#!/usr/bin/python

# Author: Donald Miner <dminer@tresys.com>

#

# Copyright (C) 2003 - 2005 Tresys Technology, LLC

#      This program is free software; you can redistribute it and/or modify

#      it under the terms of the GNU General Public License as published by

#      the Free Software Foundation, version 2.

"""

	This script generates an object class perm definition file.

"""

import sys

USERSPACE_CLASS = "userspace"

class Class:

	"""

	This object stores an access vector class.

	"""

	def __init__(self, name, perms, common):

		# The name of the class.

		self.name = name

		# A list of permissions the class contains.

		self.perms = perms

		# True if the class is declared as common, False if not.

		self.common = common

def get_perms(name, av_db):

	"""

	Returns the list of permissions contained within an access vector

	class that is stored in the access vector database av_db.

	Returns an empty list if the object name is not found.

	"""

	# Traverse through the access vector database and try to find the

	#  object with the name passed.

	for obj in av_db:

		if obj.name == name:

			return obj.perms

	return []

def get_av_db(file_name):

	"""

	Returns an access vector database generated from the file file_name.

	"""

	av_file = open(file_name, "r")

	av_data = []

	# Read the file and strip out comments on the way.

	# At the end of the loop, av_data will contain a list of individual

	#  words. i.e. ['common', 'file', '{', ...]. All comments and whitespace

	#  will be gone.

	while True:

		av_line = av_file.readline()

		# If EOF has been reached:

		if not av_line:

			break

		# Check if there is a comment, and if there is, remove it.

		comment_index = av_line.find("#")

		if comment_index != -1:

			av_line = av_line[:comment_index]

		# Pad the braces with whitespace so that they are split into

		#  their own word. It doesn't matter if there will be extra

		#  white space, it'll get thrown away when the string is split.

		av_line.replace("{"," { ")

		av_line.replace("}"," } ")		

		# Split up the words on the line and add it to av_data.

		av_data += av_line.split()

	av_file.close()

	# Parsing the file:

	# The implementation of this parse is a queue. We use the list of words

	#  from av_data and use the front element, then dequeue it. Each

	#  loop of this while is a common or class declaration. Several

	#  expected tokens are parsed and dequeued out of av_data for each loop.

	# Dequeue from the beginning of the list until av_data is empty:

	database = []

	while len(av_data) != 0:

		# At the beginning of every loop, the next word should be

		#  "common" or "class", meaning that each loop is a common

		#  or class declaration.

		# av_data = av_data[1:] removes the first element in the

		#  list, this is what is dequeueing data.

		# Figure out whether the next class will be a common or a class.

		if av_data[0] == "class":

			common = False

		elif av_data[0] == "common":

			common = True

		else:

			error("Unexpected token in file " + file_name + ": "\

				+ av_data[0] + ".")

		# Dequeue the "class" or "common" key word.

		av_data = av_data[1:]

		if len(av_data) == 0:

			error("Missing token in file " + file_name + ".")

		# Get and dequeue the name of the class or common.

		name = av_data[0]

		av_data = av_data[1:]

		# Retrieve the permissions inherited from a common set:

		perms = []

		# If the object we are working with is a class, since only

		#  classes inherit:

		if common == False:

			if len(av_data) == 0:

				error("Missing token in file " + file_name + ".")

			# If the class inherits from something else:

			if av_data[0] == "inherits":

				# Dequeue the "inherits" key word.

				av_data = av_data[1:]

				if len(av_data) == 0:

					error("Missing token in file "\

						+ file_name + " for " +\

						keyword + " " + name + ".")

				# av_data[0] is the name of the parent.

				# Append the permissions of the parent to

				#  the current class' permissions.

				perms += get_perms(av_data[0], database)

				# Dequeue the name of the parent.

				av_data = av_data[1:]

		# Retrieve the permissions defined with this set.

		if len(av_data) > 0 and av_data[0] == "{":

			# Dequeue the "{"

			av_data = av_data[1:]

			# Keep appending permissions until a close brace is

			#  found.

			while av_data[0] != "}":

				if av_data[0] == "{":

					error("Extra '{' in file " +\

						 file_name + ".")

				# Add the permission name.

				perms.append(av_data[0])

				# Dequeue the permission name.

				av_data = av_data[1:]

				if len(av_data) == 0:

					error("Missing token '}' in file "\

						+ file_name + ".")

			# Dequeue the "}"

			av_data = av_data[1:]

		# Add the new access vector class to the database.

		database.append(Class(name, perms, common))

	return database

def get_sc_db(file_name):

	"""

	Returns a security class database generated from the file file_name.

	"""

	# Read the file then close it.

	sc_file = open(file_name)

	sc_data = sc_file.readlines()

	sc_file.close()

	# For each line in the security classes file, add the name of the class

	#  and whether it is a userspace class or not to the security class

	#  database.

	database = []

	for line in sc_data:

		line = line.lstrip()

		# If the line is empty or the entire line is a comment, skip.

		if line == "" or line[0] == "#":

			continue

		# Check if the comment to the right of the permission matches

		#  USERSPACE_CLASS.

		comment_index = line.find("#")

		if comment_index != -1 and line[comment_index+1:].strip() == USERSPACE_CLASS:

			userspace = True

		else:

			userspace = False

		# All lines should be in the format "class NAME", meaning

		#  it should have two tokens and the first token should be

		#  "class".

		split_line = line.split()

		if len(split_line) < 2 or split_line[0] != "class":

			error("Wrong syntax: " + line)

		# Add the class's name (split_line[1]) and whether it is a

		#  userspace class or not to the database.

		# This is appending a tuple of (NAME,USERSPACE), where NAME is

		#  the name of the security class and USERSPACE is True if

		#  if it has "# USERSPACE_CLASS" on the end of the line, False

		#  if not.

		database.append((split_line[1], userspace))

	return database

def gen_class_perms(av_db, sc_db):

	"""

	Generates a class permissions document and returns it.

	"""

	# Define class template:

	class_perms_line = "define(`all_%s_perms',`{ %s}')\n"

	# Generate the defines for the individual class permissions.

	class_perms = ""

	for obj in av_db:

		# Don't output commons

		if obj.common == True:

			continue

		# Get the list of permissions.

		perms = get_perms(obj.name, av_db)

		# Merge all the permissions into one string with one space

		#  padding.

		perm_str = ""

		for perm in perms:

			perm_str += perm + " "

		# Add the line to the class_perms

		class_perms += class_perms_line % (obj.name, perm_str)

	class_perms += "\n"

	# Generate the kernel_class_perms and userspace_class_perms sets.

	class_line = "\tclass %s all_%s_perms;\n"

	kernel_class_perms = "define(`all_kernel_class_perms',`\n"

	userspace_class_perms = "define(`all_userspace_class_perms',`\n"

	# For each (NAME,USERSPACE) tuple, add the class to the appropriate

	# class permission set.

	for name, userspace in sc_db:

		if userspace:

			userspace_class_perms += class_line % (name, name)

		else:

			kernel_class_perms += class_line % (name, name)

	kernel_class_perms += "')\n\n"

	userspace_class_perms += "')\n"

	# Throw all the strings together and return the string.

	return class_perms + kernel_class_perms + userspace_class_perms

def error(error):

	"""

	Print an error message and exit.

	"""

        sys.stderr.write("%s exiting for: " % sys.argv[0])

        sys.stderr.write("%s\n" % error)

        sys.stderr.flush()

        sys.exit(1)

# MAIN PROGRAM

app_name = sys.argv[0]

if len(sys.argv) != 3:

	error("Incorrect input.\nUsage: " + sys.argv[0] + " access_vectors security_classes" )

# argv[1] is the access vector file.

av_file = sys.argv[1]

# argv[2] is the security class file.

sc_file = sys.argv[2]

# Output the class permissions document.

sys.stdout.write(gen_class_perms(get_av_db(av_file), get_sc_db(sc_file)))