آگآآگآآگآآگآآگآآگآآگآآگآآگآآگآآگآآگآآگآآگآآگآآگآآگآآگآ 3 ي«„^‹"م@stddlmZddlmZddlmZddlmZmZm Z ddl mZddlm Z Gd d „d eƒZGdd„de ƒZd S)é)ع namedtupleé)عConstraintRuletypeé)عDiffResultDescriptor)ع Differenceع SymbolWrapperعWrapper)عclass_wrapper_factory)عtype_wrapper_factoryc@s eZdZdZedƒZedƒZedƒZedƒZedƒZ edƒZ edƒZedƒZdZ dZdZdZdZdZdZdZdd„Zd d „Zdd„Zd d„Zdd„Zdd„ZdS)عConstraintsDifferencea‚ Determine the difference in constraints between two policies. Since the compiler does not union constraints, there may be multiple constraints with the same ruletype, object class, and permission set, so constraints can only be added or removed, not modified. The constraint expressions are compared only on a basic level. Expressions that are logically equivalent but are structurally different, for example, by associativity, will be considered different. Type and role attributes are also not expanded, so if there are changes to attribute members, it will not be reflected as a difference. عdiff_constrainsعdiff_mlsconstrainsعdiff_validatetransعdiff_mlsvalidatetransNcCs`|jjdj|ƒƒ|jdks&|jdkr.|jƒ|jdd„|jDƒdd„|jDƒƒ\|_|_}dS)zAGenerate the difference in constraint rules between the policies.zJGenerating constraint differences from {0.left_policy} to {0.right_policy}Ncss|]}t|ƒVqdS)N)عConstraintWrapper)ع.0عc©rْ#/usr/lib64/python3.6/constraints.pyْ Qsz8ConstraintsDifference.diff_constrains..css|]}t|ƒVqdS)N)r)rrrrrrRs) عlogعinfoعformatع_left_constrainsع_right_constrainsع_create_constrain_listsع _set_diffعadded_constrainsعremoved_constrains)عselfع_rrrr Gs z%ConstraintsDifference.diff_constrainscCs`|jjdj|ƒƒ|jdks&|jdkr.|jƒ|jdd„|jDƒdd„|jDƒƒ\|_|_}dS)zEGenerate the difference in MLS constraint rules between the policies.zNGenerating MLS constraint differences from {0.left_policy} to {0.right_policy}Ncss|]}t|ƒVqdS)N)r)rrrrrr_sz;ConstraintsDifference.diff_mlsconstrains..css|]}t|ƒVqdS)N)r)rrrrrr`s) rrrع_left_mlsconstrainsع_right_mlsconstrainsrrعadded_mlsconstrainsعremoved_mlsconstrains)r r!rrrrTsz(ConstraintsDifference.diff_mlsconstrainscCs`|jjdj|ƒƒ|jdks&|jdkr.|jƒ|jdd„|jDƒdd„|jDƒƒ\|_|_}dS)zDGenerate the difference in validatetrans rules between the policies.zMGenerating validatetrans differences from {0.left_policy} to {0.right_policy}Ncss|]}t|ƒVqdS)N)r)rrrrrrmsz;ConstraintsDifference.diff_validatetrans..css|]}t|ƒVqdS)N)r)rrrrrrns) rrrع_left_validatetransع_right_validatetransrrعadded_validatetransعremoved_validatetrans)r r!rrrrbsz(ConstraintsDifference.diff_validatetranscCs`|jjdj|ƒƒ|jdks&|jdkr.|jƒ|jdd„|jDƒdd„|jDƒƒ\|_|_}dS)zHGenerate the difference in MLS validatetrans rules between the policies.zPGenerating mlsvalidatetrans differences from {0.left_policy} to {0.right_policy}Ncss|]}t|ƒVqdS)N)r)rrrrrr{sz>ConstraintsDifference.diff_mlsvalidatetrans..css|]}t|ƒVqdS)N)r)rrrrrr|s) rrrع_left_mlsvalidatetransع_right_mlsvalidatetransrrعadded_mlsvalidatetransعremoved_mlsvalidatetrans)r r!rrrrpsz+ConstraintsDifference.diff_mlsvalidatetranscCsZg|_g|_g|_g|_xژ|jjƒD]€}|jtjkrB|jj |ƒq$|jtj kr\|jj |ƒq$|jtjkrv|jj |ƒq$|jtjkrگ|jj |ƒq$|j jdj|jƒƒq$Wg|_g|_g|_g|_x”|jjƒD]†}|jtjkrê|jj |ƒqج|jtj kگr|jj |ƒqج|jtjkگr"|jj |ƒqج|jtjkگr>|jj |ƒqج|j jdj|jƒƒqجWdS)z$Create rule lists for both policies.z/Unknown rule type: {0} (This is an SETools bug)N)rr"r&r*Zleft_policyZconstraintsعruletyperZ constrainعappendZmlsconstrainZ validatetransZmlsvalidatetransrعerrorrrr#r'r+Zright_policy)r عrulerrrrپs< z-ConstraintsDifference._create_constrain_listscCsp|jjdƒd|_d|_d|_d|_d|_d|_d|_d|_ d|_ d|_d|_d|_ d|_d|_d|_d|_dS)z%Reset diff results on policy changes.z%Resetting all constraints differencesN)rعdebugrrr$r%r(r)r,r-rr"r&r*rr#r'r+)r rrrع_reset_diff¥s"z!ConstraintsDifference._reset_diff)ع__name__ع __module__ع__qualname__ع__doc__rrrr$r%r(r)r,r-rrr"r#r&r'r*r+r rrrrr3rrrrrs. $rc@s4eZdZdZdZdd„Zdd „Zd d„Zdd „ZdS)rz#Wrap constraints for diff purposes.r.عtclassعpermsعexprc Csک||_|j|_t|jƒ|_y|j|_Wntk r@d|_YnXt|ƒ|_g|_x@|j D]6}t |tƒr„|jjtdd„|DƒƒƒqZ|jj|ƒqZWdS)Ncss|]}t|ƒVqdS)N)r)rعitemrrrrسsz-ConstraintWrapper.__init__..) عoriginr.r r8r9عAttributeErrorعhashعkeyr:Z expressionع isinstanceع frozensetr/)r r1عoprrrع__init__آs zConstraintWrapper.__init__cCs|jS)N)r?)r rrrع__hash__طszConstraintWrapper.__hash__cCs|j|jkS)N)r?)r عotherrrrع__lt__غszConstraintWrapper.__lt__cCs0|j|jko.|j|jko.|j|jko.|j|jkS)N)r.r8r9r:)r rErrrع__eq__قszConstraintWrapper.__eq__N)r.r8r9r:) r4r5r6r7ع __slots__rCrDrFrGrrrrr¼srN)عcollectionsrZ policyreprZdescriptorsrع differencerrr Zobjclassr عtypesrrrrrrrعs