|
Server : Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 System : Linux localhost 2.6.18-419.el5 #1 SMP Fri Feb 24 22:47:42 UTC 2017 x86_64 User : nobody ( 99) PHP Version : 5.2.17 Disable Function : NONE Directory : /proc/21585/root/usr/lib64/python2.4/site-packages/sepolgen/ |
Upload File : |
mò
d&KRc @ sª d Z d k Z d k Z d k Z d k Z d k Z d k l Z d f d „ ƒ YZ d „ Z d „ Z
d „ Z d „ Z d „ Z
d
f d „ ƒ YZ d f d
„ ƒ YZ d S( s7
Classes for representing and manipulating interfaces.
N( t _t Paramc B sS t Z d Z d „ Z d „ Z d „ Z e e e ƒ Z e d d „ ƒ Z d „ Z RS( s;
Object representing a paramater for an interface.
c C s1 d | _ t i | _ t i ƒ | _ t | _ d S( Nt ( t selft _Param__namet refpolicyt SRC_TYPEt typet IdSett obj_classest Truet required( R ( ( t9 /usr/lib64/python2.4/site-packages/sepolgen/interfaces.pyt __init__$ s c C s1 t i | ƒ p t d | ƒ ‚ n | | _ d S( Ns Name [%s] is not a param( t accesst
is_idparamt namet
ValueErrorR R ( R R ( ( R t set_name* s c C s | i S( N( R R ( R ( ( R t get_name/ s t fgetc C s t | i d ƒ S( Ni ( t intR R ( R ( ( R t <lambda>4 s c C s* d | i t i | i d i | i ƒ f S( Ns0 <sepolgen.policygen.Param instance [%s, %s, %s]>t ( R R R t field_to_strR t joinR ( R ( ( R t __repr__6 s (
t __name__t
__module__t __doc__R
R R t propertyR t numR ( ( ( R R s c C s= d } | | j oà | | } | | i j o d Sn | t i j p | t i j o” | i t i j p | i t i j on d } | o | i g } n g } x8 t i | i
| ƒ D]! } | t i j o d } Pq´ q´ Wt i | _ qd } n) t ƒ } | | _ | | _ | | | i <| o | i
i | i ƒ n | S( Ni i ( t retR t paramst pR R R t TGT_TYPEt avt obj_classt avobjst itertoolst chainR t objt objectmodelt implicitly_typed_objectsR t add( R R R$ R! R& R R" R) ( ( R t __param_insert< s0
F
c C s! d } t } t i | i ƒ o0 t | i t i | | ƒ d j o
d } qO n t i | i ƒ o0 t | i t i | | ƒ d j o
d } q’ n t i | i
ƒ o0 t | i
t i | | ƒ d j o
d } qÕ n xE | i D]: } t i | ƒ o$ t | t ƒ d j o
d } qqß qß W| S( sj Extract the paramaters from an access vector.
Extract the paramaters (in the form $N) from an access
vector, storing them as Param objects in a dictionary.
Some attempt is made at resolving conflicts with other
entries in the dict, but if an unresolvable conflict is
found it is reported to the caller.
The goal here is to figure out how interface paramaters are
actually used in the interface - e.g., that $1 is a domain used as
a SRC_TYPE. In general an interface will look like this:
interface(`foo', `
allow $1 foo : file read;
')
This is simple to figure out - $1 is a SRC_TYPE. A few interfaces
are more complex, for example:
interface(`foo_trans',`
domain_auto_trans($1,fingerd_exec_t,fingerd_t)
allow $1 fingerd_t:fd use;
allow fingerd_t $1:fd use;
allow fingerd_t $1:fifo_file rw_file_perms;
allow fingerd_t $1:process sigchld;
')
Here the usage seems ambigious, but it is not. $1 is still domain
and therefore should be returned as a SRC_TYPE.
Returns:
0 - success
1 - conflict found
i i N( R t Falset found_srcR R R$ t src_typeR- R R R! t tgt_typeR# R% t OBJ_CLASSt permst permt PERM( R$ R! R/ R R4 ( ( R t av_extract_paramsh s$ # """
c C s4 t i | i ƒ o t | i t i d | ƒ Sn d S( N( R R t roleR- R t ROLEt NoneR! ( R7 R! ( ( R t role_extract_params¡ s c s³ ‡ d † } d } | | i t i ƒ o
d } n | | i t i ƒ o
d } n | | i t i ƒ o
d } n t
i | i ƒ o* t
| i t i d ˆ ƒ o
d } q¯ n | S( Nc sO d } xB | D]: } t i | ƒ o$ t | | d ˆ ƒ o
d } qG q
q
W| S( Ni i ( R t sett xR R R- R R9 R! ( R; R R R< ( R! ( R t extract_from_set¦ s i i ( R= R t rulet src_typesR R t tgt_typesR# R R2 R R t dest_typeR- t DEST_TYPER9 R! ( R> R! R R= ( ( R! R t type_rule_extract_params¥ s
c C sU d } xH | i D]= } t i | ƒ o' t | t i d | ƒ o
d } qM q q W| S( Ni i ( R t ifcallt argst argR R R- R R R9 R! ( RD R! R RF ( ( R t ifcall_extract_params¾ s
t InterfaceVectorc B sA t Z d d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z RS( Nc C sO t | _ d | _ t i ƒ | _ h | _ | o | i | ƒ n t | _
d S( NR ( R
R t enabledR R t AccessVectorSetR! t interfacet from_interfaceR. t expanded( R RK ( ( R R
Ë s c C s | i | _ xu | i ƒ D]g } | i t i i j o q n d | i j o q n t i
| ƒ } x | D] } | i
| ƒ qi Wq Wx+ | i ƒ D] } t | | i ƒ o q‘ q‘ Wx+ | i ƒ D] } t | | i ƒ o q¿ q¿ Wx+ | i ƒ D] } t | | i ƒ o qí qí Wd S( Nt dontaudit( RK R R t avrulest avrulet rule_typeR t AVRulet ALLOWR t avrule_to_access_vectorst avsR$ t add_avt rolesR7 R: R! t typerulesR> RC t interface_callsRD RG ( R RK RP R> RU R7 R$ RD ( ( R RL Ü s.
c C s1 t | | i ƒ d j o n | i i | ƒ d S( Ni ( R6 R$ R R! R RV ( R R$ ( ( R RV ÿ s c C sN g } | i d | i ƒ x$ | i D] } | i t | ƒ ƒ q$ Wd i | ƒ S( Ns [InterfaceVector %s]s
( t st appendR R R R$ t strR ( R RZ R$ ( ( R t to_string s
c C s
| i ƒ S( N( R R ( R ( ( R t __str__ s c C s d | i | i f S( Ns <InterfaceVector %s:%s>( R R RI ( R ( ( R R s ( R R R9 R
RL RV R] R^ R ( ( ( R RH Ê s # t InterfaceSetc B sz t Z d d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d d „ Z
d „ Z d
„ Z d „ Z
d „ Z RS(
Nc C s( h | _ h | _ g | _ | | _ d S( N( R t
interfacest tgt_type_mapt tgt_type_allt output( R Rc ( ( R R
s c C s& | i o | i i | d ƒ n d S( Ns
( R Rc t writeR\ ( R R\ ( ( R t o s
c C sÀ x¹ | i i ƒ D]¨ } | i d | i ƒ x; | i i ƒ D]* } | i d | i t i
| i f ƒ q: W| i d ƒ | i i
ƒ } x1 | D]) } | i d i | ƒ ƒ | i d ƒ q‹ Wq Wd S( Ns [InterfaceVector %s s %s:%s s ]
t ,s
( R R` t valuest ivt fdRd R R! t paramR R R R t to_listt avlR$ R ( R Ri Rj Rh Rl R$ ( ( R t to_file s (
c C s¿ d „ } d } x‡ | D] } | d } | d d j o( | o | i | ƒ n | | ƒ } q | o/ | i d ƒ } t i
| ƒ } | i | ƒ q q W| o | i | ƒ n | i
ƒ d S( Nc C s | d d !i ƒ } t | ƒ d j p | d d j o t d | ƒ ‚ n t ƒ } | d | _ t | ƒ d j o d Sn x‚ | d D]v } | i d ƒ } t | ƒ d j o t d | ƒ ‚ n t
ƒ } | d | _ t i
| d | _ | | i | i <q‡ W| S( Ni iÿÿÿÿi i RH s) Syntax error InterfaceVector statement %st :s- Invalid param in InterfaceVector statement %s( t linet splitt fieldst lent SyntaxErrorRH t ifvR t fieldR" R Rj R t str_to_fieldR R! ( Ro Rt R" Rq Ru Rj ( ( R t parse_ifv* s" $
iÿÿÿÿi t [Rf ( Rw R9 Rt Ri Ro R t add_ifvRp t lR t AccessVectorR$ RV t index( R Ri Rt Rw Rz R$ Ro ( ( R t from_file) s
c C s | | i | i <d S( N( Rt R R` R ( R Rt ( ( R Ry L s c C s¯ x¨ | i i ƒ D]— } t ƒ } xR | i D]G } t i | i ƒ o | i
i | ƒ t ƒ } Pn | i | i ƒ q) Wx0 | D]( } | i i | g ƒ } | i | ƒ q{ Wq Wd S( N( R R` Rg Rt R; R@ R R$ R R1 Rb R[ R, R Ra t
setdefaultRz ( R R@ Rt Rz R$ R ( ( R R| O s
c C s t | ƒ } | i | ƒ d S( N( RH RK Rt R Ry ( R RK Rt ( ( R R, ] s c C sQ x3 t i | i ƒ | i ƒ ƒ D] } | i | ƒ q W| i | ƒ | i ƒ d S( N(
R' R( t headersR` t templatest iR R, t expand_ifcallsR| ( R R Rc R ( ( R t add_headersa s
c C s} t i | ƒ ob t | d ƒ } | t | i ƒ j o d Sqy | i | d } t
| t ƒ o | Sqy | g Sn | g Sd S( Ni ( R R t idR R Rr RD RE R9 RF t
isinstancet list( R R„ RD R RF ( ( R t map_paramh s c
C s< | i | i | ƒ } | d j o d Sn | i | i | ƒ }
|
d j o d Sn | i | i | ƒ } | d j o d Sn t i ƒ } xD | i D]9 } | i | | ƒ } | d j o q” q” | i | ƒ q” Wt | ƒ d j o d Sn xI | D]A } x8 |
D]0 } x' | D] } | i i | | | | ƒ q
Wq Wqó Wd S( Ni ( R R‡ R$ R0 RD R? R9 R1 R@ R% R R R t new_permsR3 R4 R" t updateRr Rt R R, (
R Rt R$ RD R1 R0 R? Rˆ R4 R" R@ R% R ( ( R t
map_add_avx s2
c C sQ | d f g } | i | i } t | _ x"t | ƒ d j o| i
d ƒ \ }
} | i |
i } |
| j o< x$ | i D] } | i | | | ƒ qz W| i o q+ q¬ n x™ |
i ƒ D]‹ } | i | i j o | i t d ƒ ƒ d Sn y | | i } Wn0 t j
o$ | i t d | i ƒ ƒ q¹ n X| i | | f ƒ q¹ Wq+ Wd S( Ni iÿÿÿÿs Found circular interface classs# Missing interface definition for %s( RK R9 t stackR R` R Rt R
RM Rr t popt curt
cur_ifcallt cur_ifvR R$ RŠ RY RD t ifnameRe R t
if_by_namet newift KeyErrorR[ ( R RK R‘ Rt R’ R RŽ R$ RD R‹ R ( ( R t do_expand_ifcalls” s0
c C sy h } x3 t i | i ƒ | i ƒ ƒ D] } | | | i <q% Wx6 t i | i ƒ | i ƒ ƒ D] } | i
| | ƒ q[ Wd S( N( R‘ R' R( R R` R€ R R RK R R” ( R R R‘ R RK ( ( R R‚ ¸ s ( R R R9 R
Re Rm R} Ry R| R, Rƒ R‡ RŠ R” R‚ ( ( ( R R_ s # $( R R R R' R* t matchingt sepolgeni18nR R R- R6 R: RC RG RH R_ ( R- R RG R* R6 R RH R R' RC R_ R: R• R ( ( R t ? s
, 9 I