3
�^�^ � @ sp d dl Z d dlmZmZ d dlmZ d dlmZ ddlm Z m
Z
m Z ddl m
Z
mZ dd lmZ dd
lmZ dd lmZmZ dd lmZmZ dd
lmZ ed�Zed�Z edddddg�Z eddddg�Z G dd� de�Z eddd g�Z ed d d g�Z!ed d d g�Z"d!d"� Z#d#d$� Z$d%d&� Z%d'd(� Z&d)d*� Z'd+d,� Z(d-d.� Z)G d/d0� d0e�Z*G d1d2� d2e�Z+G d3d4� d4e�Z,dS )5� N)� defaultdict�
namedtuple)�intern)�Enum� )�RuleNotConditional� RuleUseError�TERuleNoFilename)�IoctlSet�
TERuletype� )�conditional_wrapper_factory)�DiffResultDescriptor)�
Difference�Wrapper)�type_wrapper_factory� type_or_attr_wrapper_factory)�class_wrapper_factoryz<<unconditional>>�TrueZmodified_avrule�rule� added_perms�
removed_perms�
matched_permsZmodified_teruleZ
added_defaultZremoved_defaultc @ s e Zd ZdZdZdS )�Sider r N)�__name__�
__module__� __qualname__�left�right� r r � /usr/lib64/python3.6/terules.pyr - s r Zrule_db_side_data�perms� orig_ruleZ
rule_db_sidesr r ZType_dbc C s |t jkr|j}n|j}�x�| D �]�}t}t}y tt|j��}tt|j��}W n t k
rb Y nX ||kr�t
� ||< t
� || |< n||| kr�t
� || |< |j j }dd� |j
D �} t| |�}
|| | } �x.|jj� D �] } | j }
|
|kr�| ||
< |
| k�r t
� | |
< x�|jj� D ]�}|j }||k�r4|||< || |
k�rPt
� | |
|< d}d}|| |
| k�r�| |
| | }|j}|j}|t jk�r�|�s�|
}n|j
| B }|j}t||�}n&|�s�|
}n|j
| B }|j}t||�}t||�| |
| |< �qW q�W q W dS )aP
Using rule_list, build up rule_db which is a data structure which consists
of nested dicts that store BOTH the left and the right policies. All of the
keys are interned strings. The permissions are stored as a set. The basic
structure is rule_db[cond_exp][block_bool][src][tgt][tclass] = sides
where:
cond_exp is a boolean expression
block_bool is either true or false
src is the source type
tgt is the target type
tclass is the target class
sides is a named tuple with attributes "left" and "right" referring to the
left or right policy. Each attribute in the sides named tuple refers to a
named tuple with attributes "perms" and "orig_rule" which refer to a
permission set and the original unexpanded rule.
sides = ((left_perms, left_orig_rule),(right_perms, right_orig_rule))
There are a few advantages to this structure. First, it takes up way less
memory. Second, it allows redundant rules to be easily eliminated. And,
third, it makes it easy to create the added, removed, and modified rules.
c S s h | ]}|�qS r r )�.0�pr r r � <setcomp>c s z+_avrule_expand_generator.<locals>.<setcomp>N)r r r �TERULES_UNCONDITIONAL�TERULES_UNCONDITIONAL_BLOCKr �str� conditional�conditional_blockr �dict�tclass�namer! �rule_db_side_data_record�source�expand�targetr" �rule_db_sides_record)� rule_list�rule_db�type_dbZside�types�unexpanded_rule�cond_exp�
block_boolr, r! � side_data�block�srcZsrc_str�tgtZtgt_str� left_side�
right_sideZsidesr$ Zorigr r r �_avrule_expand_generator9 sd
r@ c C sx | t t }�xd| j� D �]V\}}|t kr,q�x@|j� D �]2\}}�x&|j� D �]\}}||krbqN�x|j� D ]�\}} ||| kr�qnx�| j� D ]�\}
} |
|| | kr�q�|| | |
} | j}
| j}| jo�|
�r|
j| jj@ }|�r|
j| }|�rt||
j�}
nd }
t|
|�| |
< | jr�|r�|j| jj@ }|r�|j| }|�rNt||j�}nd }t|
|�| |
< q�W qnW qNW q8W qW d S )N) r& r' �itemsr r r! r. r" r2 )r4 Z uncond_blockr8 � cond_blocksr9 r; r< �src_datar= �tgt_datar, r: Zuncond_side_datar> r? �cr$ r r r �_av_remove_redundant_rules� sB
rF c C s| g }g }g }�xb|j � D �]T\}}�xH|j � D �]:\}} �x.| j � D �] \}
} �x| j � D �]\} }
x�|
j � D ]�\}}|jr�|jr�|jj|jj@ }|jj| }|jj| }|s�|r�|jj}|j|j|
|j| |jj�}|jt||||�� qn|j�r(|jj}|j|j|
|j| |jj�}|j|� qn|jrn|jj}|j|j|
|j| |jj�}|j|� qnW qZW qDW q.W qW |||fS )N)rA r r r! r" Zderive_expanded�append�modified_avrule_record)�ruletyper4 r5 �added�removed�modifiedr8 rB r9 r; r< rC r= rD r, r: Z common_permsZ
left_permsZ right_permsZ
original_ruler r r r �_av_generate_diffs� sB
rM c s t j� �� � fdd�}|S )z�
This is a template for the access vector diff functions.
Parameters:
ruletype The rule type, e.g. "allow".
c s | j jdj� | �� | j s$| j r,| j� tt� t� �}t� }t� |t< t� |t t < t
jd� t | j� ||t j
� t
jd� t | j� ||t j� t
jd� t|� t
jd� t� ||�\}}}|j
j� |jj� |j� t| dj� �|� t| dj� �|� t| dj� �|� d S )
z6Generate the difference in rules between the policies.zCGenerating {0} differences from {1.left_policy} to {1.right_policy}zExpanding left policyzExpanding right policyzRemoving redundant rulesz0Generating added, removed, and modified av rulesz
added_{0}sz removed_{0}sz
modified_{0}sN)�log�info�format�_left_te_rules�_right_te_rules�_create_te_rule_lists�type_db_recordr+ r& r' �loggingr@ r r r rF rM �clear�setattr)�selfr5 r4 rJ rK rL )rI r r �diff� s.
z av_diff_template.<locals>.diff)r �lookup)rI rY r )rI r �av_diff_template� s
#r[ c
C s� t � }x\| D ]T}xN|j� D ]B}||�}y|| j|jO _W q tk
rZ |||< Y qX qW q W |r�tjt�jdj|t |��� |j
� S )z`
Generator that yields wrapped, expanded, av(x) rules with
unioned permission sets.
z/Expanded {0.ruletype} rules for {0.policy}: {1}) r+ r0 r! �KeyErrorrU Z getLoggerr �debugrP �len�keys)r3 Z WrapperClassrA r7 Z
expanded_ruleZexpanded_wrapped_ruler r r �_avxrule_expand_generator
s
r` c s t j� �� � fdd�}|S )z�
This is a template for the extended permission access vector diff functions.
Parameters:
ruletype The rule type, e.g. "allowxperm".
c
s | j jdj� | �� | j s$| j r,| j� | jt| j� t�t| j� t�dd�\}}}g }x^|D ]V\}}| j|j |j dd�\}}} |s�|rd|j
t |j t
|�t
|�t
dd� | D ���� qdW t| dj� �tdd� |D ��� t| dj� �td d� |D ��� t| d
j� �|� d S ) z6Generate the difference in rules between the policies.zCGenerating {0} differences from {1.left_policy} to {1.right_policy}F)Zunwrapc s s | ]}|d V qdS )r Nr )r# r$ r r r � <genexpr>Q s z2avx_diff_template.<locals>.diff.<locals>.<genexpr>z
added_{0}sc s s | ] }|j V qd S )N)�origin)r# �ar r r ra S s z removed_{0}sc s s | ] }|j V qd S )N)rb )r# �rr r r ra T s z
modified_{0}sN)rN rO rP rQ rR rS � _set_diffr` �AVRuleXpermWrapperr! rG rH rb r
rW �set)
rX rJ rK �matchedrL � left_rule�
right_ruler r r )rI r r rY 3 s,
z avx_diff_template.<locals>.diff)r rZ )rI rY r )rI r �avx_diff_template) s
$rk c s t j� �� � fdd�}|S )z�
This is a template for the type_* diff functions.
Parameters:
ruletype The rule type, e.g. "type_transition".
c s� | j jdj� | �� | j s$| j r,| j� | j| j| j� t�| j| j� t��\}}}g }x:|D ]2\}}t |j
�t |j
�krd|j t ||j
|j
�� qdW t
| dj� �|� t
| dj� �|� t
| dj� �|� dS )z6Generate the difference in rules between the policies.zCGenerating {0} differences from {1.left_policy} to {1.right_policy}z
added_{0}sz removed_{0}sz
modified_{0}sN)rN rO rP rQ rR rS re Z_expand_generator�
TERuleWrapperr �defaultrG �modified_terule_recordrW )rX rJ rK rh rL ri rj )rI r r rY d s"
z te_diff_template.<locals>.diff)r rZ )rI rY r )rI r �te_diff_templateZ s
ro c @ s� e Zd ZdZed�Zed�Zed�Zed�Z ed�Z
ed�Z ed�Z ed�Z
ed�Zed�Zed�Zed�Zed�Zed �Zed �Zed �Zed
�Zed �Zed �Zed �Zed �Zed
�Z ed
�Z ed
�Z ed�Z ed�Z ed�Z!ed�Z"ed�Z#ed�Z$ed�Z%ed�Z&e'd�Z(ed�Z)ed�Z*ed�Z+e'd�Z,ed�Z-ed�Z.ed�Z/e'd�Z0ed�Z1ed�Z2ed�Z3e4e5�Z6e4e5�Z7dd� Z8dd� Z9d S ) �TERulesDifferencezV
Determine the difference in type enforcement rules
between two policies.
Zallow� diff_allowsZ
auditallow�diff_auditallowsZ
neverallow�diff_neverallowsZ dontaudit�diff_dontauditsZ
allowxperm�diff_allowxpermsZauditallowxperm�diff_auditallowxpermsZneverallowxperm�diff_neverallowxpermsZdontauditxperm�diff_dontauditxpermsZtype_transition�diff_type_transitionsZ type_change�diff_type_changesZ type_member�diff_type_membersc C s� | j jdj| �� x$| jj� D ]}| j|j j|� q W x.| jj� D ] \}}| j jdjt |�|�� qDW | j jdj| �� x$| j
j� D ]}| j |j j|� q�W x.| j j� D ] \}}| j jdjt |�|�� q�W | j jd� dS )z$Create rule lists for both policies.z+Building TE rule lists from {0.left_policy}zLoaded {0} {1} rules.z,Building TE rule lists from {0.right_policy}z!Completed building TE rule lists.N) rN r] rP Z left_policyZterulesrQ rI rG rA r^ Z right_policyrR )rX r rI Zrulesr r r rS � s z'TERulesDifference._create_te_rule_listsc C s� | j jd� d| _d| _d| _d| _d| _d| _d| _d| _ d| _
d| _ d| _ d| _
d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _d| _ d| _ d| _ d| _ d| _ d| _!d| _"| j#j$� | j%j$� dS )z%Reset diff results on policy changes.z Resetting TE rule differencesN)&rN r] � added_allows�removed_allows�modified_allows�added_auditallows�removed_auditallows�modified_auditallows�added_neverallows�removed_neverallows�modified_neverallows�added_dontaudits�removed_dontaudits�modified_dontaudits�added_allowxperms�removed_allowxperms�modified_allowxperms�added_auditallowxperms�removed_auditallowxperms�modified_auditallowxperms�added_neverallowxperms�removed_neverallowxperms�modified_neverallowxperms�added_dontauditxperms�removed_dontauditxperms�modified_dontauditxperms�added_type_transitions�removed_type_transitions�modified_type_transitions�added_type_changes�removed_type_changes�modified_type_changes�added_type_members�removed_type_members�modified_type_membersrQ rV rR )rX r r r � _reset_diff� sH
z TERulesDifference._reset_diffN):r r r �__doc__r[ rq r r| r} r~ rr r r� r� rs r� r� r� rt r� r� r� rk ru r� r� r� rv r� r� r� rw r� r� r� rx r� r� r� ro ry r� r� r� rz r� r� r� r{ r� r� r� r �listrQ rR rS r� r r r r rp � sb rp c @ s4 e Zd ZdZdZdd� Zd d
� Zd d � Zd
d� ZdS )rf zEWrap extended permission access vector rules to allow set operations.r/ r1 r, �
xperm_typer! c C sH || _ t|j�| _t|j�| _t|j�| _|j| _|j| _t|�| _ d S )N)
rb r r/ r1 r r, r� r! �hash�key)rX r r r r �__init__ s zAVRuleXpermWrapper.__init__c C s | j S )N)r� )rX r r r �__hash__ s zAVRuleXpermWrapper.__hash__c C s | j |j k S )N)r� )rX �otherr r r �__lt__ s zAVRuleXpermWrapper.__lt__c C s0 | j |j ko.| j|jko.| j|jko.| j|jkS )N)r/ r1 r, r� )rX r� r r r �__eq__ s zAVRuleXpermWrapper.__eq__N)r/ r1 r, r� r! ) r r r r� � __slots__r� r� r� r� r r r r rf s rf c @ s4 e Zd ZdZdZdd � Zd
d � Zd d
� Zdd� ZdS )rl z*Wrap type_* rules to allow set operations.r/ r1 r, r) r* �filenamec C s� || _ t|j�| _t|j�| _t|j�| _t|�| _yt|j �| _ |j
| _
W n t k
rl d | _ d | _
Y nX y |j | _ W n t
tfk
r� d | _ Y nX d S )N)rb r r/ r1 r r, r� r� r
r) r* r r� r r )rX r r r r r� ) s
zTERuleWrapper.__init__c C s | j S )N)r� )rX r r r r� < s zTERuleWrapper.__hash__c C s | j |j k S )N)r� )rX r� r r r r� ? s zTERuleWrapper.__lt__c C sH | j |j koF| j|jkoF| j|jkoF| j|jkoF| j|jkoF| j|jkS )N)r/ r1 r, r) r* r� )rX r� r r r r� B s zTERuleWrapper.__eq__N)r/ r1 r, r) r* r� ) r r r r� r� r� r� r� r� r r r r rl # s rl )-rU � collectionsr r �sysr �enumr Z exceptionr r r Z policyrepr
r r) r
Z descriptorsr �
differencer r r6 r r Zobjclassr r& r' rH rn r r. r2 rT r@ rF rM r[ r` rk ro rp rf rl r r r r �<module> s@ Z&$0 1(