관리-도구
편집 파일: roexec.cpython-39.pyc
a q�qe � @ s| d dl Z d dlmZ d dlmZmZmZ ddlmZm Z ddl m Z ddl m Z dd lmZ d Zd Zd ZG d d� de �ZdS )� N)� defaultdict)�Dict�List�Set� )� AnyTERule�Type)� TERuleQuery� )� CheckerModule)�ConfigSetDescriptor�exempt_write_domain�exempt_exec_domain� exempt_filec s� e Zd ZdZdZeeeef�Z e dddd�Z e dddd�Z e dddd�Z dd�� fd d � Zeeee f d�d d �Zed�d d�Z� ZS )�ReadOnlyExecutablesz@Checker module for asserting all executable files are read-only.Zro_execsZlookup_type_or_attrFT)�strict�expandN)�returnc sD t � �|||� t�t�| _|�t�| _|�t �| _ |�t �| _ d S )N) �super�__init__�loggingZ getLogger�__name__�log�get� EXEMPT_WRITEr � EXEMPT_FILEr � EXEMPT_EXECr )�self�policyZ checknameZconfig�� __class__� �</usr/lib64/python3.9/site-packages/setools/checker/roexec.pyr ! s z ReadOnlyExecutables.__init__c C s� | j �d� | j �d�| j�� t| jdddd�}tt�}|�� D ]t}t|j � � �| j }t|j � � �| j }|rv|s�| j �d�|�� qB|D ]&}| j �d�||�� || � |� q�qB|S ) Nz)Collecting list of executable file types.zIgnore exec domains: {!r}�Zallow��file)ZexecuteZexecute_no_trans�ZruletypeZtclassZpermszIgnoring execute rule: {}z"Determined {} is executable by: {})r �debug�formatr r r r �set�results�sourcer �targetr �add)r �queryZ collected�ruleZsources�targets�tr! r! r" �_collect_executables) s$ � z(ReadOnlyExecutables._collect_executablesc C s6 | j �d� t| jdddd�}| �� }tt�}|�� D ]P}| j �d� |�� ||_ t |� � �D ]&}t|j �� �| j r^|| �|� q^q6t |�� �D ]~}| j�d� | j�d� |�� | j�d � t || �D ]}| j�d � |�� q�| j�d � t || �D ]}| �t|�� q�q�| j �d � t|��� t |�� �S ) Nz#Checking executables are read-only.r# r$ )�write�appendr& z+Checking if executable type {} is writable.z ------------ z!Executable type {} is writable. zExecute rules: z * {} z Write rules: z {} failure(s))r �infor r r2 r r) �keysr' r( r, �sortedr* r+ r r r- �outputr3 Zlog_fail�str�len)r r. Z executablesZfailuresZ exec_typer/ r! r! r" �runA s2 � zReadOnlyExecutables.run)r � __module__� __qualname__�__doc__Z check_type� frozensetr r r Z check_configr r r r r r r r r r2 r r; � __classcell__r! r! r r" r s r )r � collectionsr �typingr r r Z policyrepr r Z terulequeryr Z checkermoduler Z descriptorsr r r r r r! r! r! r" �<module> s