­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ 3 ^j@@sddlZddlZddlZddlmZddlmZddlmZddl Z ddl m Z ddl m Z ddl mZdd l mZd d d d dgZdZdZGdddZddZddZddZGdddZdS)N) OrderedDict)ENOENT)suppress) exception) policyrep)PermissionMapDescriptor) TERuletyperwbnu c@seZdZdZd%ddZddZddZd d Zd d Zd dZ ddZ ddZ ddZ ddZ ddZddZddZddZdd Zd!d"Zd#d$ZdS)& PermissionMapz-Permission Map for information flow analysis.NcCsNtjt|_t|_d|_|r*|j|n tj d}dj |j }|j|dS)z\ Parameter: permmapfile The path to the permission map to load. NZsetoolsz{0}/setools/perm_map) loggingZ getLogger__name__logrpermmap permmapfileload pkg_resourcesZget_distributionformatlocation)selfrZdistropathr/usr/lib64/python3.6/permmap.py__init__*s    zPermissionMap.__init__cCs|jS)N)r)rrrr__str__;szPermissionMap.__str__cCs8tjt}|j|_tj|j|_|j|_||t|<|S)N)r__new__rcopydeepcopyrrid)rmemoZnewobjrrr __deepcopy__>s   zPermissionMap.__deepcopy__ccs0x*|jD]}x|j|D] }|VqWq WdS)N)classesperms)rclsmappingrrr__iter__FszPermissionMap.__iter__cCsb|jjdj|t|d}d}d}d}d}|jjxt|ddD]\}}|j} t| dksJ| dddkrzqJ|dkryt | d}Wn<t k r} z t j dj||| d| WYdd} ~ XnX|dkrt j d j||| dd }qJ|d krt| d ks| dd kr0t j d j||| t | d} yt | d } Wn>t k r} z t j dj||| d | WYdd} ~ XnX| dkrt j dj||| d |d7}||krt j dj||| t|j| <d} d }qJ|d krJt | d}t | d}|tkr,t j dj||| dyt | d }Wn>t k rz} z t j dj||| d | WYdd} ~ XnXt|kotknst j dj||| d tt|jjdj| ||||dkr|jjdj| |t|j| |dd}||_||_|d7}| d7} | | krJd }qJWWdQRX||_|jjdj||jjdj||dS)z\ Parameter: permmapfile The path to the permission map to load. zOpening permission map "{0}"r rr)start#z&{0}:{1}:Invalid number of classes: {2}Nz/{0}:{1}:Number of classes must be positive: {2}classz&{0}:{1}:Invalid class declaration: {2}z*{0}:{1}:Invalid number of permissions: {2}z3{0}:{1}:Number of permissions must be positive: {2}z{0}:{1}:Extra class found: {2}z/{0}:{1}:Invalid information flow direction: {2}z&{0}:{1}:Invalid permission weight: {2}z.{0}:{1}:Permission weight must be {3}-{4}: {2}zRead {0}:{1} {2} {3}rzPermission {0}:{1} is unmapped.T)createz(Successfully opened permission map "{0}"z+Read {0} classes and {1} total permissions.)rinforopenrclear enumeratesplitlenint ValueErrorrZPermissionMapParseErrorstrrinfoflow_directions min_weight max_weightdebugMapping directionweightr)rrmapfileZ total_permsZ class_countZ num_classesstateZline_numlineentryex class_nameZ num_permsZ perm_count perm_nameZflow_directionr@r)rrrrKs $   $       $       zPermissionMap.loadc Cs(t|d}|jjdj||jdjt|jx|jjD]\}}|jdj|t|x|jD]\}}|d}|d}t|kot knst dj||||t kst dj||||d kr|jj d j|||jd j|||qjW|jd qBW|jjd j|WdQRXdS)z Save the permission map to the specified path. Existing files will be overwritten. Parameter: permmapfile The path to write the permission map. r zWriting permission map to "{0}"z{0} zclass {0} {1} r?r@z={0}:{1} weight is out of range ({2}). This is an SETools bug.z@{0}:{1} flow direction ({2}) is invalid. This is an SETools bug.rz1Warning: permission {0} in class {1} is unmapped.z{0:>20} {1:>9} {2:>9}  z*Successfully wrote permission map to "{0}"N) r2rr1rwriter6ritemsr;r<AssertionErrorr:Zwarning) rrrA classnamer'ZpermnameZsettingsr?r@rrrsaves(     zPermissionMap.saveccs|jjEdHdS)zw Generate class names in the permission map. Yield: class An object class name. N)rkeys)rrrrr&szPermissionMap.classesccsfy,x&|j|jD]}t|j||VqWWn4tk r`}ztjdj||WYdd}~XnXdS)z Generate permission mappings for the specified class. Parameter: class_ An object class name. Yield: Mapping A permission's complete map (weight, direction, enabled) z{0} is not mapped.N)rrNr>KeyErrorr UnmappedClassr)rclass_permrErrrr's zPermissionMap.permscCst|j||S)z)Retrieve a specific permission's mapping.)r>r)rrQrRrrrr)szPermissionMap.mappingcCsx|j|D] }d|_q WdS)a Exclude all permissions in an object class for calculating rule weights. Parameter: class_ The object class to exclude. Exceptions: UnmappedClass The specified object class is not mapped. FN)r'enabled)rrQrRrrr exclude_classs zPermissionMap.exclude_classcCsdt|j||_dS)a Exclude a permission for calculating rule weights. Parameter: class_ The object class of the permission. permission The permission name to exclude. Exceptions: UnmappedClass The specified object class is not mapped. UnmappedPermission The specified permission is not mapped for the object class. FN)r>rrS)rrQ permissionrrrexclude_permission s z PermissionMap.exclude_permissioncCsx|j|D] }d|_q WdS)a Include all permissions in an object class for calculating rule weights. Parameter: class_ The object class to include. Exceptions: UnmappedClass The specified object class is not mapped. TN)r'rS)rrQrRrrr include_classs zPermissionMap.include_classcCsdt|j||_dS)a Include a permission for calculating rule weights. Parameter: class_ The object class of the permission. permission The permission name to include. Exceptions: UnmappedClass The specified object class is not mapped. UnmappedPermission The specified permission is not mapped for the object class. TN)r>rrS)rrQrUrrrinclude_permission's z PermissionMap.include_permissioncCsx|jD]}t|}||jkr@|jjdj||t|j|<|j}tt j ||j jO}WdQRXxB|D]:}||j|krn|jjdj|||t |j||ddqnWq WdS)zHCreate mappings for all classes and permissions in the specified policy.z"Adding unmapped class {0} from {1}Nz.Adding unmapped permission {0} in {1} from {2}T)r0) r&r9rrr=rrr'rrZNoCommoncommonr>)rZpolicyrQrFr'rGrrr map_policy6s      zPermissionMap.map_policycCsd}d}t|j}|jtjkr0tjdj|jxv|jD]l}t |j ||}|j sRq8|j dkrjt ||j}q8|j dkrt ||j}q8|j dkr8t ||j}t ||j}q8W||fS)aT Get the type enforcement rule's information flow read and write weights. Parameter: rule A type enforcement rule. Return: Tuple(read_weight, write_weight) read_weight The type enforcement rule's read weight. write_weight The type enforcement rule's write weight. rz1{0} rules cannot be used for calculating a weightr r r )r9ZtclassZruletyper ZallowrZ RuleTypeErrorrr'r>rrSr?maxr@)rZruleZ write_weightZ read_weightrFrGr)rrr rule_weightJs$         zPermissionMap.rule_weightcCs|t|j||_dS)a Set the information flow direction of a permission. Parameter: class_ The object class of the permission. permission The permission name. direction The information flow direction the permission (r/w/b/n). Exceptions: UnmappedClass The specified object class is not mapped. UnmappedPermission The specified permission is not mapped for the object class. N)r>rr?)rrQrUr?rrr set_directionqs zPermissionMap.set_directioncCs|t|j||_dS)a Set the weight of a permission. Parameter: class_ The object class of the permission. permission The permission name. weight The weight of the permission (1-10). Exceptions: UnmappedClass The specified object class is not mapped. UnmappedPermission The specified permission is not mapped for the object class. N)r>rr@)rrQrUr@rrr set_weights zPermissionMap.set_weight)N)r __module__ __qualname____doc__rrr%r*rrMr&r'r)rTrVrWrXrZr\r]r^rrrrr&s$ q%  'rcCs*t|kotkns&tdj||S)Nz$Permission weights must be 1-10: {0})r;r<r8r)r@rrrvalidate_weightsrbcCs|tkrtdj||S)Nz'Invalid information flow direction: {0})r:r8r)r?rrrvalidate_directionsrccCst|S)N)bool)rSrrrvalidate_enabledsrec@s@eZdZdZedeZedeZede Z d ddZ dd Z d S) r>z1A mapping for a permission in the permission map.r@r?rSFcCs||_||_||_|rD||jkr,t|j|<dddd|j||<n:||jkr^tjdj|||j|kr~tjdj||dS)NrrT)r?r@rSz{0} is not mapped.z{0}:{1} is not mapped.)perm_maprQrRrrrPrZUnmappedPermission)rrfrLrUr0rrrrs   zMapping.__init__cCs(|j|jkr|j|jkS|j|jkSdS)N)rQrR)rotherrrr__lt__s  zMapping.__lt__N)F) rr_r`rarrbr@rcr?rerSrrhrrrrr>s     r>)sysrr! collectionsrerrnor contextlibrrrrZ descriptorsrr r:r;r<rrbrcrer>rrrrs(       o