EVOLUTION-MANAGER
Edit File: terules.cpython-36.pyc
3 �^�^ � @ sp d dl Z d dlmZmZ d dlmZ d dlmZ ddlm Z m Z m Z ddl m Z mZ dd lmZ dd lmZ dd lmZmZ dd lmZmZ dd lmZ ed�Zed�Z edddddg�Z eddddg�Z G dd� de�Z eddd g�Z ed d d g�Z!ed d d g�Z"d!d"� Z#d#d$� Z$d%d&� Z%d'd(� Z&d)d*� Z'd+d,� Z(d-d.� Z)G d/d0� d0e�Z*G d1d2� d2e�Z+G d3d4� d4e�Z,dS )5� N)� defaultdict� namedtuple)�intern)�Enum� )�RuleNotConditional� RuleUseError�TERuleNoFilename)�IoctlSet� TERuletype� )�conditional_wrapper_factory)�DiffResultDescriptor)� Difference�Wrapper)�type_wrapper_factory� type_or_attr_wrapper_factory)�class_wrapper_factoryz<<unconditional>>�TrueZmodified_avrule�rule� added_perms� removed_perms� matched_permsZmodified_teruleZ added_defaultZremoved_defaultc @ s e Zd ZdZdZdS )�Sider r N)�__name__� __module__� __qualname__�left�right� r r � /usr/lib64/python3.6/terules.pyr - s r Zrule_db_side_data�perms� orig_ruleZ rule_db_sidesr r ZType_dbc C s |t jkr|j}n|j}�x�| D �]�}t}t}y tt|j��}tt|j��}W n t k rb Y nX ||kr�t � ||< t � || |< n||| kr�t � || |< |j j }dd� |j D �} t| |�} || | } �x.|jj� D �] } | j } | |kr�| || < | | k�r t � | | < x�|jj� D ]�}|j }||k�r4|||< || | k�rPt � | | |< d}d}|| | | k�r�| | | | }|j}|j}|t jk�r�|�s�| }n|j | B }|j}t||�}n&|�s�| }n|j | B }|j}t||�}t||�| | | |< �qW q�W q W dS )aP Using rule_list, build up rule_db which is a data structure which consists of nested dicts that store BOTH the left and the right policies. All of the keys are interned strings. The permissions are stored as a set. The basic structure is rule_db[cond_exp][block_bool][src][tgt][tclass] = sides where: cond_exp is a boolean expression block_bool is either true or false src is the source type tgt is the target type tclass is the target class sides is a named tuple with attributes "left" and "right" referring to the left or right policy. Each attribute in the sides named tuple refers to a named tuple with attributes "perms" and "orig_rule" which refer to a permission set and the original unexpanded rule. sides = ((left_perms, left_orig_rule),(right_perms, right_orig_rule)) There are a few advantages to this structure. First, it takes up way less memory. Second, it allows redundant rules to be easily eliminated. And, third, it makes it easy to create the added, removed, and modified rules. c S s h | ]}|�qS r r )�.0�pr r r � <setcomp>c s z+_avrule_expand_generator.<locals>.<setcomp>N)r r r �TERULES_UNCONDITIONAL�TERULES_UNCONDITIONAL_BLOCKr �str� conditional�conditional_blockr �dict�tclass�namer! �rule_db_side_data_record�source�expand�targetr" �rule_db_sides_record)� rule_list�rule_db�type_dbZside�types�unexpanded_rule�cond_exp� block_boolr, r! � side_data�block�srcZsrc_str�tgtZtgt_str� left_side� right_sideZsidesr$ Zorigr r r �_avrule_expand_generator9 sd r@ c C sx | t t }�xd| j� D �]V\}}|t kr,q�x@|j� D �]2\}}�x&|j� D �]\}}||krbqN�x|j� D ]�\}} ||| kr�qnx�| j� D ]�\} } | || | kr�q�|| | | } | j} | j}| jo�| �r| j| jj@ }|�r| j| }|�rt|| j�} nd } t| |�| | < | jr�|r�|j| jj@ }|r�|j| }|�rNt||j�}nd }t| |�| | < q�W qnW qNW q8W qW d S )N) r& r' �itemsr r r! r. r" r2 )r4 Z uncond_blockr8 � cond_blocksr9 r; r< �src_datar= �tgt_datar, r: Zuncond_side_datar> r? �cr$ r r r �_av_remove_redundant_rules� sB rF c C s| g }g }g }�xb|j � D �]T\}}�xH|j � D �]:\}} �x.| j � D �] \} } �x| j � D �]\} } x�| j � D ]�\}}|jr�|jr�|jj|jj@ }|jj| }|jj| }|s�|r�|jj}|j|j| |j| |jj�}|jt||||�� qn|j�r(|jj}|j|j| |j| |jj�}|j|� qn|jrn|jj}|j|j| |j| |jj�}|j|� qnW qZW qDW q.W qW |||fS )N)rA r r r! r" Zderive_expanded�append�modified_avrule_record)�ruletyper4 r5 �added�removed�modifiedr8 rB r9 r; r< rC r= rD r, r: Z common_permsZ left_permsZ right_permsZ original_ruler r r r �_av_generate_diffs� sB rM c s t j� �� � fdd�}|S )z� This is a template for the access vector diff functions. Parameters: ruletype The rule type, e.g. "allow". c s | j jdj� | �� | j s$| j r,| j� tt� t� �}t� }t� |t< t� |t t < t jd� t | j� ||t j � t jd� t | j� ||t j� t jd� t|� t jd� t� ||�\}}}|j j� |jj� |j� t| dj� �|� t| dj� �|� t| dj� �|� d S ) z6Generate the difference in rules between the policies.zCGenerating {0} differences from {1.left_policy} to {1.right_policy}zExpanding left policyzExpanding right policyzRemoving redundant rulesz0Generating added, removed, and modified av rulesz added_{0}sz removed_{0}sz modified_{0}sN)�log�info�format�_left_te_rules�_right_te_rules�_create_te_rule_lists�type_db_recordr+ r& r' �loggingr@ r r r rF rM �clear�setattr)�selfr5 r4 rJ rK rL )rI r r �diff� s. z av_diff_template.<locals>.diff)r �lookup)rI rY r )rI r �av_diff_template� s #r[ c C s� t � }x\| D ]T}xN|j� D ]B}||�}y|| j|jO _W q tk rZ |||< Y qX qW q W |r�tjt�jdj|t |��� |j � S )z` Generator that yields wrapped, expanded, av(x) rules with unioned permission sets. z/Expanded {0.ruletype} rules for {0.policy}: {1}) r+ r0 r! �KeyErrorrU Z getLoggerr �debugrP �len�keys)r3 Z WrapperClassrA r7 Z expanded_ruleZexpanded_wrapped_ruler r r �_avxrule_expand_generator s r` c s t j� �� � fdd�}|S )z� This is a template for the extended permission access vector diff functions. Parameters: ruletype The rule type, e.g. "allowxperm". c s | j jdj� | �� | j s$| j r,| j� | jt| j� t�t| j� t�dd�\}}}g }x^|D ]V\}}| j|j |j dd�\}}} |s�|rd|j t |j t |�t |�t dd� | D ���� qdW t| dj� �tdd� |D ��� t| dj� �td d� |D ��� t| d j� �|� d S ) z6Generate the difference in rules between the policies.zCGenerating {0} differences from {1.left_policy} to {1.right_policy}F)Zunwrapc s s | ]}|d V qdS )r Nr )r# r$ r r r � <genexpr>Q s z2avx_diff_template.<locals>.diff.<locals>.<genexpr>z added_{0}sc s s | ] }|j V qd S )N)�origin)r# �ar r r ra S s z removed_{0}sc s s | ] }|j V qd S )N)rb )r# �rr r r ra T s z modified_{0}sN)rN rO rP rQ rR rS � _set_diffr` �AVRuleXpermWrapperr! rG rH rb r rW �set) rX rJ rK �matchedrL � left_rule� right_ruler r r )rI r r rY 3 s, z avx_diff_template.<locals>.diff)r rZ )rI rY r )rI r �avx_diff_template) s $rk c s t j� �� � fdd�}|S )z� This is a template for the type_* diff functions. Parameters: ruletype The rule type, e.g. "type_transition". c s� | j jdj� | �� | j s$| j r,| j� | j| j| j� t�| j| j� t��\}}}g }x:|D ]2\}}t |j �t |j �krd|j t ||j |j �� qdW t | dj� �|� t | dj� �|� t | dj� �|� dS )z6Generate the difference in rules between the policies.zCGenerating {0} differences from {1.left_policy} to {1.right_policy}z added_{0}sz removed_{0}sz modified_{0}sN)rN rO rP rQ rR rS re Z_expand_generator� TERuleWrapperr �defaultrG �modified_terule_recordrW )rX rJ rK rh rL ri rj )rI r r rY d s" z te_diff_template.<locals>.diff)r rZ )rI rY r )rI r �te_diff_templateZ s ro c @ s� e Zd ZdZed�Zed�Zed�Zed�Z ed�Z ed�Z ed�Z ed�Z ed�Zed�Zed�Zed�Zed�Zed �Zed �Zed �Zed �Zed �Zed �Zed �Zed �Zed �Z ed �Z ed �Z ed�Z ed�Z ed�Z!ed�Z"ed�Z#ed�Z$ed�Z%ed�Z&e'd�Z(ed�Z)ed�Z*ed�Z+e'd�Z,ed�Z-ed�Z.ed�Z/e'd�Z0ed�Z1ed�Z2ed�Z3e4e5�Z6e4e5�Z7dd� Z8dd� Z9d S ) �TERulesDifferencezV Determine the difference in type enforcement rules between two policies. Zallow� diff_allowsZ auditallow�diff_auditallowsZ neverallow�diff_neverallowsZ dontaudit�diff_dontauditsZ allowxperm�diff_allowxpermsZauditallowxperm�diff_auditallowxpermsZneverallowxperm�diff_neverallowxpermsZdontauditxperm�diff_dontauditxpermsZtype_transition�diff_type_transitionsZ type_change�diff_type_changesZ type_member�diff_type_membersc C s� | j jdj| �� x$| jj� D ]}| j|j j|� q W x.| jj� D ] \}}| j jdjt |�|�� qDW | j jdj| �� x$| j j� D ]}| j |j j|� q�W x.| j j� D ] \}}| j jdjt |�|�� q�W | j jd� dS )z$Create rule lists for both policies.z+Building TE rule lists from {0.left_policy}zLoaded {0} {1} rules.z,Building TE rule lists from {0.right_policy}z!Completed building TE rule lists.N) rN r] rP Z left_policyZterulesrQ rI rG rA r^ Z right_policyrR )rX r rI Zrulesr r r rS � s z'TERulesDifference._create_te_rule_listsc C s� | j jd� d| _d| _d| _d| _d| _d| _d| _d| _ d| _ d| _ d| _ d| _ d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _ d| _ d| _ d| _ d| _ d| _!d| _"| j#j$� | j%j$� dS )z%Reset diff results on policy changes.z Resetting TE rule differencesN)&rN r] � added_allows�removed_allows�modified_allows�added_auditallows�removed_auditallows�modified_auditallows�added_neverallows�removed_neverallows�modified_neverallows�added_dontaudits�removed_dontaudits�modified_dontaudits�added_allowxperms�removed_allowxperms�modified_allowxperms�added_auditallowxperms�removed_auditallowxperms�modified_auditallowxperms�added_neverallowxperms�removed_neverallowxperms�modified_neverallowxperms�added_dontauditxperms�removed_dontauditxperms�modified_dontauditxperms�added_type_transitions�removed_type_transitions�modified_type_transitions�added_type_changes�removed_type_changes�modified_type_changes�added_type_members�removed_type_members�modified_type_membersrQ rV rR )rX r r r � _reset_diff� sH z TERulesDifference._reset_diffN):r r r �__doc__r[ rq r r| r} r~ rr r r� r� rs r� r� r� rt r� r� r� rk ru r� r� r� rv r� r� r� rw r� r� r� rx r� r� r� ro ry r� r� r� rz r� r� r� r{ r� r� r� r �listrQ rR rS r� r r r r rp � sb rp c @ s4 e Zd ZdZdZdd� Zd d � Zd d � Zd d� ZdS )rf zEWrap extended permission access vector rules to allow set operations.r/ r1 r, � xperm_typer! c C sH || _ t|j�| _t|j�| _t|j�| _|j| _|j| _t|�| _ d S )N) rb r r/ r1 r r, r� r! �hash�key)rX r r r r �__init__ s zAVRuleXpermWrapper.__init__c C s | j S )N)r� )rX r r r �__hash__ s zAVRuleXpermWrapper.__hash__c C s | j |j k S )N)r� )rX �otherr r r �__lt__ s zAVRuleXpermWrapper.__lt__c C s0 | j |j ko.| j|jko.| j|jko.| j|jkS )N)r/ r1 r, r� )rX r� r r r �__eq__ s zAVRuleXpermWrapper.__eq__N)r/ r1 r, r� r! ) r r r r� � __slots__r� r� r� r� r r r r rf s rf c @ s4 e Zd ZdZdZdd � Zd d � Zd d � Zdd� ZdS )rl z*Wrap type_* rules to allow set operations.r/ r1 r, r) r* �filenamec C s� || _ t|j�| _t|j�| _t|j�| _t|�| _yt|j �| _ |j | _ W n t k rl d | _ d | _ Y nX y |j | _ W n t tfk r� d | _ Y nX d S )N)rb r r/ r1 r r, r� r� r r) r* r r� r r )rX r r r r r� ) s zTERuleWrapper.__init__c C s | j S )N)r� )rX r r r r� < s zTERuleWrapper.__hash__c C s | j |j k S )N)r� )rX r� r r r r� ? s zTERuleWrapper.__lt__c C sH | j |j koF| j|jkoF| j|jkoF| j|jkoF| j|jkoF| j|jkS )N)r/ r1 r, r) r* r� )rX r� r r r r� B s zTERuleWrapper.__eq__N)r/ r1 r, r) r* r� ) r r r r� r� r� r� r� r� r r r r rl # s rl )-rU � collectionsr r �sysr �enumr Z exceptionr r r Z policyrepr r r) r Z descriptorsr � differencer r r6 r r Zobjclassr r& r' rH rn r r. r2 rT r@ rF rM r[ r` rk ro rp rf rl r r r r �<module> s@ Z&$0 1(