Changeset 4924

Timestamp:

04/21/10 08:07:04 (5 months ago)

Author:

joliver

Message:

Bring up to date with trunk

Files:

• branches/module-loading/ChangeLog (modified) (1 diff)
• branches/module-loading/apol/analysis_tab.tcl (modified) (2 diffs)
• branches/module-loading/apol/cond_rules_tab.tcl (modified) (5 diffs)
• branches/module-loading/apol/context_dialog.tcl (modified) (4 diffs)
• branches/module-loading/apol/context_selector.tcl (modified) (2 diffs)
• branches/module-loading/apol/domaintrans_module.tcl (modified) (2 diffs)
• branches/module-loading/apol/file_contexts_tab.tcl (modified) (1 diff)
• branches/module-loading/apol/initial_sids_tab.tcl (modified) (2 diffs)
• branches/module-loading/apol/open_policy_dialog.tcl (modified) (4 diffs)
• branches/module-loading/apol/progress_dialog.tcl (modified) (1 diff)
• branches/module-loading/apol/range_selector.tcl (modified) (2 diffs)
• branches/module-loading/apol/relabel_module.tcl (modified) (2 diffs)
• branches/module-loading/apol/top.tcl (modified) (2 diffs)
• branches/module-loading/apol/transflow_module.tcl (modified) (5 diffs)
• branches/module-loading/apol/users_tab.tcl (modified) (8 diffs)
• branches/module-loading/configure.ac (modified) (1 diff)
• branches/module-loading/libapol/tests/Makefile.am (modified) (1 diff)
• branches/module-loading/libapol/tests/constrain-tests.c (copied) (copied from trunk/libapol/tests/constrain-tests.c)
• branches/module-loading/libapol/tests/constrain-tests.h (copied) (copied from trunk/libapol/tests/constrain-tests.h)
• branches/module-loading/libapol/tests/libapol-tests.c (modified) (2 diffs)
• branches/module-loading/libqpol/src/constraint_query.c (modified) (3 diffs)
• branches/module-loading/libqpol/swig/python/Makefile.am (modified) (1 diff)
• branches/module-loading/secmds/seinfo.c (modified) (12 diffs)

branches/module-loading/ChangeLog

@@ +1 @@
+2010-04-20  Chris PeBenito <cpebenito@tresys.com>
+
+        * Fix seinfo to correctly handle cases where there are
+          no nodecon statements in the policy.
+
+2010-04-20  Spencer Shimko <sshimko@tresys.com>
+
+        * Fixes error conditions that prevent apol from exiting.  If 
+          window/tab was already destroyed on exit
+          then apol threw an error and refused to exit. 
+
+2010-04-15  Spencer Shimko <sshimko@tresys.com>
+
+        * Add support for displaying constraints to seinfo.
+        * Add constraint CUnit tests.
+
-2010-03-12  John Oliver <joliver@tresys.com>
-

branches/module-loading/apol/analysis_tab.tcl

@@ -200 +200 @@
-    variable widgets
-    variable tabs
+    $widgets(new) configure -state disabled
+    $widgets(update) configure -state disabled
-
-    set m [$widgets(search_opts) raise]
@@ -223 +225 @@
-        $widgets(update) configure -state normal
-    }
+    
+    $widgets(new) configure -state normal
-}
-

branches/module-loading/apol/cond_rules_tab.tcl

@@ -141 +141 @@
-    variable vals
-    variable widgets
+    .mainframe.frame.nb.frules.nb.fApol_Cond_Rules.top.obox.f.ok configure -state disabled
-
-    Apol_Widget::clearSearchResults $widgets(results)
-    if {![ApolTop::is_policy_open]} {
-        tk_messageBox -icon error -type ok -title "Error" -message "No current policy file is opened."
+        .mainframe.frame.nb.frules.nb.fApol_Cond_Rules.top.obox.f.ok configure -state normal
-        return
-    }
@@ -158 +160 @@
-    if {$avrule_selection == 0 && $terule_selection == 0} {
-            tk_messageBox -icon error -type ok -title "Error" -message "At least one rule must be selected."
+            .mainframe.frame.nb.frules.nb.fApol_Cond_Rules.top.obox.f.ok configure -state normal
-            return
-    }
@@ -165 +168 @@
-        if {[set bool_name $vals(name)] == {}} {
-            tk_messageBox -icon error -type ok -title "Error" -message "No booleean selected."
+            .mainframe.frame.nb.frules.nb.fApol_Cond_Rules.top.obox.f.ok configure -state normal
-            return
-        }
@@ -192 +196 @@
-    }
-    Apol_Widget::appendSearchResultText $widgets(results) $text
-
+
+
-        {
-            if {[ApolTop::is_capable "syntactic rules"]} {
@@ -206 +211 @@
-            }
-        }
+    }
+    .mainframe.frame.nb.frules.nb.fApol_Cond_Rules.top.obox.f.ok configure -state normal
-}
-

branches/module-loading/apol/context_dialog.tcl

@@ -29 +29 @@
-    variable dialog
-    variable vars
+    
-    if {![winfo exists $dialog]} {
-        _create_dialog $parent
@@ -38 +39 @@
-    set low_level {}
-    set high_level {}
-
+
-    # initialize widget states
-    array set vars [list $dialog:low_enable 0  $dialog:high_enable 0]
@@ -62 +63 @@
-        set vars($dialog:user_enable) 1
-    }
+    
+    
-
-    $vars($dialog:role_box) configure -values [Apol_Roles::getRoles]
@@ -127 +130 @@
-    set vars($dialog:user_cb) [checkbutton $user_f.enable -text "User" \
-                                  -variable Apol_Context_Dialog::vars($dialog:user_enable)]
-
-
+
+
+
+
-    trace add variable Apol_Context_Dialog::vars($dialog:user_enable) write \
-        [list Apol_Context_Dialog::_user_changed $dialog]

branches/module-loading/apol/context_selector.tcl

@@ -124 +124 @@
-proc Apol_Widget::_show_context_dialog {path} {
-    variable vars
+    $path.context.button configure -state disabled
-    set new_context [Apol_Context_Dialog::getContext $vars($path:context) $vars($path:attribute)]
-    if {$new_context != {}} {
@@ -129 +130 @@
-        set vars($path:attribute) [lindex $new_context 1]
-    }
+    
+    $path.context.button configure -state normal
-    # the trace on this variable will trigger [_update_context_display] to execute
-}

branches/module-loading/apol/domaintrans_module.tcl

@@ -323 +323 @@
-
-proc Apol_Analysis_domaintrans::_createAccessDialog {} {
+    variable widgets
+    $widgets(access) configure -state disabled
-    destroy .domaintrans_adv
-    set d [Dialog .domaintrans_adv -modal local -separator 1 -title "Domain Transition Access Filter" -parent .]
@@ -329 +331 @@
-    _createAccessClasses [$d getframe]
-    $d draw
+    $widgets(access) configure -state normal
-}
-

branches/module-loading/apol/file_contexts_tab.tcl

@@ -228 +228 @@
-
-proc Apol_File_Contexts::_show_info {} {
+    .mainframe.frame.nb.fApol_File_Contexts.opts.f.bb.b1 configure -state disabled
-    Apol_Widget::showPopupParagraph "File Contexts Information" $Apol_File_Contexts::info_button_text
+    .mainframe.frame.nb.fApol_File_Contexts.opts.f.bb.b1 configure -state normal
-}
-

branches/module-loading/apol/initial_sids_tab.tcl

@@ -105 +105 @@
-
-    set q [new_apol_isid_query_t]
+    
-    if {[Apol_Widget::getContextSelectorState $widgets(context)]} {
-        foreach {context range_match attribute} [Apol_Widget::getContextSelectorValue $widgets(context)] {break}
-        $q set_context $::ApolTop::policy $context $range_match
-    }
+    
-    set v [$q run $::ApolTop::policy]
+    
-    $q -acquire
-    $q -delete
@@ -124 +127 @@
-        }
-    }
+    
-    Apol_Widget::appendSearchResultText $widgets(results) $results
-}

branches/module-loading/apol/open_policy_dialog.tcl

@@ -196 +196 @@
-    variable vars
-    variable dialog
+    .open_policy_dialog.frame.primary.f.b configure -state disabled
-    if {$vars(path_type) == "monolithic"} {
-        set title "Open Monolithic Policy"
@@ -213 +214 @@
-        $dialog itemconfigure 0 -state normal
-    }
+    .open_policy_dialog.frame.primary.f.b configure -state normal
-}
-
@@ -365 +367 @@
-    variable dialog
-    variable vars
-
+
-    if {[string trim $vars(primary_file)] != {}} {
-        set ppath [list_to_policy_path $vars(path_type) $vars(primary_file) $vars(mod_paths)]
@@ -372 +374 @@
-        }
-    }
+    .open_policy_dialog.bbox.b0 configure -state normal
-}
-

branches/module-loading/apol/progress_dialog.tcl

@@ -36 +36 @@
-        set text_width 32
-    }
-
-
-
-
+
+
+
+
+
+
+
-
-    set orig_cursor [. cget -cursor]

branches/module-loading/apol/range_selector.tcl

@@ -131 +131 @@
-
-proc Apol_Widget::_show_mls_range_dialog {path} {
+    $path.range.button configure -state disabled
-    set range [Apol_Range_Dialog::getRange $Apol_Widget::vars($path:range)]
-    if {$range != {}} {
@@ -136 +137 @@
-        $range -acquire
-    }
+    
+    $path.range.button configure -state normal
-    # the trace on this variable will trigger [_update_range_display]
-    # to execute

branches/module-loading/apol/relabel_module.tcl

@@ -327 +327 @@
-
-proc Apol_Analysis_relabel::_createAdvancedDialog {} {
+    variable widgets
+    $widgets(advanced) configure -state disabled
-    destroy .relabel_analysis_adv
-    variable vals
@@ -373 +375 @@
-
-    $d draw
+    $widgets(advanced) configure -state normal
-}
-

branches/module-loading/apol/top.tcl

@@ -478 +478 @@
-        "attribs" new_apol_attr_query_t
-    }
+    
-    foreach {key func} $query_funcs {
-        set q [$func]
@@ -585 +586 @@
-        _close_policy
-    }
+    
-    Apol_File_Contexts::close
-    _write_configuration_file

branches/module-loading/apol/transflow_module.tcl

@@ -311 +311 @@
-
-proc Apol_Analysis_transflow::_createAdvancedDialog {} {
+    variable widgets
+    $widgets(advanced) configure -state disabled
-    destroy .transflow_adv
-    variable vals
@@ -318 +320 @@
-        if {![ApolTop::openDefaultPermMap]} {
-            return "This analysis requires that a permission map is loaded."
-       
+        
-    }
-
@@ -352 +354 @@
-    pack $attrib_box -side top -expand 1 -fill x -padx 10
-    _attribEnabled $attrib_box
-
+
-    $d draw
+    $widgets(advanced) configure -state normal
-}
-
@@ -386 +389 @@
-    set cb [checkbutton $f.cb -text "Exclude permissions with weights below:" \
-                -variable Apol_Analysis_transflow::vals(classes:threshold_enable)]
+    
-    set weight [spinbox $f.threshold -from 1 -to 10 -increment 1 \
-                    -width 2 -bg white -justify right \
@@ -627 +631 @@
-        if {![ApolTop::openDefaultPermMap]} {
-            return "This analysis requires that a permission map is loaded."
-       
+        
-        apol_tcl_clear_info_string
-    }

branches/module-loading/apol/users_tab.tcl

@@ -156 +156 @@
-    variable opts
-    if {$opts($name2)} {
-       
+    
-    } else {
-        $path configure -state disabled -entrybg $ApolTop::default_bg_color
@@ -175 +175 @@
-proc Apol_Users::_show_level_dialog {} {
-    variable opts
+    .mainframe.frame.nb.fcomponents.nb.fApol_Users.pw.f1.frame.obox.f.default.button configure -state disabled
-    set new_level [Apol_Level_Dialog::getLevel $opts(default_level)]
-    if {$new_level != {}} {
@@ -180 +181 @@
-        $opts(default_level) -acquire
-    }
+    .mainframe.frame.nb.fcomponents.nb.fApol_Users.pw.f1.frame.obox.f.default.button configure -state normal
-}
-
@@ -205 +207 @@
-    variable opts
-    variable widgets
+    .mainframe.frame.nb.fcomponents.nb.fApol_Users.pw.f1.frame.obox.f.ok configure -state disabled
-
-    Apol_Widget::clearSearchResults $widgets(results)
-    if {![ApolTop::is_policy_open]} {
-        tk_messageBox -icon error -type ok -title "Error" -message "No current policy file is opened."
+        .mainframe.frame.nb.fcomponents.nb.fApol_Users.pw.f1.frame.obox.f.ok configure -state normal
-        return
-    }
@@ -214 +218 @@
-        if {$opts(role) == ""} {
-            tk_messageBox -icon error -type ok -title "Error" -message "No role selected."
+            .mainframe.frame.nb.fcomponents.nb.fApol_Users.pw.f1.frame.obox.f.ok configure -state normal
-            return
-        }
@@ -223 +228 @@
-        if {$opts(default_level) == {}} {
-            tk_messageBox -icon error -type ok -title "Error" -message "No default level selected."
+            .mainframe.frame.nb.fcomponents.nb.fApol_Users.pw.f1.frame.obox.f.ok configure -state normal
-            return
-        }
@@ -235 +241 @@
-        if {$range == {}} {
-            tk_messageBox -icon error -type ok -title "Error" -message "No range selected."
+            .mainframe.frame.nb.fcomponents.nb.fApol_Users.pw.f1.frame.obox.f.ok configure -state normal
-            return
-        }
@@ -267 +274 @@
-    }
-    Apol_Widget::appendSearchResultText $widgets(results) $text
+    .mainframe.frame.nb.fcomponents.nb.fApol_Users.pw.f1.frame.obox.f.ok configure -state normal
-}
-

branches/module-loading/configure.ac

@@ -704 +704 @@
-
-have_cunit="no"
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-#AC_MSG_CHECKING([for FUSE])
-#pkg-config --exists fuse

branches/module-loading/libapol/tests/Makefile.am

@@ -10 +10 @@
-        terule-tests.c terule-tests.h \
-        user-tests.c user-tests.h \
+        constrain-tests.c constrain-tests.h \
+        ../../libqpol/src/queue.c ../../libqpol/src/queue.h \
-        libapol-tests.c
-

branches/module-loading/libapol/tests/libapol-tests.c

@@ -35 +35 @@
-#include "role-tests.h"
-#include "terule-tests.h"
+#include "constrain-tests.h"
-#include "user-tests.h"
-
@@ -44 +45 @@
-
-        CU_SuiteInfo suites[] = {
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
-                CU_SUITE_INFO_NULL
-        };

branches/module-loading/libqpol/src/constraint_query.c

@@ -752 +752 @@
-        constraint_expr_t *internal_expr = NULL;
-        cexpr_name_state_t *cns = NULL;
+        int policy_type = 0;
-
-        if (iter)
@@ -761 +762 @@
-                return STATUS_ERR;
-        }
+
+        if (qpol_policy_get_type(policy, &policy_type))
+                return STATUS_ERR;
-
-        internal_expr = (constraint_expr_t *) expr;
@@ -776 +780 @@
-        }
-        if (internal_expr->attr & QPOL_CEXPR_SYM_TYPE) {
-
-
+
+
+
+
+
+
-        } else {
-                cns->inc = &(internal_expr->names);

branches/module-loading/libqpol/swig/python/Makefile.am

@@ -33 +33 @@
-        -rm -rf $(DESTDIR)$(wrappedsodir)/$(wrappedso_SONAME) $(DESTDIR)$(wrappedsodir)/_qpol.so
-
-$(wrappedpy_DATA)
+qpol.py

branches/module-loading/secmds/seinfo.c

@@ -49 +49 @@
-
-#define COPYRIGHT_INFO "Copyright (C) 2003-2007 Tresys Technology, LLC"
+
+/* placeholder for empty set in constraint statements */
+#define CONSTRAIN_NULL_SET "<empty set>"
-
-static char *policy_file = NULL;
@@ -68 +71 @@
-        OPT_NETIFCON, OPT_NODECON, OPT_PORTCON, OPT_PROTOCOL,
-        OPT_PERMISSIVE, OPT_POLCAP,
-
+, OPT_CONSTRAIN
-};
-
@@ -80 +83 @@
-        {"user", optional_argument, NULL, 'u'},
-        {"bool", optional_argument, NULL, 'b'},
+        {"constrain", no_argument, NULL, OPT_CONSTRAIN},
-        {"initialsid", optional_argument, NULL, OPT_INITIALSID},
-        {"fs_use", optional_argument, NULL, OPT_FS_USE},
@@ -91 +95 @@
-        {"stats", no_argument, NULL, OPT_STATS},
-        {"all", no_argument, NULL, OPT_ALL},
+        {"line-breaks", no_argument, NULL, 'l'},
-        {"expand", no_argument, NULL, 'x'},
-        {"help", no_argument, NULL, 'h'},
@@ -121 +126 @@
-        printf("  -u[NAME], --user[=NAME]          print users\n");
-        printf("  -b[NAME], --bool[=NAME]          print conditional booleans\n");
+        printf("  --constrain                      print constrain statements\n");
+        printf("  -l, --line-breaks                print line breaks in constrain statements\n");
-        printf("  --initialsid[=NAME]              print initial SIDs\n");
-        printf("  --fs_use[=TYPE]                  print fs_use statements\n");
@@ -1075 +1082 @@
-
-        n_nodecons = apol_vector_get_size(v);
-
-
-
-
-
-
+
+
-                fprintf(fp, "Nodecon: %zd\n", n_nodecons);
-
-
+
+
+
+
+
+
+
-                nodecon = apol_vector_get_element(v, i);
-                tmp = apol_nodecon_render(policydb, nodecon);
@@ -1091 +1099 @@
-                free(tmp);
-        }
-
-        if (addr && !n_nodecons)
-                ERR(policydb, "No matching nodecon for address %s.", addr);
-
-        retval = 0;
@@ -1334 +1339 @@
-}
-
+static const char *get_attr_string(int attr)
+{
+        const char *string = "";
+        switch (attr)
+        {
+                case QPOL_CEXPR_SYM_USER:
+                        string = "u1";
+                        break;
+                case QPOL_CEXPR_SYM_ROLE:
+                        string = "r1";
+                        break;
+                case QPOL_CEXPR_SYM_TYPE:
+                        string = "t1";
+                        break;
+
+                case QPOL_CEXPR_SYM_USER+QPOL_CEXPR_SYM_TARGET:
+                        string = "u2";
+                        break;
+                case QPOL_CEXPR_SYM_ROLE+QPOL_CEXPR_SYM_TARGET:
+                        string = "r2";
+                        break;
+                case QPOL_CEXPR_SYM_TYPE+QPOL_CEXPR_SYM_TARGET:
+                        string = "t2";
+                        break;
+
+                case QPOL_CEXPR_SYM_USER+QPOL_CEXPR_SYM_XTARGET:
+                        string = "u3";
+                        break;
+                case QPOL_CEXPR_SYM_ROLE+QPOL_CEXPR_SYM_XTARGET:
+                        string = "r3";
+                        break;
+                case QPOL_CEXPR_SYM_TYPE+QPOL_CEXPR_SYM_XTARGET:
+                        string = "t3";
+                        break;
+
+                case QPOL_CEXPR_SYM_L1L2:
+                        string = "l1 l2";
+                        break;
+                case QPOL_CEXPR_SYM_L1H2:
+                        string = "l1 h2";
+                        break;
+                case QPOL_CEXPR_SYM_H1L2:
+                        string = "h1 l2";
+                        break;
+                case QPOL_CEXPR_SYM_H1H2:
+                        string = "h1 h2";
+                        break;
+                case QPOL_CEXPR_SYM_L1H1:
+                        string = "l1 h1";
+                        break;
+                case QPOL_CEXPR_SYM_L2H2:
+                        string = "l2 h2";
+                        break;
+        }
+
+        return string;
+}
+
+static const char *get_op_string(int op)
+{
+        char *string = "";
+
+        switch (op)
+        {
+                case QPOL_CEXPR_OP_EQ:
+                        string = "==";
+                        break;
+                case QPOL_CEXPR_OP_NEQ:
+                        string = "!=";
+                        break;
+                case QPOL_CEXPR_OP_DOM:
+                        string = "dom";
+                        break;
+                case QPOL_CEXPR_OP_DOMBY:
+                        string = "domby";
+                        break;
+                case QPOL_CEXPR_OP_INCOMP:
+                        string = "incomp";
+                        break;
+        }
+
+        return string;
+}
+
+static int print_constraints(FILE * fp, int expand, const apol_policy_t * policydb, int linebreaks)
+{
+        int retval = -1;
+        const char *class_name = NULL;
+        char *constrain_type;
+        char *perm_list = "No Perms Extracted";
+        const qpol_constraint_expr_node_t *expr = NULL;
+        qpol_iterator_t *policy_iter = NULL;    // Iterates over all constraints in a policy
+        qpol_iterator_t *perm_iter = NULL;              // Iterates over permissions in a constraint
+        qpol_iterator_t *expr_iter = NULL;              // Iterates over expression in a constraint
+        qpol_policy_t *q = apol_policy_get_qpol(policydb);
+        qpol_constraint_t *constraint = NULL;
+        const qpol_class_t *class;
+        size_t n_constraints = 0;
+        int expr_type = 0;
+        int sym_type = 0;               // 'attr' in struct constraint_expr
+        int op = 0;
+
+        if (qpol_policy_get_constraint_iter(q, &policy_iter) != 0)
+        {
+                ERR (policydb, "%s", "Policy constraint iterator not accessible");
+                return retval;
+        }
+        if (qpol_iterator_get_size(policy_iter, &n_constraints) != 0)
+        {
+                ERR(policydb, "%s", "Policy size computation failed");
+                goto cleanup;
+        }
+
+        fprintf(fp, "\nConstraints: %zd\n", n_constraints);
+
+        // Iterate through constraints
+        for (; qpol_iterator_end(policy_iter) == 0; qpol_iterator_next(policy_iter))
+        {
+                constrain_type = "";
+                if (qpol_iterator_get_item(policy_iter, (void **)&constraint) != 0)
+                {
+                        ERR(policydb, "%s", "Can't get constraint from iterator\n");
+                        goto cleanup;
+                }
+
+                if (qpol_constraint_get_class(q, constraint, &class) != 0)
+                {
+                        ERR(policydb, "%s", "Can't get class from constraint\n");
+                        goto cleanup;
+                }
+
+                if (qpol_class_get_name(q, class, &class_name) != 0)
+                {
+                        ERR(policydb, "%s", "Can't get class name from constraint\n");
+                        goto cleanup;
+                }
+
+                // Get expression, we need to look into it.
+                if (qpol_constraint_get_expr_iter (q, constraint, &expr_iter) != 0)
+                {
+                        ERR(policydb, "%s", "Can't get expression from constraint\n");
+                        goto cleanup;
+                }
+                // Traverse the iterator to see if this is mlsconstrain
+                for (; qpol_iterator_end(expr_iter) == 0; qpol_iterator_next(expr_iter))
+                {
+                        if (qpol_iterator_get_item(expr_iter, (void **)&expr) != 0)
+                        {
+                                ERR(policydb, "%s", "Can't get expression from iterator\n");
+                                goto cleanup;
+                        }
+
+                        if (qpol_constraint_expr_node_get_sym_type(q, expr, &sym_type) != 0)
+                        {
+                                ERR(policydb, "%s", "Can't get sym_type from expression\n");
+                                goto cleanup;
+                        }
+
+                        if (sym_type >= QPOL_CEXPR_SYM_L1L2)
+                        {
+                                constrain_type = "mls";
+                                break;
+                        }
+                }
+
+        // print permissions
+                fprintf (fp, "%sconstrain { %s } { ", constrain_type, class_name);
+
+                if (qpol_constraint_get_perm_iter (q, constraint, &perm_iter) != 0)
+                {
+                        ERR(policydb, "%s", "Can't get permissions from constraint\n");
+                        goto cleanup;
+                }
+
+                for (; qpol_iterator_end(perm_iter) == 0; qpol_iterator_next(perm_iter))
+                {
+                        if (qpol_iterator_get_item(perm_iter, (void **)&perm_list) != 0)
+                        {
+                                ERR(policydb, "%s", "Can't get permissions from iterator\n");
+                                goto cleanup;
+                        }
+
+                        fprintf (fp, "%s ", perm_list);
+                        free (perm_list);               // Strdup created the string.
+                }
+                fprintf (fp, " } ");
+
+                // dump RPN expressions
+                if (qpol_constraint_get_expr_iter (q, constraint, &expr_iter) != 0)
+                {
+                        ERR(policydb, "%s", "Can't get expression from constraint\n");
+                        goto cleanup;
+                }
+
+                fprintf (fp, "\n( ");
+                for (; qpol_iterator_end(expr_iter) == 0; qpol_iterator_next(expr_iter))
+                {
+                        qpol_iterator_t *names_iter = NULL;
+
+                        if (qpol_iterator_get_item(expr_iter, (void **)&expr) != 0)
+                        {
+                                ERR(policydb, "%s", "Can't get expression from iterator\n");
+                                goto cleanup;
+                        }
+
+                        if (qpol_constraint_expr_node_get_op (q, expr, &op) != 0)
+                        {
+                                ERR(policydb, "%s", "Can't get op from expression\n");
+                                goto cleanup;
+                        }
+
+                        if (qpol_constraint_expr_node_get_sym_type(q, expr, &sym_type) != 0)
+                        {
+                                ERR(policydb, "%s", "Can't get sym_type from expression\n");
+                                goto cleanup;
+                        }
+
+                        if (qpol_constraint_expr_node_get_expr_type(q, expr, &expr_type) != 0)
+                        {
+                                ERR(policydb, "%s", "Can't get expr_type from expression\n");
+                                goto cleanup;
+                        }
+
+                        if (linebreaks)
+                                fprintf (fp, "\n\t");
+
+                        if (expr_type == QPOL_CEXPR_TYPE_NOT)
+                        {
+                                fprintf (fp, " ! ");
+                        }
+                        if (expr_type == QPOL_CEXPR_TYPE_AND)
+                        {
+                                fprintf (fp, " && ");
+                        }
+                        if (expr_type == QPOL_CEXPR_TYPE_OR)
+                        {
+                                fprintf (fp, " || ");
+                        }
+                        if (expr_type == QPOL_CEXPR_TYPE_ATTR)
+                        {
+                                fprintf (fp, " %s ", get_attr_string(sym_type));
+                                fprintf (fp, "%s ", get_attr_string(sym_type | QPOL_CEXPR_SYM_TARGET));
+                                fprintf (fp, "%s ", get_op_string(op));
+                        }
+                        if (expr_type == QPOL_CEXPR_TYPE_NAMES)
+                        {
+                                size_t name_size=0;
+
+                                fprintf (fp, " %s ", get_attr_string(sym_type));
+
+                                if (qpol_constraint_expr_node_get_names_iter (q, expr, &names_iter) != 0)
+                                {
+                                        ERR(policydb, "%s", "Can't get names iterator from expression\n");
+                                        goto cleanup;
+                                }
+
+                                if (qpol_iterator_get_size(names_iter, &name_size) != 0)
+                                {
+                                        ERR(policydb, "%s", "Can't get size from names iterator\n");
+                                        goto cleanup;
+                                }
+                                if (name_size > 0)
+                                {
+                                        if (name_size > 1)
+                                                fprintf (fp, "{ ");
+
+                                        for (; qpol_iterator_end(names_iter) == 0; qpol_iterator_next(names_iter))
+                                        {
+                                                char *lname = NULL;
+
+                                                if (qpol_iterator_get_item (names_iter, (void **)&lname) != 0)
+                                                {
+                                                        ERR(policydb, "%s", "Can't get names from iterator\n");
+                                                        goto cleanup;
+                                                }
+
+                                                fprintf (fp, "%s ", lname);
+                                                free (lname);
+
+                                        }
+                                        if (name_size > 1)
+                                                fprintf (fp, "} ");
+                                } else {
+                                        fprintf (fp, "%s ", CONSTRAIN_NULL_SET);
+                                }
+
+                                fprintf (fp, "%s ", get_op_string(op));
+                        }
+                }
+                if (linebreaks)
+                        fprintf (fp, "\n);\n\n");
+                else
+                        fprintf (fp, ");\n\n");
+        }
+
+        retval = 0;
+
+cleanup:        // close and destroy iterators etc.
+        if (policy_iter != NULL) qpol_iterator_destroy(&policy_iter);
+        if (perm_iter != NULL) qpol_iterator_destroy(&perm_iter);
+        if (expr_iter != NULL) qpol_iterator_destroy(&expr_iter);
+
+        return retval;
+}
+
+
-int main(int argc, char **argv)
-{
-        int classes, types, attribs, roles, users, all, expand, stats, rt, optc, isids, bools, sens, cats, fsuse, genfs, netif,
-
+, constrain, linebreaks
-        apol_policy_t *policydb = NULL;
-        apol_policy_path_t *pol_path = NULL;
@@ -1349 +1660 @@
-                genfs_type = netif_name = node_addr = port_num = permissive_name = polcap_name = NULL;
-        classes = types = attribs = roles = users = all = expand = stats = isids = bools = sens = cats = fsuse = genfs = netif =
-
-
+constrain = linebreaks = 
+l
-                switch (optc) {
-                case 0:
@@ -1443 +1754 @@
-                case 'x':              /* expand */
-                        expand = 1;
+                        break;
+                case 'l':       /* Print line breaks in constraints */
+                        linebreaks=1;
+                        break;
+                case OPT_CONSTRAIN:     /* Print constraints */
+                        constrain=1;
-                        break;
-                case OPT_STATS:
@@ -1466 +1783 @@
-
-        /* if no options, then show stats */
-
+constrain + 
-                stats = 1;
-        }
@@ -1568 +1885 @@
-        if (polcaps || all)
-                print_polcaps(stdout, polcap_name, expand, policydb);
+        if (constrain || all)
+                print_constraints(stdout, expand, policydb, linebreaks);
-
-        apol_policy_destroy(&policydb);