a
qqeZ @ s d dl Z d dlZd dlmZ d dlmZ d dlmZmZm Z m
Z
m Z m Z z d dl
Zd dlmZmZmZ W n" ey eed Y n0 ddlmZmZ dd lmZm Z m Z m Z g d
Z G d d d e
Z G d
d de
Z!ee! Z"ee e e f Z#G dd dZ$G dd dZ%dS ) N defaultdict)suppress) DefaultDictIterableList
NamedTupleOptionalUnion)
NetworkXErrorNetworkXNoPath NodeNotFoundzNetworkX failed to import. ) EdgeAttrDict EdgeAttrList) AnyTERule
SELinuxPolicy
TERuletypeType)DomainTransitionAnalysisDomainTransitionDomainEntrypointDTAPathc @ s> e Zd ZU dZeed< ee ed< ee ed< ee ed< dS )r z0Entrypoint list entry named tuple output format.name
entrypointexecutetype_transitionN)__name__
__module__ __qualname____doc__r __annotations__r r r" r" 1/usr/lib64/python3.9/site-packages/setools/dta.pyr s
r c @ s^ e Zd ZU dZeed< eed< ee ed< ee ed< ee ed< ee ed< ee ed< d S )
r z*Transition step output named tuple format.sourcetarget
transition entrypointssetexec
dyntransition
setcurrentN) r r r r r r! r r r r" r" r" r# r # s
r c @ s e Zd ZU dZee ed< eed< d,eee e
e ee f ddddZ
eed d
d Zejdd d d Zeee d d
dZeje e
e ee f ddddZe ee f e ee f e
e dddZd-e ee f e ee f ee
e dddZe ee f e ee f e
e dddZe ee f eddd Ze d d d Zed ee d d!d"Zee ed#d$d%Z dd d&d'Z dd d(d)Z dd d*d+Z dS ).r zDomain transition analysis._exclude_reverseFN)policyreverseexcludereturnc C sv t t| _|| _|| _|| _d| _d| _zt
| _ | j | _
W n, typ | jd | jd Y n0 dS )z
Parameter:
policy The policy to analyze.
Keyword Parameters:
reverse True means reverse the direction of the analysis (find parent domains).
exclude An iterable of types to exclude from the analysis.
TzLNetworkX is not available. This is requried for Domain Transition Analysis.z2This is typically in the python3-networkx package.N)logging getLoggerr logr- r/ r. rebuildgraphrebuildsubgraphnxZDiGraphGcopysubG NameErrorZcritical)selfr- r. r/ r" r" r# __init__> s
z!DomainTransitionAnalysis.__init__)r0 c C s | j S N)r, r; r" r" r# r. Y s z DomainTransitionAnalysis.reversec C s t || _d| _d S )NT)boolr, r5 )r; directionr" r" r# r. ] s
c C s | j S r= )r+ r> r" r" r# r/ b s z DomainTransitionAnalysis.exclude)typesr0 c s* |r fdd|D _ ng _ d _d S )Nc s g | ]} j |qS r" )r- lookup_type).0tr> r" r#
i z4DomainTransitionAnalysis.exclude..T)r+ r5 )r; rA r" r> r# r/ f s )r$ r% r0 c c s | j |}| j |}| jr&| | jd|| ttt * |
t j | j
||dV W d n1 st0 Y dS )a
Generator which yields one shortest domain transition path
between the source and target types (there may be more).
Parameters:
source The source type.
target The target type.
Yield: generator(steps)
steps A generator that returns the tuple of
source, target, and rules for each
domain transition.
z8Generating one domain transition path from {0} to {1}...)r$ r% N)r- rB r5 _build_subgraphr3 infoformatr r r
)_DomainTransitionAnalysis__generate_stepsr6
shortest_pathr9 )r; r$ r% srD r" r" r# rK o s z&DomainTransitionAnalysis.shortest_path )r$ r% maxlenr0 c c s |dk rt d| j|}| j|}| jr6| | jd||| tt t
4 t | j
|||D ]}| |V qjW d n1 s0 Y dS )a
Generator which yields all domain transition paths between
the source and target up to the specified maximum path
length.
Parameters:
source The source type.
target The target type.
maxlen Maximum length of paths.
Yield: generator(steps)
steps A generator that returns the tuple of
source, target, and rules for each
domain transition.
r z%Maximum path length must be positive.zIGenerating all domain transition paths from {0} to {1}, max length {2}...N)
ValueErrorr- rB r5 rG r3 rH rI r r r
r6 Zall_simple_pathsr9 rJ )r; r$ r% rN rL rD pathr" r" r# all_paths s
z"DomainTransitionAnalysis.all_pathsc c s | j |}| j |}| jr&| | jd|| ttt 2 t
| j ||D ]}|
|V qVW d n1 s|0 Y dS )a
Generator which yields all shortest domain transition paths
between the source and target types.
Parameters:
source The source type.
target The target type.
Yield: generator(steps)
steps A generator that returns the tuple of
source, target, and rules for each
domain transition.
zBGenerating all shortest domain transition paths from {0} to {1}...N)r- rB r5 rG r3 rH rI r r r
r6 all_shortest_pathsr9 rJ )r; r$ r% rL rD rP r" r" r# rR s
z+DomainTransitionAnalysis.all_shortest_paths)type_r0 c
c s | j |}| jr| | jd|| jr0dnd tt t | j
|D ]V\}}t | j
||}| jrv|| }}n
|| }}t
|||j| ||j|j|jV qNW d n1 s0 Y dS )aM
Generator which yields all domain transitions out of a
specified source type.
Parameters:
type_ The starting type.
Yield: generator(steps)
steps A generator that returns the tuple of
source, target, and rules for each
domain transition.
z)Generating all domain transitions {1} {0}zin tozout fromN)r- rB r5 rG r3 rH rI r. r r r9 Z out_edgesEdger r& /_DomainTransitionAnalysis__generate_entrypointsr( r) r* )r; rS rL r$ r% edge real_source real_targetr" r" r# transitions s(
z$DomainTransitionAnalysis.transitionsc C s. | j r| dt| j dt| j S )zR
Get the domain transition graph statistics.
Return: str
z
Graph nodes: z
Graph edges: )r4 _build_graphr6 number_of_nodesr7 number_of_edgesr> r" r" r# get_stats s
z"DomainTransitionAnalysis.get_statsrT )rV r0 c s fdd j D S )a
Creates a list of entrypoint, execute, and
type_transition rules for each entrypoint.
Parameter:
data The dictionary of entrypoints.
Return: list of tuple(type, entry, exec, trans)
type The entrypoint type.
entry The list of entrypoint rules.
exec The list of execute rules.
trans The list of type_transition rules.
c s, g | ]$}t | j| j| j| qS r" )r r r r )rC erV r" r# rE s zCDomainTransitionAnalysis.__generate_entrypoints..)r r_ r" r_ r# Z__generate_entrypoints
s
z/DomainTransitionAnalysis.__generate_entrypoints)rP r0 c c sz t dt|D ]f}||d }|| }t| j||}| jrF|| }}n
|| }}t|||j| ||j|j |j
V qdS )a
Generator which yields the source, target, and associated rules
for each domain transition.
Parameter:
path A list of graph node names representing an information flow path.
Yield: tuple(source, target, transition, entrypoints,
setexec, dyntransition, setcurrent)
source The source type for this step of the domain transition.
target The target type for this step of the domain transition.
transition The list of transition rules.
entrypoints Generator which yields entrypoint-related rules.
setexec The list of setexec rules.
dyntranstion The list of dynamic transition rules.
setcurrent The list of setcurrent rules.
r N) rangelenrT r9 r. r r& rU r( r) r* )r; rP rL r$ r% rV rW rX r" r" r# Z__generate_steps s
z)DomainTransitionAnalysis.__generate_stepsc C s | j d| j| j _| jd| j tt}tt}tdd }tdd }tdd }| j D ]}|j
t j kr"|j
dvrql|j
dkrd |jv rt|j |j D ].\}}||krt| j ||d
d } | j| qd |jv rBt|j |j D ]2\}}||krt| j ||d
d }
|
j| qd
|jv rn|j D ]}|| | qXd|jv r |j D ]}|| | qnd|jv rt|j |j D ] \}}|| | | qd|jv r|t|j |j D ] \}}|| | | qql|j
t jkrl|j
dkr rF z7DomainTransitionAnalysis._build_graph..c S s t tS r= rb r" r" r" r# rd rF c S s t dd S )Nc S s t tS r= rb r" r" r" r# rd rF zIDomainTransitionAnalysis._build_graph....r r" r" r" r# rd rF )processfilere r& T)creater) r( r* r r Fz+Completed building domain transition graph.z$Graph stats: nodes: {0}, edges: {1}.)*r7 clearrI r- r r3 rH r rc ZterulesZruletyper ZallowZtclassZperms itertoolsproductr$ expandr% rT r& appendr) r defaultedgessetkeys intersectionr r r( extendr* remove_edges_fromr4 r5 debugr6 r[ r\ )r; r( r* r r Z
type_transZrulerL rD rV r^ dZ invalid_edgeZclear_transitionZclear_dyntransitionZ
invalid_transZinvalid_dyntransentryZexematchmr" r" r# rZ { s
"
z%DomainTransitionAnalysis._build_graphc
C s g }| j D ]\}}t| j ||}t|j}|| j |s@q|D ]D}|j|= |j|= tt |j
|= W d qD1 s~0 Y qD|js|j s| | q| j
| d S r= )r9 rn rT ro r intersection_updater/ r r KeyErrorr r) rl rs )r; Z
invalid_edgesr$ r% rV r' r^ r" r" r# Z __remove_excluded_entrypoints s
( z6DomainTransitionAnalysis.__remove_excluded_entrypointsc C s | j r| | jd | jd| j | jd| j | jrZ| jjdd| _ n | j
| _ | jr| j | j | d| _
| jd | jdt| j t| j d S ) Nz$Building domain transition subgraph.z
Excluding {0}z Reverse {0}T)r8 Fz.Completed building domain transition subgraph.z'Subgraph stats: nodes: {0}, edges: {1}.)r4 rZ r3 rH rt rI r/ r. r7 r9 r8 Zremove_nodes_from6_DomainTransitionAnalysis__remove_excluded_entrypointsr5 r6 r[ r\ r> r" r" r# rG + s"
z(DomainTransitionAnalysis._build_subgraph)FN)rM ) r r r r r r r! r? r r r r
strr< propertyr. setterr/ r rK intrQ rR rY r] staticmethodr rU rJ rZ r{ rG r" r" r" r# r 7 sD
" % (^ r c @ sv e Zd ZdZedZedZedZedZe dZ
e dZ e dZ de
e
ed
d d d
Zdd Zee
dddZd
S )rT aS
A graph edge. Also used for returning domain transition steps.
Parameters:
graph The NetworkX graph.
source The source type of the edge.
target The target tyep of the edge.
Keyword Parameters:
create (T/F) create the edge if it does not exist.
The default is False.
r& r( r) r* r r r FN)r$ r% rg r0 c C sj || _ || _|| _| j ||sf|s.tdn8| j || d | _d | _d | _d | _ d | _
d | _ d | _ d S )Nz Edge does not exist in graph)
r7 r$ r% Zhas_edgerO Zadd_edger& r r r r( r) r* )r; Zgraphr$ r% rg r" r" r# r< ^ s
z
Edge.__init__c s4 t |tr& fddt|d D S |S d S )Nc s g | ]} |qS r" )_index_to_item)rC ir> r" r# rE t rF z$Edge.__getitem__..rM )
isinstanceslicer` indicesr )r; keyr" r> r# __getitem__p s
zEdge.__getitem__)indexr0 c C s. |dkr| j S |dkr | jS td|dS )z'Return source or target based on index.r r z,Invalid index (edges only have 2 items): {0}N)r$ r%
IndexErrorrI )r; r r" r" r# r x s
zEdge._index_to_item)F)r r r r r r& r( r) r* r r r r r r? r< r r r r" r" r" r# rT G s
rT )&ri r1 collectionsr
contextlibr typingr r r r r r
Znetworkxr6 Znetworkx.exceptionr r r
ImportErrorr2 r rt Z descriptorsr r Z policyrepr r r r __all__r r r ZRuleHashr rT r" r" r" r# s,