3
KlfQ@ @ s d Z ddlZddlZddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G d d
d
Z
d d Z d
d Z dd Z
dd Zdd ZG dd dZG dd dZG dd dZG dd d ZdS ) z7
Classes for representing and manipulating interfaces.
N )access) refpolicy) objectmodel)matching)_c @ sH e Zd ZdZdd Zdd Zdd ZeeeZedd d
Z d d Z
d
S )Paramz;
Object representing a paramater for an interface.
c C s" d| _ tj| _tj | _d| _d S )N T) _Param__namer SRC_TYPEtypeIdSet obj_classesZrequired)self r /usr/lib/python3.6/interfaces.py__init__& s
zParam.__init__c C s t j|std| || _d S )NzName [%s] is not a param)r
is_idparam
ValueErrorr
)r namer r r set_name, s
zParam.set_namec C s | j S )N)r
)r r r r get_name1 s zParam.get_namec C s t | jdd S )Nr )intr )r r r r 6 s zParam.)fgetc C s d| j tj| j dj| jf S )Nz0 )r r field_to_strr joinr )r r r r __repr__8 s zParam.__repr__N) __name__
__module__ __qualname____doc__r r r propertyr numr r r r r r " s
r c C s d}| |kr|| }||j kr"d S |tjks6|tjkr|j tjksN|j tjkrd}|r`|jg}ng }x&tj|j|D ]}|tj krtd}P qtW tj|_ qd}n t
}| |_ ||_ |||j < |r|jj |j |S )Nr r )
r r r TGT_TYPE obj_class itertoolschainr r Zimplicitly_typed_objectsr r add)r r avparamsretpZavobjsobjr r r __param_insert> s0
r/ c C s~ d}d}t j| jr.t| jtj| |dkr.d}t j| jrTt| jtj| |dkrTd}t j| jrzt| jtj | |dkrzd}|S )aj Extract the paramaters from an access vector.
Extract the paramaters (in the form $N) from an access
vector, storing them as Param objects in a dictionary.
Some attempt is made at resolving conflicts with other
entries in the dict, but if an unresolvable conflict is
found it is reported to the caller.
The goal here is to figure out how interface parameters are
actually used in the interface - e.g., that $1 is a domain used as
a SRC_TYPE. In general an interface will look like this:
interface(`foo', `
allow $1 foo : file read;
')
This is simple to figure out - $1 is a SRC_TYPE. A few interfaces
are more complex, for example:
interface(`foo_trans',`
domain_auto_trans($1,fingerd_exec_t,fingerd_t)
allow $1 fingerd_t:fd use;
allow fingerd_t $1:fd use;
allow fingerd_t $1:fifo_file rw_file_perms;
allow fingerd_t $1:process sigchld;
')
Here the usage seems ambigious, but it is not. $1 is still domain
and therefore should be returned as a SRC_TYPE.
Returns:
0 - success
1 - conflict found
r Fr )
r r src_typer/ r r tgt_typer% r& OBJ_CLASS)r* r+ r, Z found_srcr r r av_extract_paramsj s $ r3 c C s" t j| jr t| jtjd |S d S )N)r r roler/ r ZROLE)r4 r+ r r r role_extract_params s r5 c sl fdd}d}|| j tjr"d}|| jtjr4d}|| jtjrFd}tj| j rht
| j tj d rhd}|S )Nc s2 d}x(| D ] }t j|r
t||d r
d}q
W |S )Nr r )r r r/ )setr r, x)r+ r r extract_from_set s
z2type_rule_extract_params..extract_from_setr r ) src_typesr r tgt_typesr% r r2 r r Z dest_typer/ Z DEST_TYPE)ruler+ r8 r, r )r+ r type_rule_extract_params s r< c C s6 d}x,| j D ]"}tj|r t|tjd |r d}q W |S )Nr r )argsr r r/ r r )ifcallr+ r, argr r r ifcall_extract_params s
r@ c @ s e Zd Zdd Zdd ZdS )AttributeVectorc C s d| _ tj | _d S )Nr )r r AccessVectorSet)r r r r r s zAttributeVector.__init__c C s | j j| d S )N)r add_av)r r* r r r rC s zAttributeVector.add_avN)r r r! r rC r r r r rA s rA c @ s$ e Zd Zdd Zdd Zdd ZdS ) AttributeSetc C s
i | _ d S )N)
attributes)r r r r r s zAttributeSet.__init__c C s || j |j< d S )N)rE r )r attrr r r add_attr s zAttributeSet.add_attrc C s~ dd }d }x^|D ]V}|d d }|d dkrF|r<| j | ||}q|r|jd}tj|}|j| qW |rz| j | d S )Nc S sH | dd j }t|dks(|d dkr4td| t }|d |_|S )Nr r Z Attributez#Syntax error Attribute statement %s)splitlen SyntaxErrorrA r )linefieldsar r r
parse_attr s
z*AttributeSet.from_file..parse_attrr r [,rI )rG rJ r AccessVectorrC )r fdrP rO rM lr* r r r from_file s
zAttributeSet.from_fileN)r r r! r rG rV r r r r rD s rD c @ sF e Zd Zdi fddZi fddZdd Zdd Zd
d Zd d
ZdS )InterfaceVectorNc C s6 d| _ d| _tj | _i | _|r,| j|| d| _d S )NTr F)enabledr r rB r+ from_interfaceexpanded)r interfacerE r r r r s
zInterfaceVector.__init__c
C sF |j | _ xN|j D ]B}|jtjjkr&qd|j kr2qtj|}x|D ]}| j| qBW qW |rx|j D ]v}xp|j
D ]f}||j
krqr|j
| }xJ|jD ]@} t j | }|j |j kr|j
|_ |j|j kr|j
|_| j| qW qrW qfW x |j D ]}
t|
| jrqW x |j D ]} t| | jrqW x |j D ]} t| | jr*q*W d S )NZ dontaudit)r ZavrulesZ rule_typer ZAVRuleZALLOWr Zavrule_to_access_vectorsrC ZtypeattributesrE copyr0 r r1 Zrolesr5 r+ Z typerulesr< interface_callsr@ )
r r[ rE ZavruleZavsr* Z
typeattributerF Zattr_vecrO r4 r; r> r r r rY s>
z InterfaceVector.from_interfacec C s t || jdkr| jj| d S )Nr )r3 r+ r rC )r r* r r r rC 3 s zInterfaceVector.add_avc C s< g }|j d| j x | jD ]}|j t| q W dj|S )Nz[InterfaceVector %s]
)appendr r strr )r sr* r r r to_string9 s
zInterfaceVector.to_stringc C s | j S )N)r )r r r r __str__@ s zInterfaceVector.__str__c C s d| j | jf S )Nz)r rX )r r r r r C s zInterfaceVector.__repr__) r r r! r rY rC rb rc r r r r r rW s 4rW c @ sx e Zd ZdddZdd Zdd Zdd Zd
d Zd d
Zi fddZ di fddZ
dd Z dd Z dd Z
dd ZdS ) InterfaceSetNc C s i | _ i | _g | _|| _d S )N)
interfaces tgt_type_map tgt_type_alloutput)r rh r r r r H s zInterfaceSet.__init__c C s | j r| j j|d d S )Nr^ )rh write)r r` r r r oN s zInterfaceSet.oc C s xt | jj dd dD ]}|jd|j x:t |jj dd dD ] }|jd|jtj|j f qDW |jd t |j j
}x&|D ] }|jdj | |jd qW qW d S )
Nc S s | j S )N)r )r7 r r r r S s z&InterfaceSet.to_file..)keyz[InterfaceVector %s c S s | j S )N)r )r7 r r r r U s z%s:%s z]
rR r^ ) sortedre valuesri r r+ r r r r Zto_listr )r rT ZivparamZavlr* r r r to_fileR s
zInterfaceSet.to_filec C s dd }d }x^|D ]V}|d d }|d dkrF|r<| j | ||}q|r|jd}tj|}|j| qW |rz| j | | j d S )Nc S s | dd j }t|dk s(|d dkr4td| t }|d |_t|dkrTd S xb|dd D ]R}|j d}t|dkrtd| t }|d |_tj|d |_||j |j< qbW |S ) Nr rH r rW z)Syntax error InterfaceVector statement %s:z-Invalid param in InterfaceVector statement %srI )
rJ rK rL rW r r r Z str_to_fieldr r+ )rM rN ifvZfieldr- rn r r r parse_ifv^ s
z)InterfaceSet.from_file..parse_ifvr r rQ rR rI )add_ifvrJ r rS rC index)r rT rr rq rM rU r* r r r rV ] s
zInterfaceSet.from_filec C s || j |j< d S )N)re r )r rq r r r rs s zInterfaceSet.add_ifvc C s xz| j j D ]l}t }x:|jD ]0}tj|jrB| jj| t }P |j|j q W x$|D ] }| j j
|g }|j| qXW q W d S )N) re rm r6 r r r1 rg r_ r) rf
setdefault)r rq r: r* r rU r r r rt s
zInterfaceSet.indexc C s t ||}| j| d S )N)rW rs )r r[ rE rq r r r r) s
zInterfaceSet.addc C s@ x(t j|j |j D ]}| j|| qW | j| | j d S )N)r' r( re templatesr) expand_ifcallsrt )r headersrh rE ir r r add_headers s
zInterfaceSet.add_headersc C sZ t j|rPt|dd }|t|jkr,d S |j|d }t|trH|S |gS n|gS d S )Nr )r r r rK r=
isinstancelist)r idr> r$ r? r r r map_param s
zInterfaceSet.map_paramc
C s | j |j|}|d krd S | j |j|}|d kr4d S | j |j|}|d krNd S tj }x0|jD ]&}| j ||} | d krzq^q^|j| q^W t|dkrd S x:|D ]2}
x,|D ]$} x |D ]} |j j
|
| | | qW qW qW d S )Nr ) r~ r0 r1 r& r r
ZpermsupdaterK r r) )
r rq r* r> r9 r: r Z new_permsZpermr- r0 r1 r& r r r
map_add_av s*
zInterfaceSet.map_add_avc C s |d fg}| j |j }d|_xt|dkr|jd\}}| j |j }||krrx |jD ]}| j||| qTW |jrrq xv|j D ]j} | j|jkr| j t
d d S y|| j }
W n* t k
r | j t
d| j w|Y nX |j |
| f q|W q W d S )NTr r z Found circular interface classz#Missing interface definition for %srI )
re r rZ rK popr r r] Zifnamerj r KeyErrorr_ ) r r[
if_by_namestackrq ZcurZ
cur_ifcallZcur_ifvr* r> Znewifr r r do_expand_ifcalls s*
z InterfaceSet.do_expand_ifcallsc C sZ i }x&t j|j |j D ]}|||j< qW x(t j|j |j D ]}| j|| qBW d S )N)r' r( re rv r r )r rx r ry r[ r r r rw s
zInterfaceSet.expand_ifcalls)N)r r r! r rj ro rV rs rt r) rz r~ r r rw r r r r rd G s
# $rd )r" r\ r' r r r r r Z sepolgeni18nr r r/ r3 r5 r< r@ rA rD rW rd r r r r s" ,4 Z