a
qqe @ s d dl Z d dlmZmZ ddlmZ ddlmZ ddlm Z ddl
m Z dd l m
Z
mZmZ d
Zd Zd Zd
ZdZdZdZdZG dd de ZdS ) N)ListUnion )InvalidCheckValue) AnyTERule) TERuleQuery )
CheckerModule)ConfigDescriptorConfigSetDescriptor ConfigPermissionSetDescriptorsourcetargettclassperms
exempt_source
exempt_target
expect_source
expect_targetc s e Zd ZdZdZeeeee e
e e e
fZedZedZeddddZe ZeddddZeddddZeddddZeddddZdd fd
d Zed d d
Z Z S )AssertTEzKChecker module for asserting a type enforcement allow rule exists (or not).Z assert_teZlookup_type_or_attrZ lookup_classTF)strictexpandN)returnc s t ||| tt| _|t| _|t | _
|t | _ |t
| _|t| _|t| _|t| _|t| _t| j| j
| j | jfstd| j| j@ }|r| jdddd |D | j| j@ }|r| jdddd |D d S )NzEAt least one of source, target, tclass, or perms options must be set.z.Overlap in expect_source and exempt_source: {}z, c s s | ] }|j V qd S Nname.0i r >/usr/lib64/python3.9/site-packages/setools/checker/assertte.py A z$AssertTE.__init__..z.Overlap in expect_target and exempt_target: {}c s s | ] }|j V qd S r r r r r r r! F r" ) super__init__loggingZ getLogger__name__logget
SOURCE_OPTr
TARGET_OPTr CLASS_OPTr PERMS_OPTr EXEMPT_SRC_OPTr EXEMPT_TGT_OPTr EXPECT_SRC_OPTr EXPECT_TGT_OPTr anyr infoformatjoin)selfpolicyZ checknameZconfigZ source_exempt_expect_overlapZ target_exempt_expect_overlap __class__r r r$ , s0
zAssertTE.__init__c
C s. | j d t| j| j| j| j| jdd}t| j }t| j
}g }t | D ]x}t|j
}t|j
}||8 }||8 }|| j | j r|| j
| j r| t| || qN| t| qN|D ]"}d|} | | || q|D ]"}d|} | | || q| j d| |S )Nz!Checking TE allow rule assertion.)Zallow)r
r r r Zruletypez)Expected rule with source "{}" not found.z)Expected rule with target "{}" not found.z
{} failure(s))r' r2 r r6 r
r r r setr r sortedresultsr r r Zlog_failstrappendZlog_okr3 debug)
r5 queryZunseen_sourcesZunseen_targetsZfailuresZruleZsrcsZtgtsitemZfailurer r r runH s@
z AssertTE.run) r&
__module__ __qualname____doc__Z
check_type frozensetr) r* r+ r, r- r. r/ r0 Z check_configr
r
r r r r r r r r r r$ r rA
__classcell__r r r7 r r s r )r% typingr r exceptionr Z policyrepr Z terulequeryr Z
checkermoduler Z descriptorsr
r r r) r* r+ r, r- r. r/ r0 r r r r r s