509318396 ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ 3 ^l$@sddlZddlZddlmZmZddlmZmZddlm Z m Z ddl m Z m Z ddlmZmZmZGdd d ejejejZdS) N)mixinsquery)CriteriaDescriptorCriteriaSetDescriptor) RuleUseErrorRuleNotConditional)IoctlSet TERuletype) match_regexmatch_indirect_regexmatch_regex_or_setcseZdZdZeedZeddZdZ dZ eddZ dZ dZ eddZdZed d ZdZdZd ZdZed d Zejdd ZfddZddZZS) TERuleQueryae Query the Type Enforcement rules. Parameter: policy The policy to query. Keyword Parameters/Class attributes: ruletype The list of rule type(s) to match. source The name of the source type/attribute to match. source_indirect If true, members of an attribute will be matched rather than the attribute itself. Default is true. source_regex If true, regular expression matching will be used on the source type/attribute. Obeys the source_indirect option. Default is false. target The name of the target type/attribute to match. target_indirect If true, members of an attribute will be matched rather than the attribute itself. Default is true. target_regex If true, regular expression matching will be used on the target type/attribute. Obeys target_indirect option. Default is false. tclass The object class(es) to match. tclass_regex If true, use a regular expression for matching the rule's object class. Default is false. perms The set of permission(s) to match. perms_equal If true, the permission set of the rule must exactly match the permissions criteria. If false, any set intersection will match. Default is false. perms_regex If true, regular expression matching will be used on the permission names instead of set logic. Default is false. perms_subset If true, the rule matches if the permissions criteria is a subset of the rule's permission set. Default is false. default The name of the default type to match. default_regex If true, regular expression matching will be used on the default type. Default is false. boolean The set of boolean(s) to match. boolean_regex If true, regular expression matching will be used on the booleans. Default is false. boolean_equal If true, the booleans in the conditional expression of the rule must exactly match the criteria. If false, any set intersection will match. Default is false. ) enum_class source_regexZlookup_type_or_attrFT target_regex default_regex boolean_regexZlookup_booleanNcCs|jS)N)_xperms)selfr#/usr/lib64/python3.6/terulequery.pyxpermsdszTERuleQuery.xpermscCs|rt}x|D]\}}d|ko*dkns>tdj|d|koPdknsdtdj|||krv||}}|jddt||dDqWt||_nd|_dS)Nriz{0:#07x} is not a valid ioctl.css|] }|VqdS)Nr).0irrr wsz%TERuleQuery.xperms..r)set ValueErrorformatupdateranger r)rvalueZpending_xpermsZlowZhighrrrrhs " c s$tt|j|f|tjt|_dS)N)superr__init__loggingZ getLogger__name__log)rpolicykwargs) __class__rrr#}szTERuleQuery.__init__c$csB|jjdj||jjdj||jjdj||jjdj||j|j|j|j|jjdj||jjdj||jjdj|x|jjD]}|jr|j|jkrq|j rt |j |j |j |j  rq|j rt |j |j |j|j rq|j|s qyN|jrJ|jrJ|jr8t|jdkr8w|j|jkrXwn|j|sXwWntk rrwYnXy&|jrt|j|j|jd  rwWntk rwYnX|jryt |j|jd |jswWntk rwYnX|jr4y t|jj|j|j |j!swWnt"k r2wYnX|VqWd S) z-Generator which yields all matching TE rules.z*Generating TE rule results from {0.policy}zRuletypes: {0.ruletype}zLSource: {0.source!r}, indirect: {0.source_indirect}, regex: {0.source_regex}zLTarget: {0.target!r}, indirect: {0.target_indirect}, regex: {0.target_regex}z*Xperms: {0.xperms!r}, eq: {0.xperms_equal}z0Default: {0.default!r}, regex: {0.default_regex}zGBoolean: {0.boolean!r}, eq: {0.boolean_equal}, regex: {0.boolean_regex}rFTN)#r&infordebugZ_match_object_class_debugZ_match_perms_debugr'Zterulesruletypesourcer source_indirectrtargettarget_indirectrZ_match_object_classZpermsZextendedZ perms_equallenZ xperm_typeZ _match_permsrrr xperms_equaldefaultrbooleanZ conditionalZbooleans boolean_equalrr)rZrulerrrresultss              zTERuleQuery.results)r% __module__ __qualname____doc__rr r,rr-rr.r/rr0r3rr4rr5rr2propertyrsetterr#r6 __classcell__rr)r)rrs&6       r)r$rerrZ descriptorsrrZ exceptionrrZ policyrepr r utilr r r Z MatchObjClassZMatchPermissionZ PolicyQueryrrrrrs