3
Klf} @ sb d dl Z d dlZd ZdZdZdZdZdZddd d
d d gZeeeeeed
Z G dd dZ
G dd de
Z G dd de
Z dzddZ
d{ddZd}d d Zd d ZG d d! d!eZG d"d# d#e ZG d$d% d%e ZG d&d' d'ZG d(d) d)e ZG d*d+ d+e ZG d,d- d-e ZG d.d/ d/e ZG d0d1 d1e ZG d2d3 d3e ZG d4d5 d5e Z G d6d7 d7e Z G d8d9 d9e Z G d:d; d;e Z G dd? d?e Z!G d@dA dAe Z"G dBdC dCe Z#G dDdE dEe Z$G dFdG dGe Z%G dHdI dIe Z&G dJdK dKe Z'G dLdM dMe Z(G dNdO dOe Z)G dPdQ dQe Z*G dRdS dSe Z+G dTdU dUe Z,G dVdW dWe Z-G dXdY dYe Z.G dZd[ d[e Z/G d\d] d]e Z0d^d_ Z1G d`da dae Z2G dbdc dce Z3G ddde dee Z4G dfdg dge Z5G dhdi die Z6G djdk dke Z7G dldm dme Z8G dndo doe Z9G dpdq dqe Z:G drds dse Z;G dtdu duZdS )~ N sourcetargetobject
permissionrole destination)r r r r
r r c @ s e Zd ZdddZdS )
PolicyBaseNc C s d | _ d | _d S )N)parentcomment)selfr r /usr/lib/python3.6/refpolicy.py__init__5 s zPolicyBase.__init__)N)__name__
__module__ __qualname__r r r r r r
4 s r
c @ s e Zd ZdZd/ddZdd Zdd Zd d
Zd d Zd
d Z dd Z
dd Z dd Z dd Z
dd Zdd Zdd Zd d Zd d Zd!d" Zd#d$ Zd%d& Zd'd( Zd)d* Zd+d, Zd-d. ZdS )0Nodea Base class objects produced from parsing the reference policy.
The Node class is used as the base class for any non-leaf
object produced by parsing the reference policy. This object
should contain a reference to its parent (or None for a top-level
object) and 0 or more children.
The general idea here is to have a very simple tree structure. Children
are not separated out by type. Instead the tree structure represents
fairly closely the real structure of the policy statements.
The object should be iterable - by default over all children but
subclasses are free to provide additional iterators over a subset
of their childre (see Interface for example).
Nc C s t j| | g | _d S )N)r
r children)r r r r r r J s z
Node.__init__c C s
t | jS )N)iterr )r r r r __iter__N s z
Node.__iter__c C s t dd t| S )Nc S s
t | tS )N)
isinstancer )xr r r W s z Node.nodes..)filterwalktree)r r r r nodesV s z
Node.nodesc C s t dd t| S )Nc S s
t | tS )N)r Module)r r r r r Z s z Node.modules..)r r )r r r r modulesY s z Node.modulesc C s t dd t| S )Nc S s
t | tS )N)r Interface)r r r r r ] s z!Node.interfaces..)r r )r r r r
interfaces\ s zNode.interfacesc C s t dd t| S )Nc S s
t | tS )N)r Template)r r r r r ` s z Node.templates..)r r )r r r r templates_ s zNode.templatesc C s t dd t| S )Nc S s
t | tS )N)r
SupportMacros)r r r r r c s z%Node.support_macros..)r r )r r r r support_macrosb s zNode.support_macrosc C s t dd t| S )Nc S s
t | tS )N)r ModuleDeclaration)r r r r r h s z*Node.module_declarations..)r r )r r r r module_declarationsg s zNode.module_declarationsc C s t dd t| S )Nc S s
t | tS )N)r
InterfaceCall)r r r r r k s z&Node.interface_calls..)r r )r r r r interface_callsj s zNode.interface_callsc C s t dd t| S )Nc S s
t | tS )N)r AVRule)r r r r r n s z Node.avrules..)r r )r r r r avrulesm s z Node.avrulesc C s t dd t| S )Nc S s
t | tS )N)r AVExtRule)r r r r r q s z!Node.avextrules..)r r )r r r r
avextrulesp s zNode.avextrulesc C s t dd t| S )Nc S s
t | tS )N)r TypeRule)r r r r r t s z Node.typerules..)r r )r r r r typeruless s zNode.typerulesc C s t dd t| S )Nc S s
t | tS )N)r TypeBound)r r r r r w s z!Node.typebounds..)r r )r r r r
typeboundsv s zNode.typeboundsc C s t dd t| S )zAIterate over all of the TypeAttribute children of this Interface.c S s
t | tS )N)r
TypeAttribute)r r r r r { s z%Node.typeattributes..)r r )r r r r typeattributesy s zNode.typeattributesc C s t dd t| S )zAIterate over all of the RoleAttribute children of this Interface.c S s
t | tS )N)r
RoleAttribute)r r r r r s z%Node.roleattributes..)r r )r r r r roleattributes} s zNode.roleattributesc C s t dd t| S )Nc S s
t | tS )N)r Require)r r r r r s z Node.requires..)r r )r r r r requires s z
Node.requiresc C s t dd t| S )Nc S s
t | tS )N)r Role)r r r r r s z Node.roles..)r r )r r r r roles s z
Node.rolesc C s t dd t| S )Nc S s
t | tS )N)r RoleAllow)r r r r r s z"Node.role_allows..)r r )r r r r role_allows s zNode.role_allowsc C s t dd t| S )Nc S s
t | tS )N)r RoleType)r r r r r s z!Node.role_types..)r r )r r r r
role_types s zNode.role_typesc C s( | j r t| j d | j S | j S d S )N
)r str to_string)r r r r __str__ s z Node.__str__c C s d| j j| j f S )Nz<%s(%s)>) __class__r rC )r r r r __repr__ s z
Node.__repr__c C s dS )N r )r r r r rC s zNode.to_string)N)r r r __doc__r r r r" r$ r& r( r* r, r. r0 r2 r4 r6 r8 r: r< r> r@ rD rF rC r r r r r 9 s.
r c @ s. e Zd Zd
ddZdd Zdd Zdd ZdS ) LeafNc C s t j| | d S )N)r
r )r r r r r r s z
Leaf.__init__c C s( | j r t| j d | j S | j S d S )NrA )r rB rC )r r r r rD s z Leaf.__str__c C s d| j j| j f S )Nz<%s(%s)>)rE r rC )r r r r rF s z
Leaf.__repr__c C s dS )NrG r )r r r r rC s zLeaf.to_string)N)r r r r rD rF rC r r r r rI s
rI TFc
c s |r
d}nd}| dfg}xt |dkr|j|\}}|rD||fV n|V t|trg }t |jd } xD| dkr|dkst|j| |r|j|j| |d f | d8 } qhW |j| qW dS )a Iterate over a Node and its Children.
The walktree function iterates over a tree containing Nodes and
leaf objects. The iteration can perform a depth first or a breadth
first traversal of the tree (controlled by the depthfirst
paramater. The passed in node will be returned.
This function will only work correctly for trees - arbitrary graphs
will likely cause infinite looping.
r r N)lenpopr r r appendextend)
nodeZ
depthfirst showdepthtypeindexstackZcurdepthitemsir r r r s"
r c c s* x$| D ] }|dks t ||r|V qW dS )a Iterate over the direct children of a Node.
The walktree function iterates over the children of a Node.
Unlike walktree it does note return the passed in node or
the children of any Node objects (that is, it does not go
beyond the current level in the tree).
N)r )rO rQ r r r r walknode s
rW {}c C sR t | }d}|dk r tddj| }|dkr2|S |d d | d |d S dS )zConvert a set (or any sequence type) into a string representation
formatted to match SELinux space separated list conventions.
For example the list ['read', 'write'] would be converted into:
'{ read write }'
rG r z"cannot convert 0 len set to string r N)rK
ValueErrorjoin)scontlrB r r r list_to_space_str s
r` c C s" t | }|dk rtddj| S )Nr z'cannot conver 0 len set to comma stringz, )rK r[ r\ )r] r_ r r r list_to_comma_str s ra c @ s& e Zd ZdddZdd Zdd ZdS ) IdSetNc C s& |rt j| | n
t j| d| _d S )NF)setr Z
compliment)r listr r r r s
zIdSet.__init__c C s t t| S )N)r` sorted)r r r r to_space_str s zIdSet.to_space_strc C s t t| S )N)ra re )r r r r to_comma_str s zIdSet.to_comma_str)N)r r r r rf rg r r r r rb s
rb c @ s4 e Zd ZdZd ddZdd Zdd Zd d d
ZdS )
SecurityContextz;An SELinux security context with optional MCS / MLS fields.Nc C s: t j| | d| _d| _d| _d| _|dk r6| j| dS )zCreate a SecurityContext object, optionally from a string.
Parameters:
[context] - string representing a security context. Same format
as a string passed to the from_string method.
rG N)rI r userr rQ level from_string)r contextr r r r r s zSecurityContext.__init__c C s t j|}|d dkr |d }|jd}t|dk r@td| |d | _|d | _|d | _t|dkrdj|dd | _ nd| _ dS )zParse a string representing a context into a SecurityContext.
The string should be in the standard format - e.g.,
'user:role:type:level'.
Raises ValueError if the string is not parsable as a security context.
r r :r z)context string [%s] not in a valid formatr N)
selinuxZ selinux_trans_to_raw_contextsplitrK r[ ri r rQ r\ rj )r rl rawfieldsr r r rk s
zSecurityContext.from_stringc C s0 | j |j ko.| j|jko.| j|jko.| j|jkS )a Compare two SecurityContext objects - all fields must be exactly the
the same for the comparison to work. It is possible for the level fields
to be semantically the same yet syntactically different - in this case
this function will return false.
)ri r rQ rj )r otherr r r __eq__4 s zSecurityContext.__eq__c C s\ | j | j| jg}| jdkrF|dkr:tj dkrD|jd qR|j| n |j| j dj|S )a Return a string representing this security context.
By default, the string will contiain a MCS / MLS level
potentially from the default which is passed in if none was
set.
Arguments:
default_level - the default level to use if self.level is an
empty string.
Returns:
A string represening the security context in the form
'user:role:type:level'.
Nr Zs0rm )ri r rQ rj rn Zis_selinux_mls_enabledrM r\ )r Z
default_levelrq r r r rC ? s
zSecurityContext.to_string)NN)N)r r r rH r rk rs rC r r r r rh s
rh c @ s e Zd ZdZdddZdS ) ObjectClassa" SELinux object class and permissions.
This class is a basic representation of an SELinux object
class - it does not represent separate common permissions -
just the union of the common and class specific permissions.
It is meant to be convenient for policy generation.
rG Nc C s t j| | || _t | _d S )N)rI r namerb perms)r ru r r r r r a s zObjectClass.__init__)rG N)r r r rH r r r r r rt Y s rt c @ s< e Zd ZdZdddZdd Zdd Zdd
d Zd d
Zd S )XpermSeta) Extended permission set.
This class represents one or more extended permissions
represented by numeric values or ranges of values. The
.complement attribute is used to specify all permission
except those specified.
Two xperm set can be merged using the .extend() method.
Fc C s || _ g | _d S )N)
complementranges)r rx r r r r p s zXpermSet.__init__c C s | j j d}x|t| j k rx|d t| j k r| j |d d | j | d d kr| j | d t| j | d | j |d d f| j |< | j |d = q P q W |d7 }qW dS )z0Ensure that ranges are not overlapping.
r r N)ry sortrK max)r rV r r r Z__normalize_rangest s
$ zXpermSet.__normalize_rangesc C s | j j|j | j dS )z%Add ranges from an xperm set
N)ry rN _XpermSet__normalize_ranges)r r] r r r rN s zXpermSet.extendNc C s( |dkr |}| j j||f | j dS )z7Add value of range of values to the xperm set.
N)ry rM r| )r ZminimumZmaximumr r r add s z XpermSet.addc C sz | j s
dS | jrdnd}t| j dkrX| j d d | j d d krX|t| j d d S tdd | j }d|dj|f S ) NrG z~ r r c S s$ | d | d kr t | d S d| S )Nr r z%s-%s)rB )r r r r r s z$XpermSet.to_string..z%s{ %s }rZ )ry rx rK rB mapr\ )r Zcomplvalsr r r rC s *zXpermSet.to_string)F)N) r r r rH r r| rN r} rC r r r r rw f s
rw c @ s" e Zd ZdZdddZdd ZdS )r5 z[SElinux typeattribute statement.
This class represents a typeattribute statement.
Nc C s t j| | d| _t | _d S )NrG )rI r rQ rb
attributes)r r r r r r s zTypeAttribute.__init__c C s d| j | jj f S )Nztypeattribute %s %s;)rQ r rg )r r r r rC s zTypeAttribute.to_string)N)r r r rH r rC r r r r r5 s
r5 c @ s" e Zd ZdZdddZdd ZdS )r7 z[SElinux roleattribute statement.
This class represents a roleattribute statement.
Nc C s t j| | d| _t | _d S )NrG )rI r r rb r8 )r r r r r r s zRoleAttribute.__init__c C s d| j | jj f S )Nzroleattribute %s %s;)r r8 rg )r r r r rC s zRoleAttribute.to_string)N)r r r rH r rC r r r r r7 s
r7 c @ s e Zd ZdddZdd ZdS )r; Nc C s t j| | d| _t | _d S )NrG )rI r r rb types)r r r r r r s z
Role.__init__c C s* d}x | j D ]}|d| j|f 7 }q W |S )NrG zrole %s types %s;
)r r )r r] tr r r rC s zRole.to_string)N)r r r r rC r r r r r; s
r; c @ s e Zd ZdddZdd ZdS )TyperG Nc C s& t j| | || _t | _t | _d S )N)rI r ru rb r aliases)r ru r r r r r s z
Type.__init__c C sR d| j }t| jdkr*|d| jj }t| jdkrJ|d| jj }|d S )Nztype %sr zalias %sz, %s;)ru rK r rf r rg )r r] r r r rC s
zType.to_string)rG N)r r r r rC r r r r r s
r c @ s e Zd ZdddZdd ZdS ) TypeAliasNc C s t j| | d| _t | _d S )NrG )rI r rQ rb r )r r r r r r s zTypeAlias.__init__c C s d| j | jj f S )Nztypealias %s alias %s;)rQ r rf )r r r r rC s zTypeAlias.to_string)N)r r r r rC r r r r r s
r c @ s e Zd ZdddZdd ZdS ) AttributerG Nc C s t j| | || _d S )N)rI r ru )r ru r r r r r s zAttribute.__init__c C s
d| j S )Nz
attribute %s;)ru )r r r r rC s zAttribute.to_string)rG N)r r r r rC r r r r r s
r c @ s e Zd ZdddZdd ZdS )Attribute_RolerG Nc C s t j| | || _d S )N)rI r ru )r ru r r r r r s zAttribute_Role.__init__c C s
d| j S )Nzattribute_role %s;)ru )r r r r rC s zAttribute_Role.to_string)rG N)r r r r rC r r r r r s
r c @ sB e Zd ZdZdZdZdZdZdddZd d
Z d d Z
d
d Z dS )r- a SELinux access vector (AV) rule.
The AVRule class represents all varieties of AV rules including
allow, dontaudit, and auditallow (indicated by the flags self.ALLOW,
self.DONTAUDIT, and self.AUDITALLOW respectively).
The source and target types, object classes, and perms are all represented
by sets containing strings. Sets are used to make it simple to add
strings repeatedly while avoiding duplicates.
No checking is done to make certain that the symbols are valid or
consistent (e.g., perms that don't match the object classes). It is
even possible to put invalid types like '$1' into the rules to allow
storage of the reference policy interfaces.
r r r r Nc C sF t j| | t | _t | _t | _t | _| j| _|rB| j | d S )N)
rI r rb src_types tgt_types obj_classesrv ALLOW rule_typefrom_av)r avr r r r r
s zAVRule.__init__c C sD | j | jkrdS | j | jkr dS | j | jkr0dS | j | jkr@dS d S )NZallowZ dontauditZ
auditallowZ
neverallow)r r DONTAUDIT
AUDITALLOW
NEVERALLOW)r r r r __rule_type_str s zAVRule.__rule_type_strc C sV | j j|j |j|jkr(| jjd n| jj|j | jj|j | jj|j dS )zIAdd the access from an access vector to this allow
rule.
r N) r r} src_typetgt_typer r obj_classrv update)r r r r r r s zAVRule.from_avc C s. d| j | jj | jj | jj | jj f S )zReturn a string representation of the rule
that is a valid policy language representation (assuming
that the types, object class, etc. are valie).
z%s %s %s:%s %s;)_AVRule__rule_type_strr rf r r rv )r r r r rC * s
zAVRule.to_string)NN) r r r rH r r r r r r r rC r r r r r- s
r- c @ sB e Zd ZdZdZdZdZdZdddZd d
Z d d Z
d
d Z dS )r/ aj Extended permission access vector rule.
The AVExtRule class represents allowxperm, dontauditxperm,
auditallowxperm, and neverallowxperm rules.
The source and target types, and object classes are represented
by sets containing strings. The operation is a single string,
e.g. 'ioctl'. Extended permissions are represented by an XpermSet.
r r r r Nc C sN t j| | t | _t | _t | _| j| _t | _ || _
|rJ| j || d S )N) rI r rb r r r
ALLOWXPERMr rw xperms operationr )r r opr r r r r D s zAVExtRule.__init__c C sD | j | jkrdS | j | jkr dS | j | jkr0dS | j | jkr@dS d S )NZ
allowxpermZdontauditxpermZauditallowxpermZneverallowxperm)r r DONTAUDITXPERMAUDITALLOWXPERMNEVERALLOWXPERM)r r r r r O s zAVExtRule.__rule_type_strc C sZ | j j|j |j|jkr(| jjd n| jj|j | jj|j || _|j| | _d S )Nr ) r r} r r r r r r r )r r r r r r r Y s zAVExtRule.from_avc C s2 d| j | jj | jj | jj | j| jj f S )zReturn a string representation of the rule that is
a valid policy language representation (assuming that
the types, object class, etc. are valid).
z%s %s %s:%s %s %s;)_AVExtRule__rule_type_strr rf r r r r rC )r r r r rC c s zAVExtRule.to_string)NNN) r r r rH r r r r r r r rC r r r r r/ 5 s
r/ c @ s6 e Zd ZdZdZdZdZd ddZdd Zd
d Z dS )
r1 zSELinux type rules.
This class is very similar to the AVRule class, but is for representing
the type rules (type_trans, type_change, and type_member). The major
difference is the lack of perms and only and sing destination type.
r r r Nc C s6 t j| | t | _t | _t | _d| _| j| _d S )NrG ) rI r rb r r r dest_typeTYPE_TRANSITIONr )r r r r r r z s zTypeRule.__init__c C s( | j | jkrdS | j | jkr dS dS d S )NZtype_transitionZ type_changeZ type_member)r r TYPE_CHANGE)r r r r r s
zTypeRule.__rule_type_strc C s* d| j | jj | jj | jj | jf S )Nz%s %s %s:%s %s;)_TypeRule__rule_type_strr rf r r r )r r r r rC s
zTypeRule.to_string)N)
r r r rH r r Z TYPE_MEMBERr r rC r r r r r1 o s
r1 c @ s" e Zd ZdZdddZdd ZdS )r3 zSSElinux typebound statement.
This class represents a typebound statement.
Nc C s t j| | d| _t | _d S )NrG )rI r rQ rb r )r r r r r r s zTypeBound.__init__c C s d| j | jj f S )Nztypebounds %s %s;)rQ r rg )r r r r rC s zTypeBound.to_string)N)r r r rH r rC r r r r r3 s
r3 c @ s e Zd ZdddZdd ZdS )r= Nc C s t j| | t | _t | _d S )N)rI r rb src_roles tgt_roles)r r r r r r s zRoleAllow.__init__c C s d| j j | jj f S )Nz allow %s %s;)r rg r )r r r r rC s
zRoleAllow.to_string)N)r r r r rC r r r r r= s
r= c @ s e Zd ZdddZdd ZdS )r? Nc C s t j| | d| _t | _d S )NrG )rI r r rb r )r r r r r r s zRoleType.__init__c C s* d}x | j D ]}|d| j|f 7 }q W |S )NrG zrole %s types %s;
)r r )r r] r r r r rC s zRoleType.to_string)N)r r r r rC r r r r r? s
r? c @ s e Zd ZdddZdd ZdS )r) Nc C s" t j| | d| _d| _d| _d S )NrG F)rI r ru version refpolicy)r r r r r r s zModuleDeclaration.__init__c C s* | j rd| j| jf S d| j| jf S d S )Nzpolicy_module(%s, %s)z
module %s %s;)r ru r )r r r r rC s zModuleDeclaration.to_string)N)r r r r rC r r r r r) s
r) c @ s e Zd ZdddZdd ZdS ) ConditionalNc C s t j| | g | _d S )N)r r cond_expr)r r r r r r s zConditional.__init__c C s dt | jdd S )Nz[If %s]rG )r^ )rG rG )r` r )r r r r rC s zConditional.to_string)N)r r r r rC r r r r r s
r c @ s e Zd ZdddZdd ZdS )BoolNc C s t j| | d| _d| _d S )NrG F)rI r ru state)r r r r r r s z
Bool.__init__c C s$ d| j }|jr|d S |d S d S )Nzbool %s trueZfalse)ru r )r r] r r r rC s
zBool.to_string)N)r r r r rC r r r r r s
r c @ s e Zd ZdddZdd ZdS )
InitialSidNc C s t j| | d| _d | _d S )NrG )rI r ru rl )r r r r r Z__init s zInitialSid.__initc C s d| j t| jf S )Nz sid %s %s)ru rB rl )r r r r rC s zInitialSid.to_string)N)r r r Z_InitialSid__initrC r r r r r s
r c @ s e Zd ZdddZdd ZdS )GenfsConNc C s" t j| | d| _d| _d | _d S )NrG )rI r
filesystempathrl )r r r r r r s zGenfsCon.__init__c C s d| j | jt| jf S )Nzgenfscon %s %s %s)r r rB rl )r r r r rC s zGenfsCon.to_string)N)r r r r rC r r r r r s
r c @ s* e Zd ZdZdZdZd ddZdd ZdS )
FilesystemUser r r Nc C s$ t j| | | j| _d| _d | _d S )NrG )rI r XATTRrQ r rl )r r r r r r s zFilesystemUse.__init__c C sN d}| j | jkrd}n"| j | jkr(d}n| j | jkr8d}d|| jt| jf S )NrG z
fs_use_xattr z
fs_use_trans z fs_use_task z %s %s %s;)rQ r TRANSTASKr rB rl )r r] r r r rC s zFilesystemUse.to_string)N)r r r r r r r rC r r r r r s
r c @ s e Zd ZdddZdd ZdS )PortConNc C s" t j| | d| _d| _d | _d S )NrG )rI r port_type port_numberrl )r r r r r r s zPortCon.__init__c C s d| j | jt| jf S )Nzportcon %s %s %s)r r rB rl )r r r r rC s zPortCon.to_string)N)r r r r rC r r r r r s
r c @ s e Zd ZdddZdd ZdS )NodeConNc C s" t j| | d| _d| _d | _d S )NrG )rI r startendrl )r r r r r r
s zNodeCon.__init__c C s d| j | jt| jf S )Nznodecon %s %s %s)r r rB rl )r r r r rC s zNodeCon.to_string)N)r r r r rC r r r r r s
r c @ s e Zd ZdddZdd ZdS )NetifConNc C s" t j| | d| _d | _d | _d S )NrG )rI r interfaceinterface_contextpacket_context)r r r r r r s zNetifCon.__init__c C s d| j t| jt| jf S )Nznetifcon %s %s %s)r rB r r )r r r r rC s zNetifCon.to_string)N)r r r r rC r r r r r s
r c @ s e Zd ZdddZdd ZdS )PirqConNc C s t j| | d| _d | _d S )NrG )rI r pirq_numberrl )r r r r r r s zPirqCon.__init__c C s d| j t| jf S )Nz
pirqcon %s %s)r rB rl )r r r r rC # s zPirqCon.to_string)N)r r r r rC r r r r r s
r c @ s e Zd ZdddZdd ZdS )IomemConNc C s t j| | d| _d | _d S )NrG )rI r
device_memrl )r r r r r r ' s zIomemCon.__init__c C s d| j t| jf S )Nziomemcon %s %s)r rB rl )r r r r rC , s zIomemCon.to_string)N)r r r r rC r r r r r & s
r c @ s e Zd ZdddZdd ZdS ) IoportConNc C s t j| | d| _d | _d S )NrG )rI r ioportrl )r r r r r r 0 s zIoportCon.__init__c C s d| j t| jf S )Nzioportcon %s %s)r rB rl )r r r r rC 5 s zIoportCon.to_string)N)r r r r rC r r r r r / s
r c @ s e Zd ZdddZdd ZdS ) PciDeviceConNc C s t j| | d| _d | _d S )NrG )rI r devicerl )r r r r r r 9 s zPciDeviceCon.__init__c C s d| j t| jf S )Nzpcidevicecon %s %s)r rB rl )r r r r rC > s zPciDeviceCon.to_string)N)r r r r rC r r r r r 8 s
r c @ s e Zd ZdddZdd ZdS )
DeviceTreeConNc C s t j| | d| _d | _d S )NrG )rI r r rl )r r r r r r B s zDeviceTreeCon.__init__c C s d| j t| jf S )Nzdevicetreecon %s %s)r rB rl )r r r r rC G s zDeviceTreeCon.to_string)N)r r r r rC r r r r r A s
r c C sL xFt | ddD ]6\}}d}xt|D ] }|d }q$W t|t| qW d S )NT)rP rG )r rangeprintrB )headrO rT r] rV r r r
print_treeL s
r c @ s e Zd ZdddZdd ZdS )HeadersNc C s t j| | d S )N)r r )r r r r r r U s zHeaders.__init__c C s dS )Nz [Headers]r )r r r r rC X s zHeaders.to_string)N)r r r r rC r r r r r T s
r c @ s e Zd ZdddZdd ZdS )r! Nc C s t j| | d S )N)r r )r r r r r r ] s zModule.__init__c C s dS )NrG r )r r r r rC ` s zModule.to_string)N)r r r r rC r r r r r! \ s
r! c @ s" e Zd ZdZdddZdd ZdS ) r# zqA reference policy interface definition.
This class represents a reference policy interface definition.
rG Nc C s t j| | || _d S )N)r r ru )r ru r r r r r h s zInterface.__init__c C s
d| j S )Nz[Interface name: %s])ru )r r r r rC l s zInterface.to_string)rG N)r r r rH r rC r r r r r# c s
r# c @ s e Zd ZdddZdd ZdS )
TunablePolicyNc C s t j| | g | _d S )N)r r r )r r r r r r p s zTunablePolicy.__init__c C s dt | jdd S )Nz[Tunable Policy %s]rG )r^ )rG rG )r` r )r r r r rC t s zTunablePolicy.to_string)N)r r r r rC r r r r r o s
r c @ s e Zd ZdddZdd ZdS )r% rG Nc C s t j| | || _d S )N)r r ru )r ru r r r r r x s zTemplate.__init__c C s
d| j S )Nz[Template name: %s])ru )r r r r rC | s zTemplate.to_string)rG N)r r r r rC r r r r r% w s
r% c @ s e Zd ZdddZdd ZdS )IfDefrG Nc C s t j| | || _d S )N)r r ru )r ru r r r r r s zIfDef.__init__c C s
d| j S )Nz[Ifdef name: %s])ru )r r r r rC s zIfDef.to_string)rG N)r r r r rC r r r r r s
r c @ s& e Zd Zd ddZdd Zdd ZdS )
r+ rG Nc C s" t j| | || _g | _g | _d S )N)rI r ifnameargsZcomments)r r r r r r r s zInterfaceCall.__init__c C sT | j |j krdS t| jt|jkr(dS x&t| j|jD ]\}}||kr8dS q8W dS )NFT)r rK r zip)r rr abr r r matches s zInterfaceCall.matchesc C sd d| j }d}xL| jD ]B}t|tr.t|}n|}|dkrH|d| }n|| }|d7 }qW |d S )Nz%s(r z, %sr ))r r r rd r` )r r] rV r rB r r r rC s
zInterfaceCall.to_string)rG N)r r r r r rC r r r r r+ s
r+ c @ s e Zd ZdddZdd ZdS )OptionalPolicyNc C s t j| | d S )N)r r )r r r r r r s zOptionalPolicy.__init__c C s dS )Nz[Optional Policy]r )r r r r rC s zOptionalPolicy.to_string)N)r r r r rC r r r r r s
r c @ s> e Zd ZdddZdd Zdd Zdd Zd
d Zd d
ZdS )r' Nc C s t j| | d | _d S )N)r r r~ )r r r r r r s zSupportMacros.__init__c C s dS )Nz[Support Macros]r )r r r r rC s zSupportMacros.to_stringc C sD t }|| jkr6x.| j|D ]}|j| j| q W n
|j| |S )N)rc r~ by_namer _SupportMacros__expand_permr} )r permr] pr r r Z
__expand_perm s
zSupportMacros.__expand_permc C sJ i | _ x>| D ]6}t }x |jD ]}|j| j| q W || j |j< q W d S )N)r~ rc rv r r ru )r r Z exp_permsr r r r Z __gen_map s
zSupportMacros.__gen_mapc C s | j s| j | j | S )N)r~ _SupportMacros__gen_map)r ru r r r r s zSupportMacros.by_namec C s | j s| j || j kS )N)r~ r )r ru r r r has_key s zSupportMacros.has_key)N) r r r r rC r r r r r r r r r' s
r' c @ s& e Zd ZdddZdd Zdd ZdS ) r9 Nc C s6 t j| | t | _i | _t | _t | _t | _d S )N)rI r rb r r r< datausers)r r r r r r s zRequire.__init__c C s | j j|t }|j| d S )N)r
setdefaultrb r )r r rv r r r r
add_obj_class s zRequire.add_obj_classc C s g }|j d x | jD ]}|j d| qW x,| jj D ] \}}|j d||j f q8W x | jD ]}|j d| qbW x | jD ]}|j d| qW x | jD ]}|j d| qW |j d t|dkrd S d
j |S ) Nz require {z type %s;z
class %s %s;z role %s;z bool %s;z user %s;rY r rG rA )
rM r r rU rf r< r r rK r\ )r r] rQ r rv r boolri r r r rC s
zRequire.to_string)N)r r r r r rC r r r r r9 s
r9 c @ s e Zd Zdd Zdd ZdS )
ObjPermSetc C s || _ t | _d S )N)ru rc rv )r ru r r r r s zObjPermSet.__init__c C s d| j | jj f S )Nzdefine(`%s', `%s'))ru rv rf )r r r r rC s zObjPermSet.to_stringN)r r r r rC r r r r r s r c @ s e Zd Zdd Zdd ZdS )ClassMapc C s || _ || _d S )N)r rv )r r rv r r r r s zClassMap.__init__c C s | j d | j S )Nz: )r rv )r r r r rC s zClassMap.to_stringN)r r r r rC r r r r r s r c @ s. e Zd Zd
ddZdd Zdd Zdd ZdS ) CommentNc C s |r || _ ng | _ d S )N)lines)r r_ r r r r
s zComment.__init__c C sB t | jdkrdS g }x | jD ]}|jd| q W dj|S d S )Nr rG #rA )rK r rM r\ )r outliner r r rC s zComment.to_stringc C s2 t |jr.x"|jD ]}|dkr| jj| qW d S )NrG )rK r rM )r rr r r r r merge s
z
Comment.mergec C s | j S )N)rC )r r r r rD ! s zComment.__str__)N)r r r r rC r rD r r r r r s
r )TFN)NrX rY )r )?stringrn ZSRC_TYPEZTGT_TYPEZ OBJ_CLASSZPERMSZROLEZ DEST_TYPEZ field_to_strZ str_to_fieldr
r rI r rW r` ra rc rb rh rt rw r5 r7 r; r r r r r- r/ r1 r3 r= r? r) r r r r r r r r r r r r r r r r! r# r r% r r+ r r' r9 r r r r r r r s| a
&
P
=
@:!
!&$