3
^^ @ sp d dl Z d dlmZmZ d dlmZ d dlmZ ddlm Z m
Z
m Z ddl m
Z
mZ dd lmZ dd
lmZ dd lmZmZ dd lmZmZ dd
lmZ edZedZ edddddgZ eddddgZ G dd deZ eddd gZ ed d d gZ!ed d d gZ"d!d" Z#d#d$ Z$d%d& Z%d'd( Z&d)d* Z'd+d, Z(d-d. Z)G d/d0 d0eZ*G d1d2 d2eZ+G d3d4 d4eZ,dS )5 N) defaultdict
namedtuple)intern)Enum )RuleNotConditional RuleUseErrorTERuleNoFilename)IoctlSet
TERuletype )conditional_wrapper_factory)DiffResultDescriptor)
DifferenceWrapper)type_wrapper_factory type_or_attr_wrapper_factory)class_wrapper_factoryz<>TrueZmodified_avrulerule added_perms
removed_perms
matched_permsZmodified_teruleZ
added_defaultZremoved_defaultc @ s e Zd ZdZdZdS )Sider r N)__name__
__module__ __qualname__leftright r r /usr/lib64/python3.6/terules.pyr - s r Zrule_db_side_dataperms orig_ruleZ
rule_db_sidesr r ZType_dbc C s |t jkr|j}n|j}x| D ]}t}t}y tt|j}tt|j}W n t k
rb Y nX ||krt
||< t
|| |< n||| krt
|| |< |j j }dd |j
D } t| |}
|| | } x.|jj D ] } | j }
|
|kr| ||
< |
| kr t
| |
< x|jj D ]}|j }||kr4|||< || |
krPt
| |
|< d}d}|| |
| kr| |
| | }|j}|j}|t jkr|s|
}n|j
| B }|j}t||}n&|s|
}n|j
| B }|j}t||}t||| |
| |< qW qW q W dS )aP
Using rule_list, build up rule_db which is a data structure which consists
of nested dicts that store BOTH the left and the right policies. All of the
keys are interned strings. The permissions are stored as a set. The basic
structure is rule_db[cond_exp][block_bool][src][tgt][tclass] = sides
where:
cond_exp is a boolean expression
block_bool is either true or false
src is the source type
tgt is the target type
tclass is the target class
sides is a named tuple with attributes "left" and "right" referring to the
left or right policy. Each attribute in the sides named tuple refers to a
named tuple with attributes "perms" and "orig_rule" which refer to a
permission set and the original unexpanded rule.
sides = ((left_perms, left_orig_rule),(right_perms, right_orig_rule))
There are a few advantages to this structure. First, it takes up way less
memory. Second, it allows redundant rules to be easily eliminated. And,
third, it makes it easy to create the added, removed, and modified rules.
c S s h | ]}|qS r r ).0pr r r c s z+_avrule_expand_generator..N)r r r TERULES_UNCONDITIONALTERULES_UNCONDITIONAL_BLOCKr str conditionalconditional_blockr dicttclassnamer! rule_db_side_data_recordsourceexpandtargetr" rule_db_sides_record) rule_listrule_dbtype_dbZsidetypesunexpanded_rulecond_exp
block_boolr, r! side_datablocksrcZsrc_strtgtZtgt_str left_side
right_sideZsidesr$ Zorigr r r _avrule_expand_generator9 sd
r@ c C sx | t t }xd| j D ]V\}}|t kr,qx@|j D ]2\}}x&|j D ]\}}||krbqNx|j D ]\}} ||| krqnx| j D ]\}
} |
|| | krq|| | |
} | j}
| j}| jo|
r|
j| jj@ }|r|
j| }|rt||
j}
nd }
t|
|| |
< | jr|r|j| jj@ }|r|j| }|rNt||j}nd }t|
|| |
< qW qnW qNW q8W qW d S )N) r& r' itemsr r r! r. r" r2 )r4 Z uncond_blockr8 cond_blocksr9 r; r< src_datar= tgt_datar, r: Zuncond_side_datar> r? cr$ r r r _av_remove_redundant_rules sB
rF c C s| g }g }g }xb|j D ]T\}}xH|j D ]:\}} x.| j D ] \}
} x| j D ]\} }
x|
j D ]\}}|jr|jr|jj|jj@ }|jj| }|jj| }|s|r|jj}|j|j|
|j| |jj}|jt|||| qn|jr(|jj}|j|j|
|j| |jj}|j| qn|jrn|jj}|j|j|
|j| |jj}|j| qnW qZW qDW q.W qW |||fS )N)rA r r r! r" Zderive_expandedappendmodified_avrule_record)ruletyper4 r5 addedremovedmodifiedr8 rB r9 r; r< rC r= rD r, r: Z common_permsZ
left_permsZ right_permsZ
original_ruler r r r _av_generate_diffs sB
rM c s t j fdd}|S )z
This is a template for the access vector diff functions.
Parameters:
ruletype The rule type, e.g. "allow".
c s | j jdj | | j s$| j r,| j tt t }t }t |t< t |t t < t
jd t | j ||t j
t
jd t | j ||t j t
jd t| t
jd t ||\}}}|j
j |jj |j t| dj | t| dj | t| dj | d S )
z6Generate the difference in rules between the policies.zCGenerating {0} differences from {1.left_policy} to {1.right_policy}zExpanding left policyzExpanding right policyzRemoving redundant rulesz0Generating added, removed, and modified av rulesz
added_{0}sz removed_{0}sz
modified_{0}sN)loginfoformat_left_te_rules_right_te_rules_create_te_rule_liststype_db_recordr+ r& r' loggingr@ r r r rF rM clearsetattr)selfr5 r4 rJ rK rL )rI r r diff s.
z av_diff_template..diff)r lookup)rI rY r )rI r av_diff_template s
#r[ c
C s t }x\| D ]T}xN|j D ]B}||}y|| j|jO _W q tk
rZ |||< Y qX qW q W |rtjtjdj|t | |j
S )z`
Generator that yields wrapped, expanded, av(x) rules with
unioned permission sets.
z/Expanded {0.ruletype} rules for {0.policy}: {1}) r+ r0 r! KeyErrorrU Z getLoggerr debugrP lenkeys)r3 Z WrapperClassrA r7 Z
expanded_ruleZexpanded_wrapped_ruler r r _avxrule_expand_generator
s
r` c s t j fdd}|S )z
This is a template for the extended permission access vector diff functions.
Parameters:
ruletype The rule type, e.g. "allowxperm".
c
s | j jdj | | j s$| j r,| j | jt| j tt| j tdd\}}}g }x^|D ]V\}}| j|j |j dd\}}} |s|rd|j
t |j t
|t
|t
dd | D qdW t| dj tdd |D t| dj td d |D t| d
j | d S ) z6Generate the difference in rules between the policies.zCGenerating {0} differences from {1.left_policy} to {1.right_policy}F)Zunwrapc s s | ]}|d V qdS )r Nr )r# r$ r r r Q s z2avx_diff_template..diff..z
added_{0}sc s s | ] }|j V qd S )N)origin)r# ar r r ra S s z removed_{0}sc s s | ] }|j V qd S )N)rb )r# rr r r ra T s z
modified_{0}sN)rN rO rP rQ rR rS _set_diffr` AVRuleXpermWrapperr! rG rH rb r
rW set)
rX rJ rK matchedrL left_rule
right_ruler r r )rI r r rY 3 s,
z avx_diff_template..diff)r rZ )rI rY r )rI r avx_diff_template) s
$rk c s t j fdd}|S )z
This is a template for the type_* diff functions.
Parameters:
ruletype The rule type, e.g. "type_transition".
c s | j jdj | | j s$| j r,| j | j| j| j t| j| j t\}}}g }x:|D ]2\}}t |j
t |j
krd|j t ||j
|j
qdW t
| dj | t
| dj | t
| dj | dS )z6Generate the difference in rules between the policies.zCGenerating {0} differences from {1.left_policy} to {1.right_policy}z
added_{0}sz removed_{0}sz
modified_{0}sN)rN rO rP rQ rR rS re Z_expand_generator
TERuleWrapperr defaultrG modified_terule_recordrW )rX rJ rK rh rL ri rj )rI r r rY d s"
z te_diff_template..diff)r rZ )rI rY r )rI r te_diff_templateZ s
ro c @ s e Zd ZdZedZedZedZedZ edZ
edZ edZ edZ
edZedZedZedZedZed Zed Zed Zed
Zed Zed Zed Zed Zed
Z ed
Z ed
Z edZ edZ edZ!edZ"edZ#edZ$edZ%edZ&e'dZ(edZ)edZ*edZ+e'dZ,edZ-edZ.edZ/e'dZ0edZ1edZ2edZ3e4e5Z6e4e5Z7dd Z8dd Z9d S ) TERulesDifferencezV
Determine the difference in type enforcement rules
between two policies.
Zallow diff_allowsZ
auditallowdiff_auditallowsZ
neverallowdiff_neverallowsZ dontauditdiff_dontauditsZ
allowxpermdiff_allowxpermsZauditallowxpermdiff_auditallowxpermsZneverallowxpermdiff_neverallowxpermsZdontauditxpermdiff_dontauditxpermsZtype_transitiondiff_type_transitionsZ type_changediff_type_changesZ type_memberdiff_type_membersc C s | j jdj| x$| jj D ]}| j|j j| q W x.| jj D ] \}}| j jdjt || qDW | j jdj| x$| j
j D ]}| j |j j| qW x.| j j D ] \}}| j jdjt || qW | j jd dS )z$Create rule lists for both policies.z+Building TE rule lists from {0.left_policy}zLoaded {0} {1} rules.z,Building TE rule lists from {0.right_policy}z!Completed building TE rule lists.N) rN r] rP Z left_policyZterulesrQ rI rG rA r^ Z right_policyrR )rX r rI Zrulesr r r rS s z'TERulesDifference._create_te_rule_listsc C s | j jd d| _d| _d| _d| _d| _d| _d| _d| _ d| _
d| _ d| _ d| _
d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _ d| _ d| _ d| _ d| _ d| _!d| _"| j#j$ | j%j$ dS )z%Reset diff results on policy changes.z Resetting TE rule differencesN)&rN r] added_allowsremoved_allowsmodified_allowsadded_auditallowsremoved_auditallowsmodified_auditallowsadded_neverallowsremoved_neverallowsmodified_neverallowsadded_dontauditsremoved_dontauditsmodified_dontauditsadded_allowxpermsremoved_allowxpermsmodified_allowxpermsadded_auditallowxpermsremoved_auditallowxpermsmodified_auditallowxpermsadded_neverallowxpermsremoved_neverallowxpermsmodified_neverallowxpermsadded_dontauditxpermsremoved_dontauditxpermsmodified_dontauditxpermsadded_type_transitionsremoved_type_transitionsmodified_type_transitionsadded_type_changesremoved_type_changesmodified_type_changesadded_type_membersremoved_type_membersmodified_type_membersrQ rV rR )rX r r r _reset_diff sH
z TERulesDifference._reset_diffN):r r r __doc__r[ rq r r| r} r~ rr r r r rs r r r rt r r r rk ru r r r rv r r r rw r r r rx r r r ro ry r r r rz r r r r{ r r r r listrQ rR rS r r r r r rp sb rp c @ s4 e Zd ZdZdZdd Zd d
Zd d Zd
d ZdS )rf zEWrap extended permission access vector rules to allow set operations.r/ r1 r,
xperm_typer! c C sH || _ t|j| _t|j| _t|j| _|j| _|j| _t|| _ d S )N)
rb r r/ r1 r r, r r! hashkey)rX r r r r __init__ s zAVRuleXpermWrapper.__init__c C s | j S )N)r )rX r r r __hash__ s zAVRuleXpermWrapper.__hash__c C s | j |j k S )N)r )rX otherr r r __lt__ s zAVRuleXpermWrapper.__lt__c C s0 | j |j ko.| j|jko.| j|jko.| j|jkS )N)r/ r1 r, r )rX r r r r __eq__ s zAVRuleXpermWrapper.__eq__N)r/ r1 r, r r! ) r r r r __slots__r r r r r r r r rf s rf c @ s4 e Zd ZdZdZdd Zd
d Zd d
Zdd ZdS )rl z*Wrap type_* rules to allow set operations.r/ r1 r, r) r* filenamec C s || _ t|j| _t|j| _t|j| _t|| _yt|j | _ |j
| _
W n t k
rl d | _ d | _
Y nX y |j | _ W n t
tfk
r d | _ Y nX d S )N)rb r r/ r1 r r, r r r
r) r* r r r r )rX r r r r r ) s
zTERuleWrapper.__init__c C s | j S )N)r )rX r r r r < s zTERuleWrapper.__hash__c C s | j |j k S )N)r )rX r r r r r ? s zTERuleWrapper.__lt__c C sH | j |j koF| j|jkoF| j|jkoF| j|jkoF| j|jkoF| j|jkS )N)r/ r1 r, r) r* r )rX r r r r r B s zTERuleWrapper.__eq__N)r/ r1 r, r) r* r ) r r r r r r r r r r r r r rl # s rl )-rU collectionsr r sysr enumr Z exceptionr r r Z policyrepr
r r) r
Z descriptorsr
differencer r r6 r r Zobjclassr r& r' rH rn r r. r2 rT r@ rF rM r[ r` rk ro rp rf rl r r r r s@ Z&$0 1(