관리-도구
편집 파일: terules.cpython-39.pyc
a q�qe]` � @ s� d dl Z d dlmZ d dlmZ d dlmZ d dlmZm Z m Z m Z m Z m Z mZmZmZmZ ddlmZmZmZ ddlmZmZmZmZmZm Z m Z d d l m Z d d l m!Z! d d l"m#Z#m$Z$ d d l%m&Z&m'Z' d dlm(Z( d dl)m*Z* ed�Z+ed�Z,G dd� de �Z-G dd� de �Z.G dd� de�Z/G dd� de �Z0G dd� de �Z1G d d � d e �Z2eee3f Z4ee5e3f Z6e e4e e6e e3e e3e e3e1f f f f f Z7e e e7e2e/dd �d d �Z8e7dd!�d"d#�Z9e7e2ee e e e e e- f d$�d%d&�Z:e3e d'gdf d(�d)d*�Z;e e e d+ d,�d-d.�Z<e3e d'gdf d(�d/d0�Z=e3e egdf d(�d1d2�Z>G d3d'� d'e#�Z?G d4d+� d+e$e �Z@G d5d6� d6e$�ZAdS )7� N)� defaultdict)�intern)�Enum) �Any�Callable�Dict�Iterable�List� NamedTuple�Optional�Set�Tuple�Union� )�RuleNotConditional� RuleUseError�TERuleNoFilename)� AnyTERule�AVRule� AVRuleXperm� Conditional�IoctlSet� TERuletype�Type� )�conditional_wrapper_factory)�DiffResultDescriptor)� Difference�Wrapper)�type_wrapper_factory� type_or_attr_wrapper_factory)�RuleList)�class_wrapper_factoryz<<unconditional>>�Truec @ sV e Zd ZU dZeed< eee e f ed< eee e f ed< eee e f ed< dS )�ModifiedAVRulez5Difference details for a modified access vector rule.�rule� added_perms� removed_perms� matched_permsN) �__name__� __module__� __qualname__�__doc__r �__annotations__r r �strr � r/ r/ �:/usr/lib64/python3.9/site-packages/setools/diff/terules.pyr$ s r$ c @ s* e Zd ZU dZeed< eed< eed< dS )�ModifiedTERulez.Difference details for a modified type_* rule.r% Z added_defaultZremoved_defaultN)r) r* r+ r, r r- r r/ r/ r/ r0 r1 $ s r1 c @ s e Zd ZdZdZdS )�Sider r N)r) r* r+ �left�rightr/ r/ r/ r0 r2 0 s r2 c @ s" e Zd ZU ee ed< eed< dS )�RuleDBSideDataRecord�perms� orig_ruleN)r) r* r+ r r. r- r r/ r/ r/ r0 r5 5 s r5 c @ s& e Zd ZU ee ed< ee ed< dS )�RuleDBSidesRecordr3 r4 N)r) r* r+ r r5 r- r/ r/ r/ r0 r8 : s r8 c @ s. e Zd ZU eeef ed< eeef ed< dS )� TypeDBRecordr3 r4 N)r) r* r+ r r. r r- r/ r/ r/ r0 r9 ? s r9 )� rule_list�rule_db�type_db�side�returnc C s� |t jkr|j}n|j}| D �]�}z tt|j��}tt|j��}W n ty\ t}t }Y n0 ||vr�t � ||< t � || |< n||| vr�t � || |< |j j }t |j�} t| |�} || | } |j�� D �]} | j } | |vr�| || < | | vr�t � | | < |j�� D ]�}|j }||v�r |||< || | v�r<t � | | |< d}d}|| | | v �rr| | | | }|j}|j}|t jk�r�|�s�| }n|j| B }|j}t||�}n&|�s�| }n|j| B }|j}t||�}t||�| | | |< �qq�q dS )aP Using rule_list, build up rule_db which is a data structure which consists of nested dicts that store BOTH the left and the right policies. All of the keys are interned strings. The permissions are stored as a set. The basic structure is rule_db[cond_exp][block_bool][src][tgt][tclass] = sides where: cond_exp is a boolean expression block_bool is either true or false src is the source type tgt is the target type tclass is the target class sides is a named tuple with attributes "left" and "right" referring to the left or right policy. Each attribute in the sides named tuple refers to a named tuple with attributes "perms" and "orig_rule" which refer to a permission set and the original unexpanded rule. sides = ((left_perms, left_orig_rule),(right_perms, right_orig_rule)) There are a few advantages to this structure. First, it takes up way less memory. Second, it allows redundant rules to be easily eliminated. And, third, it makes it easy to create the added, removed, and modified rules. N)r2 r3 r4 r r. � conditional�conditional_blockr �TERULES_UNCONDITIONAL�TERULES_UNCONDITIONAL_BLOCK�dict�tclass�name�setr6 r5 �source�expand�targetr7 r8 )r: r; r< r= �types�unexpanded_rule�cond_expZ block_boolrD r6 � side_data�block�srcZsrc_str�tgtZtgt_str� left_side� right_sideZsides�pZorigr/ r/ r0 �_avrule_expand_generatorJ sb rT )r; r> c C sR | t t }| �� D �]6\}}|t kr(q|�� D �]}|�� D �]\}}||vrRq>|�� D ]�\}}||| vrpqZ|�� D ]�\} } | || | vr�qx|| | | } | j} | j} | jr�| r�| j| jj@ }|r�| j| }|r�t|| j�} nd } t | | �|| < | jrx| rx| j| jj@ }|rx| j| }|�r2t|| j�} nd } t | | �|| < qxqZq>q0qd S �N) rA rB �items�valuesr3 r4 r6 r5 r7 r8 )r; Z uncond_blockrL � cond_blocksrN rO �src_datarP �tgt_datarD rM Zuncond_side_datarQ rR �crS r/ r/ r0 �_av_remove_redundant_rules� sB r\ )r; r< r> c C sT g }g }g }| � � D �]2}|� � D �]"}|�� D �]\}}|�� D � ]�\} } | � � D ]�} | jr�| jr�| jj| jj@ } | jj| } | jj| }| s�|r�| jj}|�|j| |j| | jj�}|�t||| | �� qT| j�r | jj}|�|j| |j| | jj�}|�|� qT| jrT| jj}|�|j| |j| | jj�}|�|� qTqBq0q"q|||fS rU ) rW rV r3 r4 r6 r7 Zderive_expanded�appendr$ )r; r< �added�removed�modifiedrX rN rO rY rP rZ rM Z common_permsZ left_permsZ right_permsZ original_ruler% r/ r/ r0 �_av_generate_diffs� sJ � �� �ra �TERulesDifference)�ruletyper> c s t �� �� dd�� fdd� }|S )z� This is a template for the access vector diff functions. Parameters: ruletype The rule type, e.g. "allow". N�r> c s2 | j �d�� | �� | jdu s(| jdu r0| �� tt� t� �}t� }t� |t< t� |t t < | j �d�| �� t | j� ||t j � | j �d�| �� t | j� ||t j � | j �d� t|� | j �d� t||�\}}}|j �� |j �� |�� t| d�� �|� t| d�� �|� t| d �� �|� dS ) �6Generate the difference in rules between the policies.�CGenerating {0} differences from {1.left_policy} to {1.right_policy}Nz(Expanding AV rules from {0.left_policy}.z)Expanding AV rules from {0.right_policy}.z Removing redundant AV rules.zGenerating AV rule diff.� added_{0}s� removed_{0}s� modified_{0}s)�log�info�format�_left_te_rules�_right_te_rules�_create_te_rule_listsr9 rC rA rB rT r2 r3 r4 r\ ra �clear�setattr)�selfr< r; r^ r_ r` �rc r/ r0 �diff� s2 �� z av_diff_template.<locals>.diff�r �lookup�rc rt r/ rs r0 �av_diff_template� s #rx �AVRuleXpermWrapper)r: r> c C s� t � }| D ]N}|�� D ]@}t|�}z|| j|jO _W q tyT |||< Y q0 qq |rzt�t��d� |t |��� |� � S )z` Generator that yields wrapped, expanded, av(x) rules with unioned permission sets. z/Expanded {0.ruletype} rules for {0.policy}: {1}) rC rH ry r6 �KeyError�loggingZ getLoggerr) �debugrl �len�keys)r: rV rK Z expanded_ruleZexpanded_wrapped_ruler/ r/ r0 �_avxrule_expand_generator" s ��r c s t �� �� dd�� fdd� }|S )z� This is a template for the extended permission access vector diff functions. Parameters: ruletype The rule type, e.g. "allowxperm". Nrd c s | j �d�� | �� | jr | js(| �� | jt| j� �t| j� �dd�\}}}g }|D ]V\}}| j|j|jdd�\}}} |s�|rZ|� t |j t |�t |�t dd� | D ���� qZt | d�� �tdd� |D ��� t | d�� �td d� |D ��� t | d �� �|� d S ) re rf F)�unwrapc s s | ]}|d V qdS )r Nr/ )�.0rS r/ r/ r0 � <genexpr>f � z2avx_diff_template.<locals>.diff.<locals>.<genexpr>rg c s s | ] }|j V qd S rU ��origin)r� �ar/ r/ r0 r� h r� rh c s s | ] }|j V qd S rU r� )r� �rr/ r/ r0 r� i r� ri N)rj rk rl rm rn ro � _set_diffr r6 r] r$ r� r rq rF ) rr r^ r_ �matchedr` � left_rule� right_ruler& r' r( rs r/ r0 rt H s6 �� � � � z avx_diff_template.<locals>.diffru rw r/ rs r0 �avx_diff_template> s $r� c s t �� �� dd�� fdd� }|S )z� This is a template for the type_* diff functions. Parameters: ruletype The rule type, e.g. "type_transition". Nrd c s� | j �d�� | �� | jdu s(| jdu r0| �� | �| �| j� t�| �| j� t��\}}}g }|D ]2\}}t |j �t |j �krf|� t ||j |j �� qft | d�� �|� t | d�� �|� t | d�� �|� dS )re rf Nrg rh ri )rj rk rl rm rn ro r� Z_expand_generator� TERuleWrapperr �defaultr] r1 rq )rr r^ r_ r� r` r� r� rs r/ r0 rt y s* ��� �z te_diff_template.<locals>.diffru rw r/ rs r0 �te_diff_templateo s r� c @ s� e Zd ZU dZed�Zed�Zed�Zed�Z ed�Z ed�Z ed�Z ed�Z ed�Zed�Zed�Zed�Zed�Zed �Zed �Zed �Zed �Zed �Zed �Zed �Zed �Zed �Z ed �Z ed �Z ed�Z ed�Z ed�Z!ed�Z"ed�Z#ed�Z$ed�Z%ed�Z&e'd�Z(ed�Z)ed�Z*ed�Z+e'd�Z,ed�Z-ed�Z.ed�Z/e'd�Z0ed�Z1ed�Z2ed�Z3dZ4e5e6e7f e8d< dZ9e5e6e7f e8d< dd�d d �Z:dd�d d �Z;dS ) rb zV Determine the difference in type enforcement rules between two policies. Zallow� diff_allowsZ auditallow�diff_auditallowsZ neverallow�diff_neverallowsZ dontaudit�diff_dontauditsZ allowxperm�diff_allowxpermsZauditallowxperm�diff_auditallowxpermsZneverallowxperm�diff_neverallowxpermsZdontauditxperm�diff_dontauditxpermsZtype_transition�diff_type_transitionsZ type_change�diff_type_changesZ type_member�diff_type_membersNrm rn rd c C s� | j �d�| �� tt�| _| j�� D ]}| j|j � |� q&| j� � D ] \}}| j �d�t |�|�� qH| j �d�| �� tt�| _ | j �� D ]}| j |j � |� q�| j � � D ] \}}| j �d�t |�|�� q�| j �d� dS )z$Create rule lists for both policies.z+Building TE rule lists from {0.left_policy}zLoaded {0} {1} rules.z,Building TE rule lists from {0.right_policy}z!Completed building TE rule lists.N)rj r| rl r �listrm Z left_policyZterulesrc r] rV r} rn Z right_policy)rr r% rc Zrulesr/ r/ r0 ro � s z'TERulesDifference._create_te_rule_listsc C s� | j �d� d| _d| _d| _d| _d| _d| _d| _d| _ d| _ d| _ d| _ d| _ d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _ d| _ d| _ d| _ d| _ d| _!d| _"d| _#d| _$dS )z%Reset diff results on policy changes.z Resetting TE rule differencesN)%rj r| � added_allows�removed_allows�modified_allows�added_auditallows�removed_auditallows�modified_auditallows�added_neverallows�removed_neverallows�modified_neverallows�added_dontaudits�removed_dontaudits�modified_dontaudits�added_allowxperms�removed_allowxperms�modified_allowxperms�added_auditallowxperms�removed_auditallowxperms�modified_auditallowxperms�added_neverallowxperms�removed_neverallowxperms�modified_neverallowxperms�added_dontauditxperms�removed_dontauditxperms�modified_dontauditxperms�added_type_transitions�removed_type_transitions�modified_type_transitions�added_type_changes�removed_type_changes�modified_type_changes�added_type_members�removed_type_members�modified_type_membersrm rn �rr r/ r/ r0 � _reset_diff� sH z TERulesDifference._reset_diff)<r) r* r+ r, rx r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rm r! r r r- rn ro r� r/ r/ r/ r0 rb � sb c @ s< e Zd ZdZdZedd�dd�Zdd� Zd d � Zd d � Z dS ) ry zEWrap extended permission access vector rules to allow set operations.)rG rI rD � xperm_typer6 N)r% r> c C sL || _ t|j�| _t|j�| _t|j�| _|j| _t|j�| _t |�| _ d S rU ) r� r rG rI r" rD r� rF r6 �hash�key�rr r% r/ r/ r0 �__init__! s zAVRuleXpermWrapper.__init__c C s | j S rU �r� r� r/ r/ r0 �__hash__* s zAVRuleXpermWrapper.__hash__c C s | j |j k S rU r� �rr �otherr/ r/ r0 �__lt__- s zAVRuleXpermWrapper.__lt__c C s0 | j |j ko.| j|jko.| j|jko.| j|jkS rU )rG rI rD r� r� r/ r/ r0 �__eq__0 s � � �zAVRuleXpermWrapper.__eq__) r) r* r+ r, � __slots__r r� r� r� r� r/ r/ r/ r0 ry s c @ s4 e Zd ZdZdZdd� Zdd� Zdd� Zd d � Zd S ) r� z*Wrap type_* rules to allow set operations.�rG rI rD r? r@ �filenamec C s� || _ t|j�| _t|j�| _t|j�| _t|�| _zt|j �| _ |j | _ W n t yj d | _ d | _ Y n0 z |j | _ W n t tfy� d | _ Y n0 d S rU )r� r rG rI r" rD r� r� r r? r@ r r� r r r� r/ r/ r0 r� ? s zTERuleWrapper.__init__c C s | j S rU r� r� r/ r/ r0 r� R s zTERuleWrapper.__hash__c C s | j |j k S rU r� r� r/ r/ r0 r� U s zTERuleWrapper.__lt__c C sH | j |j koF| j|jkoF| j|jkoF| j|jkoF| j|jkoF| j|jkS rU r� r� r/ r/ r0 r� X s � � � � �zTERuleWrapper.__eq__N) r) r* r+ r, r� r� r� r� r� r/ r/ r/ r0 r� 9 s r� )Br{ � collectionsr �sysr �enumr �typingr r r r r r r r r r � exceptionr r r Z policyrepr r r r r r r r? r Z descriptorsr � differencer r rJ r r r! Zobjclassr" rA rB r$ r1 r2 r5 r8 r9 r. ZCondExp�boolZ CondBlockZRuleDBrT r\ ra rx r r� r� rb ry r� r/ r/ r/ r0 �<module> sL 0$ , � [&� '0 1(