𝗖𝗨𝗥𝗥𝗘𝗡𝗧 𝗙𝗜𝗟𝗘 : /usr/lib64/python3.9/site-packages/setools/diff/__pycache__//terules.cpython-39.opt-1.pyc
a
q�qe]` � @ s� d dl Z d dlmZ d dlmZ d dlmZ d dlmZm Z m
Z
m Z m Z m
Z
mZmZmZmZ ddlmZmZmZ ddlmZmZmZmZmZm Z m Z d d
l m Z d d l m!Z! d d l"m#Z#m$Z$ d d
l%m&Z&m'Z' d dlm(Z( d dl)m*Z* ed�Z+ed�Z,G dd� de
�Z-G dd� de
�Z.G dd� de�Z/G dd� de
�Z0G dd� de
�Z1G d d � d e
�Z2eee3f Z4ee5e3f Z6e
e4e
e6e
e3e
e3e
e3e1f f f f f Z7e e e7e2e/dd �d d �Z8e7dd!�d"d#�Z9e7e2ee e e e e e- f d$�d%d&�Z:e3e d'gdf d(�d)d*�Z;e e e d+ d,�d-d.�Z<e3e d'gdf d(�d/d0�Z=e3e egdf d(�d1d2�Z>G d3d'� d'e#�Z?G d4d+� d+e$e �Z@G d5d6� d6e$�ZAdS )7� N)� defaultdict)�intern)�Enum)
�Any�Callable�Dict�Iterable�List�
NamedTuple�Optional�Set�Tuple�Union� )�RuleNotConditional� RuleUseError�TERuleNoFilename)� AnyTERule�AVRule� AVRuleXperm� Conditional�IoctlSet�
TERuletype�Type� )�conditional_wrapper_factory)�DiffResultDescriptor)�
Difference�Wrapper)�type_wrapper_factory� type_or_attr_wrapper_factory)�RuleList)�class_wrapper_factoryz<<unconditional>>�Truec @ sV e Zd ZU dZeed< eee e f ed< eee e f ed< eee e f ed< dS )�ModifiedAVRulez5Difference details for a modified access vector rule.�rule� added_perms�
removed_perms�
matched_permsN)
�__name__�
__module__� __qualname__�__doc__r �__annotations__r r �strr � r/ r/ �:/usr/lib64/python3.9/site-packages/setools/diff/terules.pyr$ s
r$ c @ s* e Zd ZU dZeed< eed< eed< dS )�ModifiedTERulez.Difference details for a modified type_* rule.r% Z
added_defaultZremoved_defaultN)r) r* r+ r, r r- r r/ r/ r/ r0 r1 $ s
r1 c @ s e Zd ZdZdZdS )�Sider r N)r) r* r+ �left�rightr/ r/ r/ r0 r2 0 s r2 c @ s" e Zd ZU ee ed< eed< dS )�RuleDBSideDataRecord�perms� orig_ruleN)r) r* r+ r r. r- r r/ r/ r/ r0 r5 5 s
r5 c @ s& e Zd ZU ee ed< ee ed< dS )�RuleDBSidesRecordr3 r4 N)r) r* r+ r r5 r- r/ r/ r/ r0 r8 : s
r8 c @ s. e Zd ZU eeef ed< eeef ed< dS )� TypeDBRecordr3 r4 N)r) r* r+ r r. r r- r/ r/ r/ r0 r9 ? s
r9 )� rule_list�rule_db�type_db�side�returnc C s� |t jkr|j}n|j}| D �]�}z tt|j��}tt|j��}W n ty\ t}t }Y n0 ||vr�t
� ||< t
� || |< n||| vr�t
� || |< |j j }t
|j�} t| |�}
|| | } |j�� D �]} | j }
|
|vr�| ||
< |
| vr�t
� | |
< |j�� D ]�}|j }||v�r |||< || |
v�r<t
� | |
|< d}d}|| |
| v �rr| |
| | }|j}|j}|t jk�r�|�s�|
}n|j| B }|j}t||�}n&|�s�|
}n|j| B }|j}t||�}t||�| |
| |< �qq�q dS )aP
Using rule_list, build up rule_db which is a data structure which consists
of nested dicts that store BOTH the left and the right policies. All of the
keys are interned strings. The permissions are stored as a set. The basic
structure is rule_db[cond_exp][block_bool][src][tgt][tclass] = sides
where:
cond_exp is a boolean expression
block_bool is either true or false
src is the source type
tgt is the target type
tclass is the target class
sides is a named tuple with attributes "left" and "right" referring to the
left or right policy. Each attribute in the sides named tuple refers to a
named tuple with attributes "perms" and "orig_rule" which refer to a
permission set and the original unexpanded rule.
sides = ((left_perms, left_orig_rule),(right_perms, right_orig_rule))
There are a few advantages to this structure. First, it takes up way less
memory. Second, it allows redundant rules to be easily eliminated. And,
third, it makes it easy to create the added, removed, and modified rules.
N)r2 r3 r4 r r. � conditional�conditional_blockr �TERULES_UNCONDITIONAL�TERULES_UNCONDITIONAL_BLOCK�dict�tclass�name�setr6 r5 �source�expand�targetr7 r8 )r: r; r< r= �types�unexpanded_rule�cond_expZ
block_boolrD r6 � side_data�block�srcZsrc_str�tgtZtgt_str� left_side�
right_sideZsides�pZorigr/ r/ r0 �_avrule_expand_generatorJ sb
rT )r; r> c C sR | t t }| �� D �]6\}}|t kr(q|�� D �]}|�� D �]\}}||vrRq>|�� D ]�\}}||| vrpqZ|�� D ]�\} }
| || | vr�qx|| | | } |
j} |
j}
| jr�| r�| j| jj@ }|r�| j| }|r�t|| j�} nd } t | |
�|| < | jrx|
rx|
j| jj@ }|rx|
j| }|�r2t||
j�}
nd }
t | |
�|| < qxqZq>q0qd S �N)
rA rB �items�valuesr3 r4 r6 r5 r7 r8 )r; Z uncond_blockrL � cond_blocksrN rO �src_datarP �tgt_datarD rM Zuncond_side_datarQ rR �crS r/ r/ r0 �_av_remove_redundant_rules� sB
r\ )r; r< r> c C sT g }g }g }| � � D �]2}|� � D �]"}|�� D �]\}}|�� D � ]�\} }
|
� � D ]�} | jr�| jr�| jj| jj@ } | jj| }
| jj| }|
s�|r�| jj}|�|j| |j| | jj�}|�t|||
| �� qT| j�r
| jj}|�|j| |j| | jj�}|�|� qT| jrT| jj}|�|j| |j| | jj�}|�|� qTqBq0q"q|||fS rU ) rW rV r3 r4 r6 r7 Zderive_expanded�appendr$ )r; r< �added�removed�modifiedrX rN rO rY rP rZ rM Z common_permsZ
left_permsZ right_permsZ
original_ruler% r/ r/ r0 �_av_generate_diffs� sJ �
�� �ra �TERulesDifference)�ruletyper> c s t �� �� dd�� fdd� }|S )z�
This is a template for the access vector diff functions.
Parameters:
ruletype The rule type, e.g. "allow".
N�r> c s2 | j �d�� | �� | jdu s(| jdu r0| �� tt� t� �}t� }t� |t< t� |t t < | j �d�| �� t
| j� ||t j � | j �d�| �� t
| j� ||t j
� | j �d� t|� | j �d� t||�\}}}|j �� |j
�� |�� t| d�� �|� t| d�� �|� t| d �� �|� dS )
�6Generate the difference in rules between the policies.�CGenerating {0} differences from {1.left_policy} to {1.right_policy}Nz(Expanding AV rules from {0.left_policy}.z)Expanding AV rules from {0.right_policy}.z Removing redundant AV rules.zGenerating AV rule diff.�
added_{0}s� removed_{0}s�
modified_{0}s)�log�info�format�_left_te_rules�_right_te_rules�_create_te_rule_listsr9 rC rA rB rT r2 r3 r4 r\ ra �clear�setattr)�selfr< r; r^ r_ r` �rc r/ r0 �diff� s2 ��
z av_diff_template.<locals>.diff�r �lookup�rc rt r/ rs r0 �av_diff_template� s
#rx �AVRuleXpermWrapper)r: r> c
C s� t � }| D ]N}|�� D ]@}t|�}z|| j|jO _W q tyT |||< Y q0 qq
|rzt�t��d� |t
|��� |� � S )z`
Generator that yields wrapped, expanded, av(x) rules with
unioned permission sets.
z/Expanded {0.ruletype} rules for {0.policy}: {1}) rC rH ry r6 �KeyError�loggingZ getLoggerr) �debugrl �len�keys)r: rV rK Z
expanded_ruleZexpanded_wrapped_ruler/ r/ r0 �_avxrule_expand_generator" s
��r c s t �� �� dd�� fdd� }|S )z�
This is a template for the extended permission access vector diff functions.
Parameters:
ruletype The rule type, e.g. "allowxperm".
Nrd c
s | j �d�� | �� | jr | js(| �� | jt| j� �t| j� �dd�\}}}g }|D ]V\}}| j|j|jdd�\}}} |s�|rZ|� t
|j t |�t |�t dd� | D ���� qZt
| d�� �tdd� |D ��� t
| d�� �td d� |D ��� t
| d
�� �|� d S ) re rf F)�unwrapc s s | ]}|d V qdS )r Nr/ )�.0rS r/ r/ r0 � <genexpr>f � z2avx_diff_template.<locals>.diff.<locals>.<genexpr>rg c s s | ] }|j V qd S rU ��origin)r� �ar/ r/ r0 r� h r� rh c s s | ] }|j V qd S rU r� )r� �rr/ r/ r0 r� i r� ri N)rj rk rl rm rn ro � _set_diffr r6 r] r$ r� r rq rF )
rr r^ r_ �matchedr` � left_rule�
right_ruler& r' r( rs r/ r0 rt H s6 �� � �
� z avx_diff_template.<locals>.diffru rw r/ rs r0 �avx_diff_template> s
$r� c s t �� �� dd�� fdd� }|S )z�
This is a template for the type_* diff functions.
Parameters:
ruletype The rule type, e.g. "type_transition".
Nrd c s� | j �d�� | �� | jdu s(| jdu r0| �� | �| �| j� t�| �| j� t��\}}}g }|D ]2\}}t |j
�t |j
�krf|� t ||j
|j
�� qft
| d�� �|� t
| d�� �|� t
| d�� �|� dS )re rf Nrg rh ri )rj rk rl rm rn ro r� Z_expand_generator�
TERuleWrapperr �defaultr] r1 rq )rr r^ r_ r� r` r� r� rs r/ r0 rt y s* ���
�z te_diff_template.<locals>.diffru rw r/ rs r0 �te_diff_templateo s
r� c @ s� e Zd ZU dZed�Zed�Zed�Zed�Z ed�Z
ed�Z ed�Z ed�Z
ed�Zed�Zed�Zed�Zed�Zed �Zed �Zed �Zed
�Zed �Zed �Zed �Zed �Zed
�Z ed
�Z ed
�Z ed�Z ed�Z ed�Z!ed�Z"ed�Z#ed�Z$ed�Z%ed�Z&e'd�Z(ed�Z)ed�Z*ed�Z+e'd�Z,ed�Z-ed�Z.ed�Z/e'd�Z0ed�Z1ed�Z2ed�Z3dZ4e5e6e7f e8d< dZ9e5e6e7f e8d< dd�d d �Z:dd�d d �Z;dS ) rb zV
Determine the difference in type enforcement rules
between two policies.
Zallow� diff_allowsZ
auditallow�diff_auditallowsZ
neverallow�diff_neverallowsZ dontaudit�diff_dontauditsZ
allowxperm�diff_allowxpermsZauditallowxperm�diff_auditallowxpermsZneverallowxperm�diff_neverallowxpermsZdontauditxperm�diff_dontauditxpermsZtype_transition�diff_type_transitionsZ type_change�diff_type_changesZ type_member�diff_type_membersNrm rn rd c C s� | j �d�| �� tt�| _| j�� D ]}| j|j � |� q&| j�
� D ] \}}| j �d�t |�|�� qH| j �d�| �� tt�| _ | j
�� D ]}| j |j � |� q�| j �
� D ] \}}| j �d�t |�|�� q�| j �d� dS )z$Create rule lists for both policies.z+Building TE rule lists from {0.left_policy}zLoaded {0} {1} rules.z,Building TE rule lists from {0.right_policy}z!Completed building TE rule lists.N)rj r| rl r �listrm Z left_policyZterulesrc r] rV r} rn Z right_policy)rr r% rc Zrulesr/ r/ r0 ro � s
z'TERulesDifference._create_te_rule_listsc C s� | j �d� d| _d| _d| _d| _d| _d| _d| _d| _ d| _
d| _ d| _ d| _
d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _ d| _ d| _ d| _ d| _ d| _!d| _"d| _#d| _$dS )z%Reset diff results on policy changes.z Resetting TE rule differencesN)%rj r| � added_allows�removed_allows�modified_allows�added_auditallows�removed_auditallows�modified_auditallows�added_neverallows�removed_neverallows�modified_neverallows�added_dontaudits�removed_dontaudits�modified_dontaudits�added_allowxperms�removed_allowxperms�modified_allowxperms�added_auditallowxperms�removed_auditallowxperms�modified_auditallowxperms�added_neverallowxperms�removed_neverallowxperms�modified_neverallowxperms�added_dontauditxperms�removed_dontauditxperms�modified_dontauditxperms�added_type_transitions�removed_type_transitions�modified_type_transitions�added_type_changes�removed_type_changes�modified_type_changes�added_type_members�removed_type_members�modified_type_membersrm rn �rr r/ r/ r0 � _reset_diff� sH z TERulesDifference._reset_diff)<r) r* r+ r, rx r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rm r! r r r- rn ro r� r/ r/ r/ r0 rb � sb
c @ s< e Zd ZdZdZedd�dd�Zdd� Zd d
� Zd d � Z dS )
ry zEWrap extended permission access vector rules to allow set operations.)rG rI rD �
xperm_typer6 N)r% r> c C sL || _ t|j�| _t|j�| _t|j�| _|j| _t|j�| _t |�| _
d S rU ) r� r rG rI r" rD r� rF r6 �hash�key�rr r% r/ r/ r0 �__init__! s zAVRuleXpermWrapper.__init__c C s | j S rU �r� r� r/ r/ r0 �__hash__* s zAVRuleXpermWrapper.__hash__c C s | j |j k S rU r� �rr �otherr/ r/ r0 �__lt__- s zAVRuleXpermWrapper.__lt__c C s0 | j |j ko.| j|jko.| j|jko.| j|jkS rU )rG rI rD r� r� r/ r/ r0 �__eq__0 s
�
�
�zAVRuleXpermWrapper.__eq__)
r) r* r+ r, � __slots__r r� r� r� r� r/ r/ r/ r0 ry s c @ s4 e Zd ZdZdZdd� Zdd� Zdd� Zd d
� Zd S ) r� z*Wrap type_* rules to allow set operations.�rG rI rD r? r@ �filenamec C s� || _ t|j�| _t|j�| _t|j�| _t|�| _zt|j �| _ |j
| _
W n t yj d | _ d | _
Y n0 z |j | _ W n t
tfy� d | _ Y n0 d S rU )r� r rG rI r" rD r� r� r r? r@ r r� r r r� r/ r/ r0 r� ? s
zTERuleWrapper.__init__c C s | j S rU r� r� r/ r/ r0 r� R s zTERuleWrapper.__hash__c C s | j |j k S rU r� r� r/ r/ r0 r� U s zTERuleWrapper.__lt__c C sH | j |j koF| j|jkoF| j|jkoF| j|jkoF| j|jkoF| j|jkS rU r� r� r/ r/ r0 r� X s
�
�
�
�
�zTERuleWrapper.__eq__N) r) r* r+ r, r� r� r� r� r� r/ r/ r/ r0 r� 9 s r� )Br{ � collectionsr �sysr �enumr �typingr r r r r r
r r r
r � exceptionr r r Z policyrepr r r r r r r r? r Z descriptorsr �
differencer r rJ r r r! Zobjclassr" rA rB r$ r1 r2 r5 r8 r9 r. ZCondExp�boolZ CondBlockZRuleDBrT r\ ra rx r r� r� rb ry r� r/ r/ r/ r0 �<module> sL 0$
,
� [&� '0 1( 