a
qqe]` @ s d dl Z d dlmZ d dlmZ d dlmZ d dlmZm Z m
Z
m Z m Z m
Z
mZmZmZmZ ddlmZmZmZ ddlmZmZmZmZmZm Z m Z d d
l m Z d d l m!Z! d d l"m#Z#m$Z$ d d
l%m&Z&m'Z' d dlm(Z( d dl)m*Z* edZ+edZ,G dd de
Z-G dd de
Z.G dd deZ/G dd de
Z0G dd de
Z1G d d d e
Z2eee3f Z4ee5e3f Z6e
e4e
e6e
e3e
e3e
e3e1f f f f f Z7e e e7e2e/dd d d Z8e7dd!d"d#Z9e7e2ee e e e e e- f d$d%d&Z:e3e d'gdf d(d)d*Z;e e e d+ d,d-d.ZG d3d' d'e#Z?G d4d+ d+e$e Z@G d5d6 d6e$ZAdS )7 N) defaultdict)intern)Enum)
AnyCallableDictIterableList
NamedTupleOptionalSetTupleUnion )RuleNotConditional RuleUseErrorTERuleNoFilename) AnyTERuleAVRule AVRuleXperm ConditionalIoctlSet
TERuletypeType )conditional_wrapper_factory)DiffResultDescriptor)
DifferenceWrapper)type_wrapper_factory type_or_attr_wrapper_factory)RuleList)class_wrapper_factoryz<>Truec @ sV e Zd ZU dZeed< eee e f ed< eee e f ed< eee e f ed< dS )ModifiedAVRulez5Difference details for a modified access vector rule.rule added_perms
removed_perms
matched_permsN)
__name__
__module__ __qualname____doc__r __annotations__r r strr r/ r/ :/usr/lib64/python3.9/site-packages/setools/diff/terules.pyr$ s
r$ c @ s* e Zd ZU dZeed< eed< eed< dS )ModifiedTERulez.Difference details for a modified type_* rule.r% Z
added_defaultZremoved_defaultN)r) r* r+ r, r r- r r/ r/ r/ r0 r1 $ s
r1 c @ s e Zd ZdZdZdS )Sider r N)r) r* r+ leftrightr/ r/ r/ r0 r2 0 s r2 c @ s" e Zd ZU ee ed< eed< dS )RuleDBSideDataRecordperms orig_ruleN)r) r* r+ r r. r- r r/ r/ r/ r0 r5 5 s
r5 c @ s& e Zd ZU ee ed< ee ed< dS )RuleDBSidesRecordr3 r4 N)r) r* r+ r r5 r- r/ r/ r/ r0 r8 : s
r8 c @ s. e Zd ZU eeef ed< eeef ed< dS ) TypeDBRecordr3 r4 N)r) r* r+ r r. r r- r/ r/ r/ r0 r9 ? s
r9 ) rule_listrule_dbtype_dbsidereturnc C s |t jkr|j}n|j}| D ]}z tt|j}tt|j}W n ty\ t}t }Y n0 ||vrt
||< t
|| |< n||| vrt
|| |< |j j }t
|j} t| |}
|| | } |j D ]} | j }
|
|vr| ||
< |
| vrt
| |
< |j D ]}|j }||vr |||< || |
vr c C sR | t t }| D ]6\}}|t kr(q| D ]}| D ]\}}||vrRq>| D ]\}}||| vrpqZ| D ]\} }
| || | vrqx|| | | } |
j} |
j}
| jr| r| j| jj@ }|r| j| }|rt|| j} nd } t | |
|| < | jrx|
rx|
j| jj@ }|rx|
j| }|r2t||
j}
nd }
t | |
|| < qxqZq>q0qd S N)
rA rB itemsvaluesr3 r4 r6 r5 r7 r8 )r; Z uncond_blockrL cond_blocksrN rO src_datarP tgt_datarD rM Zuncond_side_datarQ rR crS r/ r/ r0 _av_remove_redundant_rules sB
r\ )r; r< r> c C sT g }g }g }| D ]2}| D ]"}| D ]\}}| D ]\} }
|
D ]} | jr| jr| jj| jj@ } | jj| }
| jj| }|
s|r| jj}||j| |j| | jj}|t|||
| qT| jr
| jj}||j| |j| | jj}|| qT| jrT| jj}||j| |j| | jj}|| qTqBq0q"q|||fS rU ) rW rV r3 r4 r6 r7 Zderive_expandedappendr$ )r; r< addedremovedmodifiedrX rN rO rY rP rZ rM Z common_permsZ
left_permsZ right_permsZ
original_ruler% r/ r/ r0 _av_generate_diffs sJ
ra TERulesDifference)ruletyper> c s t dd fdd }|S )z
This is a template for the access vector diff functions.
Parameters:
ruletype The rule type, e.g. "allow".
Nr> c s2 | j d | | jdu s(| jdu r0| tt t }t }t |t< t |t t < | j d| t
| j ||t j | j d| t
| j ||t j
| j d t| | j d t||\}}}|j |j
| t| d | t| d | t| d | dS )
6Generate the difference in rules between the policies.CGenerating {0} differences from {1.left_policy} to {1.right_policy}Nz(Expanding AV rules from {0.left_policy}.z)Expanding AV rules from {0.right_policy}.z Removing redundant AV rules.zGenerating AV rule diff.
added_{0}s removed_{0}s
modified_{0}s)loginfoformat_left_te_rules_right_te_rules_create_te_rule_listsr9 rC rA rB rT r2 r3 r4 r\ ra clearsetattr)selfr< r; r^ r_ r` rc r/ r0 diff s2
z av_diff_template..diffr lookuprc rt r/ rs r0 av_diff_template s
#rx AVRuleXpermWrapper)r: r> c
C s t }| D ]N}| D ]@}t|}z|| j|jO _W q tyT |||< Y q0 qq
|rzttd |t
| | S )z`
Generator that yields wrapped, expanded, av(x) rules with
unioned permission sets.
z/Expanded {0.ruletype} rules for {0.policy}: {1}) rC rH ry r6 KeyErrorloggingZ getLoggerr) debugrl lenkeys)r: rV rK Z
expanded_ruleZexpanded_wrapped_ruler/ r/ r0 _avxrule_expand_generator" s
r c s t dd fdd }|S )z
This is a template for the extended permission access vector diff functions.
Parameters:
ruletype The rule type, e.g. "allowxperm".
Nrd c
s | j d | | jr | js(| | jt| j t| j dd\}}}g }|D ]V\}}| j|j|jdd\}}} |s|rZ| t
|j t |t |t dd | D qZt
| d tdd |D t
| d td d |D t
| d
| d S ) re rf F)unwrapc s s | ]}|d V qdS )r Nr/ ).0rS r/ r/ r0 f z2avx_diff_template..diff..rg c s s | ] }|j V qd S rU origin)r ar/ r/ r0 r h r rh c s s | ] }|j V qd S rU r )r rr/ r/ r0 r i r ri N)rj rk rl rm rn ro _set_diffr r6 r] r$ r r rq rF )
rr r^ r_ matchedr` left_rule
right_ruler& r' r( rs r/ r0 rt H s6
z avx_diff_template..diffru rw r/ rs r0 avx_diff_template> s
$r c s t dd fdd }|S )z
This is a template for the type_* diff functions.
Parameters:
ruletype The rule type, e.g. "type_transition".
Nrd c s | j d | | jdu s(| jdu r0| | | | j t| | j t\}}}g }|D ]2\}}t |j
t |j
krf| t ||j
|j
qft
| d | t
| d | t
| d | dS )re rf Nrg rh ri )rj rk rl rm rn ro r Z_expand_generator
TERuleWrapperr defaultr] r1 rq )rr r^ r_ r r` r r rs r/ r0 rt y s*
z te_diff_template..diffru rw r/ rs r0 te_diff_templateo s
r c @ s e Zd ZU dZedZedZedZedZ edZ
edZ edZ edZ
edZedZedZedZedZed Zed Zed Zed
Zed Zed Zed Zed Zed
Z ed
Z ed
Z edZ edZ edZ!edZ"edZ#edZ$edZ%edZ&e'dZ(edZ)edZ*edZ+e'dZ,edZ-edZ.edZ/e'dZ0edZ1edZ2edZ3dZ4e5e6e7f e8d< dZ9e5e6e7f e8d< ddd d Z:ddd d Z;dS ) rb zV
Determine the difference in type enforcement rules
between two policies.
Zallow diff_allowsZ
auditallowdiff_auditallowsZ
neverallowdiff_neverallowsZ dontauditdiff_dontauditsZ
allowxpermdiff_allowxpermsZauditallowxpermdiff_auditallowxpermsZneverallowxpermdiff_neverallowxpermsZdontauditxpermdiff_dontauditxpermsZtype_transitiondiff_type_transitionsZ type_changediff_type_changesZ type_memberdiff_type_membersNrm rn rd c C s | j d| tt| _| j D ]}| j|j | q&| j
D ] \}}| j dt || qH| j d| tt| _ | j
D ]}| j |j | q| j
D ] \}}| j dt || q| j d dS )z$Create rule lists for both policies.z+Building TE rule lists from {0.left_policy}zLoaded {0} {1} rules.z,Building TE rule lists from {0.right_policy}z!Completed building TE rule lists.N)rj r| rl r listrm Z left_policyZterulesrc r] rV r} rn Z right_policy)rr r% rc Zrulesr/ r/ r0 ro s
z'TERulesDifference._create_te_rule_listsc C s | j d d| _d| _d| _d| _d| _d| _d| _d| _ d| _
d| _ d| _ d| _
d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _ d| _ d| _ d| _ d| _ d| _!d| _"d| _#d| _$dS )z%Reset diff results on policy changes.z Resetting TE rule differencesN)%rj r| added_allowsremoved_allowsmodified_allowsadded_auditallowsremoved_auditallowsmodified_auditallowsadded_neverallowsremoved_neverallowsmodified_neverallowsadded_dontauditsremoved_dontauditsmodified_dontauditsadded_allowxpermsremoved_allowxpermsmodified_allowxpermsadded_auditallowxpermsremoved_auditallowxpermsmodified_auditallowxpermsadded_neverallowxpermsremoved_neverallowxpermsmodified_neverallowxpermsadded_dontauditxpermsremoved_dontauditxpermsmodified_dontauditxpermsadded_type_transitionsremoved_type_transitionsmodified_type_transitionsadded_type_changesremoved_type_changesmodified_type_changesadded_type_membersremoved_type_membersmodified_type_membersrm rn rr r/ r/ r0 _reset_diff sH z TERulesDifference._reset_diff) c C sL || _ t|j| _t|j| _t|j| _|j| _t|j| _t || _
d S rU ) r r rG rI r" rD r rF r6 hashkeyrr r% r/ r/ r0 __init__! s zAVRuleXpermWrapper.__init__c C s | j S rU r r r/ r/ r0 __hash__* s zAVRuleXpermWrapper.__hash__c C s | j |j k S rU r rr otherr/ r/ r0 __lt__- s zAVRuleXpermWrapper.__lt__c C s0 | j |j ko.| j|jko.| j|jko.| j|jkS rU )rG rI rD r r r/ r/ r0 __eq__0 s
zAVRuleXpermWrapper.__eq__)
r) r* r+ r, __slots__r r r r r r/ r/ r/ r0 ry s c @ s4 e Zd ZdZdZdd Zdd Zdd Zd d
Zd S ) r z*Wrap type_* rules to allow set operations.rG rI rD r? r@ filenamec C s || _ t|j| _t|j| _t|j| _t|| _zt|j | _ |j
| _
W n t yj d | _ d | _
Y n0 z |j | _ W n t
tfy d | _ Y n0 d S rU )r r rG rI r" rD r r r r? r@ r r r r r r/ r/ r0 r ? s
zTERuleWrapper.__init__c C s | j S rU r r r/ r/ r0 r R s zTERuleWrapper.__hash__c C s | j |j k S rU r r r/ r/ r0 r U s zTERuleWrapper.__lt__c C sH | j |j koF| j|jkoF| j|jkoF| j|jkoF| j|jkoF| j|jkS rU r r r/ r/ r0 r X s
zTERuleWrapper.__eq__N) r) r* r+ r, r r r r r r/ r/ r/ r0 r 9 s r )Br{ collectionsr sysr enumr typingr r r r r r
r r r
r exceptionr r r Z policyrepr r r r r r r r? r Z descriptorsr
differencer r rJ r r r! Zobjclassr" rA rB r$ r1 r2 r5 r8 r9 r. ZCondExpboolZ CondBlockZRuleDBrT r\ ra rx r r r rb ry r r/ r/ r/ r0 sL 0$
,
[& '0 1(