3
^" @ st d dl mZ ddlmZ ddlmZ ddlmZmZm Z ddl
m Z ddl m
Z
G d d
d
eZG d d d e Zd
S ) )
namedtuple )ConstraintRuletype )DiffResultDescriptor)
Difference
SymbolWrapperWrapper)class_wrapper_factory)type_wrapper_factoryc @ s e Zd ZdZedZedZedZedZedZ edZ
edZ edZ dZ
dZdZdZdZdZdZdZdd Zd d
Zd d Zd
d Zdd Zdd ZdS )ConstraintsDifferencea
Determine the difference in constraints between two policies.
Since the compiler does not union constraints, there may be multiple
constraints with the same ruletype, object class, and permission
set, so constraints can only be added or removed, not modified.
The constraint expressions are compared only on a basic level.
Expressions that are logically equivalent but are structurally
different, for example, by associativity, will be considered
different. Type and role attributes are also not expanded,
so if there are changes to attribute members, it will not
be reflected as a difference.
diff_constrainsdiff_mlsconstrainsdiff_validatetransdiff_mlsvalidatetransNc C s` | j jdj| | jdks&| jdkr.| j | jdd | jD dd | jD \| _| _}dS )zAGenerate the difference in constraint rules between the policies.zJGenerating constraint differences from {0.left_policy} to {0.right_policy}Nc s s | ]}t |V qd S )N)ConstraintWrapper).0c r #/usr/lib64/python3.6/constraints.py Q s z8ConstraintsDifference.diff_constrains..c s s | ]}t |V qd S )N)r )r r r r r r R s ) loginfoformat_left_constrains_right_constrains_create_constrain_lists _set_diffadded_constrainsremoved_constrains)self_r r r r
G s
z%ConstraintsDifference.diff_constrainsc C s` | j jdj| | jdks&| jdkr.| j | jdd | jD dd | jD \| _| _}dS )zEGenerate the difference in MLS constraint rules between the policies.zNGenerating MLS constraint differences from {0.left_policy} to {0.right_policy}Nc s s | ]}t |V qd S )N)r )r r r r r r _ s z;ConstraintsDifference.diff_mlsconstrains..c s s | ]}t |V qd S )N)r )r r r r r r ` s ) r r r _left_mlsconstrains_right_mlsconstrainsr r added_mlsconstrainsremoved_mlsconstrains)r r! r r r r T s z(ConstraintsDifference.diff_mlsconstrainsc C s` | j jdj| | jdks&| jdkr.| j | jdd | jD dd | jD \| _| _}dS )zDGenerate the difference in validatetrans rules between the policies.zMGenerating validatetrans differences from {0.left_policy} to {0.right_policy}Nc s s | ]}t |V qd S )N)r )r r r r r r m s z;ConstraintsDifference.diff_validatetrans..c s s | ]}t |V qd S )N)r )r r r r r r n s ) r r r _left_validatetrans_right_validatetransr r added_validatetransremoved_validatetrans)r r! r r r r b s z(ConstraintsDifference.diff_validatetransc C s` | j jdj| | jdks&| jdkr.| j | jdd | jD dd | jD \| _| _}dS )zHGenerate the difference in MLS validatetrans rules between the policies.zPGenerating mlsvalidatetrans differences from {0.left_policy} to {0.right_policy}Nc s s | ]}t |V qd S )N)r )r r r r r r { s z>ConstraintsDifference.diff_mlsvalidatetrans..c s s | ]}t |V qd S )N)r )r r r r r r | s ) r r r _left_mlsvalidatetrans_right_mlsvalidatetransr r added_mlsvalidatetransremoved_mlsvalidatetrans)r r! r r r r p s z+ConstraintsDifference.diff_mlsvalidatetransc C sZ g | _ g | _g | _g | _x| jj D ]}|jtjkrB| j j | q$|jtj
kr\| jj | q$|jtj krv| jj | q$|jtj kr| jj | q$| j
jdj|j q$W g | _g | _g | _g | _x| jj D ]}|jtjkr| jj | q|jtj
kr| jj | q|jtj kr"| jj | q|jtj kr>| jj | q| j
jdj|j qW dS )z$Create rule lists for both policies.z/Unknown rule type: {0} (This is an SETools bug)N)r r" r& r* Z left_policyZ constraintsruletyper Z constrainappendZ mlsconstrainZ
validatetransZmlsvalidatetransr errorr r r# r' r+ Z right_policy)r ruler r r r s<
z-ConstraintsDifference._create_constrain_listsc C sp | j jd d| _d| _d| _d| _d| _d| _d| _d| _ d| _
d| _ d| _ d| _
d| _d| _d| _d| _dS )z%Reset diff results on policy changes.z%Resetting all constraints differencesN)r debugr r r$ r% r( r) r, r- r r" r& r* r r# r' r+ )r r r r _reset_diff s" z!ConstraintsDifference._reset_diff)__name__
__module__ __qualname____doc__r r r r$ r% r( r) r, r- r r r" r# r& r' r* r+ r
r r r r r3 r r r r r s.
$r c @ s4 e Zd ZdZdZdd Zdd Zd
d Zd d
ZdS )r z#Wrap constraints for diff purposes.r. tclasspermsexprc
C s || _ |j| _t|j| _y |j| _W n tk
r@ d | _Y nX t|| _g | _x@|j D ]6}t
|t r| jj t dd |D qZ| jj | qZW d S )Nc s s | ]}t |V qd S )N)r )r itemr r r r s z-ConstraintWrapper.__init__..)
originr. r
r8 r9 AttributeErrorhashkeyr: Z
expression
isinstance frozensetr/ )r r1 opr r r __init__ s
zConstraintWrapper.__init__c C s | j S )N)r? )r r r r __hash__ s zConstraintWrapper.__hash__c C s | j |j k S )N)r? )r otherr r r __lt__ s zConstraintWrapper.__lt__c C s0 | j |j ko.| j|jko.| j|jko.| j|jkS )N)r. r8 r9 r: )r rE r r r __eq__ s zConstraintWrapper.__eq__N)r. r8 r9 r: ) r4 r5 r6 r7 __slots__rC rD rF rG r r r r r s r N) collectionsr Z policyrepr Z descriptorsr
differencer r r Zobjclassr
typesr r r r r r r s