1#!/usr/bin/env python
2# coding: utf-8
3
4"""
5Copyright (c) 2023 Huawei Device Co., Ltd.
6Licensed under the Apache License, Version 2.0 (the "License");
7you may not use this file except in compliance with the License.
8You may obtain a copy of the License at
9
10    http://www.apache.org/licenses/LICENSE-2.0
11
12Unless required by applicable law or agreed to in writing, software
13distributed under the License is distributed on an "AS IS" BASIS,
14WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15See the License for the specific language governing permissions and
16limitations under the License.
17
18"""
19
20import argparse
21import os
22from check_common import read_json_file, run_command
23
24
25def get_request_args(args, request):
26    arg_list = request.split()
27    request_args = []
28    for arg in arg_list:
29        if arg == "--file_contexts":
30            request_args.append(arg)
31            request_args.append(os.path.join(args.output_path, "file_contexts"))
32        if arg == "--cil_file":
33            request_args.append(arg)
34            request_args.append(os.path.join(args.output_path, "all.cil"))
35            request_args.append("--developer_cil_file")
36            request_args.append(os.path.join(args.output_path, "developer/all.cil"))
37    return request_args
38
39
40def build_cil(args):
41    check_policy_cmd = [os.path.join(args.tool_path, "checkpolicy"),
42                        "-b", args.user_policy,
43                        "-M", "-C", "-S", "-O",
44                        "-o", os.path.join(args.output_path, "all.cil")]
45    run_command(check_policy_cmd)
46    check_policy_cmd = [os.path.join(args.tool_path, "checkpolicy"),
47                        "-b", args.developer_policy,
48                        "-M", "-C", "-S", "-O",
49                        "-o", os.path.join(args.output_path, "developer/all.cil")]
50    run_command(check_policy_cmd)
51
52
53def get_policy_dir_list(args):
54    path_list = ["base/security/selinux_adapter/sepolicy"]
55    path_list += args.policy_dir_list.split(":")
56
57    build_dir_list = []
58    for i in path_list:
59        if i == "" or i == "default":
60            continue
61        path = os.path.join(args.source_root_dir, i)
62        if (os.path.exists(path)):
63            build_dir_list.append(path)
64        else:
65            print("following path not exists {}".format(path))
66            raise Exception(-1)
67
68    return build_dir_list
69
70
71def parse_args():
72    parser = argparse.ArgumentParser()
73    parser.add_argument('--output-path', help='the selinux compile output path', required=True)
74    parser.add_argument('--source-root-dir', help='the project root path', required=True)
75    parser.add_argument('--selinux-check-config', help='the selinux check config file path', required=True)
76    parser.add_argument('--user-policy', help='the user policy file', required=True)
77    parser.add_argument('--developer-policy', help='the developer policy file', required=True)
78    parser.add_argument('--tool-path', help='the policy tool bin path', required=True)
79    parser.add_argument('--policy-dir-list', help='policy dirs need to be included', required=True)
80    return parser.parse_args()
81
82
83if __name__ == "__main__":
84    input_args = parse_args()
85    build_cil(input_args)
86    policy_dir_list = get_policy_dir_list(input_args)
87    check_config = read_json_file(os.path.join(input_args.source_root_dir, input_args.selinux_check_config))
88    check_list = check_config.get("selinux_check")
89    for check in check_list:
90        script = os.path.join(input_args.source_root_dir, check.get("script"))
91        cmd = ["python", script]
92        cmd.extend(get_request_args(input_args, check.get("args")))
93        extra_args = check.get("extra_args").split()
94        if len(extra_args):
95            cmd.extend(extra_args)
96        cmd.extend(["--policy-dir-list", ":".join(policy_dir_list)])
97        run_command(cmd)
98