+
     hQ  c                   s    ^ RI Ht ^ RIHtHtHt ^ RIHt ^ RIt^ RI	t	^ RI
t
^ RIHt ]! R4      '       d   RMRtRtRtR	tR
tRtRt. tR tR tR tR tR tR tR tR tR tR tR tR# )    )copy)chdirgetcwdremove)existsNz./templatesz/usr/share/udica/templatesz/etcz/homez/var/logz/tmpz*/usr/share/udica/ansible/deploy-module.ymlzvariables-deploy-module.ymlc                 s0    \         P                  V 4       R # N)templates_to_loadappend)template   &1/usr/lib/python3.14/site-packages/udica/policy.pyadd_templater   +   s    X&    c                 sN    R P                  \        \        V 4      4      R,           # )z.cil,.cil)ZjoinZmapstr)r   r
   r   list_templates_to_stringr   /   s    <<C!234v==r   c                 s   \        V 4      p\        P                  ! 4       p\        P                  ! V4       \        P                  ! V4      w  r4\        P
                  ! V4      w  r5\        P                  ! V4      w  r6. pWE,           V,            Fj  p\        P                  ! V4      p	V	^ V V 8X  g   K%  \        P                  ! V4      p
V
'       g   KE  VP                  \        P                  ! V
4      4       Kl  	  \        P                  ! \        P                  R^ 4      p \        P                  ! W^ 4      w  r:V
'       d(   VP                  V
P!                  R4      ^,          4        \        P"                  ! V 4      ^,          p
V
'       d(   VP                  V
P!                  R4      ^,          4       V#   \         d    Rp
 Li ; i  \         d    Rp
 LSi ; i)r    NZ:)lensemanagesemanage_handle_createsemanage_connectZsemanage_fcontext_listZsemanage_fcontext_list_localZsemanage_fcontext_list_homedirsZsemanage_fcontext_get_exprZsemanage_fcontext_get_conr   semanage_context_get_typeselinuxZselabel_openZSELABEL_CTX_FILEZselabel_lookupZFileNotFoundErrorsplitZ
getfilecon)Z	directoryZdirectory_lenhandlercZfclistZfclocalZfchomecontextsZfcontextZ
expressioncontextZselabels   &           r   list_contextsr   3   s   	NM,,.Ff%226:LR99&AMR;;FCLRH$v--88B
a&)388BGw B B7 KL . ""7#;#;T1EG..w1E c*1-.$$Y/2 c*1-.O    s$   %F< .G <GGGGc                 s   \         P                  ! 4       p\         P                  ! V4       \         P                  ! V4      w  r4\         P                  ! V4      w  r5WT,            F  p\         P
                  ! V4      p\         P                  ! V4      p\         P                  ! V4      p	\         P                  ! V	4      p
\         P                  ! V4      p\         P                  ! V4      pYu;8:  d
   V8:  g   K  M K  W8X  g   K  Vu # 	  R # r   )r   r   r   Zsemanage_port_listZsemanage_port_list_localZsemanage_port_get_conr   Zsemanage_port_get_protoZsemanage_port_get_proto_strZsemanage_port_get_lowZsemanage_port_get_high)Zport_numberZ
port_protor   r   ZplistZplocalZportZconZctypeZprotoZ	proto_strZlowZhighs   &&           r   
list_portsr   Z   s    ,,.Ff%--f5KR44V<LR,,T2223700688?	,,T2..t4%%%**AL r   c           	      s   \        V R ,          R,           R4      pVP                  RV R ,          ,           R,           4       VP                  R4       \        R4       V R,          '       d   VP                  R4       \        R	4       V R
,          '       d   VP                  R4       \        R4       V R,          '       d   VP                  R4       \        R4       V R,          '       d   VP                  R4       \        R4       V'       d   VP                  R4       \        R	4       V R,          '       dM   VP                  RV R,          ,           R,           4       VP                  RV R,          ,           R,           4       V'       d   RpV FM  p	RV	9   d'   WR,          P                  4       ,           R,           pK0  WP                  4       ,           R,           pKO  	  VP                  RV,           R,           4       VP                  R4       \	        VR R7       Fm  p	R V	9   g   K  VP                  R\        V	R ,          V	R!,          4      ,           R",           \        P                  V	R!,          ,          ,           R#,           4       Ko  	  VR$8w  dD   V R%,          '       d*   V R%,          P                  R&4       U
u. uF  p
R'V
/NK	  	  pp
\        W'4       VR(8X  d   \        W74       MVR)8X  d   \        W74       M\        W74       VR*8w  d   V F  pV R ,          V^ ,          9   dS   VP                  RV^,          ,           R",           V^,          ,           R",           V^,          ,           R+,           4       Kj  \        R,V^ ,          ,           R-,           4       K  	  VP                  R.4       VP                  4        R*# u up
i )/ContainerNamer   wz(block 
z    (blockinherit container)
Zbase_containerZFullNetworkAccessz!    (blockinherit net_container)
Znet_containerZ
VirtAccessz"    (blockinherit virt_container)
Zvirt_containerZXAccessz    (blockinherit x_container)
Zx_containerZ	TtyAccessz!    (blockinherit tty_container)
Ztty_containerz,    (blockinherit restricted_net_container)
ZStreamConnect    (allow process z/.process ( unix_stream_socket ( connectto ))) 
z5.socket ( sock_file ( getattr write open append ))) 
 ZCAP_:i   NN z*    (allow process process ( capability ( z))) 
c                 s&    V P                  R ^ 4      # )
portNumber)ZgetZxr
   r   <lambda>Zcreate_policy.<locals>.<lambda>   s    AEE,,Br   Zkeyr$   Zprotocolz ( z (  name_bind ))) 
zCRI-0ZDevices,
PathOnHostzCRI-OZ
containerdN ))) 
zWARNING: process type: zE seems to be unrelated to this container policy. Skipping allow rule.Z))openwriter   Zlowersortedr   permsZsocketr   write_policy_for_podman_deviceswrite_policy_for_crio_mounts"write_policy_for_containerd_mountswrite_policy_for_podman_mountsprintZclose)optsZcapabilitiesdevicesmountsZportsZappend_rulesZinspect_formatpolicyZcapsitemZdeviceZrules   &&&&&&&     r   create_policyr9   l   s:    $'&0#6F
LLT/22T9:
LL12!"  9:_%L:;%&I78]#K9:_%DE_%O!?#$@A	

 	!?#$FG	
  D~2hnn..4jjl*S0 ! 	ADH8STT u"BC4LL%T,/j1ABC ,,tJ/01 )	) D  	??<@O<Q<QRU<VW<V&f-<VGW'8  $V4	<	'*6:&v6t DO$Q/)1g 1g 	
 1g    -1g]^ !$ LL
LLN? Xs   O	c                 s(   . p. pV  EF  pVR ,          P                  R4      '       d   K$  VR ,          \        8X  d@   VR,          '       d   VP                  R4       MVP                  R4       \        R4       Ku  VR ,          \        8X  d@   VR,          '       d   VP                  R4       MVP                  R4       \        R4       K  VR ,          \
        8X  dA   VR,          '       d   VP                  R	4       MVP                  R
4       \        R4       EK  VR ,          \        8X  dA   VR,          '       d   VP                  R4       MVP                  R4       \        R4       EKj  VR,          RJ d%   VP                  \        VR ,          4      4       EK  VP                  \        VR ,          4      4       EK  	  \        \        V4      4       EF  pVP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       EK  	  \        \        V4      4       EF  pVP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       EK  	  R# )ZhostPathz/var/lib/kubeletZreadonly!    (blockinherit log_container)
$    (blockinherit log_rw_container)
log_container"    (blockinherit home_container)
%    (blockinherit home_rw_container)
home_container!    (blockinherit tmp_container)
$    (blockinherit tmp_rw_container)
tmp_container$    (blockinherit config_container)
'    (blockinherit config_rw_container)
config_containerFr!   	 ( dir ( dir_rwr*   
 ( file ( file_rw ( fifo_file ( fifo_rw ( sock_file ( 	socket_rwdir_rofile_rofifo_ro	socket_roN)Z
startswithLOG_CONTAINERr,   r   HOME_CONTAINERTMP_CONTAINERCONFIG_CONTAINERextendr   r-   setr.   perm)r6   r7   r   Zcontexts_readonlyr8   r      &&    r   r0   r0      s   H
&&'9::
},JABDE)
~-JBCEF)*
},JABDE)
//JDEGH+, 
u$OOM$z*:;<$$]4
3C%DES V #h-(! jj"# 		
 	! jj#$ 		
 	!  jj#$ 		
 	!  jj%& 		
- )< #/01! jj"# 		
 	! jj#$ 		
 	!  jj#$ 		
 	!  jj%& 		
- 2r   c                 s   . pV  F$  pVP                  \        VR ,          4      4       K&  	  \        \        V4      4       F  pVP	                  RV,           R,           \
        P                  R,          ,           R,           4       VP	                  RV,           R,           \
        P                  R,          ,           R,           4       K  	  R# )r)   r!   z ( blk_file ( Z	device_rwr*   z ( chr_file ( N)rV   r   r-   rW   r,   r.   rX   )r5   r7   r   r8   r      &&   r   r/   r/   >  s    Hd<&89:  #h-(! jj%& 		
 	! jj%& 		
 )r   c                 sv	   . p. pV  EFc  pVR ,          P                  R4      '       d   K$  VR ,          \        8X  d,   VR,          RJ d   VP                  R4       \        R4       Ka  VR ,          \        8X  d,   VR,          RJ d   VP                  R4       \        R4       K  VR ,          \        8X  d,   VR,          RJ d   VP                  R4       \        R	4       K  VR ,          \        8X  d-   VR,          RJ d    VP                  R
4       \        R	4       EK  VR ,          \
        8X  d-   VR,          RJ d    VP                  R4       \        R4       EKW  VR ,          \
        8X  d-   VR,          RJ d    VP                  R4       \        R4       EK  VR ,          \        8X  d-   VR,          RJ d    VP                  R4       \        R4       EK  VR ,          \        8X  d-   VR,          RJ d    VP                  R4       \        R4       EK  VR,          RJ d%   VP                  \        VR ,          4      4       EKB  VP                  \        VR ,          4      4       EKf  	  \        \        V4      4       EF  pVP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       EK  	  \        \        V4      4       EF  pVP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       EK  	  R# ) ZSource/ZRWFr:   r<   Tr;   r=   r?   r>   r@   rB   rA   rC   rE   rD   r!   rF   rG   r*   rH   rI   rJ   rK   rL   rM   rN   rO   rP   rQ   N)findrR   r,   r   rS   rT   rU   rV   r   r-   rW   r.   rX   )r6   r7   r   Zcontexts_rwr8   r   rY   r   r2   r2   U  s   HKH~""3''H~.4:3FAB_-H~.4:3EDE_-H~/DJ%4GBC-.H~/DJ$4FEF-.H~.4:3FAB_-H~.4:3EDE_-H~!11d4jE6IDE/0H~!11d4jD6HGH/0DzT!""=h#@Ad8n =>[ ^ #k*+! jj"# 		
 	! jj#$ 		
 	!  jj#$ 		
 	!  jj%& 		
- ,< #h-(! jj"# 		
 	! jj#$ 		
 	!  jj#$ 		
 	!  jj%& 		
- )r   c                 s   \        V R  R7       EFf  pVR,          P                  R4      '       d   K$  VR,          \        8X  d-   RVR,          9   d   VP                  R4       \	        R4       Kb  VR,          \        8X  d-   RVR,          9  d   VP                  R4       \	        R4       K  VR,          \
        8X  d-   RVR,          9   d   VP                  R	4       \	        R
4       K  VR,          \
        8X  d.   RVR,          9  d    VP                  R4       \	        R
4       EK  VR,          \        8X  d.   RVR,          9   d    VP                  R4       \	        R4       EK\  VR,          \        8X  d.   RVR,          9  d    VP                  R4       \	        R4       EK  VR,          \        8X  d.   RVR,          9   d    VP                  R4       \	        R4       EK  VR,          \        8X  d.   RVR,          9  d    VP                  R4       \	        R4       EK  \        VR,          4      pV EF4  pRVR,          9  Ed	   VP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       RVR,          9   g   EK,  VP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       VP                  RV,           R,           \        P                  R,          ,           R,           4       EK7  	  EKi  	  R # )!c                 s&    \        V R ,          4      # )source)r   r%   r
   r   r&   Z4write_policy_for_containerd_mounts.<locals>.<lambda>  s    S8-=r   r'   r]   r[   ZroZoptionsr:   r<   r;   r=   r?   r>   r@   rB   rA   rC   rE   rD   r!   rF   rG   r*   rH   rI   rJ   rK   rL   rM   rN   rO   rP   rQ   N)r-   r\   rR   r,   r   rS   rT   rU   r   r.   rX   )r6   r7   r8   r   r   rZ   r   r1   r1     s    v#=>>H~""3''H~.44	?3JAB_-H~.4tI3NDE_-H~/DDO4KBC-.H~/DY4OEF-.H~.44	?3JAB_-H~.4tI3NDE_-H~!11dd9o6MDE/0H~!11d$y/6QGH/0$T(^4H#tI.LL-!"%&  **X./ $	$ LL-!"&'  **Y/0 $	$ LL-!"+,  **Y/0 $	$ LL-!"+,  **[12 $	$ 4	?*LL-!"%&  **X./ $	$ LL-!"&'  **Y/0 $	$ LL-!"+,  **Y/0 $	$ LL-!"+,  **[12 $	$i $W ?r   c                 sB   \        4       p\        \        4      '       g   \        R 4       \	        ^4       \        \        4       V R,          '       d   \        P                  ! 4       p\        P                  ! V4       \         F   p\        P                  ! W#R,           4       K"  	  \        V4       \        P                  ! W R,          R,           4       \        P                  ! V4       R
# \        \        4      p\        \        4      ^8  dB   \        RV R,          ,           R,           \        ,           R,           V,           R,           4       M@\        RV R,          ,           R,           \        ,           R,           V,           R	,           4       \        V4       R
# )zEPolicy templates not found! Please install container-selinux package.ZLoadModulesr   r   z1
Please load these modules using: 
# semodule -i .cil z/{Z}r[   r"   N)r   r   TEMPLATES_STOREr3   Zexitr   r   r   r   r   Zsemanage_module_install_fileZsemanage_commitr   r   )r4   ZPWDr   r	   Z	templatess   &    r   load_policyr`   :  sS   
(C/""UVQ	/M002!!&))H11&V:KL * 	c
--f?6Kf6TU  (,->?	 !A%E'( "" 	
   E'( "" 	
   	c
r   c           	      sd   \         pR p\        W4       \        \        R4      ;_uu_ 4       pVP	                  RV R,          ,           R,           4       VP	                  RV R,          ,           R,           \        \        4      P                  RR4      ,           R	,           4       VP	                  R
V R,          ,           R,           4       RRR4       \        P                  ! V R,          R,           R4      ;_uu_ 4       p\         F5  pVP                  \        R,           V,           R,           VR,           4       K7  	  VP                  V R,          R,           4       \        V R,          R,           4       RRR4       \        R4       R#   + '       g   i     L; i  + '       g   i     L0; i)z./r   z	archive: r   z-policy.tar.gz
zpolicy: r^   r(   r#   r    zfinal_policy: r   Nz-policy.tar.gzzw:gzr[   zk
Ansible playbook and archive with udica policies generated! 
Please run ansible play to deploy the policy.)TEMPLATE_PLAYBOOKr   r+   VARIABLE_FILE_NAMEr,   r   r   ZreplacetarfileZaddr_   r   r3   )r4   ZsrcZdstZvarsfileZtarr	   s   &     r   generate_playbookrd   i  sJ   
C
CN	 #	&	&({T/%::=OOP?#$ ''89AA#sKL 		
 	'$*??&HI 
' 
d?+.>>	G	G3)HGGOc)H4v=x&?PQ *_%./tO$v-.	 
H 
	:# 
'	& 
H	Gs   BF?A8FF	F/	) Zshutilr   Zosr   r   r   Zos.pathr   rc   r   r   Zudica.permsr.   r_   rU   rS   rR   rT   ra   rb   r   r   r   r   r   r9   r0   r/   r2   r1   r`   rd   ) r   r   <module>re      s      $ $     
 M**M0L   @ 2  '>$N$cLi
X
.m
`rj,^r   