HEX

File: //lib64/python3.9/site-packages/setools/__pycache__/permmap.cpython-39.pyc
a

q�qe�@�
@s�ddlZddlZddlmZddlmZddlmZmZm	Z	m
Z
mZmZddl
Z
ddlmZddlmZddlmZmZmZd	ZdZd
ZGdd�de
�Zeed
�dd�Zeed�dd�ZeeeeeeeeeeffffZGdd�d�Z Gdd�d�Z!dS)�N)�OrderedDict)�suppress)�cast�Dict�Iterable�
NamedTuple�Optional�Union�)�	exception)�PermissionMapDescriptor)�AVRule�
SELinuxPolicy�
TERuletype)�r�w�b�n�u�
c@s"eZdZUdZeed<eed<dS)�
RuleWeightzDThe read and write weights for a rule, given all of its permissions.�read�writeN)�__name__�
__module__�__qualname__�__doc__�int�__annotations__�rr�5/usr/lib64/python3.9/site-packages/setools/permmap.pyrs
r)�weight�returncCs(t|krtks$ntd�|���|S)Nz$Permission weights must be 1-10: {0})�
MIN_WEIGHT�
MAX_WEIGHT�
ValueError�format)r!rrr �validate_weight!sr')�	directionr"cCs|tvrtd�|���|S)Nz'Invalid information flow direction: {0})�INFOFLOW_DIRECTIONSr%r&)r(rrr �validate_direction(sr*c@sfeZdZUdZede�Zede�Zede	�Z
eed<eed<de
eee	dd	�d
d�Ze	d�d
d�ZdS)�Mappingz1A mapping for a permission in the permission map.r!r(�enabled�class_�permFN)�perm_map�	classname�
permission�creater"cCs�||_||_||_|rD||jvr,t�|j|<dddd�|j||<n:||jvr^t�d�|���||j|vr~t�d�||���dS)Nrr
T)r(r!r,�{0} is not mapped.z{0}:{1} is not mapped.)Z	_perm_mapr-r.rr�
UnmappedClassr&ZUnmappedPermission)�selfr/r0r1r2rrr �__init__=s 
�
�zMapping.__init__�r"cCs$|j|jkr|j|jkS|j|jkS�N)r-r.)r5�otherrrr �__lt__TszMapping.__lt__)F)rrrrrr'r!r*r(�boolr,�strr�	MapStructr6r:rrrr r+3s



��r+c@s8eZdZdZd.eedd�dd�Zed�dd�Zdd�d	d
�Ze	e
d�dd�Zedd�d
d�Zedd�dd�Z
e	ed�dd�Zee	e
d�dd�Zeee
d�dd�Zedd�dd�Zeedd�dd�Zedd�dd�Zeedd�d d!�Zedd"�d#d$�Zeed%�d&d'�Zeeedd(�d)d*�Zeeedd+�d,d-�ZdS)/�
PermissionMapz-Permission Map for information flow analysis.N)�permmapfiler"cCsLt�t�|_t�|_||r(|�|�n t�d�}d�	|j
�}|�|�dS)�\
        Parameter:
        permmapfile     The path to the permission map to load.
        Zsetoolsz{0}/setools/perm_mapN)�loggingZ	getLoggerr�logr�_permmap�load�
pkg_resourcesZget_distributionr&�location)r5r?Zdistro�pathrrr r6_s
zPermissionMap.__init__r7cCs|jSr8)�_permmapfile�r5rrr �__str__pszPermissionMap.__str__cCs8t�t�}|j|_t�|j�|_|j|_||t|�<|Sr8)r>�__new__rB�copy�deepcopyrCrH�id)r5�memoZnewobjrrr �__deepcopy__ss
zPermissionMap.__deepcopy__ccs(|��D]}|�|�D]
}|VqqdSr8)�classes�perms)r5�cls�mappingrrr �__iter__{szPermissionMap.__iter__c
Csv|j�d�|��t|d���}d}d}d}d}|j��t|dd�D�]�\}}|��}	t|	�dksF|	dddkrvqF|dkr�zt	|	d�}Wn>t
y�}
z&t�d�|||	d��|
�WYd}
~
n
d}
~
00|dkr�t�d	�|||	d���d
}qF|d
k�r�t|	�dk�s|	ddk�r.t�d
�|||	���t
|	d�}zt	|	d
�}Wn@t
�y�}
z&t�d�|||	d
��|
�WYd}
~
n
d}
~
00|dk�r�t�d�|||	d
���|d7}||k�r�t�d�|||���t�|j|<d}
d}qF|dkrFt
|	d�}t
|	d�}|tv�r,t�d�|||	d���zt	|	d
�}Wn@t
�y|}
z&t�d�|||	d
��|
�WYd}
~
n
d}
~
00t|k�r�tk�s�nt�d�|||	d
tt���|j�d�||||��|dk�r�|j�d�||��t|j||dd�}||_||_|d7}|
d7}
|
|krFd
}qFWd�n1�s<0Y||_|j�d�|��|j�d�||��dS)r@zOpening permission map "{0}"rrr
)�start�#z&{0}:{1}:Invalid number of classes: {2}Nz/{0}:{1}:Number of classes must be positive: {2}���classz&{0}:{1}:Invalid class declaration: {2}z*{0}:{1}:Invalid number of permissions: {2}z3{0}:{1}:Number of permissions must be positive: {2}z{0}:{1}:Extra class found: {2}z/{0}:{1}:Invalid information flow direction: {2}z&{0}:{1}:Invalid permission weight: {2}z.{0}:{1}:Permission weight must be {3}-{4}: {2}zRead {0}:{1} {2} {3}rzPermission {0}:{1} is unmapped.T�r2z(Successfully opened permission map "{0}"z+Read {0} classes and {1} total permissions.)rB�infor&�openrC�clear�	enumerate�split�lenrr%rZPermissionMapParseErrorr<rr)r#r$�debugr+r(r!rH)r5r?�mapfileZtotal_permsZclass_countZnum_classes�stateZline_num�line�entry�ex�
class_nameZ	num_permsZ
perm_count�	perm_nameZflow_directionr!rTrrr rD�s�

���
��
��
���

��
��

��
���
��
�

�&
�zPermissionMap.loadc	
Cs@t|d���}|j�d�|��|�d�t|j���|j��D]�\}}|�d�|t|���|��D]�\}}tt	|d�}tt
|d�}t|kr�tks�nJd�|||���|t
vs�Jd�|||���|d	kr�|j�d
�||��|�d�|||��qf|�d�q@|j�d
�|��Wd�n1�s20YdS)z�
        Save the permission map to the specified path.  Existing files
        will be overwritten.

        Parameter:
        permmapfile         The path to write the permission map.
        rzWriting permission map to "{0}"z{0}

zclass {0} {1}
r(r!z={0}:{1} weight is out of range ({2}). This is an SETools bug.z@{0}:{1} flow direction ({2}) is invalid. This is an SETools bug.rz1Warning: permission {0} in class {1} is unmapped.z{0:>20} {1:>9} {2:>9}
�
z*Successfully wrote permission map to "{0}"N)r]rBr\r&rrarC�itemsrr<rr#r$r)Zwarning)	r5r?rcr0rRZpermnameZsettingsr(r!rrr �save�s2��
��
�zPermissionMap.saveccs|j��EdHdS)zw
        Generate class names in the permission map.

        Yield:
        class       An object class name.
        N)rC�keysrIrrr rQszPermissionMap.classes)r-r"c
csdz(|j|��D]}t|j||�VqWn6ty^}zt�d�|��|�WYd}~n
d}~00dS)z�
        Generate permission mappings for the specified class.

        Parameter:
        class_      An object class name.

        Yield:
        Mapping     A permission's complete map (weight, direction, enabled)
        r3N)rCrmr+�KeyErrorrr4r&)r5r-r.rgrrr rRs

zPermissionMap.perms)r-r.r"cCst|j||�S)z)Retrieve a specific permission's mapping.)r+rC�r5r-r.rrr rT/szPermissionMap.mappingcCs|�|�D]
}d|_q
dS)a
        Exclude all permissions in an object class for calculating rule weights.

        Parameter:
        class_              The object class to exclude.

        Exceptions:
        UnmappedClass       The specified object class is not mapped.
        FN�rRr,rorrr �
exclude_class3s
zPermissionMap.exclude_class)r-r1r"cCsdt|j||�_dS)a�
        Exclude a permission for calculating rule weights.

        Parameter:
        class_              The object class of the permission.
        permission          The permission name to exclude.

        Exceptions:
        UnmappedClass       The specified object class is not mapped.
        UnmappedPermission  The specified permission is not mapped for the object class.
        FN�r+rCr,�r5r-r1rrr �exclude_permission@sz PermissionMap.exclude_permissioncCs|�|�D]
}d|_q
dS)a
        Include all permissions in an object class for calculating rule weights.

        Parameter:
        class_              The object class to include.

        Exceptions:
        UnmappedClass       The specified object class is not mapped.
        TNrprorrr �
include_classNszPermissionMap.include_classcCsdt|j||�_dS)a�
        Include a permission for calculating rule weights.

        Parameter:
        class_              The object class of the permission.
        permission          The permission name to include.

        Exceptions:
        UnmappedClass       The specified object class is not mapped.
        UnmappedPermission  The specified permission is not mapped for the object class.
        TNrrrsrrr �include_permission\s
z PermissionMap.include_permission)�policyr"c	Cs�|��D]�}t|�}||jvr>|j�d�||��t�|j|<|j}tt	j
��||jjO}Wd�n1sp0Y|D]:}||j|vr~|j�d�|||��t|j||dd�q~qdS)zHCreate mappings for all classes and permissions in the specified policy.z"Adding unmapped class {0} from {1}Nz.Adding unmapped permission {0} in {1} from {2}Tr[)
rQr<rCrBrbr&rrRrrZNoCommon�commonr+)r5rwr-rhrRrirrr �
map_policyks
*
�zPermissionMap.map_policy)�ruler"cCs�d}d}t|j�}|jtjkr0t�d�|j���|jD]l}t	|j
||�}|jsPq6|jdkrht
||j�}q6|jdkr�t
||j�}q6|jdkr6t
||j�}t
||j�}q6t||�S)aT
        Get the type enforcement rule's information flow read and write weights.

        Parameter:
        rule            A type enforcement rule.

        Return: Tuple(read_weight, write_weight)
        read_weight     The type enforcement rule's read weight.
        write_weight    The type enforcement rule's write weight.
        rz1{0} rules cannot be used for calculating a weightrrr)r<ZtclassZruletyperZallowrZ
RuleTypeErrorr&rRr+rCr,r(�maxr!r)r5rzZwrite_weightZread_weightrhrirTrrr �rule_weights&
�



zPermissionMap.rule_weight)r-r1r(r"cCs|t|j||�_dS)a�
        Set the information flow direction of a permission.

        Parameter:
        class_              The object class of the permission.
        permission          The permission name.
        direction           The information flow direction the permission (r/w/b/n).

        Exceptions:
        UnmappedClass       The specified object class is not mapped.
        UnmappedPermission  The specified permission is not mapped for the object class.
        N)r+rCr()r5r-r1r(rrr �
set_direction�s
zPermissionMap.set_direction)r-r1r!r"cCs|t|j||�_dS)a�
        Set the weight of a permission.

        Parameter:
        class_              The object class of the permission.
        permission          The permission name.
        weight              The weight of the permission (1-10).

        Exceptions:
        UnmappedClass       The specified object class is not mapped.
        UnmappedPermission  The specified permission is not mapped for the object class.
        N)r+rCr!)r5r-r1r!rrr �
set_weight�s
zPermissionMap.set_weight)N)rrrrrr<r6rJrPrr+rUrDrlrQrRrTrqrtrurvrryr
rr|r}rr~rrrr r>[s$q%	
'r>)"rArL�collectionsr�
contextlibr�typingrrrrrr	rE�rZdescriptorsrZ	policyrepr
rrr)r#r$rrr'r<r*r;r=r+r>rrrr �<module>s" &(