Merge pull request #158 from pebenito/seinfo-improvements

pebenito · web-flow · commit e51eeae318a2 · 2025-10-07T11:29:29.000-04:00
Seinfo improvements
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -30,6 +30,7 @@ jobs:
           - {python: '3.10', tox: python3}
           - {python: '3.11', tox: python3}
           - {python: '3.12', tox: python3}
+          - {python: '3.13', tox: python3}
           - {python: '3.11', tox: pep8}
           - {python: '3.11', tox: lint}
           - {python: '3.11', tox: mypy}
@@ -41,7 +42,7 @@ jobs:
 
     # This should be the minimum required Python version to build refpolicy.
     - name: Set up Python ${{ matrix.build-opts.python }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.build-opts.python }}
 
diff --git a/seinfo b/seinfo
diff --git a/setools/devicetreeconquery.py b/setools/devicetreeconquery.py
@@ -44,6 +44,8 @@ class DevicetreeconQuery(mixins.MatchContext, query.PolicyQuery):
                     No effect if not using set operations.
     """
 
+    required_platform = policyrep.PolicyTarget.xen
+
     path: str | None = None
 
     def results(self) -> Iterable[policyrep.Devicetreecon]:
diff --git a/setools/exception.py b/setools/exception.py
@@ -49,6 +49,16 @@ class MLSDisabled(PolicyrepException):
     pass
 
 
+class PlatformMismatch(ValueError, PolicyrepException):
+
+    """
+    Exception when the policy platform does not match the requested
+    platform.  For example a Xen policy is loaded, but a query
+    requiring SELinux is attempted.
+    """
+    pass
+
+
 #
 # Invalid component exceptions
 #
diff --git a/setools/fsusequery.py b/setools/fsusequery.py
@@ -44,6 +44,8 @@ class FSUseQuery(mixins.MatchContext, query.PolicyQuery):
                     No effect if not using set operations.
     """
 
+    required_platform = policyrep.PolicyTarget.selinux
+
     ruletype = CriteriaSetDescriptor[policyrep.FSUseRuletype](enum_class=policyrep.FSUseRuletype)
     fs = CriteriaDescriptor[str]("fs_regex")
     fs_regex: bool = False
diff --git a/setools/genfsconquery.py b/setools/genfsconquery.py
@@ -46,6 +46,8 @@ class GenfsconQuery(mixins.MatchContext, query.PolicyQuery):
                     No effect if not using set operations.
     """
 
+    required_platform = policyrep.PolicyTarget.selinux
+
     filetype: int | None = None
     fs = CriteriaDescriptor[str]("fs_regex")
     fs_regex: bool = False
diff --git a/setools/ibendportconquery.py b/setools/ibendportconquery.py
@@ -43,6 +43,8 @@ class IbendportconQuery(mixins.MatchContext, mixins.MatchName, query.PolicyQuery
                     No effect if not using set operations.
     """
 
+    required_platform = policyrep.PolicyTarget.selinux
+
     _port: int | None = None
 
     @property
diff --git a/setools/ibpkeyconquery.py b/setools/ibpkeyconquery.py
@@ -51,6 +51,8 @@ class IbpkeyconQuery(mixins.MatchContext, query.PolicyQuery):
                     No effect if not using set operations.
     """
 
+    required_platform = policyrep.PolicyTarget.selinux
+
     _subnet_prefix: IPv6Address | None = None
     _pkeys: policyrep.IbpkeyconRange | None = None
     pkeys_subset: bool = False
diff --git a/setools/initsidquery.py b/setools/initsidquery.py
@@ -42,6 +42,8 @@ class InitialSIDQuery(mixins.MatchName, mixins.MatchContext, query.PolicyQuery):
                     No effect if not using set operations.
     """
 
+    required_platform = policyrep.PolicyTarget.selinux
+
     def results(self) -> Iterable[policyrep.InitialSID]:
         """Generator which yields all matching initial SIDs."""
         self.log.info(f"Generating initial SID results from {self.policy}")
diff --git a/setools/iomemconquery.py b/setools/iomemconquery.py
@@ -53,6 +53,8 @@ class IomemconQuery(mixins.MatchContext, query.PolicyQuery):
                     No effect if not using set operations.
     """
 
+    required_platform = policyrep.PolicyTarget.xen
+
     _addr: policyrep.IomemconRange | None = None
     addr_subset: bool = False
     addr_overlap: bool = False
@@ -64,11 +66,11 @@ def addr(self) -> policyrep.IomemconRange | None:
         return self._addr
 
     @addr.setter
-    def addr(self, value: tuple[int, int] | None) -> None:
-        if value:
-            self._addr = policyrep.IomemconRange(*value)
+    def addr(self, value: policyrep.IomemconRange | tuple[int, int] | None) -> None:
+        if isinstance(value, policyrep.IomemconRange):
+            self._addr = value
         else:
-            self._addr = None
+            self._addr = policyrep.IomemconRange(*value) if value else None
 
     def results(self) -> Iterable[policyrep.Iomemcon]:
         """Generator which yields all matching iomemcons."""
diff --git a/setools/ioportconquery.py b/setools/ioportconquery.py
@@ -53,6 +53,8 @@ class IoportconQuery(mixins.MatchContext, query.PolicyQuery):
                     No effect if not using set operations.
     """
 
+    required_platform = policyrep.PolicyTarget.xen
+
     _ports: policyrep.IoportconRange | None = None
     ports_subset: bool = False
     ports_overlap: bool = False
@@ -64,11 +66,11 @@ def ports(self) -> policyrep.IoportconRange | None:
         return self._ports
 
     @ports.setter
-    def ports(self, value: tuple[int, int] | None) -> None:
-        if value:
-            self._ports = policyrep.IoportconRange(*value)
+    def ports(self, value: policyrep.IoportconRange | tuple[int, int] | None) -> None:
+        if isinstance(value, policyrep.IoportconRange):
+            self._ports = value
         else:
-            self._ports = None
+            self._ports = policyrep.IoportconRange(*value) if value else None
 
     def results(self) -> Iterable[policyrep.Ioportcon]:
         """Generator which yields all matching ioportcons."""
diff --git a/setools/netifconquery.py b/setools/netifconquery.py
@@ -42,6 +42,8 @@ class NetifconQuery(mixins.MatchContext, mixins.MatchName, query.PolicyQuery):
                     No effect if not using set operations.
     """
 
+    required_platform = policyrep.PolicyTarget.selinux
+
     def results(self) -> Iterable[policyrep.Netifcon]:
         """Generator which yields all matching netifcons."""
         self.log.info(f"Generating netifcon results from {self.policy}")
diff --git a/setools/nodeconquery.py b/setools/nodeconquery.py
@@ -50,6 +50,8 @@ class NodeconQuery(mixins.MatchContext, query.PolicyQuery):
                     No effect if not using set operations.
     """
 
+    required_platform = policyrep.PolicyTarget.selinux
+
     _network: AnyIPNetwork | None = None
     network_overlap: bool = False
     _ip_version: policyrep.NodeconIPVersion | None = None
diff --git a/setools/pcideviceconquery.py b/setools/pcideviceconquery.py
@@ -44,6 +44,8 @@ class PcideviceconQuery(mixins.MatchContext, query.PolicyQuery):
                     No effect if not using set operations.
     """
 
+    required_platform = policyrep.PolicyTarget.xen
+
     _device: int | None = None
 
     @property
diff --git a/setools/pirqconquery.py b/setools/pirqconquery.py
@@ -44,6 +44,8 @@ class PirqconQuery(mixins.MatchContext, query.PolicyQuery):
                     No effect if not using set operations.
     """
 
+    required_platform = policyrep.PolicyTarget.xen
+
     _irq: int | None = None
 
     @property
diff --git a/setools/policyrep/netcontext.pxi b/setools/policyrep/netcontext.pxi
@@ -17,16 +17,19 @@ class IbpkeyconRange:
 
     def __post_init__(self):
         if self.low < IbpkeyconRange.MIN or self.high < IbpkeyconRange.MIN:
-            raise ValueError(
-                f"Pkeys must be >= {IbpkeyconRange.MIN:#x}: {self.low:#x}-{self.high:#x}")
+            raise ValueError(f"Partition keys must be >= {IbpkeyconRange.MIN:0=#6x}: {self}")
 
         if self.low > IbpkeyconRange.MAX or self.high > IbpkeyconRange.MAX:
-            raise ValueError(
-                f"Pkeys must be <= {IbpkeyconRange.MAX:#x}: {self.low:#x}-{self.high:#x}")
+            raise ValueError(f"Partition keys must be <= {IbpkeyconRange.MAX:0=#6x}: {self}")
 
         if self.low > self.high:
-            raise ValueError(
-                f"The low pkey must be <= the high pkey: {self.low:#x}-{self.high:#x}")
+            raise ValueError(f"The low partition key must be <= the high partition key: {self}")
+
+    def __str__(self):
+        if self.low == self.high:
+            return f"{self.low:0=#6x}"
+        else:
+            return f"{self.low:0=#6x}-{self.high:0=#6x}"
 
 
 @dataclasses.dataclass(eq=True, order=True, frozen=True)
@@ -42,14 +45,19 @@ class PortconRange:
 
     def __post_init__(self):
         if self.low < PortconRange.MIN or self.high < PortconRange.MIN:
-            raise ValueError(f"Port numbers must be >= {PortconRange.MIN}: {self.low}-{self.high}")
+            raise ValueError(f"Port numbers must be >= {PortconRange.MIN}: {self}")
 
         if self.low > PortconRange.MAX or self.high > PortconRange.MAX:
-            raise ValueError(f"Port numbers must be <= {PortconRange.MAX}: {self.low}-{self.high}")
+            raise ValueError(f"Port numbers must be <= {PortconRange.MAX}: {self}")
 
         if self.low > self.high:
-            raise ValueError(
-                f"The low port must be <= the high port: {self.low}-{self.high}")
+            raise ValueError(f"The low port must be <= the high port: {self}")
+
+    def __str__(self):
+        if self.low == self.high:
+            return str(self.low)
+        else:
+            return f"{self.low}-{self.high}"
 
 
 #
@@ -140,10 +148,7 @@ cdef class Ibpkeycon(Ocontext):
         return str(self) < str(other)
 
     def statement(self):
-        if self.pkeys.low == self.pkeys.high:
-            return f"ibpkeycon {self.subnet_prefix} {self.pkeys.low:#x} {self.context}"
-        else:
-            return f"ibpkeycon {self.subnet_prefix} {self.pkeys.low:#x}-{self.pkeys.high:#x} {self.context}"
+        return f"ibpkeycon {self.subnet_prefix} {self.pkeys} {self.context}"
 
 
 cdef class Netifcon(Ocontext):
@@ -316,12 +321,7 @@ cdef class Portcon(Ocontext):
         return str(self) < str(other)
 
     def statement(self):
-        low, high = self.ports.low, self.ports.high
-
-        if low == high:
-            return f"portcon {self.protocol} {low} {self.context}"
-        else:
-            return f"portcon {self.protocol} {low}-{high} {self.context}"
+        return f"portcon {self.protocol} {self.ports} {self.context}"
 
 
 #
diff --git a/setools/policyrep/selinuxpolicy.pxi b/setools/policyrep/selinuxpolicy.pxi
@@ -742,7 +742,7 @@ cdef class SELinuxPolicy:
             for version in range(max_ver, min_ver - 1, -1):
                 potential_policies.append(f"{base_policy_path}.{version}")
 
-        self.log.debug("Potential policies: {potential_policies}")
+        self.log.debug(f"Potential policies: {potential_policies}")
         for filename in potential_policies:
             try:
                 self._load_policy(filename)
diff --git a/setools/policyrep/xencontext.pxi b/setools/policyrep/xencontext.pxi
@@ -17,16 +17,19 @@ class IomemconRange:
 
     def __post_init__(self):
         if self.low < IomemconRange.MIN or self.high < IomemconRange.MIN:
-            raise ValueError(
-                f"Memory address must be >= {IomemconRange.MIN}: {self.low}-{self.high}")
+            raise ValueError(f"Memory address must be >= {IomemconRange.MIN:0=#6x}: {self}")
 
         if self.low > IomemconRange.MAX or self.high > IomemconRange.MAX:
-            raise ValueError(
-                f"Memory address must be <= {IomemconRange.MAX}: {self.low}-{self.high}")
+            raise ValueError(f"Memory address must be <= {IomemconRange.MAX:0=#6x}: {self}")
 
         if self.low > self.high:
-            raise ValueError(
-                f"The low mem addr must be smaller than the high mem addr: {self.low}-{self.high}")
+            raise ValueError(f"The low mem addr must be smaller than the high mem addr: {self}")
+
+    def __str__(self):
+        if self.low == self.high:
+            return f"{self.low:0=#6x}"
+        else:
+            return f"{self.low:0=#6x}-{self.high:0=#6x}"
 
 
 @dataclasses.dataclass(eq=True, order=True, frozen=True)
@@ -42,16 +45,20 @@ class IoportconRange:
 
     def __post_init__(self):
         if self.low < IoportconRange.MIN or self.high < IoportconRange.MIN:
-            raise ValueError(
-                f"Port numbers must be >= {IoportconRange.MIN}: {self.low}-{self.high}")
+            raise ValueError(f"Port numbers must be >= {IoportconRange.MIN:0=#6x}: {self}")
 
         if self.low > IoportconRange.MAX or self.high > IoportconRange.MAX:
-            raise ValueError(
-                f"Port numbers must be <= {IoportconRange.MAX}: {self.low}-{self.high}")
+            raise ValueError( f"Port numbers must be <= {IoportconRange.MAX:0=#6x}: {self}")
 
         if self.low > self.high:
-            raise ValueError("The low port must be smaller than the high port: "
-                f"{self.low}-{self.high}")
+            raise ValueError(f"The low port must be smaller than the high port: {self}")
+
+    def __str__(self):
+        if self.low == self.high:
+            return f"{self.low:0=#6x}"
+        else:
+            return f"{self.low:0=#6x}-{self.high:0=#6x}"
+
 
 #
 # Classes
@@ -93,12 +100,7 @@ cdef class Iomemcon(Ocontext):
         return i
 
     def statement(self):
-        low, high = self.addr.low, self.addr.high
-
-        if low == high:
-            return "iomemcon {low} {self.context1}"
-        else:
-            return "iomemcon {low}-{high} {self.context}"
+        return f"iomemcon {self.addr} {self.context}"
 
 
 cdef class Ioportcon(Ocontext):
@@ -118,12 +120,7 @@ cdef class Ioportcon(Ocontext):
         return i
 
     def statement(self):
-        low, high = self.ports.low, self.ports.high
-
-        if low == high:
-            return "ioportcon {low} {self.context}"
-        else:
-            return "ioportcon {low}-{high} {self.context}"
+        return f"ioportcon {self.ports} {self.context}"
 
 
 cdef class Pcidevicecon(Ocontext):
@@ -143,7 +140,7 @@ cdef class Pcidevicecon(Ocontext):
         return p
 
     def statement(self):
-        return f"pcidevicecon {self.device} {self.context}"
+        return f"pcidevicecon {self.device:0=#6x} {self.context}"
 
 
 cdef class Pirqcon(Ocontext):
diff --git a/setools/portconquery.py b/setools/portconquery.py
@@ -56,6 +56,8 @@ class PortconQuery(mixins.MatchContext, query.PolicyQuery):
                     No effect if not using set operations.
     """
 
+    required_platform = policyrep.PolicyTarget.selinux
+
     _protocol: policyrep.PortconProtocol | None = None
     _ports: policyrep.PortconRange | None = None
     ports_subset: bool = False
diff --git a/setools/query.py b/setools/query.py
diff --git a/tests/conftest.py b/tests/conftest.py
