Changeset 1995

Timestamp:

03/12/08 12:45:03 (8 months ago)

Author:

dsugar

Message:

Begin changes to policy translator to support customization stuff.
So far domains, resources, entrypoints and accesses have been started.
None of this is finalized, but it should be enough for Anand to move forward with.

Files:

• branches/custome_policy/framework-plugin/src/com/tresys/framework/compiler/policy/AccessResource.java (modified) (1 diff)
• branches/custome_policy/framework-plugin/src/com/tresys/framework/compiler/policy/ComponentWithDictObjects.java (modified) (3 diffs)
• branches/custome_policy/framework-plugin/src/com/tresys/framework/compiler/policy/Domain.java (modified) (1 diff)
• branches/custome_policy/framework-plugin/src/com/tresys/framework/compiler/policy/Resource.java (modified) (3 diffs)
• branches/custome_policy/framework-plugin/src/com/tresys/framework/compiler/translator/SELinuxPolicy.java (modified) (34 diffs)
• branches/custome_policy/framework-plugin/src/com/tresys/framework/plugin/editor/action/AddCustomPolicy.java (modified) (5 diffs)
• branches/custome_policy/framework-plugin/src/com/tresys/framework/plugin/editor/policy/graphic/GraphicPolicyEditorContextMenuProvider.java (modified) (4 diffs)
• branches/custome_policy/framework-plugin/src/com/tresys/framework/plugin/editor/policy/graphic/model/AccessConnection.java (modified) (2 diffs)
• branches/custome_policy/framework-plugin/src/com/tresys/framework/plugin/editor/policy/graphic/model/Connection.java (modified) (2 diffs)
• branches/custome_policy/framework-plugin/src/com/tresys/framework/plugin/editor/policy/graphic/model/EntryConnection.java (modified) (2 diffs)

branches/custome_policy/framework-plugin/src/com/tresys/framework/compiler/policy/AccessResource.java

@@ -85 +85 @@
-                return allDefns;
-        }
-
+
+
+
+
+
+
+
+
+
+
+
+
-        /*
-         *  (non-Javadoc)

branches/custome_policy/framework-plugin/src/com/tresys/framework/compiler/policy/ComponentWithDictObjects.java

@@ -20 +20 @@
-import com.tresys.framework.compiler.ErrorHandler;
-import com.tresys.framework.compiler.AbstractToken;
+import com.tresys.framework.compiler.custom.ICustomPolicy;
-import com.tresys.framework.compiler.dictionary.Rdef;
-import com.tresys.framework.compiler.dictionary.IDictionaryObject;
@@ -41 +42 @@
-public abstract class ComponentWithDictObjects 
-        extends Component 
-
+, ICustomPolicy
-{
-        protected final Map/*<String, Rdef>*/assocRdefs; // associated rdefs
@@ -292 +293 @@
-                sysResources.clear();
-        }
+
+        public boolean supportsCustomPolicy()
+        {
+                return true;
+        }
+        
+        public boolean hasCustomization()
+        {
+                return mIsModified;
+        }
+        
+        public void markCustomized ()
+        {
+                mIsModified = true;
+        }
+        
+        public void removeCustomization ()
+        {
+                mIsModified = false;
+        }
-}

branches/custome_policy/framework-plugin/src/com/tresys/framework/compiler/policy/Domain.java

@@ -359 +359 @@
-        public boolean supportsCustomPolicy()
-        {
-
-
-
-
-
-
-
-
+
+
-}

branches/custome_policy/framework-plugin/src/com/tresys/framework/compiler/policy/Resource.java

@@ -17 +17 @@
-
-import com.tresys.framework.compiler.AbstractToken;
-import com.tresys.framework.compiler.custom.ICustomPolicy;
-import com.tresys.framework.compiler.dictionary.Rdef;
-import com.tresys.framework.compiler.dictionary.Verb;
@@ -32 +31 @@
-public class Resource 
-        extends ComponentWithDictObjects
-, ICustomPolicy
+
-{
-
@@ -143 +142 @@
-                accesses.clear();
-        }
-        
-        public boolean supportsCustomPolicy()
-        {
-                return true;
-        }
-        
-        public boolean hasCustomization()
-        {
-                return mIsModified;
-        }
-        
-        public void markCustomized ()
-        {
-                mIsModified = true;
-        }
-        
-        public void removeCustomization ()
-        {
-                mIsModified = false;
-        }
-
-}

branches/custome_policy/framework-plugin/src/com/tresys/framework/compiler/translator/SELinuxPolicy.java

@@ -47 +47 @@
-import com.tresys.framework.compiler.Utility;
-import com.tresys.framework.compiler.dictionary.AccessDefn;
+import com.tresys.framework.compiler.dictionary.AccessDefnGroup;
-import com.tresys.framework.compiler.dictionary.AccessTarget;
-import com.tresys.framework.compiler.dictionary.EntryAccessDefn;
@@ -78 +79 @@
-import com.tresys.framework.compiler.policy.IMLSSetting;
-import com.tresys.framework.compiler.policy.IPolicyVisitor;
-import com.tresys.framework.compiler.policy.IResource;
-import com.tresys.framework.compiler.policy.Policy;
-import com.tresys.framework.compiler.policy.Resource;
@@ -93 +93 @@
-{       
-        private final Linkage m_linkage;
+        private final boolean m_bGeneratePolicyTemplate;
-        
-        private boolean m_hasFileContext = false;
@@ -116 +117 @@
-                m_moduleName = _moduleName;
-                m_hasFileContext = false;
+                m_bGeneratePolicyTemplate = false;
-        
-                if(fcFile != null && fcFile.exists()) 
@@ -125 +127 @@
-        }
-        
-Customization
+Generate
-        {
-                m_linkage = i_linkage;
-
+
+
-        }
-        
@@ -177 +180 @@
-        public void PreVisit (Policy i_policy)
-        {
+                m_linkage.InitInterface(m_bufferInterfaces);
+                m_bufferInterfaces.print("\n# SEFramework generated interface\n\n");
+
+                
-                m_bufferPolicy.print("# SEFramework policy output\n");
-                m_linkage.InitPolicy(m_bufferPolicy, m_moduleName);
@@ -189 +196 @@
-        public void Visit(Resource i_resource)
-        {
+                PrintStream outStream = m_bufferPolicy;
+
-                Map rdefs = i_resource.GetRdefs();
-
-
-
+
+
+
+
+
+
+
-                {
-                        Rdef rdef = (Rdef) itr.next();
-
+                        String sType = i_resource.GetTypeWithDictionaryObject(rdef.GetName());
+
+                        String sCustomName = "customize_" + i_resource.getName () + "_" + rdef.GetOutputName(); 
+
+                        if (m_bGeneratePolicyTemplate)
+                        {
+                                outStream = m_bufferInterfaces;
+                                outStream.println();
+                                outStream.println("########################");
+                                outStream.println("##<summary>");
+                                outStream.println("## Customization for resource " + i_resource.getName ()); 
+                                outStream.println("##</summary>");
+                                outStream.println("##<param name='resource'>");
+                                outStream.println("## Type of resource being customized");
+                                outStream.println("##</param>");
+                                outStream.println("template(`" + sCustomName + "',`");
+                        }
+
+                        if (m_bGeneratePolicyTemplate)
+                                sType = "$1";
+
+
-                        m_bufferPolicy.println("# CDSFramework resource: " + i_resource.getName());
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        }       
-
-        public void Visit(Domain i_domain)
-        {
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                {
-                        for (Iterator iter = i_domain.GetRdefs().values().iterator(); iter.hasNext(); ) 
-                        {
-                                Rdef rdef = (Rdef) iter.next();
-
-
-
-
-m_bufferPolicy
+'
+
+ 
+
+outStream
-                                        // create the access rules
-m_bufferPolicy.println("framework_" + rdef.GetOutputName () + "_owner_self(" + i_domain.getType ()
+outStream.println("framework_" + rdef.GetOutputName () + "_owner_self(" + sType
-//                                      makeAllowsOnSelf(i_domain, rdef.getAccessAllSelf(), m_bufferPolicy);
-                                } 
-                                else 
-                                {
-
-
+
+
+
+
+
+
+
+
-                                        // create the access rules
-m_bufferPolicy.println("framework_" + rdef.GetOutputName () + "_owner_self(" + i_domain.getType ()
+outStream.println("framework_" + rdef.GetOutputName () + "_owner_self(" + sType
-//                                      makeAllowsOnSelf(i_domain, rdef.getAccessAllSelf(), m_bufferPolicy);
-
-                                        
-//                                      makeAllowWithRdef(i_domain, i_domain, rdef, rdef.getAccessAllResource(), m_bufferPolicy);
-
-
+
-                                        
-                                        IDomain srcParent = i_domain;
-                                        Component targParent = i_domain;
-                                        
-
-
-
+ 
+
+ 
-                                                        srcParent = srcParent.getParent();
-
+ 
-                                                        targParent = targParent.getParent();
-
+
+
+
+
+
-                                                {
-m_bufferPolicy.println ("framework_" + rdef.GetOutputName () + "_owner_resource(" + srcParent.getType () + ", " + i_domain.GetTypeWithDictionaryObject (rdef.GetName ())
+outStream.println ("framework_" + rdef.GetOutputName () + "_owner_resource(" + sSrcType + ", " + sRdefType
-//                                                      policyStream.print("allow " + srcParent.getType() + " "
-//                                                              + target.GetTypeWithDictionaryObject(rdef.GetName())
@@ -269 +361 @@
-                                                        if (srcParent.getType().equals (targParent.getType()))
-                                                        {
-m_bufferPolicy.println ("framework_" + rdef.GetOutputName () + "_owner_resource(" + srcParent.getType ()
+outStream.println ("framework_" + rdef.GetOutputName () + "_owner_resource(" + sSrcType
-//                                                              policyStream.print("allow " + srcParent.getType() + " self:" + classAndPerms + ";\n");
-                                                        }
-                                                        else
-                                                        {
-m_bufferPolicy.println ("framework_" + rdef.GetOutputName () + "_owner_resource(" + srcParent.getType () + ", " + targParent.getType()
+outStream.println ("framework_" + rdef.GetOutputName () + "_owner_resource(" + sSrcType + ", " + sTargType
-//                                                              policyStream.print("allow " + srcParent.getType() + " " + targParent.getType() + ":" + classAndPerms + ";\n");
-                                                        }
@@ -280 +372 @@
-                                        }
-
-                                        
-                                        // if it has children re-expand it's resource group for ?allow dom_t dom_t:<selfperms>"
-                                        // this is required to pass the hierarchy checks in checkpolicy
-
-
-m_bufferPolicy
+ 
+
+outStream
-                                        }
-                                }
@@ -293 +384 @@
-                                        || rdef.GetSysResourceState (SystemResourceTypes.file) != SysResourceState.No) 
-                                {
-
-
-m_bufferPolicy
+ 
+
+outStream
-                                        } 
-                                        else 
-                                        {
-m_bufferPolicy
+outStream
-                                        }
-                                        
-                                        Domain currDom = i_domain.getParent();
-
-
-m_bufferPolicy
+ 
+
+outStream
-                                                currDom = currDom.getParent();
-                                        }
@@ -311 +402 @@
-                        }
-                }
-
-
+
+
+
+
+
+
+
-        }
-
@@ -319 +415 @@
-                boolean isBoolean = false;
-                
-
+ 
-                {
-                        m_bufferPolicy.println ("if(" + i_enter.getBool().image + ") {");
@@ -383 +479 @@
-        public void Visit(EntrypointResource i_entryPoint)
-        {
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                // this call obtains the actual definition of the type
-
-
+
+
+
+
+
+
+
-        }
-
@@ -466 +596 @@
-                boolean isBoolean = false;
-                
-
+
+
+
-                {
-                        isBoolean = true;
@@ -481 +613 @@
-                if (domain instanceof BaseDomain)
-                {
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
-
-                // for each AccessTarget associated with this AccessDefn
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                {
-                        AccessDefn axxDefn = (AccessDefn) axxDefs.next();
+                        AccessDefnGroup axxGroup = axxDefn.getAccessDefnGroup ();
+                        
-                        String templateName = "framework_"
-Defn.getAccessDefnGroup()
-Defn.getAccessDefnGroup()
+Group
+Group
-                                + axxDefn.getName();
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                                if (rdef.GetSysResourceState (SystemResourceTypes.file) != SysResourceState.No)
-m_bufferPolicy
+outStream
-                        }
-                        
@@ -540 +721 @@
-                                        {
-                                                Component entry = (Component) iter3.next();
-m_bufferPolicy
+outStream
-                                        }       
-                                }
@@ -550 +731 @@
-                        {
-                                String sObjClass = itr2.next ().toString ();
-
-
+//
+//
-
-                                // if it isn't a real resource - we can't make a transition
-
-
-
-
+//
+//
+
+//
-                                List paths = resource.GetSystemResources (rdef);
-
@@ -569 +750 @@
-
-                                        
-String 
+
-                                        if(sResType == null) 
-                                        {
-
+//
-                                                String sErrMsg = "Unable to determine file context for "+ sPath + ", dynamic file labeling will not work correctly.";
-                                                if (resource.getToken () != null)
@@ -581 +762 @@
-                                        }
-
-
-
-
-
-
-
-