FM / sepolgen

/usr/lib64/python2.6/site-packages/sepolgen/

/usr/lib64/python2.6/site-packages/sepolgen

Name	Size	Mode	Actions
access.py	11639	0644	edit dl rm
access.pyc	12695	0644	edit dl rm
access.pyo	12695	0644	edit dl rm
audit.py	20706	0644	edit dl rm
audit.pyc	20514	0644	edit dl rm
audit.pyo	20514	0644	edit dl rm
classperms.py	2801	0644	edit dl rm
classperms.pyc	3200	0644	edit dl rm
classperms.pyo	3200	0644	edit dl rm
defaults.py	1287	0644	edit dl rm
defaults.pyc	1516	0644	edit dl rm
defaults.pyo	1516	0644	edit dl rm
interfaces.py	16509	0644	edit dl rm
interfaces.pyc	16051	0644	edit dl rm
interfaces.pyo	16051	0644	edit dl rm
lex.py	33586	0644	edit dl rm
lex.pyc	20103	0644	edit dl rm
lex.pyo	20103	0644	edit dl rm
matching.py	8629	0644	edit dl rm
matching.pyc	7486	0644	edit dl rm
matching.pyo	7486	0644	edit dl rm
module.py	7218	0644	edit dl rm
module.pyc	8565	0644	edit dl rm
module.pyo	8565	0644	edit dl rm
objectmodel.py	6524	0644	edit dl rm
objectmodel.pyc	4790	0644	edit dl rm
objectmodel.pyo	4790	0644	edit dl rm
output.py	5031	0644	edit dl rm
output.pyc	4524	0644	edit dl rm
output.pyo	4524	0644	edit dl rm
policygen.py	14427	0644	edit dl rm
policygen.pyc	14095	0644	edit dl rm
policygen.pyo	14026	0644	edit dl rm
refparser.py	29030	0644	edit dl rm
refparser.pyc	34463	0644	edit dl rm
refparser.pyo	34463	0644	edit dl rm
refpolicy.py	26448	0644	edit dl rm
refpolicy.pyc	44231	0644	edit dl rm
refpolicy.pyo	44231	0644	edit dl rm
sepolgeni18n.py	912	0644	edit dl rm
sepolgeni18n.pyc	410	0644	edit dl rm
sepolgeni18n.pyo	410	0644	edit dl rm
util.py	2573	0644	edit dl rm
util.pyc	2722	0644	edit dl rm
util.pyo	2722	0644	edit dl rm
yacc.py	82075	0644	edit dl rm
yacc.pyc	43220	0644	edit dl rm
yacc.pyo	43220	0644	edit dl rm
__init__.py	0	0644	edit dl rm
__init__.pyc	142	0644	edit dl rm
__init__.pyo	142	0644	edit dl rm

Edit: /usr/lib64/python2.6/site-packages/sepolgen/access.py (11639B)

# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
#
# Copyright (C) 2006 Red Hat 
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License as
# published by the Free Software Foundation; version 2 only
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#

"""
Classes representing basic access.

SELinux - at the most basic level - represents access as
the 4-tuple subject (type or context), target (type or context),
object class, permission. The policy language elaborates this basic
access to faciliate more concise rules (e.g., allow rules can have multiple
source or target types - see refpolicy for more information).

This module has objects for representing the most basic access (AccessVector)
and sets of that access (AccessVectorSet). These objects are used in Madison
in a variety of ways, but they are the fundamental representation of access.
"""

import refpolicy
from selinux import audit2why

def is_idparam(id):
    """Determine if an id is a paramater in the form $N, where N is
    an integer.

Returns:
      True if the id is a paramater
      False if the id is not a paramater
    """
    if len(id) > 1 and id[0] == '$':
        try:
            int(id[1:])
        except ValueError:
            return False
        return True
    else:
        return False

class AccessVector:
    """
    An access vector is the basic unit of access in SELinux.

Access vectors are the most basic representation of access within
    SELinux. It represents the access a source type has to a target
    type in terms of an object class and a set of permissions.

Access vectors are distinct from AVRules in that they can only
    store a single source type, target type, and object class. The
    simplicity of AccessVectors makes them useful for storing access
    in a form that is easy to search and compare.

The source, target, and object are stored as string. No checking
    done to verify that the strings are valid SELinux identifiers.
    Identifiers in the form $N (where N is an integer) are reserved as
    interface parameters and are treated as wild cards in many
    circumstances.

Properties:
     .src_type - The source type allowed access. [String or None]
     .tgt_type - The target type to which access is allowed. [String or None]
     .obj_class - The object class to which access is allowed. [String or None]
     .perms - The permissions allowed to the object class. [IdSet]
     .audit_msgs - The audit messages that generated this access vector [List of strings]
    """
    def __init__(self, init_list=None):
        if init_list:
            self.from_list(init_list)
        else:
            self.src_type = None
            self.tgt_type = None
            self.obj_class = None
            self.perms = refpolicy.IdSet()
            self.audit_msgs = []
            self.type = audit2why.TERULE
            self.bools = []

# The direction of the information flow represented by this
        # access vector - used for matching
        self.info_flow_dir = None

def from_list(self, list):
        """Initialize an access vector from a list.

Initialize an access vector from a list treating the list as
        positional arguments - i.e., 0 = src_type, 1 = tgt_type, etc.
        All of the list elements 3 and greater are treated as perms.
        For example, the list ['foo_t', 'bar_t', 'file', 'read', 'write']
        would create an access vector list with the source type 'foo_t',
        target type 'bar_t', object class 'file', and permissions 'read'
        and 'write'.

This format is useful for very simple storage to strings or disc
        (see to_list) and for initializing access vectors.
        """
        if len(list) < 4:
            raise ValueError("List must contain at least four elements %s" % str(list))
        self.src_type = list[0]
        self.tgt_type = list[1]
        self.obj_class = list[2]
        self.perms = refpolicy.IdSet(list[3:])

def to_list(self):
        """
        Convert an access vector to a list.

Convert an access vector to a list treating the list as positional
        values. See from_list for more information on how an access vector
        is represented in a list.
        """
        l = [self.src_type, self.tgt_type, self.obj_class]
        l.extend(self.perms)
        return l

def __str__(self):
        return self.to_string()

def to_string(self):
        return "allow %s %s:%s %s;" % (self.src_type, self.tgt_type,
                                        self.obj_class, self.perms.to_space_str())

def __cmp__(self, other):
        if self.src_type != other.src_type:
            return cmp(self.src_type, other.src_type)
        if self.tgt_type != other.tgt_type:
            return cmp(self.tgt_type, other.tgt_type)
        if self.obj_class != self.obj_class:
            return cmp(self.obj_class, other.obj_class)
        if len(self.perms) != len(other.perms):
            return cmp(len(self.perms), len(other.perms))
        x = list(self.perms)
        x.sort()
        y = list(other.perms)
        y.sort()
        for pa, pb in zip(x, y):
            if pa != pb:
                return cmp(pa, pb)
        return 0

def avrule_to_access_vectors(avrule):
    """Convert an avrule into a list of access vectors.

AccessVectors and AVRules are similary, but differ in that
    an AVRule can more than one source type, target type, and
    object class. This function expands a single avrule into a
    list of one or more AccessVectors representing the access
    defined in the AVRule.

"""
    if isinstance(avrule, AccessVector):
        return [avrule]
    a = []
    for src_type in avrule.src_types:
        for tgt_type in avrule.tgt_types:
            for obj_class in avrule.obj_classes:
                access = AccessVector()
                access.src_type = src_type
                access.tgt_type = tgt_type
                access.obj_class = obj_class
                access.perms = avrule.perms.copy()
                a.append(access)
    return a

class AccessVectorSet:
    """A non-overlapping set of access vectors.

An AccessVectorSet is designed to store one or more access vectors
    that are non-overlapping. Access can be added to the set
    incrementally and access vectors will be added or merged as
    necessary.  For example, adding the following access vectors using
    add_av:
       allow $1 etc_t : read;
       allow $1 etc_t : write;
       allow $1 var_log_t : read;
    Would result in an access vector set with the access vectors:
       allow $1 etc_t : { read write};
       allow $1 var_log_t : read;
    """
    def __init__(self):
        """Initialize an access vector set.
        """
        self.src = {}
        # The information flow direction of this access vector
        # set - see objectmodel.py for more information. This
        # stored here to speed up searching - see matching.py.
        self.info_dir = None

def __iter__(self):
        """Iterate over all of the unique access vectors in the set."""
        for tgts in self.src.values():
            for objs in tgts.values():
                for av in objs.values():
                    yield av

def __len__(self):
        """Return the number of unique access vectors in the set.

Because of the inernal representation of the access vector set,
        __len__ is not a constant time operation. Worst case is O(N)
        where N is the number of unique access vectors, but the common
        case is probably better.
        """
        l = 0
        for tgts in self.src.values():
            for objs in tgts.values():
               l += len(objs)
        return l

def to_list(self):
        """Return the unique access vectors in the set as a list.

The format of the returned list is a set of nested lists,
        each access vector represented by a list. This format is
        designed to be simply  serializable to a file.

For example, consider an access vector set with the following
        access vectors:
          allow $1 user_t : file read;
          allow $1 etc_t : file { read write};
        to_list would return the following:
          [[$1, user_t, file, read]
           [$1, etc_t, file, read, write]]

See AccessVector.to_list for more information.
        """
        l = []
        for av in self:
            l.append(av.to_list())

return l

def from_list(self, l):
        """Add access vectors stored in a list.

See to list for more information on the list format that this
        method accepts.

This will add all of the access from the list. Any existing
        access vectors in the set will be retained.
        """
        for av in l:
            self.add_av(AccessVector(av))

def add(self, src_type, tgt_type, obj_class, perms, audit_msg=None, avc_type=audit2why.TERULE, bools=[]):
        """Add an access vector to the set.
        """
        tgt = self.src.setdefault(src_type, { })
        cls = tgt.setdefault(tgt_type, { })
        
        if cls.has_key((obj_class, avc_type)):
            access = cls[obj_class, avc_type]
        else:
            access = AccessVector()
            access.src_type = src_type
            access.tgt_type = tgt_type
            access.obj_class = obj_class
            access.bools = bools
            access.type = avc_type
            cls[obj_class, avc_type] = access

access.perms.update(perms)
        if audit_msg:
            access.audit_msgs.append(audit_msg)

def add_av(self, av, audit_msg=None):
        """Add an access vector to the set."""
        self.add(av.src_type, av.tgt_type, av.obj_class, av.perms)

def avs_extract_types(avs):
    types = refpolicy.IdSet()
    for av in avs:
        types.add(av.src_type)
        types.add(av.tgt_type)
        
    return types

def avs_extract_obj_perms(avs):
    perms = { }
    for av in avs:
        if perms.has_key(av.obj_class):
            s = perms[av.obj_class]
        else:
            s = refpolicy.IdSet()
            perms[av.obj_class] = s
        s.update(av.perms)
    return perms

class RoleTypeSet:
    """A non-overlapping set of role type statements.

This clas allows the incremental addition of role type statements and
    maintains a non-overlapping list of statements.
    """
    def __init__(self):
        """Initialize an access vector set."""
        self.role_types = {}

def __iter__(self):
        """Iterate over all of the unique role allows statements in the set."""
        for role_type in self.role_types.values():
            yield role_type

def __len__(self):
        """Return the unique number of role allow statements."""
        return len(self.role_types.keys())

def add(self, role, type):
        if self.role_types.has_key(role):
            role_type = self.role_types[role]
        else:
            role_type = refpolicy.RoleType()
            role_type.role = role
            self.role_types[role] = role_type

role_type.types.add(type)

cmd: