a

q�qeD�@s�dd
lZddl
mZ
ddlmZ
ddlmZmZmZ
ddl	m
Z

ddlmZm
Z
mZmZ
Gdd	�d	�ZGd
d�d�ZGdd
�d
�ZGdd�d�ZGdd�d�Zd
S)�N)
�Logger)
�Iterable�
)�CriteriaDescriptor�CriteriaSetDescriptor�CriteriaPermissionSetDescriptor)
�Context)�match_in_set�match_regex�match_range�match_regex_or_setc@s>eZ
dZUd
Zed�
ZdZeed<e	dd�dd�Z
dd	�ZdS)
�
MatchAliasz'Mixin for matching an object's aliases.�alias_regexFN��log�returncCs|
�d
�
|�
�

dS)z+Emit log debugging info for alias matching.z(Alias: {0.alias}, regex: {0.alias_regex}N��debug�format��selfr�r�4/usr/lib64/python3.9/site-packages/setools/mixins.py�_match_alias_debugszMatchAlias._match_alias_debugcCs|js
d
St
|
��|j|j�S)z�
        Match the alias criteria

        Parameter:
        obj     An object with an alias generator method named "aliases"
        T)�aliasr	�aliasesr�r�objrrr�_match_aliasszMatchAlias._match_alias)�__name__�
__module__�__qualname__�__doc__rrr�bool�__annotations__rrrrrrrr
s


r
c@s�eZ
dZUd
Zedd�ZdZeed<edd�Z	dZ
eed<edd�ZdZeed<ed	d
�
Z
dZeed<dZeed<dZeed
<dZeed<ed�
dd�Zeed�dd�ZdS)�MatchContextaL
    Mixin for matching contexts.

    Class attributes:
    user            The user to match in the context.
    user_regex      If true, regular expression matching
                    will be used on the user.
    role            The role to match in the context.
    role_regex      If true, regular expression matching
                    will be used on the role.
    type_           The type to match in the context.
    type_regex      If true, regular expression matching
                    will be used on the type.
    range_          The range to match in the context.
    range_subset    If true, the criteria will match if it
                    is a subset of the context's range.
    range_overlap   If true, the criteria will match if it
                    overlaps any of the context's range.
    range_superset  If true, the criteria will match if it
                    is a superset of the context's range.
    range_proper    If true, use proper superset/subset
                    on range matching operations.
                    No effect if not using set operations.
    �
user_regexZlookup_userF�
role_regexZlookup_role�
type_regexZlookup_typeZlookup_range)
Zlookup_function�
range_overlap�range_subset�range_superset�range_proper�
rcCsD|
�d
�
|�
�

|
�d�
|�
�

|
�d�
|�
�

|
�d�
|�
�

dS)z-Emit log debugging info for context matching.z'User: {0.user!r}, regex: {0.user_regex}z'Role: {0.role!r}, regex: {0.role_regex}z(Type: {0.type_!r}, regex: {0.type_regex}z�Range: {0.range_!r}, subset: {0.range_subset}, overlap: {0.range_overlap}, superset: {0.range_superset}, proper: {0.range_proper}Nrrrrr�_match_context_debugQs



�z!MatchContext._match_context_debug)�contextrcCs�|jrt
|
j|j|j�sd
S|jr8t
|
j|j|j�s8d
S|jrTt
|
j|j|j�sTd
S|jr|t|
j|j|j	|j
|j|j�s|d
SdS)z�
        Match the context criteria.

        Parameter:
        obj     An object with context attributes "user", "role",
                "type_" and "range_".
        FT)
�userr
r&�roler'�type_r(�range_rr*r)r+r,)rr/rrr�_match_contextYs8	


�


�


�





�zMatchContext._match_contextN)rr r!r"rr0r&r#r$r1r'r2r(r3r)r*r+r,rr.rr4rrrrr%*s














r%c@sJeZ
dZUd
Zed�
ZdZeed<dZ	eed<e
dd�dd�Zd	d
�ZdS)�	MatchNamez=Mixin for matching an object's name with alias dereferencing.�
name_regexF�alias_derefNrcCs|
�d
�
|�
�

dS)z)Log debugging messages for name matching.z?Name: {0.name!r}, regex: {0.name_regex}, deref: {0.alias_deref}Nrrrrr�_match_name_debug�szMatchName._match_name_debugcCsH|js
d
S|j
r4t|
|j|j�p2t|
��|j|j�St|
|j|j�SdS)z&Match the object to the name criteria.TN)�namer7r
r6r	rrrrr�_match_name�s

�zMatchName._match_name)
rr r!r"rr9r6r#r$r7rr8r:rrrrr5�s


r5c@s@eZ
dZUd
Zedd�ZdZeed<e	dd�dd�Z
d	d
�ZdS)�
MatchObjClassz%Mixin for matching an object's class.�tclass_regexZlookup_classFNrcCs|
�d
�
|�
�

dS)�0Emit log debugging info for permission matching.z,Class: {0.tclass!r}, regex: {0.tclass_regex}Nrrrrr�_match_object_class_debug�sz'MatchObjClass._match_object_class_debugcCs6|js
d
S|j
r&t|j�t|
j�
�
�
S|
j|jvSdS)z�
        Match the object class criteria

        Parameter:
        obj     An object with an object class attribute named "tclass"
        TN)�tclassr<r#�search�strrrrr�_match_object_class�s


z!MatchObjClass._match_object_class)rr r!r"rr?r<r#r$rr>rBrrrrr;�s



r;c@sVeZ
dZUd
Zedd�
ZdZeed<dZ	eed<dZ
eed<ed�
dd	�Zd
d�Z
dS)
�MatchPermissionz+Mixin for matching an object's permissions.�perms_regex)
r6F�perms_equal�perms_subsetr-cCs|
�d
�
|�
�

dS)r=z[Perms: {0.perms!r}, regex: {0.perms_regex}, eq: {0.perms_equal}, subset: {0.perms_subset!r}Nrrrrr�_match_perms_debug�s
�z"MatchPermission._match_perms_debugcCs6|js
d
S|j
r|
j|jkSt|
j|j|j|j�SdS)z�
        Match the permission criteria

        Parameter:
        obj     An object with a permission set class attribute named "perms"
        TN)�permsrFrrErDrrrr�_match_perms�s

zMatchPermission._match_permsN)rr r!r"rrHrEr#r$rDrFrrGrIrrrrrC�s




rC)�reZloggingr�typingrZdescriptorsrrrZ	policyrepr�utilr	r
rrr
r%r5r;rCrrrr�<module>s



V