0;
0fd1802
 }
0fd1802
 
0fd1802
+avrule_t *define_cond_filename_trans(void)
0fd1802
+{
0fd1802
+	yyerror("type transitions with a filename not allowed inside "
0fd1802
+		"conditionals\n");
0fd1802
+	return COND_ERR;
0fd1802
+}
0fd1802
+
0fd1802
+int define_filename_trans(void)
0fd1802
+{
0fd1802
+	char *id, *name = NULL;
0fd1802
+	type_set_t stypes, ttypes;
0fd1802
+	ebitmap_t e_stypes, e_ttypes;
0fd1802
+	ebitmap_t e_tclasses;
0fd1802
+	ebitmap_node_t *snode, *tnode, *cnode;
0fd1802
+	filename_trans_t *ft;
0fd1802
+	filename_trans_rule_t *ftr;
0fd1802
+	class_datum_t *cladatum;
0fd1802
+	type_datum_t *typdatum;
0fd1802
+	uint32_t otype;
0fd1802
+	unsigned int c, s, t;
0fd1802
+	int add;
0fd1802
+
0fd1802
+	if (pass == 1) {
0fd1802
+		/* stype */
0fd1802
+		while ((id = queue_remove(id_queue)))
0fd1802
+			free(id);
0fd1802
+		/* ttype */
0fd1802
+		while ((id = queue_remove(id_queue)))
0fd1802
+			free(id);
0fd1802
+		/* tclass */
0fd1802
+		while ((id = queue_remove(id_queue)))
0fd1802
+			free(id);
0fd1802
+		/* otype */
0fd1802
+		id = queue_remove(id_queue);
0fd1802
+		free(id);
0fd1802
+		/* name */
0fd1802
+		id = queue_remove(id_queue);
0fd1802
+		free(id);
0fd1802
+		return 0;
0fd1802
+	}
0fd1802
+
0fd1802
+
0fd1802
+	add = 1;
0fd1802
+	type_set_init(&stypes);
0fd1802
+	while ((id = queue_remove(id_queue))) {
0fd1802
+		if (set_types(&stypes, id, &add, 0))
0fd1802
+			goto bad;
0fd1802
+	}
0fd1802
+
0fd1802
+	add =1;
0fd1802
+	type_set_init(&ttypes);
0fd1802
+	while ((id = queue_remove(id_queue))) {
0fd1802
+		if (set_types(&ttypes, id, &add, 0))
0fd1802
+			goto bad;
0fd1802
+	}
0fd1802
+
0fd1802
+	ebitmap_init(&e_tclasses);
0fd1802
+	while ((id = queue_remove(id_queue))) {
0fd1802
+		if (!is_id_in_scope(SYM_CLASSES, id)) {
0fd1802
+			yyerror2("class %s is not within scope", id);
0fd1802
+			free(id);
0fd1802
+			goto bad;
0fd1802
+		}
0fd1802
+		cladatum = hashtab_search(policydbp->p_classes.table, id);
0fd1802
+		if (!cladatum) {
0fd1802
+			yyerror2("unknown class %s", id);
0fd1802
+			goto bad;
0fd1802
+		}
0fd1802
+		if (ebitmap_set_bit(&e_tclasses, cladatum->s.value - 1, TRUE)) {
0fd1802
+			yyerror("Out of memory");
0fd1802
+			goto bad;
0fd1802
+		}
0fd1802
+		free(id);
0fd1802
+	}
0fd1802
+
0fd1802
+	id = (char *)queue_remove(id_queue);
0fd1802
+	if (!id) {
0fd1802
+		yyerror("no otype in transition definition?");
0fd1802
+		goto bad;
0fd1802
+	}
0fd1802
+	if (!is_id_in_scope(SYM_TYPES, id)) {
0fd1802
+		yyerror2("type %s is not within scope", id);
0fd1802
+		free(id);
0fd1802
+		goto bad;
0fd1802
+	}
0fd1802
+	typdatum = hashtab_search(policydbp->p_types.table, id);
0fd1802
+	if (!typdatum) {
0fd1802
+		yyerror2("unknown type %s used in transition definition", id);
0fd1802
+		goto bad;
0fd1802
+	}
0fd1802
+	free(id);
0fd1802
+	otype = typdatum->s.value;
0fd1802
+
0fd1802
+	name = queue_remove(id_queue);
0fd1802
+	if (!name) {
0fd1802
+		yyerror("no pathname specified in filename_trans definition?");
0fd1802
+		goto bad;
0fd1802
+	}
0fd1802
+
0fd1802
+	/* We expand the class set into seperate rules.  We expand the types
0fd1802
+	 * just to make sure there are not duplicates.  They will get turned
0fd1802
+	 * into seperate rules later */
0fd1802
+	ebitmap_init(&e_stypes);
0fd1802
+	if (type_set_expand(&stypes, &e_stypes, policydbp, 1))
0fd1802
+		goto bad;
0fd1802
+
0fd1802
+	ebitmap_init(&e_ttypes);
0fd1802
+	if (type_set_expand(&ttypes, &e_ttypes, policydbp, 1))
0fd1802
+		goto bad;
0fd1802
+
0fd1802
+	ebitmap_for_each_bit(&e_tclasses, cnode, c) {
0fd1802
+		if (!ebitmap_node_get_bit(cnode, c))
0fd1802
+			continue;
0fd1802
+		ebitmap_for_each_bit(&e_stypes, snode, s) {
0fd1802
+			if (!ebitmap_node_get_bit(snode, s))
0fd1802
+				continue;
0fd1802
+			ebitmap_for_each_bit(&e_ttypes, tnode, t) {
0fd1802
+				if (!ebitmap_node_get_bit(tnode, t))
0fd1802
+					continue;
0fd1802
+	
0fd1802
+				for (ft = policydbp->filename_trans; ft; ft = ft->next) {
0fd1802
+					if (ft->stype == (s + 1) &&
0fd1802
+					    ft->ttype == (t + 1) &&
0fd1802
+					    ft->tclass == (c + 1) &&
0fd1802
+					    !strcmp(ft->name, name)) {
0fd1802
+						yyerror2("duplicate filename transition for: filename_trans %s %s %s:%s",
0fd1802
+							 name, 
0fd1802
+							 policydbp->p_type_val_to_name[s],
0fd1802
+							 policydbp->p_type_val_to_name[t],
0fd1802
+							 policydbp->p_class_val_to_name[c]);
0fd1802
+						goto bad;
0fd1802
+					}
0fd1802
+				}
0fd1802
+	
0fd1802
+				ft = malloc(sizeof(*ft));
0fd1802
+				if (!ft) {
0fd1802
+					yyerror("out of memory");
0fd1802
+					goto bad;
0fd1802
+				}
0fd1802
+				memset(ft, 0, sizeof(*ft));
0fd1802
+	
0fd1802
+				ft->next = policydbp->filename_trans;
0fd1802
+				policydbp->filename_trans = ft;
0fd1802
+	
0fd1802
+				ft->name = strdup(name);
0fd1802
+				if (!ft->name) {
0fd1802
+					yyerror("out of memory");
0fd1802
+					goto bad;
0fd1802
+				}
0fd1802
+				ft->stype = s + 1;
0fd1802
+				ft->ttype = t + 1;
0fd1802
+				ft->tclass = c + 1;
0fd1802
+				ft->otype = otype;
0fd1802
+			}
0fd1802
+		}
0fd1802
+	
0fd1802
+		/* Now add the real rule since we didn't find any duplicates */
0fd1802
+		ftr = malloc(sizeof(*ftr));
0fd1802
+		if (!ftr) {
0fd1802
+			yyerror("out of memory");
0fd1802
+			goto bad;
0fd1802
+		}
0fd1802
+		filename_trans_rule_init(ftr);
0fd1802
+		append_filename_trans(ftr);
0fd1802
+
0fd1802
+		ftr->name = strdup(name);
0fd1802
+		ftr->stypes = stypes;
0fd1802
+		ftr->ttypes = ttypes;
0fd1802
+		ftr->tclass = c + 1;
0fd1802
+		ftr->otype = otype;
0fd1802
+	}
0fd1802
+
0fd1802
+	free(name);
0fd1802
+	ebitmap_destroy(&e_stypes);
0fd1802
+	ebitmap_destroy(&e_ttypes);
0fd1802
+	ebitmap_destroy(&e_tclasses);
0fd1802
+
0fd1802
+	return 0;
0fd1802
+
0fd1802
+bad:
0fd1802
+	free(name);
0fd1802
+	return -1;
0fd1802
+}
0fd1802
+
0fd1802
 static constraint_expr_t *constraint_expr_clone(constraint_expr_t * expr)
0fd1802
 {
0fd1802
 	constraint_expr_t *h = NULL, *l = NULL, *e, *newe;
0fd1802
diff --git a/libqpol/src/policy_parse.y b/libqpol/src/policy_parse.y
0fd1802
index 84f4114..dc16c6f 100644
0fd1802
--- a/libqpol/src/policy_parse.y
0fd1802
+++ b/libqpol/src/policy_parse.y
0fd1802
@@ -98,6 +98,7 @@ extern char *qpol_src_inputlim;/* end of data */
0fd1802
 %type <require_func> require_decl_def
0fd1802
 
0fd1802
 %token PATH
0fd1802
+%token FILENAME
0fd1802
 %token CLONE
0fd1802
 %token COMMON
0fd1802
 %token CLASS
0fd1802
@@ -360,7 +361,10 @@ cond_rule_def           : cond_transition_def
0fd1802
 			| require_block
0fd1802
 			{ $$ = NULL; }
0fd1802
                         ;
0fd1802
-cond_transition_def	: TYPE_TRANSITION names names ':' names identifier ';'
0fd1802
+cond_transition_def	: TYPE_TRANSITION names names ':' names identifier filename ';'
0fd1802
+                        { $$ = define_cond_filename_trans() ;
0fd1802
+                          if ($$ == COND_ERR) return -1;}
0fd1802
+                        | TYPE_TRANSITION names names ':' names identifier ';'
0fd1802
                         { $$ = define_cond_compute_type(AVRULE_TRANSITION) ;
0fd1802
                           if ($$ == COND_ERR) return -1;}
0fd1802
                         | TYPE_MEMBER names names ':' names identifier ';'
0fd1802
@@ -395,7 +399,9 @@ cond_dontaudit_def	: DONTAUDIT names names ':' names names ';'
0fd1802
 			{ $$ = define_cond_te_avtab(AVRULE_DONTAUDIT);
0fd1802
                           if ($$ == COND_ERR) return -1; }
0fd1802
 		        ;
0fd1802
-transition_def		: TYPE_TRANSITION names names ':' names identifier ';'
0fd1802
+transition_def		: TYPE_TRANSITION  names names ':' names identifier filename ';'
0fd1802
+			{if (define_filename_trans()) return -1; }
0fd1802
+			| TYPE_TRANSITION names names ':' names identifier ';'
0fd1802
                         {if (define_compute_type(AVRULE_TRANSITION)) return -1;}
0fd1802
                         | TYPE_MEMBER names names ':' names identifier ';'
0fd1802
                         {if (define_compute_type(AVRULE_MEMBER)) return -1;}
0fd1802
@@ -752,6 +758,9 @@ identifier		: IDENTIFIER
0fd1802
 path     		: PATH
0fd1802
 			{ if (insert_id(yytext,0)) return -1; }
0fd1802
 			;
0fd1802
+filename		: FILENAME
0fd1802
+			{ yytext[strlen(yytext) - 1] = '\0'; if (insert_id(yytext + 1,0)) return -1; }
0fd1802
+			;
0fd1802
 number			: NUMBER 
0fd1802
 			{ $$ = strtoul(yytext,NULL,0); }
0fd1802
 			;
0fd1802
diff --git a/libqpol/src/policy_scan.l b/libqpol/src/policy_scan.l
0fd1802
index 75485f3..30203cd 100644
0fd1802
--- a/libqpol/src/policy_scan.l
0fd1802
+++ b/libqpol/src/policy_scan.l
0fd1802
@@ -235,6 +235,7 @@ POLICYCAP			{ return(POLICYCAP); }
0fd1802
 permissive |
0fd1802
 PERMISSIVE			{ return(PERMISSIVE); }
0fd1802
 "/"({alnum}|[_\.\-/])*	        { return(PATH); }
0fd1802
+\"({alnum}|[_\.\-])+\"			{ return(FILENAME); }
0fd1802
 {letter}({alnum}|[_\-])*([\.]?({alnum}|[_\-]))*	{ return(IDENTIFIER); }
0fd1802
 {digit}+|0x{hexval}+            { return(NUMBER); }
0fd1802
 {digit}{1,3}(\.{digit}{1,3}){3}    { return(IPV4_ADDR); }
0fd1802
diff --git a/secmds/sesearch.c b/secmds/sesearch.c
0fd1802
index ec0315f..e44b3bc 100644
0fd1802
--- a/secmds/sesearch.c
0fd1802
+++ b/secmds/sesearch.c
0fd1802
@@ -575,6 +575,95 @@ static void print_te_results(const apol_policy_t * policy, const options_t * opt
0fd1802
 	free(expr);
0fd1802
 }
0fd1802
 
0fd1802
+static int perform_ft_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v)
0fd1802
+{
0fd1802
+	apol_filename_trans_query_t *ftq = NULL;
0fd1802
+	int error = 0;
0fd1802
+
0fd1802
+	if (!policy || !opt || !v) {
0fd1802
+		ERR(policy, "%s", strerror(EINVAL));
0fd1802
+		errno = EINVAL;
0fd1802
+		return -1;
0fd1802
+	}
0fd1802
+
0fd1802
+	if (!opt->type == QPOL_RULE_TYPE_TRANS && !opt->all) {
0fd1802
+		*v = NULL;
0fd1802
+		return 0;	       /* no search to do */
0fd1802
+	}
0fd1802
+
0fd1802
+	ftq = apol_filename_trans_query_create();
0fd1802
+	if (!ftq) {
0fd1802
+		ERR(policy, "%s", strerror(ENOMEM));
0fd1802
+		errno = ENOMEM;
0fd1802
+		return -1;
0fd1802
+	}
0fd1802
+
0fd1802
+	apol_filename_trans_query_set_regex(policy, ftq, opt->useregex);
0fd1802
+	if (opt->src_name) {
0fd1802
+		if (apol_filename_trans_query_set_source(policy, ftq, opt->src_name)) {
0fd1802
+			error = errno;
0fd1802
+			goto err;
0fd1802
+		}
0fd1802
+	}
0fd1802
+	if (opt->tgt_name) {
0fd1802
+		if (apol_filename_trans_query_set_target(policy, ftq, opt->tgt_name, opt->indirect)) {
0fd1802
+			error = errno;
0fd1802
+			goto err;
0fd1802
+		}
0fd1802
+	}
0fd1802
+
0fd1802
+	if (apol_filename_trans_get_by_query(policy, ftq, v)) {
0fd1802
+		error = errno;
0fd1802
+		goto err;
0fd1802
+	}
0fd1802
+
0fd1802
+	apol_filename_trans_query_destroy(&ftq);
0fd1802
+	return 0;
0fd1802
+
0fd1802
+      err:
0fd1802
+	apol_vector_destroy(v);
0fd1802
+	apol_filename_trans_query_destroy(&ftq);
0fd1802
+	ERR(policy, "%s", strerror(error));
0fd1802
+	errno = error;
0fd1802
+	return -1;
0fd1802
+}
0fd1802
+
0fd1802
+static void print_ft_results(const apol_policy_t * policy, const options_t * opt, const apol_vector_t * v)
0fd1802
+{
0fd1802
+	qpol_policy_t *q = apol_policy_get_qpol(policy);
0fd1802
+	size_t i, num_rules = 0;
0fd1802
+	const qpol_filename_trans_t *rule = NULL;
0fd1802
+	char *tmp = NULL, *rule_str = NULL, *expr = NULL;
0fd1802
+	char enable_char = ' ', branch_char = ' ';
0fd1802
+	qpol_iterator_t *iter = NULL;
0fd1802
+	const qpol_cond_t *cond = NULL;
0fd1802
+	uint32_t enabled = 0, list = 0;
0fd1802
+
0fd1802
+	if (!(num_rules = apol_vector_get_size(v)))
0fd1802
+		goto cleanup;
0fd1802
+
0fd1802
+	fprintf(stdout, "Found %zd named file transition rules:\n", num_rules);
0fd1802
+
0fd1802
+	for (i = 0; i < num_rules; i++) {
0fd1802
+		enable_char = branch_char = ' ';
0fd1802
+		if (!(rule = apol_vector_get_element(v, i)))
0fd1802
+			goto cleanup;
0fd1802
+
0fd1802
+		if (!(rule_str = apol_filename_trans_render(policy, rule)))
0fd1802
+			goto cleanup;
0fd1802
+		fprintf(stdout, "%s %s\n", rule_str, expr ? expr : "");
0fd1802
+		free(rule_str);
0fd1802
+		rule_str = NULL;
0fd1802
+		free(expr);
0fd1802
+		expr = NULL;
0fd1802
+	}
0fd1802
+
0fd1802
+      cleanup:
0fd1802
+	free(tmp);
0fd1802
+	free(rule_str);
0fd1802
+	free(expr);
0fd1802
+}
0fd1802
+
0fd1802
 static int perform_ra_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v)
0fd1802
 {
0fd1802
 	apol_role_allow_query_t *raq = NULL;
0fd1802
@@ -1128,6 +1217,18 @@ int main(int argc, char **argv)
0fd1802
 			print_te_results(policy, &cmd_opts, v);
0fd1802
 		fprintf(stdout, "\n");
0fd1802
 	}
0fd1802
+
0fd1802
+	if (cmd_opts.all || cmd_opts.type == QPOL_RULE_TYPE_TRANS) {
0fd1802
+		apol_vector_destroy(&v);
0fd1802
+		if (perform_ft_query(policy, &cmd_opts, &v)) {
0fd1802
+			rt = 1;
0fd1802
+			goto cleanup;
0fd1802
+		}
0fd1802
+
0fd1802
+		print_ft_results(policy, &cmd_opts, v);
0fd1802
+		fprintf(stdout, "\n");
0fd1802
+	}
0fd1802
+
0fd1802
 	apol_vector_destroy(&v);
0fd1802
 	if (perform_ra_query(policy, &cmd_opts, &v)) {
0fd1802
 		rt = 1;
0fd1802
-- 
0fd1802
1.7.6.2
0fd1802
66ba7d0
diff -up setools-3.3.7/libapol/include/apol/Makefile.am.filenametrans setools-3.3.7/libapol/include/apol/Makefile.am
66ba7d0
--- setools-3.3.7/libapol/include/apol/Makefile.am.filenametrans	2009-07-14 14:03:27.000000000 -0400
66ba7d0
+++ setools-3.3.7/libapol/include/apol/Makefile.am	2011-10-26 16:24:59.948130442 -0400
66ba7d0
@@ -27,6 +27,7 @@ apol_HEADERS = \
66ba7d0
 	relabel-analysis.h \
66ba7d0
 	render.h \
66ba7d0
 	role-query.h \
66ba7d0
+	ftrule-query.h \
66ba7d0
 	terule-query.h \
66ba7d0
 	type-query.h \
66ba7d0
 	types-relation-analysis.h \
66ba7d0
diff -up setools-3.3.7/libqpol/include/qpol/Makefile.am.filenametrans setools-3.3.7/libqpol/include/qpol/Makefile.am
66ba7d0
--- setools-3.3.7/libqpol/include/qpol/Makefile.am.filenametrans	2011-10-26 16:22:28.723523155 -0400
66ba7d0
+++ setools-3.3.7/libqpol/include/qpol/Makefile.am	2011-10-26 16:22:41.283493767 -0400
66ba7d0
@@ -25,6 +25,7 @@ qpol_HEADERS = \
66ba7d0
 	role_query.h \
66ba7d0
 	syn_rule_query.h \
66ba7d0
 	terule_query.h \
66ba7d0
+	ftrule_query.h \
66ba7d0
 	type_query.h \
66ba7d0
 	user_query.h \
66ba7d0
 	util.h