
­­­­­­­­­­­­­­­­­­
<!DOCTYPE html>
<html>
3
^l$                 @   s   d dl Z d dlZddlmZmZ ddlmZmZ ddlm	Z	m
Z
 ddlmZmZ ddlmZmZmZ G dd	 d	ejejejZdS )
    N   )mixinsquery)CriteriaDescriptorCriteriaSetDescriptor)RuleUseErrorRuleNotConditional)IoctlSet
TERuletype)match_regexmatch_indirect_regexmatch_regex_or_setc                   s   e Zd ZdZeedZeddZdZ	dZ
eddZdZdZeddZdZed	d
ZdZdZdZdZedd Zejdd Z fddZdd Z  ZS )TERuleQueryae
  
    Query the Type Enforcement rules.

    Parameter:
    policy            The policy to query.

    Keyword Parameters/Class attributes:
    ruletype          The list of rule type(s) to match.
    source            The name of the source type/attribute to match.
    source_indirect   If true, members of an attribute will be
                      matched rather than the attribute itself.
                      Default is true.
    source_regex      If true, regular expression matching will
                      be used on the source type/attribute.
                      Obeys the source_indirect option.
                      Default is false.
    target            The name of the target type/attribute to match.
    target_indirect   If true, members of an attribute will be
                      matched rather than the attribute itself.
                      Default is true.
    target_regex      If true, regular expression matching will
                      be used on the target type/attribute.
                      Obeys target_indirect option.
                      Default is false.
    tclass            The object class(es) to match.
    tclass_regex      If true, use a regular expression for
                      matching the rule's object class.
                      Default is false.
    perms             The set of permission(s) to match.
    perms_equal       If true, the permission set of the rule
                      must exactly match the permissions
                      criteria.  If false, any set intersection
                      will match.
                      Default is false.
    perms_regex       If true, regular expression matching will be used
                      on the permission names instead of set logic.
                      Default is false.
    perms_subset      If true, the rule matches if the permissions criteria
                      is a subset of the rule's permission set.
                      Default is false.
    default           The name of the default type to match.
    default_regex     If true, regular expression matching will be
                      used on the default type.
                      Default is false.
    boolean           The set of boolean(s) to match.
    boolean_regex     If true, regular expression matching will be
                      used on the booleans.
                      Default is false.
    boolean_equal     If true, the booleans in the conditional
                      expression of the rule must exactly match the
                      criteria.  If false, any set intersection
                      will match.  Default is false.
    )
enum_classsource_regexZlookup_type_or_attrFTtarget_regexdefault_regexboolean_regexZlookup_booleanNc             C   s   | j S )N)_xperms)self r   #/usr/lib64/python3.6/terulequery.pyxpermsd   s    zTERuleQuery.xpermsc             C   s   |rt  }x|D ]\}}d|  ko*dkn  s>tdj|d|  koPdkn  sdtdj|||k rv|| }}|jdd t||d D  qW t|| _nd | _d S )Nr   i  z{0:#07x} is not a valid ioctl.c             s   s   | ]
}|V  qd S )Nr   ).0ir   r   r   	<genexpr>w   s    z%TERuleQuery.xperms.<locals>.<genexpr>r   )set
ValueErrorformatupdateranger	   r   )r   valueZpending_xpermsZlowZhighr   r   r   r   h   s    
"c                s$   t t| j|f| tjt| _d S )N)superr   __init__loggingZ	getLogger__name__log)r   policykwargs)	__class__r   r   r#   }   s    zTERuleQuery.__init__c          $   c   sB  | j jdj|  | j jdj|  | j jdj|  | j jdj|  | j| j  | j| j  | j jdj|  | j jdj|  | j jdj|  x| jj D ]}| jr|j| jkrq| j	rt
|j	| j	| j| j rq| jrt
|j| j| j| j rq| j|sqyN| jrJ|jrJ| jr8t| jdkr8w|j| jkrXwn| j|sXwW n tk
rr   wY nX y&| jrt|j| j| jd	 rwW n tk
r   wY nX | jryt
|j| jd
| jswW n tk
r   wY nX | jr4y t|jj| j| j | j!swW n t"k
r2   wY nX |V  qW dS )z-Generator which yields all matching TE rules.z*Generating TE rule results from {0.policy}zRuletypes: {0.ruletype}zLSource: {0.source!r}, indirect: {0.source_indirect}, regex: {0.source_regex}zLTarget: {0.target!r}, indirect: {0.target_indirect}, regex: {0.target_regex}z*Xperms: {0.xperms!r}, eq: {0.xperms_equal}z0Default: {0.default!r}, regex: {0.default_regex}zGBoolean: {0.boolean!r}, eq: {0.boolean_equal}, regex: {0.boolean_regex}r   FTN)#r&   infor   debugZ_match_object_class_debugZ_match_perms_debugr'   Zterulesruletypesourcer   source_indirectr   targettarget_indirectr   Z_match_object_classZpermsZextendedZperms_equallenZ
xperm_typeZ_match_permsr   r   r   xperms_equaldefaultr   booleanZconditionalZbooleansboolean_equalr   r   )r   Zruler   r   r   results   s    








zTERuleQuery.results)r%   
__module____qualname____doc__r   r
   r,   r   r-   r   r.   r/   r   r0   r3   r   r4   r   r5   r   r2   propertyr   setterr#   r6   __classcell__r   r   )r)   r   r      s&   6




r   )r$   re r   r   Zdescriptorsr   r   Z	exceptionr   r   Z	policyrepr	   r
   utilr   r   r   ZMatchObjClassZMatchPermissionZPolicyQueryr   r   r   r   r   <module>   s   