EVOLUTION-MANAGER
Edit File: permmap.cpython-36.pyc
3 �^j@ � @ s� d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl Z ddl m Z ddl m Z ddl mZ dd l mZ d d d d dgZdZdZG dd� d�Zdd� Zdd� Zdd� ZG dd� d�ZdS )� N)� OrderedDict)�ENOENT)�suppress� )� exception)� policyrep)�PermissionMapDescriptor)� TERuletype�r�w�b�n�u� c @ s� e Zd ZdZd%dd�Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� ZdS )&� PermissionMapz-Permission Map for information flow analysis.Nc C sN t jt�| _t� | _d| _|r*| j|� n tj d�}dj |j �}| j|� dS )z\ Parameter: permmapfile The path to the permission map to load. NZsetoolsz{0}/setools/perm_map) �loggingZ getLogger�__name__�logr �permmap� permmapfile�load� pkg_resourcesZget_distribution�format�location)�selfr Zdistro�path� r � /usr/lib64/python3.6/permmap.py�__init__* s zPermissionMap.__init__c C s | j S )N)r )r r r r �__str__; s zPermissionMap.__str__c C s8 t jt �}| j|_tj| j�|_| j|_||t| �< |S )N)r �__new__r �copy�deepcopyr r �id)r �memoZnewobjr r r � __deepcopy__> s zPermissionMap.__deepcopy__c c s0 x*| j � D ] }x| j|�D ] }|V qW q W d S )N)�classes�perms)r �cls�mappingr r r �__iter__F s zPermissionMap.__iter__c C sb | j jdj|�� t|d���}d}d}d}d}| jj� �x�t|dd�D �]�\}}|j� } t| �dksJ| d d dkrzqJ|dkr�yt | d �}W n< t k r� } z t j dj||| d ��| �W Y dd} ~ X nX |dk r�t j d j||| d ���d }qJ|d k�r�t| �d k�s | d d k�r0t j d j||| ���t | d �} yt | d �} W n> t k �r� } z t j dj||| d ��| �W Y dd} ~ X nX | dk �r�t j dj||| d ���|d7 }||k�r�t j dj||| ���t� | j| < d} d }qJ|d krJt | d �}t | d �}|tk�r,t j dj||| d ���yt | d �}W n> t k �rz } z t j dj||| d ��| �W Y dd} ~ X nX t| k�o�tkn �s�t j dj||| d tt���| j jdj| |||�� |dk�r�| j jdj| |�� t| j| |dd�}||_||_|d7 }| d7 } | | krJd }qJW W dQ R X || _| j jdj|�� | j jdj||�� dS )z\ Parameter: permmapfile The path to the permission map to load. z Opening permission map "{0}"r r r )�start�#z&{0}:{1}:Invalid number of classes: {2}Nz/{0}:{1}:Number of classes must be positive: {2}� � �classz&{0}:{1}:Invalid class declaration: {2}z*{0}:{1}:Invalid number of permissions: {2}z3{0}:{1}:Number of permissions must be positive: {2}z {0}:{1}:Extra class found: {2}z/{0}:{1}:Invalid information flow direction: {2}z&{0}:{1}:Invalid permission weight: {2}z.{0}:{1}:Permission weight must be {3}-{4}: {2}zRead {0}:{1} {2} {3}r z Permission {0}:{1} is unmapped.T)�createz(Successfully opened permission map "{0}"z+Read {0} classes and {1} total permissions.)r �infor �openr �clear� enumerate�split�len�int� ValueErrorr ZPermissionMapParseError�strr �infoflow_directions� min_weight� max_weight�debug�Mapping� direction�weightr )r r �mapfileZ total_permsZ class_countZ num_classes�stateZline_num�line�entry�ex� class_nameZ num_permsZ perm_count� perm_nameZflow_directionr@ r) r r r r K s� $ $ $ zPermissionMap.loadc C s( t |d���}| jjdj|�� |jdjt| j��� x�| jj� D ]�\}}|jdj|t|��� x�|j� D ]�\}}|d }|d }t| ko�t kn s�t dj|||���|t ks�t dj|||���|d kr�| jj d j||�� |jd j|||�� qjW |jd � qBW | jjd j|�� W dQ R X dS )z� Save the permission map to the specified path. Existing files will be overwritten. Parameter: permmapfile The path to write the permission map. r z Writing permission map to "{0}"z{0} zclass {0} {1} r? r@ z={0}:{1} weight is out of range ({2}). This is an SETools bug.z@{0}:{1} flow direction ({2}) is invalid. This is an SETools bug.r z1Warning: permission {0} in class {1} is unmapped.z{0:>20} {1:>9} {2:>9} � z*Successfully wrote permission map to "{0}"N) r2 r r1 r �writer6 r �itemsr; r< �AssertionErrorr: Zwarning) r r rA � classnamer' ZpermnameZsettingsr? r@ r r r �save� s( zPermissionMap.savec c s | j j� E dH dS )zw Generate class names in the permission map. Yield: class An object class name. N)r �keys)r r r r r& � s zPermissionMap.classesc c sf y,x&| j | j� D ]}t| j ||�V qW W n4 tk r` } ztjdj|��|�W Y dd}~X nX dS )z� Generate permission mappings for the specified class. Parameter: class_ An object class name. Yield: Mapping A permission's complete map (weight, direction, enabled) z{0} is not mapped.N)r rN r> �KeyErrorr � UnmappedClassr )r �class_�permrE r r r r' � s zPermissionMap.permsc C s t | j||�S )z)Retrieve a specific permission's mapping.)r> r )r rQ rR r r r r) � s zPermissionMap.mappingc C s x| j |�D ] }d|_q W dS )a Exclude all permissions in an object class for calculating rule weights. Parameter: class_ The object class to exclude. Exceptions: UnmappedClass The specified object class is not mapped. FN)r' �enabled)r rQ rR r r r � exclude_class� s zPermissionMap.exclude_classc C s dt | j||�_dS )a� Exclude a permission for calculating rule weights. Parameter: class_ The object class of the permission. permission The permission name to exclude. Exceptions: UnmappedClass The specified object class is not mapped. UnmappedPermission The specified permission is not mapped for the object class. FN)r> r rS )r rQ � permissionr r r �exclude_permission s z PermissionMap.exclude_permissionc C s x| j |�D ] }d|_q W dS )a Include all permissions in an object class for calculating rule weights. Parameter: class_ The object class to include. Exceptions: UnmappedClass The specified object class is not mapped. TN)r' rS )r rQ rR r r r � include_class s zPermissionMap.include_classc C s dt | j||�_dS )a� Include a permission for calculating rule weights. Parameter: class_ The object class of the permission. permission The permission name to include. Exceptions: UnmappedClass The specified object class is not mapped. UnmappedPermission The specified permission is not mapped for the object class. TN)r> r rS )r rQ rU r r r �include_permission' s z PermissionMap.include_permissionc C s� x�|j � D ]�}t|�}|| jkr@| jjdj||�� t� | j|< |j}tt j �� ||j jO }W dQ R X xB|D ]:}|| j| krn| jjdj|||�� t | j||dd� qnW q W dS )zHCreate mappings for all classes and permissions in the specified policy.z"Adding unmapped class {0} from {1}Nz.Adding unmapped permission {0} in {1} from {2}T)r0 ) r& r9 r r r= r r r' r r ZNoCommon�commonr> )r ZpolicyrQ rF r' rG r r r � map_policy6 s zPermissionMap.map_policyc C s� d}d}t |j�}|jtjkr0tjdj|j���xv|jD ]l}t | j ||�}|j sRq8|j dkrjt ||j�}q8|j dkr�t ||j�}q8|j dkr8t ||j�}t ||j�}q8W ||fS )aT Get the type enforcement rule's information flow read and write weights. Parameter: rule A type enforcement rule. Return: Tuple(read_weight, write_weight) read_weight The type enforcement rule's read weight. write_weight The type enforcement rule's write weight. r z1{0} rules cannot be used for calculating a weightr r r )r9 ZtclassZruletyper Zallowr Z RuleTypeErrorr r' r> r rS r? �maxr@ )r ZruleZ write_weightZ read_weightrF rG r) r r r � rule_weightJ s$ zPermissionMap.rule_weightc C s |t | j||�_dS )a� Set the information flow direction of a permission. Parameter: class_ The object class of the permission. permission The permission name. direction The information flow direction the permission (r/w/b/n). Exceptions: UnmappedClass The specified object class is not mapped. UnmappedPermission The specified permission is not mapped for the object class. N)r> r r? )r rQ rU r? r r r � set_directionq s zPermissionMap.set_directionc C s |t | j||�_dS )a� Set the weight of a permission. Parameter: class_ The object class of the permission. permission The permission name. weight The weight of the permission (1-10). Exceptions: UnmappedClass The specified object class is not mapped. UnmappedPermission The specified permission is not mapped for the object class. N)r> r r@ )r rQ rU r@ r r r � set_weight� s zPermissionMap.set_weight)N)r � __module__� __qualname__�__doc__r r r% r* r rM r& r' r) rT rV rW rX rZ r\ r] r^ r r r r r & s$ q% 'r c C s* t | kotkn s&tdj| ���| S )Nz$Permission weights must be 1-10: {0})r; r< r8 r )r@ r r r �validate_weight� s rb c C s | t krtdj| ���| S )Nz'Invalid information flow direction: {0})r: r8 r )r? r r r �validate_direction� s rc c C s t | �S )N)�bool)rS r r r �validate_enabled� s re c @ s@ e Zd ZdZede�Zede�Zede �Z d dd�Z dd � Z d S ) r> z1A mapping for a permission in the permission map.r@ r? rS Fc C s� || _ || _|| _|rD|| j kr,t� | j |< dddd�| j | |< n:|| j kr^tjdj|���|| j | kr~tjdj||���d S )Nr r T)r? r@ rS z{0} is not mapped.z{0}:{1} is not mapped.)�perm_maprQ rR r r rP r ZUnmappedPermission)r rf rL rU r0 r r r r � s zMapping.__init__c C s( | j |j kr| j|jk S | j |j k S d S )N)rQ rR )r �otherr r r �__lt__� s zMapping.__lt__N)F) r r_ r` ra r rb r@ rc r? re rS r rh r r r r r> � s r> )�sysr r! � collectionsr �errnor � contextlibr r � r r Z descriptorsr r r: r; r< r rb rc re r> r r r r �<module> s( o