a
qqeD @ s d dl Z d dlmZ d dlmZ ddlmZmZmZ ddl m
Z
ddl m Z m
Z
mZmZ G dd d ZG d
d d ZG d d
d
ZG dd dZG dd dZdS ) N)Logger)Iterable )CriteriaDescriptorCriteriaSetDescriptor CriteriaPermissionSetDescriptor)Context) match_in_set match_regex match_rangematch_regex_or_setc @ s> e Zd ZU dZedZdZeed< e ddddZ
dd Z dS )
MatchAliasz'Mixin for matching an object's aliases. alias_regexFNlogreturnc C s | d| dS )z+Emit log debugging info for alias matching.z(Alias: {0.alias}, regex: {0.alias_regex}Ndebugformatselfr r 4/usr/lib64/python3.9/site-packages/setools/mixins.py_match_alias_debug s z MatchAlias._match_alias_debugc C s | j s
dS t| | j | jS )z
Match the alias criteria
Parameter:
obj An object with an alias generator method named "aliases"
T)aliasr aliasesr r objr r r _match_alias s zMatchAlias._match_alias) __name__
__module__ __qualname____doc__r r r bool__annotations__r r r r r r r r
s
r
c @ s e Zd ZU dZeddZdZeed< eddZ dZ
eed< eddZ dZ eed< ed d
Z
dZeed < dZeed < dZeed
< dZeed< edddZeedddZdS ) MatchContextaL
Mixin for matching contexts.
Class attributes:
user The user to match in the context.
user_regex If true, regular expression matching
will be used on the user.
role The role to match in the context.
role_regex If true, regular expression matching
will be used on the role.
type_ The type to match in the context.
type_regex If true, regular expression matching
will be used on the type.
range_ The range to match in the context.
range_subset If true, the criteria will match if it
is a subset of the context's range.
range_overlap If true, the criteria will match if it
overlaps any of the context's range.
range_superset If true, the criteria will match if it
is a superset of the context's range.
range_proper If true, use proper superset/subset
on range matching operations.
No effect if not using set operations.
user_regexZ lookup_userF
role_regexZ lookup_role
type_regexZ lookup_typeZ lookup_range)Zlookup_function
range_overlap range_subsetrange_superset range_properr c C sD | d| | d| | d| | d| dS )z-Emit log debugging info for context matching.z'User: {0.user!r}, regex: {0.user_regex}z'Role: {0.role!r}, regex: {0.role_regex}z(Type: {0.type_!r}, regex: {0.type_regex}zRange: {0.range_!r}, subset: {0.range_subset}, overlap: {0.range_overlap}, superset: {0.range_superset}, proper: {0.range_proper}Nr r r r r _match_context_debugQ s z!MatchContext._match_context_debug)contextr c C s | j r t|j | j | js dS | jr8t|j| j| js8dS | jrTt|j| j| jsTdS | jr|t|j| j| j | j
| j | j s|dS dS )z
Match the context criteria.
Parameter:
obj An object with context attributes "user", "role",
"type_" and "range_".
FT)
userr
r& roler' type_r( range_r r* r) r+ r, )r r/ r r r _match_contextY s8 zMatchContext._match_contextN)r r r! r" r r0 r& r# r$ r1 r' r2 r( r3 r) r* r+ r, r r. r r4 r r r r r% * s
r% c @ sJ e Zd ZU dZedZdZeed< dZ eed< e
ddddZ d d
Z dS ) MatchNamez=Mixin for matching an object's name with alias dereferencing.
name_regexF alias_derefNr c C s | d| dS )z)Log debugging messages for name matching.z?Name: {0.name!r}, regex: {0.name_regex}, deref: {0.alias_deref}Nr r r r r _match_name_debug s zMatchName._match_name_debugc C sH | j s
dS | jr4t|| j | jp2t| | j | jS t|| j | jS dS )z&Match the object to the name criteria.TN)namer7 r
r6 r r r r r r _match_name s zMatchName._match_name)
r r r! r" r r9 r6 r# r$ r7 r r8 r: r r r r r5 s
r5 c @ s@ e Zd ZU dZeddZdZeed< e ddddZ
d d
Z dS )
MatchObjClassz%Mixin for matching an object's class. tclass_regexZ lookup_classFNr c C s | d| dS )0Emit log debugging info for permission matching.z,Class: {0.tclass!r}, regex: {0.tclass_regex}Nr r r r r _match_object_class_debug s z'MatchObjClass._match_object_class_debugc C s6 | j s
dS | jr&t| j t|j S |j | j v S dS )z
Match the object class criteria
Parameter:
obj An object with an object class attribute named "tclass"
TN)tclassr< r# searchstrr r r r _match_object_class s
z!MatchObjClass._match_object_class) r r r! r" r r? r< r# r$ r r> rB r r r r r; s
r; c @ sV e Zd ZU dZeddZdZeed< dZ eed< dZ
eed< e ddd Z d
d Z
d S )
MatchPermissionz+Mixin for matching an object's permissions. perms_regex)r6 F perms_equal perms_subsetr- c C s | d| dS )r= z[Perms: {0.perms!r}, regex: {0.perms_regex}, eq: {0.perms_equal}, subset: {0.perms_subset!r}Nr r r r r _match_perms_debug s z"MatchPermission._match_perms_debugc C s6 | j s
dS | jr |j | j kS t|j | j | j| jS dS )z
Match the permission criteria
Parameter:
obj An object with a permission set class attribute named "perms"
TN)permsrF r rE rD r r r r _match_perms s
z MatchPermission._match_permsN)r r r! r" r rH rE r# r$ rD rF r rG rI r r r r rC s
rC )reZloggingr typingr Z descriptorsr r r Z policyrepr utilr r
r r r
r% r5 r; rC r r r r s V