/* Authors: Jason Tang     <jtang@tresys.com>

 *          James Athey    <jathey@tresys.com>

 *

 * Copyright (C) 2004-2006 Tresys Technology, LLC

 *

 *  This library is free software; you can redistribute it and/or

 *  modify it under the terms of the GNU Lesser General Public

 *  License as published by the Free Software Foundation; either

 *  version 2.1 of the License, or (at your option) any later version.

 *

 *  This library is distributed in the hope that it will be useful,

 *  but WITHOUT ANY WARRANTY; without even the implied warranty of

 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 *  Lesser General Public License for more details.

 *

 *  You should have received a copy of the GNU Lesser General Public

 *  License along with this library; if not, write to the Free Software

 *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA

 */

%{

#include "semanage_conf.h"

#include <sepol/policydb.h>

#include <selinux/selinux.h>

#include <semanage/handle.h>

#include <unistd.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

extern int semanage_lex(void);                /* defined in conf-scan.c */

extern int semanage_lex_destroy(void);        /* defined in conf-scan.c */

int semanage_error(const char *msg);

extern FILE *semanage_in;

extern char *semanage_text;

static int parse_module_store(char *arg);

static int parse_store_root_path(char *arg);

static int parse_compiler_path(char *arg);

static void semanage_conf_external_prog_destroy(external_prog_t *ep);

static int new_external_prog(external_prog_t **chain);

static semanage_conf_t *current_conf;

static external_prog_t *new_external;

static int parse_errors;

#define PASSIGN(p1,p2) { free(p1); p1 = p2; }

%}

%name-prefix "semanage_"

%union {

        int d;

        char *s;

}

%token MODULE_STORE VERSION EXPAND_CHECK FILE_MODE SAVE_PREVIOUS SAVE_LINKED TARGET_PLATFORM COMPILER_DIR IGNORE_MODULE_CACHE STORE_ROOT

%token LOAD_POLICY_START SETFILES_START SEFCONTEXT_COMPILE_START DISABLE_GENHOMEDIRCON HANDLE_UNKNOWN USEPASSWD IGNOREDIRS

%token BZIP_BLOCKSIZE BZIP_SMALL REMOVE_HLL

%token VERIFY_MOD_START VERIFY_LINKED_START VERIFY_KERNEL_START BLOCK_END

%token PROG_PATH PROG_ARGS

%token <s> ARG

%type <d> verify_start_tok

%%

config_file:    config_line config_file

        |       /* empty */

        ;

config_line:    single_opt

        |       command_block

        |       verify_block

        ;

single_opt:     module_store

        |       version

        |       target_platform

        |       store_root

        |       compiler_dir

        |       ignore_module_cache

        |       expand_check

        |       file_mode

        |       save_previous

        |       save_linked

        |       disable_genhomedircon

        |       usepasswd

        |       ignoredirs

        |       handle_unknown

	|	bzip_blocksize

	|	bzip_small

	|	remove_hll

        ;

module_store:   MODULE_STORE '=' ARG {

                        if (parse_module_store($3) != 0) {

                                parse_errors++;

                                YYABORT;

                        }

                        free($3);

                }

        ;

store_root:     STORE_ROOT '=' ARG  {

                        if (parse_store_root_path($3) != 0) {

                                parse_errors++;

                                YYABORT;

                        }

                        free($3);

                }

        ;

compiler_dir:       COMPILER_DIR '=' ARG  {

                        if (parse_compiler_path($3) != 0) {

                                parse_errors++;

                                YYABORT;

                        }

                        free($3);

                }

        ;

ignore_module_cache:	IGNORE_MODULE_CACHE '=' ARG  {

							if (strcasecmp($3, "true") == 0)

								current_conf->ignore_module_cache = 1;

							else if (strcasecmp($3, "false") == 0)

								current_conf->ignore_module_cache = 0;

							else {

								yyerror("disable-caching can only be 'true' or 'false'");

							}

							free($3);

						}

        ;

version:        VERSION '=' ARG  {

                        current_conf->policyvers = atoi($3);

                        free($3);

                        if (current_conf->policyvers < sepol_policy_kern_vers_min() ||

                            current_conf->policyvers > sepol_policy_kern_vers_max()) {

                                parse_errors++;

                                YYABORT;

                        }

                }

        ;

target_platform: TARGET_PLATFORM '=' ARG  {

                        if (strcasecmp($3, "selinux") == 0)

                                current_conf->target_platform = SEPOL_TARGET_SELINUX;

                        else if (strcasecmp($3, "xen") == 0)

                                current_conf->target_platform = SEPOL_TARGET_XEN;

                        else {

                                yyerror("target_platform can only be 'selinux' or 'xen'");

                        }

                        free($3);

                }

        ;

expand_check:   EXPAND_CHECK '=' ARG  {

                        current_conf->expand_check = atoi($3);

                        free($3);

                }

        ;

file_mode:   FILE_MODE '=' ARG  {

                        current_conf->file_mode = strtoul($3, NULL, 8);

                        free($3);

                }

        ;

save_previous:    SAVE_PREVIOUS '=' ARG {

	                if (strcasecmp($3, "true") == 0)

		                current_conf->save_previous = 1;

			else if (strcasecmp($3, "false") == 0)

				current_conf->save_previous = 0;		

			else {

				yyerror("save-previous can only be 'true' or 'false'");

			}

			free($3);

                }

        ;

save_linked:    SAVE_LINKED '=' ARG {

	                if (strcasecmp($3, "true") == 0)

		                current_conf->save_linked = 1;

			else if (strcasecmp($3, "false") == 0)

				current_conf->save_linked = 0;		

			else {

				yyerror("save-linked can only be 'true' or 'false'");

			}

			free($3);

                }

        ;

disable_genhomedircon: DISABLE_GENHOMEDIRCON '=' ARG {

	if (strcasecmp($3, "false") == 0) {

		current_conf->disable_genhomedircon = 0;

	} else if (strcasecmp($3, "true") == 0) {

		current_conf->disable_genhomedircon = 1;

	} else {

		yyerror("disable-genhomedircon can only be 'true' or 'false'");

	}

	free($3);

 }

usepasswd: USEPASSWD '=' ARG {

	if (strcasecmp($3, "false") == 0) {

		current_conf->usepasswd = 0;

	} else if (strcasecmp($3, "true") == 0) {

		current_conf->usepasswd = 1;

	} else {

		yyerror("usepasswd can only be 'true' or 'false'");

	}

	free($3);

 }

ignoredirs: IGNOREDIRS '=' ARG {

	current_conf->ignoredirs = strdup($3);

	free($3);

 }

handle_unknown: HANDLE_UNKNOWN '=' ARG {

	if (strcasecmp($3, "deny") == 0) {

		current_conf->handle_unknown = SEPOL_DENY_UNKNOWN;

	} else if (strcasecmp($3, "reject") == 0) {

		current_conf->handle_unknown = SEPOL_REJECT_UNKNOWN;

	} else if (strcasecmp($3, "allow") == 0) {

		current_conf->handle_unknown = SEPOL_ALLOW_UNKNOWN;

	} else {

		yyerror("handle-unknown can only be 'deny', 'reject' or 'allow'");

	}

	free($3);

 }

bzip_blocksize:  BZIP_BLOCKSIZE '=' ARG {

	int blocksize = atoi($3);

	free($3);

	if (blocksize > 9)

		yyerror("bzip-blocksize can only be in the range 0-9");

	else

		current_conf->bzip_blocksize = blocksize;

}

bzip_small:  BZIP_SMALL '=' ARG {

	if (strcasecmp($3, "false") == 0) {

		current_conf->bzip_small = 0;

	} else if (strcasecmp($3, "true") == 0) {

		current_conf->bzip_small = 1;

	} else {

		yyerror("bzip-small can only be 'true' or 'false'");

	}

	free($3);

}

remove_hll:  REMOVE_HLL'=' ARG {

	if (strcasecmp($3, "false") == 0) {

		current_conf->remove_hll = 0;

	} else if (strcasecmp($3, "true") == 0) {

		current_conf->remove_hll = 1;

	} else {

		yyerror("remove-hll can only be 'true' or 'false'");

	}

	free($3);

}

command_block: 

                command_start external_opts BLOCK_END  {

                        if (new_external->path == NULL) {

                                parse_errors++;

                                YYABORT;

                        }

                }

        ;

command_start:

                LOAD_POLICY_START {

                        semanage_conf_external_prog_destroy(current_conf->load_policy);

                        current_conf->load_policy = NULL;

                        if (new_external_prog(&current_conf->load_policy) == -1) {

                                parse_errors++;

                                YYABORT;

                        }

                }

        |       SETFILES_START {

                        semanage_conf_external_prog_destroy(current_conf->setfiles);

                        current_conf->setfiles = NULL;

                        if (new_external_prog(&current_conf->setfiles) == -1) {

                                parse_errors++;

                                YYABORT;

                        }

                }

        |       SEFCONTEXT_COMPILE_START {

                        semanage_conf_external_prog_destroy(current_conf->sefcontext_compile);

                        current_conf->sefcontext_compile = NULL;

                        if (new_external_prog(&current_conf->sefcontext_compile) == -1) {

                                parse_errors++;

                                YYABORT;

                        }

                }

        ;

verify_block:   verify_start external_opts BLOCK_END  {

                        if (new_external->path == NULL) {

                                parse_errors++;

                                YYABORT;

                        }

                }

        ;

verify_start:   verify_start_tok {

                        if ($1 == -1) {

                                parse_errors++;

                                YYABORT;

                        }

                }

        ;

verify_start_tok: VERIFY_MOD_START  {$$ = new_external_prog(&current_conf->mod_prog);}

        |       VERIFY_LINKED_START {$$ = new_external_prog(&current_conf->linked_prog);}

        |       VERIFY_KERNEL_START {$$ = new_external_prog(&current_conf->kernel_prog);}

        ;

external_opts:  external_opt external_opts

        |       /* empty */

        ;

external_opt:   PROG_PATH '=' ARG  { PASSIGN(new_external->path, $3); }

        |       PROG_ARGS '=' ARG  { PASSIGN(new_external->args, $3); }

        ;

%%

static int semanage_conf_init(semanage_conf_t * conf)

{

	conf->store_type = SEMANAGE_CON_DIRECT;

	conf->store_path = strdup(basename(selinux_policy_root()));

	conf->ignoredirs = NULL;

	conf->store_root_path = strdup("/var/lib/selinux");

	conf->compiler_directory_path = strdup("/usr/libexec/selinux/hll");

	conf->policyvers = sepol_policy_kern_vers_max();

	conf->target_platform = SEPOL_TARGET_SELINUX;

	conf->expand_check = 1;

	conf->handle_unknown = -1;

	conf->usepasswd = 1;

	conf->file_mode = 0644;

	conf->bzip_blocksize = 9;

	conf->bzip_small = 0;

	conf->ignore_module_cache = 0;

	conf->remove_hll = 0;

	conf->save_previous = 0;

	conf->save_linked = 0;

	if ((conf->load_policy =

	     calloc(1, sizeof(*(current_conf->load_policy)))) == NULL) {

		return -1;

	}

	if (access("/sbin/load_policy", X_OK) == 0) {

		conf->load_policy->path = strdup("/sbin/load_policy");

	} else {

		conf->load_policy->path = strdup("/usr/sbin/load_policy");

	}

	if (conf->load_policy->path == NULL) {

		return -1;

	}

	conf->load_policy->args = NULL;

	if ((conf->setfiles =

	     calloc(1, sizeof(*(current_conf->setfiles)))) == NULL) {

		return -1;

	}

	if (access("/sbin/setfiles", X_OK) == 0) {

		conf->setfiles->path = strdup("/sbin/setfiles");

	} else {

		conf->setfiles->path = strdup("/usr/sbin/setfiles");

	}

	if ((conf->setfiles->path == NULL) ||

	    (conf->setfiles->args = strdup("-q -c $@ $<")) == NULL) {

		return -1;

	}

	if ((conf->sefcontext_compile =

	     calloc(1, sizeof(*(current_conf->sefcontext_compile)))) == NULL) {

		return -1;

	}

	if (access("/sbin/sefcontext_compile", X_OK) == 0) {

		conf->sefcontext_compile->path = strdup("/sbin/sefcontext_compile");

	} else {

		conf->sefcontext_compile->path = strdup("/usr/sbin/sefcontext_compile");

	}

	if ((conf->sefcontext_compile->path == NULL) ||

	    (conf->sefcontext_compile->args = strdup("$@")) == NULL) {

		return -1;

	}

	return 0;

}

/* Parse a libsemanage configuration file.  THIS FUNCTION IS NOT

 * THREAD-SAFE!	 Return a newly allocated semanage_conf_t *.  If the

 * configuration file could be read, parse it; otherwise rely upon

 * default values.  If the file could not be parsed correctly or if

 * out of memory return NULL.

 */

semanage_conf_t *semanage_conf_parse(const char *config_filename)

{

	if ((current_conf = calloc(1, sizeof(*current_conf))) == NULL) {

		return NULL;

	}

	if (semanage_conf_init(current_conf) == -1) {

		goto cleanup;

	}

	if ((semanage_in = fopen(config_filename, "r")) == NULL) {

		/* configuration file does not exist or could not be

		 * read.  THIS IS NOT AN ERROR.  just rely on the

		 * defaults. */

		return current_conf;

	}

	parse_errors = 0;

	semanage_parse();

	fclose(semanage_in);

	semanage_lex_destroy();

	if (parse_errors != 0) {

		goto cleanup;

	}

	return current_conf;

      cleanup:

	semanage_conf_destroy(current_conf);

	return NULL;

}

static void semanage_conf_external_prog_destroy(external_prog_t * ep)

{

	while (ep != NULL) {

		external_prog_t *next = ep->next;

		free(ep->path);

		free(ep->args);

		free(ep);

		ep = next;

	}

}

/* Deallocates all space associated with a configuration struct,

 * including the pointer itself. */

void semanage_conf_destroy(semanage_conf_t * conf)

{

	if (conf != NULL) {

		free(conf->store_path);

		free(conf->ignoredirs);

		free(conf->store_root_path);

		free(conf->compiler_directory_path);

		semanage_conf_external_prog_destroy(conf->load_policy);

		semanage_conf_external_prog_destroy(conf->setfiles);

		semanage_conf_external_prog_destroy(conf->sefcontext_compile);

		semanage_conf_external_prog_destroy(conf->mod_prog);

		semanage_conf_external_prog_destroy(conf->linked_prog);

		semanage_conf_external_prog_destroy(conf->kernel_prog);

		free(conf);

	}

}

int semanage_error(const char *msg)

{

	fprintf(stderr, "error parsing semanage configuration file: %s\n", msg);

	parse_errors++;

	return 0;

}

/* Take the string argument for a module store.	 If it is exactly the

 * word "direct" then have libsemanage directly manipulate the module

 * store. The policy path will default to the active policy directory.

 * Otherwise if it begins with a forward slash interpret it as

 * an absolute path to a named socket, to which a policy server is

 * listening on the other end.	Otherwise treat it as the host name to

 * an external server; if there is a colon in the name then everything

 * after gives a port number.  The default port number is 4242.

 * Returns 0 on success, -1 if out of memory, -2 if a port number is

 * illegal.

 */

static int parse_module_store(char *arg)

{

	/* arg is already a strdup()ed copy of yytext */

	if (arg == NULL) {

		return -1;

	}

	free(current_conf->store_path);

	if (strcmp(arg, "direct") == 0) {

		current_conf->store_type = SEMANAGE_CON_DIRECT;

		current_conf->store_path =

		    strdup(basename(selinux_policy_root()));

		current_conf->server_port = -1;

	} else if (*arg == '/') {

		current_conf->store_type = SEMANAGE_CON_POLSERV_LOCAL;

		current_conf->store_path = strdup(arg);

		current_conf->server_port = -1;

	} else {

		char *s;

		current_conf->store_type = SEMANAGE_CON_POLSERV_REMOTE;

		if ((s = strchr(arg, ':')) == NULL) {

			current_conf->store_path = arg;

			current_conf->server_port = 4242;

		} else {

			char *endptr;

			*s = '\0';

			current_conf->store_path = arg;

			current_conf->server_port = strtol(s + 1, &endptr, 10);

			if (*(s + 1) == '\0' || *endptr != '\0') {

				return -2;

			}

		}

	}

	return 0;

}

static int parse_store_root_path(char *arg)

{

	if (arg == NULL) {

		return -1;

	}

	free(current_conf->store_root_path);

	current_conf->store_root_path = strdup(arg);

	return 0;

}

static int parse_compiler_path(char *arg)

{

	if (arg == NULL) {

		return -1;

	}

	free(current_conf->compiler_directory_path);

	current_conf->compiler_directory_path = strdup(arg);

	return 0;

}

/* Helper function; called whenever configuration file specifies

 * another external program.  Returns 0 on success, -1 if out of

 * memory.

 */

static int new_external_prog(external_prog_t ** chain)

{

	if ((new_external = calloc(1, sizeof(*new_external))) == NULL) {

		return -1;

	}

	/* hook this new external program to the end of the chain */

	if (*chain == NULL) {

		*chain = new_external;

	} else {

		external_prog_t *prog = *chain;

		while (prog->next != NULL) {

			prog = prog->next;

		}

		prog->next = new_external;

	}

	return 0;

}