a
qqe @ s d dl Z d dlZd dlmZmZ ddlmZmZ ddlm Z ddl
m Z m Z ddl
mZmZ ddlmZ dd lmZ G d
d d e e eZdS ) N)IterableSet )CriteriaDescriptorCriteriaSetDescriptor)ConstraintUseError)
MatchObjClassMatchPermission)
AnyConstraintConstraintRuletype) PolicyQuery) match_in_setc s e Zd ZU dZeedZeddZdZ e
e d< eddZ dZ
e
e d< dZe
e d < ed
d ZdZe
e d
< dZe
e d < d
d fdd Zdd Zee dddZ ZS )ConstraintQuerya
Query constraint rules, (mls)constrain/(mls)validatetrans.
Parameter:
policy The policy to query.
Keyword Parameters/Class attributes:
ruletype The list of rule type(s) to match.
tclass The object class(es) to match.
tclass_regex If true, use a regular expression for
matching the rule's object class.
perms The permission(s) to match.
perms_equal If true, the permission set of the rule
must exactly match the permissions
criteria. If false, any set intersection
will match.
perms_regex If true, regular expression matching will be used
on the permission names instead of set logic.
role The name of the role to match in the
constraint expression.
role_indirect If true, members of an attribute will be
matched rather than the attribute itself.
role_regex If true, regular expression matching will
be used on the role.
type_ The name of the type/attribute to match in the
constraint expression.
type_indirect If true, members of an attribute will be
matched rather than the attribute itself.
type_regex If true, regular expression matching will
be used on the type/attribute.
user The name of the user to match in the
constraint expression.
user_regex If true, regular expression matching will
be used on the user.
)
enum_class
user_regexZ lookup_userF
role_regexZ lookup_roleT
role_indirect
type_regexZlookup_type_or_attr
type_indirectN)returnc s( t t| j|fi | tt| _d S )N)superr __init__loggingZ getLogger__name__log)selfpolicykwargs __class__ =/usr/lib64/python3.9/site-packages/setools/constraintquery.pyr A s zConstraintQuery.__init__c C s4 |r$t }|D ]}|| qn|}t|||S )ay
Match roles/types/users in a constraint expression,
optionally by expanding the contents of attributes.
Parameters:
expr The expression to match.
criteria The criteria to match.
indirect If attributes in the expression should be expanded.
regex If regular expression matching should be used.
)setupdateexpandr
)r exprZcriteriaZindirectZregexobjitemr r r! _match_exprE s zConstraintQuery._match_exprc c sB | j d| | j d| | | j | | j | j d| | j d| | j d| | j D ]}| jr|j| jvrq|| |sq|z|
|sW q|W n t y Y q|Y n0 | j r|
|jj| j | j| jsq|| jr|
|jj| j| j| jsq|| jr6|
|jj| jd| js6q||V q|dS )z6Generator which yields all matching constraints rules.z-Generating constraint results from {0.policy}zRuletypes: {0.ruletype}z'User: {0.user!r}, regex: {0.user_regex}z'Role: {0.role!r}, regex: {0.role_regex}z(Type: {0.type_!r}, regex: {0.type_regex}FN)r infoformatdebugZ_match_object_class_debugZ_match_perms_debugr constraintsruletypeZ_match_object_classZ _match_permsr roler( Z
expressionZrolesr r type_typesr r userZusersr )r cr r r! resultsZ sP
zConstraintQuery.results)r
__module__ __qualname____doc__r r r- r r1 r bool__annotations__r. r r r/ r r r r( r r
r3
__classcell__r r r r! r s
$
r )r retypingr r Z descriptorsr r exceptionr Zmixinsr r Z policyrepr
r queryr utilr
r r r r r! s