a
qqe] @ s d dl mZ d dlmZmZmZmZ ddlmZm Z ddl
m Z m Z m
Z
eedddZeed d
d Zeedd d
ZeeedddZeeedddZeeeeedddZe e eeeedddZd"ee eee ee
ddd d Zd#eeeeeef d d d!ZdS )$ )suppress)IterableListOptionalTuple )InvalidPermissionNoCommon)LevelObjClass
SELinuxPolicy)regexreturnc C s" |rt |t| S | |kS dS )z
Match the object with optional regular expression.
Parameters:
obj The object to match.
criteria The criteria to match.
regex If regular expression matching should be used.
N)boolsearchstrobjcriteriar
r 2/usr/lib64/python3.9/site-packages/setools/util.py match_regex
s
r )equalr c C s |r | |kS t | |S dS )a
Match the object (a set) with optional set equality.
Parameters:
obj The object to match. (a set)
criteria The criteria to match. (a set)
equal If set equality should be used. Otherwise
any set intersection will match.
N)r intersection)r r r r r r match_set s r c s& |rt fdd| D S | v S dS )z
Match if the criteria is in the list, with optional
regular expression matching.
Parameters:
obj The object to match.
criteria The criteria to match.
regex If regular expression matching should be used.
c s g | ]} t|r|qS r r r .0mr r r
: z match_in_set..N)r r r r r match_in_set. s r" )indirectr
r c sN |r>|r"t fdd| D S t t | S n t| |S dS )aK
Match the object with optional regular expression and indirection.
Parameters:
obj The object to match.
criteria The criteria to match.
regex If regular expression matching should be used.
indirect If object indirection should be used, e.g.
expanding an attribute.
c s g | ]} t|r|qS r r )r or r r r M r! z(match_indirect_regex..N)r expandsetr r )r r r# r
r r r match_indirect_regex? s
r' )r r
r c s. |rt fdd| D S t| t |S dS )a"
Match the object (a set) with either set comparisons
(equality or intersection) or by regex matching of the
set members. Regular expression matching will override
the set equality option.
Parameters:
obj The object to match. (a set)
criteria The criteria to match.
equal If set equality should be used. Otherwise
any set intersection will match. Ignored
if regular expression matching is used.
regex If regular expression matching should be used.
c s g | ]} t|r|qS r r r r r r r e r! z&match_regex_or_set..N)r r r& )r r r r
r r r match_regex_or_setT s r( )subsetoverlapsupersetproperr c C s |rX| j |j ko | jkn pV| j |j ko:| jkn pV|j | j koV| j|jkS |r|r| j |j k rx|j| jkp| j |j ko|j| jk S | j |j ko|j| jkS np|r |r|j | j k r| j|jkp|j | j ko| j|jk S |j | j k o| j|jkS n|j | j ko| j|jkS dS )aR
Match ranges of objects.
obj An object with attributes named "low" and "high", representing the range.
criteria An object with attributes named "low" and "high", representing the criteria.
subset If true, the criteria will match if it is a subset obj's range.
overlap If true, the criteria will match if it overlaps any of the obj's range.
superset If true, the criteria will match if it is a superset of the obj's range.
proper If true, use proper superset/subset operations.
No effect if not using set operations.
N)ZlowZhigh)r r r) r* r+ r, r r r match_rangej s&
r- )r r domdombyincompr c C s0 |r || kS |r|| kS |r$|| A S || kS dS )aX
Match the an MLS level.
obj The level to match.
criteria The criteria to match. (a level)
dom If true, the criteria will match if it dominates obj.
domby If true, the criteria will match if it is dominated by obj.
incomp If true, the criteria will match if it is incomparable to obj.
Nr )r r r. r/ r0 r r r match_level s r1 N)permstclasspolicyr c C s | s t d|r$tdd |D }n|r6t| }nt dtdd | D }|D ]J}||j8 }tt ||jj8 }W d n1 s0 Y |sT qqT|rtdd |ntd d |dS )
a
Validate that each permission is valid for at least one
of specified object classes. If no classes are specified,
then all classes in the policy are checked.
A tclass or policy must be specified.
Parameters:
perms A container of str permission names.
Keyword Parameters.
tclass An iterable of 1 or more ObjClass.
policy A SELinuxPolicy
Exceptions:
ValueError Invalid parameter.
InvalidPermission One or more permissions is invalid.
Return: None
zNo permissions specified.c s s | ]
}|V qd S Nr )r cr r r r! z%validate_perms_any..z(No object class(es) or policy specified.c s s | ]
}|V qd S r5 r )r pr r r r7 r! Nz7Permission(s) do not exist in the specified classes: {}z, z(Permission(s) do not exist any class: {})
ValueErrorr& classesr2 r r commonr formatjoin)r2 r3 r4 Zselected_classesZinvalidr6 r r r validate_perms_any s2
*r> ,)r2 separatorr c C s g }| |D ]}| d}t|dkrP|t|d ddt|d ddf qt|dkr|t|d ddt|d ddf qtd|q|S )a
Create a extended permission list of ranges from a string representation of ranges.
This does not do any checking for out-of-range values.
Parameters:
perms A string representation of integer extended permissions, such as
"0x08,0x30-0x40,0x55,0x60-0x65"
Keyword Parameters:
separator The separator between permissions/permission ranges.
Default is ","
Return: List[Tuple[int, int]] equivalent of the permissions.
- r )baser z Unable to parse "{}" for xperms.)splitlenappendintr9 r< )r2 r@ Zxpermsitemrngr r r xperm_str_to_tuple_ranges s
( (rK )NN)r? )
contextlibr typingr r r r exceptionr r Z policyrepr
r r r r r r" r' r( r- r1 r r> rH rK r r r r s ! 6