libsemanage: semanage store migration script

We created a migration script to ease the burden of transition from the
old libsemanage store layout to the new. The script will detect all the
stores in /etc/selinux using the old layout and convert them to the new
layout in /var/lib/selinux. It also allows you to specify the default
priority to use with -p and store to operate on with -s. After migration
the script by default will leave the old store unchanged, but can be
told to remove the old modules directory with -c.

Examples:

migrate.py

Migrating from /etc/selinux/targeted/modules/active to /var/lib/selinux/targeted/active
Attempting to rebuild policy from /var/lib/selinux

migrate.py -s targeted

Migrating from /etc/selinux/targeted/modules/active to /var/lib/selinux/targeted/active
Attempting to rebuild policy from /var/lib/selinux

migrate.py -p 150

Migrating from /etc/selinux/targeted/modules/active to /var/lib/selinux/targeted/active
Attempting to rebuild policy from /var/lib/selinux

Signed-off-by: Chad Sellers <csellers@tresys.com>
libsemanage: add back original module enable/disable functions for ABI compatability

This uses symbolic versioning to maintain ABI compatability with the old
versions of semanage_module_get_enabled. Also to maintain ABI, the functions
semanage_module_{enable,disable} are added back and modified to call the
new semanage_module_set_enabled function.

Removed in commits:
- Revert "Last attempt at upstreaming semodule_disable patch."
- Revert "fixes to commit 847d27b8385ce77ac71df8aa58a2d298b33d1ea4"
- Revert "libsemanage: change module disabled from rename to symlink"
- Revert "libsemanage: Cleanup/fix enable/disable/remove module."

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
libsemanage: add back support for semange_set_root using the new source policy infrastructure

Removed in commits:
- Revert "libsemanage: introduce semanage_set_root and friends"
- Revert "libsemanage: Alternate path for semanage.conf"
- Revert "libsemanage: Use default semanage.conf as a fallback"

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
policycoreutils: semodule: add back support for alternative root paths

Removed in commits:
- Revert "policycoreutils: semodule: support for alternative root paths"

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
libsemanage: rewrite semanage_direct_list to not assume binary modular policies

Rather than getting the list of pp modules and parsing their headers to get
the name, use the new source policy functions to get the necessary
information from the module store.

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
libsepol: add function to libsepol for setting target_platform

With pp modules, the target platform information comes form the base
module. However, CIL modules have no concept of target platform.  So it
must come from somewhere else. This adds an API function that allows
setting the target platform.

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
libsemanage: add target-platform option to semanage.conf

The target platform used to come from the base module. However, CIL has
no concept of a base module or a target platform. This adds an option to
semanage.conf (target-platform) to control how policies should be built.

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
libsemanage: update install functions to support CIL

With CIL, the filename and language extension are no longer stored in
the modules themselves like with pp files. So parse this information
from the filename when given a file to install, and require the
information be passed when just data. Symbolic versioning is used to
maintain ABI compatability with the old install functions. API
compatability is not maintained.

Also, remove version from the module info struct and the
semanage_module_info_{get,set}_version functions. These functions have
not been part of an official release, so removing them without providing
ABI/API compatability should not break anything.

Because versioning is removed, semanage_module_upgrade can no longer
perform the necessary checks to ensure an old module is not overriding
a newer module. So, this just remove the upgrade functions from the API.
Functions are added to maintain ABI compatability, which call the
install functions.

Also, CIL has no concept of a base module, so remove the notion of a
base module, including the API functions semanage_module_base_install
and related functions. To maintain ABI compatability, functions are
added which call the new install functions, thus treating base modules
as if they are normal modules.

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
policycoreutils: deprecate base/upgrade/version in semodule

Providing --upgrade or --base will now just call --install, and display
a deprecation message to the user. Additionally, because CIL has no
concept of version numbers, this removes the version output from --list.

Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
libsepol: build cil into libsepol

Set DISABLE_CIL=y to build libsepol without CIL support, e.g

    make DISABLE_CIL=y

To enable CIL support in libsepol, set DISABLE_CIL=n. This is the default
if not specified.

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
libsemanage: use libcil for compiling modules

Also finally removes the concept of a "base" module and special "_base" handling.

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
libsemanage: update source policy migration script

- Add --nobuild option to disabling rebuilding of policy
- Store the higher level language files in <module_name>/hll rather than
  <module_name>/<module_name>.<lang_ext>
- Remove the creation of the version file, that is no longer part of
  semanage
- Remove the special case naming for base. With the pp converter and the
  lack of a base in CIL, there is no need to special case it. Instead,
  just check for conflicting module names (should be rare) and error if
  one is found
- Copies status of disabled modules into the new store

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
policycoreutils: semanage: update to new source policy infrastructure

- Remove version references
- Use new methods for enabling/disabling modules
- Add support to set priority when adding/removing modules
- Modify module --list output to include priority and language extension
- Update permissiveRecords call to support cil policy

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
Signed-off-by: Jason Dana <jdana@tresys.com>
policycoreutils: add a HLL compiler to convert policy packages (.pp) to CIL

Reads in a policy package file via stdin or via filename, and writes out
the equivilent CIL to stdout or to an output file, depending on the
parameters passed in.

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
libsemanage: add support for HLL to CIL compilers

An HLL to CIL compiler must exist in the compiler_directory path which
is configubrable in semanage.conf. By default, this path is
/usr/libexec/selinux/hll/. The compiler name needs to match the HLL
language extension. For example, for pp files,
/usr/libexec/selinux/hll/pp must exist.

The HLL infrastructure uncompresses the HLL module and pipes the data to
the appropriate CIL compiler. The output CIL from the compiler is read
from another pipe, compressed, and saved to the module store as a cached
CIL file. This file will be used on all subsequent policy builds, unless
a new module is installed with the same name at the same priority, at
which point the cache is deleted and is subsequently rebuilt and cached.

A new option is added to semanage.conf, ignore_cache, which if set to
true will cause the cached CIL files to be ignored and all HLL files to
be recompiled and the resulting CIL to be recached.

Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
policycoreutils: add semodule flag for ignoring cached CIL

Providing --ignore-cache will cause the recompilating of all HLL
modules, and recaching of the resulting CIL files.

Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
libsemanage: add the ability to set an alternative root path for store

Allow an alternative selinux store root path to be used. The option
can be set in semanage.conf as store_root. If no option is provided, the
default path for the store_root is "/var/lib/selinux".

Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
policycoreutils: add semodule option to set store root path

Add a new -S option to semodule. This option overrides store_root
in semanage.conf and sets the SELinux store's root path. If neither -S,
nor store_root are specified in semanage.conf, then the default
location is used.

Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>