ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ 3 Kl„f¢}ã@sbddlZddlZdZdZdZdZdZdZddd d ddgZeeeeeed œZ Gdd„dƒZ Gdd„de ƒZGdd„de ƒZdzdd„Z d{dd„Zd}dd„Zdd„ZGd d!„d!eƒZGd"d#„d#eƒZGd$d%„d%eƒZGd&d'„d'ƒZGd(d)„d)eƒZGd*d+„d+eƒZGd,d-„d-eƒZGd.d/„d/eƒZGd0d1„d1eƒZGd2d3„d3eƒZGd4d5„d5eƒZGd6d7„d7eƒZGd8d9„d9eƒZGd:d;„d;eƒZGdd?„d?eƒZ!Gd@dA„dAeƒZ"GdBdC„dCeƒZ#GdDdE„dEeƒZ$GdFdG„dGeƒZ%GdHdI„dIeƒZ&GdJdK„dKeƒZ'GdLdM„dMeƒZ(GdNdO„dOeƒZ)GdPdQ„dQeƒZ*GdRdS„dSeƒZ+GdTdU„dUeƒZ,GdVdW„dWeƒZ-GdXdY„dYeƒZ.GdZd[„d[eƒZ/Gd\d]„d]eƒZ0d^d_„Z1Gd`da„daeƒZ2Gdbdc„dceƒZ3Gddde„deeƒZ4Gdfdg„dgeƒZ5Gdhdi„dieƒZ6Gdjdk„dkeƒZ7Gdldm„dmeƒZ8Gdndo„doeƒZ9Gdpdq„dqeƒZ:Gdrds„dseƒZ;Gdtdu„duƒZdS)~éNéééééÚsourceÚtargetÚobjectÚ permissionÚroleÚdestination)rrr r rrc@seZdZddd„ZdS)Ú PolicyBaseNcCsd|_d|_dS)N)ÚparentÚcomment)Úselfr©rú/usr/lib/python3.6/refpolicy.pyÚ__init__5szPolicyBase.__init__)N)Ú__name__Ú __module__Ú__qualname__rrrrrr 4sr c@sÂeZdZdZd/dd„Zdd„Zdd„Zd d „Zdd„Zd d„Z dd„Z dd„Zdd„Zdd„Z dd„Zdd„Zdd„Zdd„Zdd „Zd!d"„Zd#d$„Zd%d&„Zd'd(„Zd)d*„Zd+d,„Zd-d.„ZdS)0ÚNodeaÁBase class objects produced from parsing the reference policy. The Node class is used as the base class for any non-leaf object produced by parsing the reference policy. This object should contain a reference to its parent (or None for a top-level object) and 0 or more children. The general idea here is to have a very simple tree structure. Children are not separated out by type. Instead the tree structure represents fairly closely the real structure of the policy statements. The object should be iterable - by default over all children but subclasses are free to provide additional iterators over a subset of their childre (see Interface for example). NcCstj||ƒg|_dS)N)r rÚchildren)rrrrrrJsz Node.__init__cCs t|jƒS)N)Úiterr)rrrrÚ__iter__Nsz Node.__iter__cCstdd„t|ƒƒS)NcSs t|tƒS)N)Ú isinstancer)ÚxrrrÚWszNode.nodes..)ÚfilterÚwalktree)rrrrÚnodesVsz Node.nodescCstdd„t|ƒƒS)NcSs t|tƒS)N)rÚModule)rrrrrZszNode.modules..)rr)rrrrÚmodulesYszNode.modulescCstdd„t|ƒƒS)NcSs t|tƒS)N)rÚ Interface)rrrrr]sz!Node.interfaces..)rr)rrrrÚ interfaces\szNode.interfacescCstdd„t|ƒƒS)NcSs t|tƒS)N)rÚTemplate)rrrrr`sz Node.templates..)rr)rrrrÚ templates_szNode.templatescCstdd„t|ƒƒS)NcSs t|tƒS)N)rÚ SupportMacros)rrrrrcsz%Node.support_macros..)rr)rrrrÚsupport_macrosbszNode.support_macroscCstdd„t|ƒƒS)NcSs t|tƒS)N)rÚModuleDeclaration)rrrrrhsz*Node.module_declarations..)rr)rrrrÚmodule_declarationsgszNode.module_declarationscCstdd„t|ƒƒS)NcSs t|tƒS)N)rÚ InterfaceCall)rrrrrksz&Node.interface_calls..)rr)rrrrÚinterface_callsjszNode.interface_callscCstdd„t|ƒƒS)NcSs t|tƒS)N)rÚAVRule)rrrrrnszNode.avrules..)rr)rrrrÚavrulesmszNode.avrulescCstdd„t|ƒƒS)NcSs t|tƒS)N)rÚ AVExtRule)rrrrrqsz!Node.avextrules..)rr)rrrrÚ avextrulespszNode.avextrulescCstdd„t|ƒƒS)NcSs t|tƒS)N)rÚTypeRule)rrrrrtsz Node.typerules..)rr)rrrrÚ typerulessszNode.typerulescCstdd„t|ƒƒS)NcSs t|tƒS)N)rÚ TypeBound)rrrrrwsz!Node.typebounds..)rr)rrrrÚ typeboundsvszNode.typeboundscCstdd„t|ƒƒS)zAIterate over all of the TypeAttribute children of this Interface.cSs t|tƒS)N)rÚ TypeAttribute)rrrrr{sz%Node.typeattributes..)rr)rrrrÚtypeattributesyszNode.typeattributescCstdd„t|ƒƒS)zAIterate over all of the RoleAttribute children of this Interface.cSs t|tƒS)N)rÚ RoleAttribute)rrrrrsz%Node.roleattributes..)rr)rrrrÚroleattributes}szNode.roleattributescCstdd„t|ƒƒS)NcSs t|tƒS)N)rÚRequire)rrrrr‚szNode.requires..)rr)rrrrÚrequiressz Node.requirescCstdd„t|ƒƒS)NcSs t|tƒS)N)rÚRole)rrrrr…szNode.roles..)rr)rrrrÚroles„sz Node.rolescCstdd„t|ƒƒS)NcSs t|tƒS)N)rÚ RoleAllow)rrrrrˆsz"Node.role_allows..)rr)rrrrÚrole_allows‡szNode.role_allowscCstdd„t|ƒƒS)NcSs t|tƒS)N)rÚRoleType)rrrrr‹sz!Node.role_types..)rr)rrrrÚ role_typesŠszNode.role_typescCs(|jrt|jƒd|jƒS|jƒSdS)NÚ )rÚstrÚ to_string)rrrrÚ__str__szNode.__str__cCsd|jj|jƒfS)Nz<%s(%s)>)Ú __class__rrC)rrrrÚ__repr__“sz Node.__repr__cCsdS)NÚr)rrrrrC–szNode.to_string)N)rrrÚ__doc__rrr r"r$r&r(r*r,r.r0r2r4r6r8r:r<r>r@rDrFrCrrrrr9s. rc@s.eZdZd dd„Zdd„Zdd„Zdd „ZdS)ÚLeafNcCstj||ƒdS)N)r r)rrrrrr›sz Leaf.__init__cCs(|jrt|jƒd|jƒS|jƒSdS)NrA)rrBrC)rrrrrDžszLeaf.__str__cCsd|jj|jƒfS)Nz<%s(%s)>)rErrC)rrrrrF¤sz Leaf.__repr__cCsdS)NrGr)rrrrrC§szLeaf.to_string)N)rrrrrDrFrCrrrrrIšs rITFc cs¾|r d}nd}|dfg}x t|ƒdkr¸|j|ƒ\}}|rD||fVn|Vt|tƒrg}t|jƒd} xD| dkrª|dksˆt|j| |ƒr |j|j| |dfƒ| d8} qhW|j|ƒqWdS)a™Iterate over a Node and its Children. The walktree function iterates over a tree containing Nodes and leaf objects. The iteration can perform a depth first or a breadth first traversal of the tree (controlled by the depthfirst paramater. The passed in node will be returned. This function will only work correctly for trees - arbitrary graphs will likely cause infinite looping. rrNéÿÿÿÿ)ÚlenÚpoprrrÚappendÚextend) ÚnodeZ depthfirstÚ showdepthÚtypeÚindexÚstackZcurÚdepthÚitemsÚirrrr®s" rccs*x$|D]}|dkst||ƒr|VqWdS)aIterate over the direct children of a Node. The walktree function iterates over the children of a Node. Unlike walktree it does note return the passed in node or the children of any Node objects (that is, it does not go beyond the current level in the tree). N)r)rOrQrrrrÚwalknodeÔs rWú{ú}cCsRt|ƒ}d}|dkrtdƒ‚dj|ƒ}|dkr2|S|dd|d|dSdS)záConvert a set (or any sequence type) into a string representation formatted to match SELinux space separated list conventions. For example the list ['read', 'write'] would be converted into: '{ read write }' rGrz"cannot convert 0 len set to stringú rN)rKÚ ValueErrorÚjoin)ÚsÚcontÚlrBrrrÚlist_to_space_strás r`cCs"t|ƒ}|dkrtdƒ‚dj|ƒS)Nrz'cannot conver 0 len set to comma stringz, )rKr[r\)r]r_rrrÚlist_to_comma_stròsrac@s&eZdZddd„Zdd„Zdd„ZdS) ÚIdSetNcCs&|rtj||ƒn tj|ƒd|_dS)NF)ÚsetrZ compliment)rÚlistrrrrüs zIdSet.__init__cCstt|ƒƒS)N)r`Úsorted)rrrrÚto_space_strszIdSet.to_space_strcCstt|ƒƒS)N)rare)rrrrÚto_comma_strszIdSet.to_comma_str)N)rrrrrfrgrrrrrbûs rbc@s4eZdZdZddd„Zdd„Zdd„Zdd d „ZdS) ÚSecurityContextz;An SELinux security context with optional MCS / MLS fields.NcCs:tj||ƒd|_d|_d|_d|_|dk r6|j|ƒdS)zßCreate a SecurityContext object, optionally from a string. Parameters: [context] - string representing a security context. Same format as a string passed to the from_string method. rGN)rIrÚuserrrQÚlevelÚfrom_string)rÚcontextrrrrrszSecurityContext.__init__cCsŠtj|ƒ}|ddkr|d}|jdƒ}t|ƒdkr@td|ƒ‚|d|_|d|_|d|_t|ƒdkr€dj|dd…ƒ|_ nd|_ dS)zóParse a string representing a context into a SecurityContext. The string should be in the standard format - e.g., 'user:role:type:level'. Raises ValueError if the string is not parsable as a security context. rrú:rz)context string [%s] not in a valid formatrN) ÚselinuxZselinux_trans_to_raw_contextÚsplitrKr[rirrQr\rj)rrlÚrawÚfieldsrrrrks zSecurityContext.from_stringcCs0|j|jko.|j|jko.|j|jko.|j|jkS)aCompare two SecurityContext objects - all fields must be exactly the the same for the comparison to work. It is possible for the level fields to be semantically the same yet syntactically different - in this case this function will return false. )rirrQrj)rÚotherrrrÚ__eq__4szSecurityContext.__eq__cCs\|j|j|jg}|jdkrF|dkr:tjƒdkrD|jdƒqR|j|ƒn|j|jƒdj|ƒS)a½Return a string representing this security context. By default, the string will contiain a MCS / MLS level potentially from the default which is passed in if none was set. Arguments: default_level - the default level to use if self.level is an empty string. Returns: A string represening the security context in the form 'user:role:type:level'. NrZs0rm)rirrQrjrnZis_selinux_mls_enabledrMr\)rZ default_levelrqrrrrC?s zSecurityContext.to_string)NN)N)rrrrHrrkrsrCrrrrrh s rhc@seZdZdZddd„ZdS)ÚObjectClassa"SELinux object class and permissions. This class is a basic representation of an SELinux object class - it does not represent separate common permissions - just the union of the common and class specific permissions. It is meant to be convenient for policy generation. rGNcCstj||ƒ||_tƒ|_dS)N)rIrÚnamerbÚperms)rrurrrrraszObjectClass.__init__)rGN)rrrrHrrrrrrtYsrtc@s<eZdZdZddd„Zdd„Zdd„Zdd d„Zdd „Zd S)ÚXpermSeta)Extended permission set. This class represents one or more extended permissions represented by numeric values or ranges of values. The .complement attribute is used to specify all permission except those specified. Two xperm set can be merged using the .extend() method. FcCs||_g|_dS)N)Ú complementÚranges)rrxrrrrpszXpermSet.__init__cCs°|jjƒd}xœ|t|jƒkrªx€|dt|jƒkrž|j|dd|j|ddkrš|j|dt|j|d|j|ddƒf|j|<|j|d=q Pq W|d7}qWdS)z0Ensure that ranges are not overlapping. rrN)ryÚsortrKÚmax)rrVrrrZ__normalize_rangests $zXpermSet.__normalize_rangescCs|jj|jƒ|jƒdS)z%Add ranges from an xperm set N)ryrNÚ_XpermSet__normalize_ranges)rr]rrrrN„szXpermSet.extendNcCs(|dkr|}|jj||fƒ|jƒdS)z7Add value of range of values to the xperm set. N)ryrMr|)rZminimumZmaximumrrrÚaddŠszXpermSet.addcCsz|js dS|jrdnd}t|jƒdkrX|jdd|jddkrX|t|jddƒStdd„|jƒ}d|dj|ƒfS) NrGz~ rrcSs$|d|dkrt|dƒSd|S)Nrrz%s-%s)rB)rrrrrœsz$XpermSet.to_string..z%s{ %s }rZ)ryrxrKrBÚmapr\)rZcomplÚvalsrrrrC’s*zXpermSet.to_string)F)N) rrrrHrr|rNr}rCrrrrrwfs rwc@s"eZdZdZddd„Zdd„ZdS)r5z[SElinux typeattribute statement. This class represents a typeattribute statement. NcCstj||ƒd|_tƒ|_dS)NrG)rIrrQrbÚ attributes)rrrrrr¨szTypeAttribute.__init__cCsd|j|jjƒfS)Nztypeattribute %s %s;)rQr€rg)rrrrrCszTypeAttribute.to_string)N)rrrrHrrCrrrrr5£s r5c@s"eZdZdZddd„Zdd„ZdS)r7z[SElinux roleattribute statement. This class represents a roleattribute statement. NcCstj||ƒd|_tƒ|_dS)NrG)rIrrrbr8)rrrrrrµszRoleAttribute.__init__cCsd|j|jjƒfS)Nzroleattribute %s %s;)rr8rg)rrrrrCºszRoleAttribute.to_string)N)rrrrHrrCrrrrr7°s r7c@seZdZddd„Zdd„ZdS)r;NcCstj||ƒd|_tƒ|_dS)NrG)rIrrrbÚtypes)rrrrrr¿sz Role.__init__cCs*d}x |jD]}|d|j|f7}qW|S)NrGzrole %s types %s; )rr)rr]ÚtrrrrCÄszRole.to_string)N)rrrrrCrrrrr;¾s r;c@seZdZddd„Zdd„ZdS)ÚTyperGNcCs&tj||ƒ||_tƒ|_tƒ|_dS)N)rIrrurbr€Úaliases)rrurrrrrËsz Type.__init__cCsRd|j}t|jƒdkr*|d|jjƒ}t|jƒdkrJ|d|jjƒ}|dS)Nztype %srzalias %sz, %sú;)rurKr„rfr€rg)rr]rrrrCÑs zType.to_string)rGN)rrrrrCrrrrrƒÊs rƒc@seZdZddd„Zdd„ZdS)Ú TypeAliasNcCstj||ƒd|_tƒ|_dS)NrG)rIrrQrbr„)rrrrrrÚszTypeAlias.__init__cCsd|j|jjƒfS)Nztypealias %s alias %s;)rQr„rf)rrrrrCßszTypeAlias.to_string)N)rrrrrCrrrrr†Ùs r†c@seZdZddd„Zdd„ZdS)Ú AttributerGNcCstj||ƒ||_dS)N)rIrru)rrurrrrrãszAttribute.__init__cCs d|jS)Nz attribute %s;)ru)rrrrrCçszAttribute.to_string)rGN)rrrrrCrrrrr‡âs r‡c@seZdZddd„Zdd„ZdS)ÚAttribute_RolerGNcCstj||ƒ||_dS)N)rIrru)rrurrrrrëszAttribute_Role.__init__cCs d|jS)Nzattribute_role %s;)ru)rrrrrCïszAttribute_Role.to_string)rGN)rrrrrCrrrrrˆês rˆc@sBeZdZdZdZdZdZdZddd„Zd d „Z dd„Z d d„ZdS)r-a»SELinux access vector (AV) rule. The AVRule class represents all varieties of AV rules including allow, dontaudit, and auditallow (indicated by the flags self.ALLOW, self.DONTAUDIT, and self.AUDITALLOW respectively). The source and target types, object classes, and perms are all represented by sets containing strings. Sets are used to make it simple to add strings repeatedly while avoiding duplicates. No checking is done to make certain that the symbols are valid or consistent (e.g., perms that don't match the object classes). It is even possible to put invalid types like '$1' into the rules to allow storage of the reference policy interfaces. rrrrNcCsFtj||ƒtƒ|_tƒ|_tƒ|_tƒ|_|j|_|rB|j |ƒdS)N) rIrrbÚ src_typesÚ tgt_typesÚobj_classesrvÚALLOWÚ rule_typeÚfrom_av)rÚavrrrrr szAVRule.__init__cCsD|j|jkrdS|j|jkr dS|j|jkr0dS|j|jkr@dSdS)NZallowZ dontauditZ auditallowZ neverallow)rrŒÚ DONTAUDITÚ AUDITALLOWÚ NEVERALLOW)rrrrÚ__rule_type_strszAVRule.__rule_type_strcCsV|jj|jƒ|j|jkr(|jjdƒn|jj|jƒ|jj|jƒ|jj|jƒdS)zIAdd the access from an access vector to this allow rule. rN) r‰r}Úsrc_typeÚtgt_typerŠr‹Ú obj_classrvÚupdate)rrrrrrŽszAVRule.from_avcCs.d|jƒ|jjƒ|jjƒ|jjƒ|jjƒfS)z«Return a string representation of the rule that is a valid policy language representation (assuming that the types, object class, etc. are valie). z%s %s %s:%s %s;)Ú_AVRule__rule_type_strr‰rfrŠr‹rv)rrrrrC*s zAVRule.to_string)NN)rrrrHrŒrr‘r’rr˜rŽrCrrrrr-õs r-c@sBeZdZdZdZdZdZdZddd„Zd d „Z dd„Z d d„ZdS)r/ajExtended permission access vector rule. The AVExtRule class represents allowxperm, dontauditxperm, auditallowxperm, and neverallowxperm rules. The source and target types, and object classes are represented by sets containing strings. The operation is a single string, e.g. 'ioctl'. Extended permissions are represented by an XpermSet. rrrrNcCsNtj||ƒtƒ|_tƒ|_tƒ|_|j|_tƒ|_ ||_ |rJ|j||ƒdS)N)rIrrbr‰rŠr‹Ú ALLOWXPERMrrwÚxpermsÚ operationrŽ)rrÚoprrrrrDszAVExtRule.__init__cCsD|j|jkrdS|j|jkr dS|j|jkr0dS|j|jkr@dSdS)NZ allowxpermZdontauditxpermZauditallowxpermZneverallowxperm)rr™ÚDONTAUDITXPERMÚAUDITALLOWXPERMÚNEVERALLOWXPERM)rrrrr“OszAVExtRule.__rule_type_strcCsZ|jj|jƒ|j|jkr(|jjdƒn|jj|jƒ|jj|jƒ||_|j||_dS)Nr) r‰r}r”r•rŠr‹r–r›rš)rrrœrrrrŽYszAVExtRule.from_avcCs2d|jƒ|jjƒ|jjƒ|jjƒ|j|jjƒfS)z«Return a string representation of the rule that is a valid policy language representation (assuming that the types, object class, etc. are valid). z%s %s %s:%s %s %s;)Ú_AVExtRule__rule_type_strr‰rfrŠr‹r›ršrC)rrrrrCcszAVExtRule.to_string)NNN)rrrrHr™rržrŸrr rŽrCrrrrr/5s r/c@s6eZdZdZdZdZdZddd„Zdd „Zd d„Z dS) r1zöSELinux type rules. This class is very similar to the AVRule class, but is for representing the type rules (type_trans, type_change, and type_member). The major difference is the lack of perms and only and sing destination type. rrrNcCs6tj||ƒtƒ|_tƒ|_tƒ|_d|_|j|_dS)NrG) rIrrbr‰rŠr‹Ú dest_typeÚTYPE_TRANSITIONr)rrrrrrzszTypeRule.__init__cCs(|j|jkrdS|j|jkr dSdSdS)NZtype_transitionZtype_changeZtype_member)rr¢ÚTYPE_CHANGE)rrrrr“‚s zTypeRule.__rule_type_strcCs*d|jƒ|jjƒ|jjƒ|jjƒ|jfS)Nz%s %s %s:%s %s;)Ú_TypeRule__rule_type_strr‰rfrŠr‹r¡)rrrrrCŠs zTypeRule.to_string)N) rrrrHr¢r£ZTYPE_MEMBERrr¤rCrrrrr1os r1c@s"eZdZdZddd„Zdd„ZdS)r3zSSElinux typebound statement. This class represents a typebound statement. NcCstj||ƒd|_tƒ|_dS)NrG)rIrrQrbrŠ)rrrrrr•szTypeBound.__init__cCsd|j|jjƒfS)Nztypebounds %s %s;)rQrŠrg)rrrrrCšszTypeBound.to_string)N)rrrrHrrCrrrrr3s r3c@seZdZddd„Zdd„ZdS)r=NcCs tj||ƒtƒ|_tƒ|_dS)N)rIrrbÚ src_rolesÚ tgt_roles)rrrrrrŸszRoleAllow.__init__cCsd|jjƒ|jjƒfS)Nzallow %s %s;)r¥rgr¦)rrrrrC¤s zRoleAllow.to_string)N)rrrrrCrrrrr=žs r=c@seZdZddd„Zdd„ZdS)r?NcCstj||ƒd|_tƒ|_dS)NrG)rIrrrbr)rrrrrr©szRoleType.__init__cCs*d}x |jD]}|d|j|f7}qW|S)NrGzrole %s types %s; )rr)rr]r‚rrrrC®szRoleType.to_string)N)rrrrrCrrrrr?¨s r?c@seZdZddd„Zdd„ZdS)r)NcCs"tj||ƒd|_d|_d|_dS)NrGF)rIrruÚversionÚ refpolicy)rrrrrrµszModuleDeclaration.__init__cCs*|jrd|j|jfSd|j|jfSdS)Nzpolicy_module(%s, %s)z module %s %s;)r¨rur§)rrrrrC»szModuleDeclaration.to_string)N)rrrrrCrrrrr)´s r)c@seZdZddd„Zdd„ZdS)ÚConditionalNcCstj||ƒg|_dS)N)rrÚ cond_expr)rrrrrrÂszConditional.__init__cCsdt|jddS)Nz[If %s]rG)r^)rGrG)r`rª)rrrrrCÆszConditional.to_string)N)rrrrrCrrrrr©Ás r©c@seZdZddd„Zdd„ZdS)ÚBoolNcCstj||ƒd|_d|_dS)NrGF)rIrruÚstate)rrrrrrÊsz Bool.__init__cCs$d|j}|jr|dS|dSdS)Nzbool %s ÚtrueZfalse)rur¬)rr]rrrrCÏs zBool.to_string)N)rrrrrCrrrrr«És r«c@seZdZddd„Zdd„ZdS)Ú InitialSidNcCstj||ƒd|_d|_dS)NrG)rIrrurl)rrrrrZ__init×szInitialSid.__initcCsd|jt|jƒfS)Nz sid %s %s)rurBrl)rrrrrCÜszInitialSid.to_string)N)rrrZ_InitialSid__initrCrrrrr®Ös r®c@seZdZddd„Zdd„ZdS)ÚGenfsConNcCs"tj||ƒd|_d|_d|_dS)NrG)rIrÚ filesystemÚpathrl)rrrrrràszGenfsCon.__init__cCsd|j|jt|jƒfS)Nzgenfscon %s %s %s)r°r±rBrl)rrrrrCæszGenfsCon.to_string)N)rrrrrCrrrrr¯ßs r¯c@s*eZdZdZdZdZd dd„Zdd„ZdS) Ú FilesystemUserrrNcCs$tj||ƒ|j|_d|_d|_dS)NrG)rIrÚXATTRrQr°rl)rrrrrrîszFilesystemUse.__init__cCsNd}|j|jkrd}n"|j|jkr(d}n|j|jkr8d}d||jt|jƒfS)NrGz fs_use_xattr z fs_use_trans zfs_use_task z %s %s %s;)rQr³ÚTRANSÚTASKr°rBrl)rr]rrrrCôszFilesystemUse.to_string)N)rrrr³r´rµrrCrrrrr²és r²c@seZdZddd„Zdd„ZdS)ÚPortConNcCs"tj||ƒd|_d|_d|_dS)NrG)rIrÚ port_typeÚport_numberrl)rrrrrrszPortCon.__init__cCsd|j|jt|jƒfS)Nzportcon %s %s %s)r·r¸rBrl)rrrrrCszPortCon.to_string)N)rrrrrCrrrrr¶ÿs r¶c@seZdZddd„Zdd„ZdS)ÚNodeConNcCs"tj||ƒd|_d|_d|_dS)NrG)rIrÚstartÚendrl)rrrrrr szNodeCon.__init__cCsd|j|jt|jƒfS)Nznodecon %s %s %s)rºr»rBrl)rrrrrCszNodeCon.to_string)N)rrrrrCrrrrr¹ s r¹c@seZdZddd„Zdd„ZdS)ÚNetifConNcCs"tj||ƒd|_d|_d|_dS)NrG)rIrÚ interfaceÚinterface_contextÚpacket_context)rrrrrrszNetifCon.__init__cCsd|jt|jƒt|jƒfS)Nznetifcon %s %s %s)r½rBr¾r¿)rrrrrCszNetifCon.to_string)N)rrrrrCrrrrr¼s r¼c@seZdZddd„Zdd„ZdS)ÚPirqConNcCstj||ƒd|_d|_dS)NrG)rIrÚpirq_numberrl)rrrrrrszPirqCon.__init__cCsd|jt|jƒfS)Nz pirqcon %s %s)rÁrBrl)rrrrrC#szPirqCon.to_string)N)rrrrrCrrrrrÀs rÀc@seZdZddd„Zdd„ZdS)ÚIomemConNcCstj||ƒd|_d|_dS)NrG)rIrÚ device_memrl)rrrrrr'szIomemCon.__init__cCsd|jt|jƒfS)Nziomemcon %s %s)rÃrBrl)rrrrrC,szIomemCon.to_string)N)rrrrrCrrrrrÂ&s rÂc@seZdZddd„Zdd„ZdS)Ú IoportConNcCstj||ƒd|_d|_dS)NrG)rIrÚioportrl)rrrrrr0szIoportCon.__init__cCsd|jt|jƒfS)Nzioportcon %s %s)rÅrBrl)rrrrrC5szIoportCon.to_string)N)rrrrrCrrrrrÄ/s rÄc@seZdZddd„Zdd„ZdS)ÚPciDeviceConNcCstj||ƒd|_d|_dS)NrG)rIrÚdevicerl)rrrrrr9szPciDeviceCon.__init__cCsd|jt|jƒfS)Nzpcidevicecon %s %s)rÇrBrl)rrrrrC>szPciDeviceCon.to_string)N)rrrrrCrrrrrÆ8s rÆc@seZdZddd„Zdd„ZdS)Ú DeviceTreeConNcCstj||ƒd|_d|_dS)NrG)rIrr±rl)rrrrrrBszDeviceTreeCon.__init__cCsd|jt|jƒfS)Nzdevicetreecon %s %s)r±rBrl)rrrrrCGszDeviceTreeCon.to_string)N)rrrrrCrrrrrÈAs rÈcCsLxFt|ddD]6\}}d}xt|ƒD]}|d}q$Wt|t|ƒƒqWdS)NT)rPrGú )rÚrangeÚprintrB)ÚheadrOrTr]rVrrrÚ print_treeLs rÍc@seZdZddd„Zdd„ZdS)ÚHeadersNcCstj||ƒdS)N)rr)rrrrrrUszHeaders.__init__cCsdS)Nz [Headers]r)rrrrrCXszHeaders.to_string)N)rrrrrCrrrrrÎTs rÎc@seZdZddd„Zdd„ZdS)r!NcCstj||ƒdS)N)rr)rrrrrr]szModule.__init__cCsdS)NrGr)rrrrrC`szModule.to_string)N)rrrrrCrrrrr!\s r!c@s"eZdZdZddd„Zdd„ZdS) r#zqA reference policy interface definition. This class represents a reference policy interface definition. rGNcCstj||ƒ||_dS)N)rrru)rrurrrrrhszInterface.__init__cCs d|jS)Nz[Interface name: %s])ru)rrrrrClszInterface.to_string)rGN)rrrrHrrCrrrrr#cs r#c@seZdZddd„Zdd„ZdS)Ú TunablePolicyNcCstj||ƒg|_dS)N)rrrª)rrrrrrpszTunablePolicy.__init__cCsdt|jddS)Nz[Tunable Policy %s]rG)r^)rGrG)r`rª)rrrrrCtszTunablePolicy.to_string)N)rrrrrCrrrrrÏos rÏc@seZdZddd„Zdd„ZdS)r%rGNcCstj||ƒ||_dS)N)rrru)rrurrrrrxszTemplate.__init__cCs d|jS)Nz[Template name: %s])ru)rrrrrC|szTemplate.to_string)rGN)rrrrrCrrrrr%ws r%c@seZdZddd„Zdd„ZdS)ÚIfDefrGNcCstj||ƒ||_dS)N)rrru)rrurrrrr€szIfDef.__init__cCs d|jS)Nz[Ifdef name: %s])ru)rrrrrC„szIfDef.to_string)rGN)rrrrrCrrrrrÐs rÐc@s&eZdZd dd„Zdd„Zdd„ZdS) r+rGNcCs"tj||ƒ||_g|_g|_dS)N)rIrÚifnameÚargsZcomments)rrÑrrrrrˆszInterfaceCall.__init__cCsT|j|jkrdSt|jƒt|jƒkr(dSx&t|j|jƒD]\}}||kr8dSq8WdS)NFT)rÑrKrÒÚzip)rrrÚaÚbrrrÚmatchesŽszInterfaceCall.matchescCsdd|j}d}xL|jD]B}t|tƒr.t|ƒ}n|}|dkrH|d|}n||}|d7}qW|dS)Nz%s(rz, %srú))rÑrÒrrdr`)rr]rVrÔrBrrrrC˜s zInterfaceCall.to_string)rGN)rrrrrÖrCrrrrr+‡s r+c@seZdZddd„Zdd„ZdS)ÚOptionalPolicyNcCstj||ƒdS)N)rr)rrrrrr©szOptionalPolicy.__init__cCsdS)Nz[Optional Policy]r)rrrrrC¬szOptionalPolicy.to_string)N)rrrrrCrrrrrØ¨s rØc@s>eZdZddd„Zdd„Zdd„Zdd „Zd d„Zdd „ZdS)r'NcCstj||ƒd|_dS)N)rrr~)rrrrrr°szSupportMacros.__init__cCsdS)Nz[Support Macros]r)rrrrrC´szSupportMacros.to_stringcCsDtƒ}||jkr6x.|j|ƒD]}|j|j|ƒƒqWn |j|ƒ|S)N)rcr~Úby_namer—Ú_SupportMacros__expand_permr})rÚpermr]ÚprrrZ __expand_perm·s zSupportMacros.__expand_permcCsJi|_x>|D]6}tƒ}x|jD]}|j|j|ƒƒqW||j|j<qWdS)N)r~rcrvr—rÚru)rrZ exp_permsrÛrrrZ __gen_mapÃs zSupportMacros.__gen_mapcCs|js|jƒ|j|S)N)r~Ú_SupportMacros__gen_map)rrurrrrÙËszSupportMacros.by_namecCs|js|jƒ||jkS)N)r~rÝ)rrurrrÚhas_keyÐszSupportMacros.has_key)N) rrrrrCrÚrÝrÙrÞrrrrr'¯s r'c@s&eZdZddd„Zdd„Zdd„ZdS) r9NcCs6tj||ƒtƒ|_i|_tƒ|_tƒ|_tƒ|_dS)N)rIrrbrr‹r<ÚdataÚusers)rrrrrrÖszRequire.__init__cCs|jj|tƒƒ}|j|ƒdS)N)r‹Ú setdefaultrbr—)rr–rvrÜrrrÚ add_obj_classÞszRequire.add_obj_classcCsØg}|jdƒx|jD]}|jd|ƒqWx,|jjƒD]\}}|jd||jƒfƒq8Wx|jD]}|jd|ƒqbWx|jD]}|jd|ƒq€Wx|jD]}|jd|ƒqžW|jdƒt|ƒdkrÎd Sd j |ƒS)Nz require {z type %s;z class %s %s;z role %s;z bool %s;z user %s;rYrrGrA) rMrr‹rUrfr<rßràrKr\)rr]rQr–rvrÚboolrirrrrCãs zRequire.to_string)N)rrrrrârCrrrrr9Õs r9c@seZdZdd„Zdd„ZdS)Ú ObjPermSetcCs||_tƒ|_dS)N)rurcrv)rrurrrrúszObjPermSet.__init__cCsd|j|jjƒfS)Nzdefine(`%s', `%s'))rurvrf)rrrrrCþszObjPermSet.to_stringN)rrrrrCrrrrräùsräc@seZdZdd„Zdd„ZdS)ÚClassMapcCs||_||_dS)N)r–rv)rr–rvrrrrszClassMap.__init__cCs|jd|jS)Nz: )r–rv)rrrrrCszClassMap.to_stringN)rrrrrCrrrrråsråc@s.eZdZd dd„Zdd„Zdd„Zdd „ZdS)ÚCommentNcCs|r||_ng|_dS)N)Úlines)rr_rrrr szComment.__init__cCsBt|jƒdkrdSg}x|jD]}|jd|ƒqWdj|ƒSdS)NrrGú#rA)rKrçrMr\)rÚoutÚlinerrrrCszComment.to_stringcCs2t|jƒr.x"|jD]}|dkr|jj|ƒqWdS)NrG)rKrçrM)rrrrêrrrÚmerges z Comment.mergecCs|jƒS)N)rC)rrrrrD!szComment.__str__)N)rrrrrCrërDrrrrræ s ræ)TFN)N©rXrY)rì)?ÚstringrnZSRC_TYPEZTGT_TYPEZ OBJ_CLASSZPERMSZROLEZ DEST_TYPEZfield_to_strZstr_to_fieldr rrIrrWr`rarcrbrhrtrwr5r7r;rƒr†r‡rˆr-r/r1r3r=r?r)r©r«r®r¯r²r¶r¹r¼rÀrÂrÄrÆrÈrÍrÎr!r#rÏr%rÐr+rØr'r9rärårærrrrÚs|a & P = @:! !&$