[PATCH v4 3/3] sepolgen-ifgen: refactor default policy path retrieval

["Christian Göttsche" <cgzones@googlemail.com>]

On a SELinux disabled system the python call
`selinux.security_policyvers()` will fail.

Move the logic to find a binary policy from the python script
`sepolgen-ifgen` to the C-helper `sepolgen-ifgen-attr-helper`.
Change the helper command line interface to accept an optional policy
path as second argument.  If not given try the current loaded policy
(`selinux_current_policy_path`) and if running on a SELinux disabled
system iterate over the default store path appending policy versions
starting at the maximum supported policy version
(`sepol_policy_kern_vers_max`).

This changes the helper command line interface from:
    sepolgen-ifgen-attr-helper policy_file out_file
to
    sepolgen-ifgen-attr-helper out_file [policy_file]
and adds a linkage to libselinux.

Export LIBSELINUXA like LIBSEPOLA in the root Makefile

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
v4: Improve the behavior on no explicit policy path given:
    - Reorder helper's command line interface
    - Use loaded policy on SELinux enabled systems
v3: Move the iteration logic from sepolgen-ifgen to 
    sepolgen-ifgen-attr-helper and use sepol_policy_kern_vers_max()
    instead of selinux.security_policyvers(), to work on SELinux
    disabled systems

 Makefile                                      |  2 +
 python/audit2allow/Makefile                   |  5 ++-
 python/audit2allow/sepolgen-ifgen             | 28 ++----------
 .../audit2allow/sepolgen-ifgen-attr-helper.c  | 43 +++++++++++++++++--
 4 files changed, 49 insertions(+), 29 deletions(-)

diff --git a/Makefile b/Makefile
index 298cd2b7..caf4cd3c 100644
--- a/Makefile
+++ b/Makefile
@@ -23,12 +23,14 @@ endif
 ifneq ($(DESTDIR),)
 	LIBDIR ?= $(DESTDIR)$(PREFIX)/lib
 	LIBSEPOLA ?= $(LIBDIR)/libsepol.a
+	LIBSELINUXA ?= $(LIBDIR)/libselinux.a
 
 	CFLAGS += -I$(DESTDIR)$(PREFIX)/include
 	LDFLAGS += -L$(DESTDIR)$(PREFIX)/lib -L$(LIBDIR)
 	export CFLAGS
 	export LDFLAGS
 	export LIBSEPOLA
+	export LIBSELINUXA
 endif
 
 all install relabel clean test indent:
diff --git a/python/audit2allow/Makefile b/python/audit2allow/Makefile
index 15db5490..5400586c 100644
--- a/python/audit2allow/Makefile
+++ b/python/audit2allow/Makefile
@@ -15,10 +15,13 @@ CFLAGS ?= -Werror -Wall -W
 ifeq ($(LIBSEPOLA),)
         LDLIBS_LIBSEPOLA := -l:libsepol.a
 endif
+ifeq ($(LIBSELINUXA),)
+        LDLIBS_LIBSELINUXA := -l:libselinux.a
+endif
 
 all: audit2why sepolgen-ifgen-attr-helper
 
-sepolgen-ifgen-attr-helper: sepolgen-ifgen-attr-helper.o $(LIBSEPOLA)
+sepolgen-ifgen-attr-helper: sepolgen-ifgen-attr-helper.o $(LIBSEPOLA) $(LIBSELINUXA)
 	$(CC) $(LDFLAGS) -o $@ $^ $(LDLIBS_LIBSEPOLA)
 
 audit2why:
diff --git a/python/audit2allow/sepolgen-ifgen b/python/audit2allow/sepolgen-ifgen
index 4a71cda4..b7a04c71 100644
--- a/python/audit2allow/sepolgen-ifgen
+++ b/python/audit2allow/sepolgen-ifgen
@@ -27,7 +27,6 @@
 
 
 import sys
-import os
 import tempfile
 import subprocess
 
@@ -65,37 +64,18 @@ def parse_options():
     return options
 
 
-def get_policy():
-    p = selinux.selinux_current_policy_path()
-    if p and os.path.exists(p):
-        return p
-    i = selinux.security_policyvers()
-    p = selinux.selinux_binary_policy_path() + "." + str(i)
-    while i > 0 and not os.path.exists(p):
-        i = i - 1
-        p = selinux.selinux_binary_policy_path() + "." + str(i)
-    if i > 0:
-        return p
-    return None
-
-
 def get_attrs(policy_path, attr_helper):
     try:
-        if not policy_path:
-            policy_path = get_policy()
-        if not policy_path:
-            sys.stderr.write("No installed policy to check\n")
-            return None
         outfile = tempfile.NamedTemporaryFile()
     except IOError as e:
         sys.stderr.write("could not open attribute output file\n")
         return None
-    except OSError:
-        # SELinux Disabled Machine
-        return None
 
     fd = open("/dev/null", "w")
-    ret = subprocess.Popen([attr_helper, policy_path, outfile.name], stdout=fd).wait()
+    if policy_path:
+        ret = subprocess.Popen([attr_helper, outfile.name, policy_path], stdout=fd).wait()
+    else:
+        ret = subprocess.Popen([attr_helper, outfile.name], stdout=fd).wait()
     fd.close()
     if ret != 0:
         sys.stderr.write("could not run attribute helper\n")
diff --git a/python/audit2allow/sepolgen-ifgen-attr-helper.c b/python/audit2allow/sepolgen-ifgen-attr-helper.c
index 1ce37b0d..001ae80b 100644
--- a/python/audit2allow/sepolgen-ifgen-attr-helper.c
+++ b/python/audit2allow/sepolgen-ifgen-attr-helper.c
@@ -26,6 +26,8 @@
 #include <sepol/policydb/avtab.h>
 #include <sepol/policydb/util.h>
 
+#include <selinux/selinux.h>
+
 #include <stdio.h>
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -147,8 +149,41 @@ static policydb_t *load_policy(const char *filename)
 	policydb_t *policydb;
 	struct policy_file pf;
 	FILE *fp;
+	char pathname[PATH_MAX];
+	int suffix_ver;
 	int ret;
 
+	/* no explicit policy name given, try loaded policy on a SELinux enabled system */
+	if (!filename) {
+		filename = selinux_current_policy_path();
+	}
+
+	/* try bare default policy path */
+	if (!filename && access(selinux_binary_policy_path(), F_OK) == 0) {
+		filename = selinux_binary_policy_path();
+	}
+
+	/*
+	 * Fallback to default store paths with version suffixes,
+	 * starting from the maximum supported policy version.
+	 */
+	if (!filename) {
+		for (suffix_ver = sepol_policy_kern_vers_max(); suffix_ver > 0; suffix_ver--) {
+			snprintf(pathname, sizeof(pathname), "%s.%d", selinux_binary_policy_path(), suffix_ver);
+
+			if (access(pathname, F_OK) == 0) {
+				filename = pathname;
+				break;
+			}
+		}
+
+		if (!filename) {
+			fprintf(stderr, "Can't find any policy at '%s'\n",
+				selinux_binary_policy_path());
+			return NULL;
+		}
+	}
+
 	fp = fopen(filename, "r");
 	if (fp == NULL) {
 		fprintf(stderr, "Can't open '%s':  %s\n",
@@ -188,7 +223,7 @@ static policydb_t *load_policy(const char *filename)
 
 void usage(char *progname)
 {
-	printf("usage: %s policy_file out_file\n", progname);
+	printf("usage: %s out_file [policy_file]\n", progname);
 }
 
 int main(int argc, char **argv)
@@ -197,18 +232,18 @@ int main(int argc, char **argv)
 	struct callback_data cb_data;
 	FILE *fp;
 
-	if (argc != 3) {
+	if (argc != 2 && argc != 3) {
 		usage(argv[0]);
 		return -1;
 	}
 
 	/* Open the policy. */
-	p = load_policy(argv[1]);
+	p = load_policy(argv[2]);
 	if (p == NULL)
 		return -1;
 
 	/* Open the output policy. */
-	fp = fopen(argv[2], "w");
+	fp = fopen(argv[1], "w");
 	if (fp == NULL) {
 		fprintf(stderr, "error opening output file\n");
 		policydb_destroy(p);
-- 
2.27.0