| # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> |
| # |
| # Copyright (C) 2006 Red Hat |
| # see file 'COPYING' for use and warranty information |
| # |
| # This program is free software; you can redistribute it and/or |
| # modify it under the terms of the GNU General Public License as |
| # published by the Free Software Foundation; version 2 only |
| # |
| # This program is distributed in the hope that it will be useful, |
| # but WITHOUT ANY WARRANTY; without even the implied warranty of |
| # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| # GNU General Public License for more details. |
| # |
| # You should have received a copy of the GNU General Public License |
| # along with this program; if not, write to the Free Software |
| # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
| # |
| |
| import string |
| import selinux |
| |
| # OVERVIEW |
| # |
| # This file contains objects and functions used to represent the reference |
| # policy (including the headers, M4 macros, and policy language statements). |
| # |
| # This representation is very different from the semantic representation |
| # used in libsepol. Instead, it is a more typical abstract representation |
| # used by the first stage of compilers. It is basically a parse tree. |
| # |
| # This choice is intentional as it allows us to handle the unprocessed |
| # M4 statements - including the $1 style arguments - and to more easily generate |
| # the data structures that we need for policy generation. |
| # |
| |
| # Constans for referring to fields |
| SRC_TYPE = 0 |
| TGT_TYPE = 1 |
| OBJ_CLASS = 2 |
| PERMS = 3 |
| ROLE = 4 |
| DEST_TYPE = 5 |
| |
| # String represenations of the above constants |
| field_to_str = ["source", "target", "object", "permission", "role", "destination" ] |
| str_to_field = { "source" : SRC_TYPE, "target" : TGT_TYPE, "object" : OBJ_CLASS, |
| "permission" : PERMS, "role" : ROLE, "destination" : DEST_TYPE } |
| |
| # Base Classes |
| |
| class PolicyBase: |
| def __init__(self, parent=None): |
| self.parent = None |
| self.comment = None |
| |
| class Node(PolicyBase): |
| """Base class objects produced from parsing the reference policy. |
| |
| The Node class is used as the base class for any non-leaf |
| object produced by parsing the reference policy. This object |
| should contain a reference to its parent (or None for a top-level |
| object) and 0 or more children. |
| |
| The general idea here is to have a very simple tree structure. Children |
| are not separated out by type. Instead the tree structure represents |
| fairly closely the real structure of the policy statements. |
| |
| The object should be iterable - by default over all children but |
| subclasses are free to provide additional iterators over a subset |
| of their childre (see Interface for example). |
| """ |
| |
| def __init__(self, parent=None): |
| PolicyBase.__init__(self, parent) |
| self.children = [] |
| |
| def __iter__(self): |
| return iter(self.children) |
| |
| # Not all of the iterators will return something on all Nodes, but |
| # they won't explode either. Putting them here is just easier. |
| |
| # Top level nodes |
| |
| def nodes(self): |
| return filter(lambda x: isinstance(x, Node), walktree(self)) |
| |
| def modules(self): |
| return filter(lambda x: isinstance(x, Module), walktree(self)) |
| |
| def interfaces(self): |
| return filter(lambda x: isinstance(x, Interface), walktree(self)) |
| |
| def templates(self): |
| return filter(lambda x: isinstance(x, Template), walktree(self)) |
| |
| def support_macros(self): |
| return filter(lambda x: isinstance(x, SupportMacros), walktree(self)) |
| |
| # Common policy statements |
| |
| def module_declarations(self): |
| return filter(lambda x: isinstance(x, ModuleDeclaration), walktree(self)) |
| |
| def interface_calls(self): |
| return filter(lambda x: isinstance(x, InterfaceCall), walktree(self)) |
| |
| def avrules(self): |
| return filter(lambda x: isinstance(x, AVRule), walktree(self)) |
| |
| def typerules(self): |
| return filter(lambda x: isinstance(x, TypeRule), walktree(self)) |
| |
| def typebounds(self): |
| return filter(lambda x: isinstance(x, TypeBound), walktree(self)) |
| |
| def typeattributes(self): |
| """Iterate over all of the TypeAttribute children of this Interface.""" |
| return filter(lambda x: isinstance(x, TypeAttribute), walktree(self)) |
| |
| def roleattributes(self): |
| """Iterate over all of the RoleAttribute children of this Interface.""" |
| return filter(lambda x: isinstance(x, RoleAttribute), walktree(self)) |
| |
| def requires(self): |
| return filter(lambda x: isinstance(x, Require), walktree(self)) |
| |
| def roles(self): |
| return filter(lambda x: isinstance(x, Role), walktree(self)) |
| |
| def role_allows(self): |
| return filter(lambda x: isinstance(x, RoleAllow), walktree(self)) |
| |
| def role_types(self): |
| return filter(lambda x: isinstance(x, RoleType), walktree(self)) |
| |
| def __str__(self): |
| if self.comment: |
| return str(self.comment) + "\n" + self.to_string() |
| else: |
| return self.to_string() |
| |
| def __repr__(self): |
| return "<%s(%s)>" % (self.__class__.__name__, self.to_string()) |
| |
| def to_string(self): |
| return "" |
| |
| |
| class Leaf(PolicyBase): |
| def __init__(self, parent=None): |
| PolicyBase.__init__(self, parent) |
| |
| def __str__(self): |
| if self.comment: |
| return str(self.comment) + "\n" + self.to_string() |
| else: |
| return self.to_string() |
| |
| def __repr__(self): |
| return "<%s(%s)>" % (self.__class__.__name__, self.to_string()) |
| |
| def to_string(self): |
| return "" |
| |
| |
| |
| # Utility functions |
| |
| def walktree(node, depthfirst=True, showdepth=False, type=None): |
| """Iterate over a Node and its Children. |
| |
| The walktree function iterates over a tree containing Nodes and |
| leaf objects. The iteration can perform a depth first or a breadth |
| first traversal of the tree (controlled by the depthfirst |
| paramater. The passed in node will be returned. |
| |
| This function will only work correctly for trees - arbitrary graphs |
| will likely cause infinite looping. |
| """ |
| # We control depth first / versus breadth first by |
| # how we pop items off of the node stack. |
| if depthfirst: |
| index = -1 |
| else: |
| index = 0 |
| |
| stack = [(node, 0)] |
| while len(stack) > 0: |
| cur, depth = stack.pop(index) |
| if showdepth: |
| yield cur, depth |
| else: |
| yield cur |
| |
| # If the node is not a Node instance it must |
| # be a leaf - so no need to add it to the stack |
| if isinstance(cur, Node): |
| items = [] |
| i = len(cur.children) - 1 |
| while i >= 0: |
| if type is None or isinstance(cur.children[i], type): |
| items.append((cur.children[i], depth + 1)) |
| i -= 1 |
| |
| stack.extend(items) |
| |
| def walknode(node, type=None): |
| """Iterate over the direct children of a Node. |
| |
| The walktree function iterates over the children of a Node. |
| Unlike walktree it does note return the passed in node or |
| the children of any Node objects (that is, it does not go |
| beyond the current level in the tree). |
| """ |
| for x in node: |
| if type is None or isinstance(x, type): |
| yield x |
| |
| |
| def list_to_space_str(s, cont=('{', '}')): |
| """Convert a set (or any sequence type) into a string representation |
| formatted to match SELinux space separated list conventions. |
| |
| For example the list ['read', 'write'] would be converted into: |
| '{ read write }' |
| """ |
| l = len(s) |
| str = "" |
| if l < 1: |
| raise ValueError("cannot convert 0 len set to string") |
| str = " ".join(s) |
| if l == 1: |
| return str |
| else: |
| return cont[0] + " " + str + " " + cont[1] |
| |
| def list_to_comma_str(s): |
| l = len(s) |
| if l < 1: |
| raise ValueError("cannot conver 0 len set to comma string") |
| |
| return ", ".join(s) |
| |
| # Basic SELinux types |
| |
| class IdSet(set): |
| def __init__(self, list=None): |
| if list: |
| set.__init__(self, list) |
| else: |
| set.__init__(self) |
| self.compliment = False |
| |
| def to_space_str(self): |
| return list_to_space_str(sorted(self)) |
| |
| def to_comma_str(self): |
| return list_to_comma_str(sorted(self)) |
| |
| class SecurityContext(Leaf): |
| """An SELinux security context with optional MCS / MLS fields.""" |
| def __init__(self, context=None, parent=None): |
| """Create a SecurityContext object, optionally from a string. |
| |
| Parameters: |
| [context] - string representing a security context. Same format |
| as a string passed to the from_string method. |
| """ |
| Leaf.__init__(self, parent) |
| self.user = "" |
| self.role = "" |
| self.type = "" |
| self.level = None |
| if context is not None: |
| self.from_string(context) |
| |
| def from_string(self, context): |
| """Parse a string representing a context into a SecurityContext. |
| |
| The string should be in the standard format - e.g., |
| 'user:role:type:level'. |
| |
| Raises ValueError if the string is not parsable as a security context. |
| """ |
| fields = context.split(":") |
| if len(fields) < 3: |
| raise ValueError("context string [%s] not in a valid format" % context) |
| |
| self.user = fields[0] |
| self.role = fields[1] |
| self.type = fields[2] |
| if len(fields) > 3: |
| # FUTURE - normalize level fields to allow more comparisons to succeed. |
| self.level = ':'.join(fields[3:]) |
| else: |
| self.level = None |
| |
| def __eq__(self, other): |
| """Compare two SecurityContext objects - all fields must be exactly the |
| the same for the comparison to work. It is possible for the level fields |
| to be semantically the same yet syntactically different - in this case |
| this function will return false. |
| """ |
| return self.user == other.user and \ |
| self.role == other.role and \ |
| self.type == other.type and \ |
| self.level == other.level |
| |
| def to_string(self, default_level=None): |
| """Return a string representing this security context. |
| |
| By default, the string will contiain a MCS / MLS level |
| potentially from the default which is passed in if none was |
| set. |
| |
| Arguments: |
| default_level - the default level to use if self.level is an |
| empty string. |
| |
| Returns: |
| A string represening the security context in the form |
| 'user:role:type:level'. |
| """ |
| fields = [self.user, self.role, self.type] |
| if self.level is None: |
| if default_level is None: |
| if selinux.is_selinux_mls_enabled() == 1: |
| fields.append("s0") |
| else: |
| fields.append(default_level) |
| else: |
| fields.append(self.level) |
| return ":".join(fields) |
| |
| class ObjectClass(Leaf): |
| """SELinux object class and permissions. |
| |
| This class is a basic representation of an SELinux object |
| class - it does not represent separate common permissions - |
| just the union of the common and class specific permissions. |
| It is meant to be convenient for policy generation. |
| """ |
| def __init__(self, name="", parent=None): |
| Leaf.__init__(self, parent) |
| self.name = name |
| self.perms = IdSet() |
| |
| # Basic statements |
| |
| class TypeAttribute(Leaf): |
| """SElinux typeattribute statement. |
| |
| This class represents a typeattribute statement. |
| """ |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.type = "" |
| self.attributes = IdSet() |
| |
| def to_string(self): |
| return "typeattribute %s %s;" % (self.type, self.attributes.to_comma_str()) |
| |
| class RoleAttribute(Leaf): |
| """SElinux roleattribute statement. |
| |
| This class represents a roleattribute statement. |
| """ |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.role = "" |
| self.roleattributes = IdSet() |
| |
| def to_string(self): |
| return "roleattribute %s %s;" % (self.role, self.roleattributes.to_comma_str()) |
| |
| |
| class Role(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.role = "" |
| self.types = IdSet() |
| |
| def to_string(self): |
| s = "" |
| for t in self.types: |
| s += "role %s types %s;\n" % (self.role, t) |
| return s |
| |
| class Type(Leaf): |
| def __init__(self, name="", parent=None): |
| Leaf.__init__(self, parent) |
| self.name = name |
| self.attributes = IdSet() |
| self.aliases = IdSet() |
| |
| def to_string(self): |
| s = "type %s" % self.name |
| if len(self.aliases) > 0: |
| s = s + "alias %s" % self.aliases.to_space_str() |
| if len(self.attributes) > 0: |
| s = s + ", %s" % self.attributes.to_comma_str() |
| return s + ";" |
| |
| class TypeAlias(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.type = "" |
| self.aliases = IdSet() |
| |
| def to_string(self): |
| return "typealias %s alias %s;" % (self.type, self.aliases.to_space_str()) |
| |
| class Attribute(Leaf): |
| def __init__(self, name="", parent=None): |
| Leaf.__init__(self, parent) |
| self.name = name |
| |
| def to_string(self): |
| return "attribute %s;" % self.name |
| |
| class Attribute_Role(Leaf): |
| def __init__(self, name="", parent=None): |
| Leaf.__init__(self, parent) |
| self.name = name |
| |
| def to_string(self): |
| return "attribute_role %s;" % self.name |
| |
| |
| # Classes representing rules |
| |
| class AVRule(Leaf): |
| """SELinux access vector (AV) rule. |
| |
| The AVRule class represents all varieties of AV rules including |
| allow, dontaudit, and auditallow (indicated by the flags self.ALLOW, |
| self.DONTAUDIT, and self.AUDITALLOW respectively). |
| |
| The source and target types, object classes, and perms are all represented |
| by sets containing strings. Sets are used to make it simple to add |
| strings repeatedly while avoiding duplicates. |
| |
| No checking is done to make certain that the symbols are valid or |
| consistent (e.g., perms that don't match the object classes). It is |
| even possible to put invalid types like '$1' into the rules to allow |
| storage of the reference policy interfaces. |
| """ |
| ALLOW = 0 |
| DONTAUDIT = 1 |
| AUDITALLOW = 2 |
| NEVERALLOW = 3 |
| |
| def __init__(self, av=None, parent=None): |
| Leaf.__init__(self, parent) |
| self.src_types = IdSet() |
| self.tgt_types = IdSet() |
| self.obj_classes = IdSet() |
| self.perms = IdSet() |
| self.rule_type = self.ALLOW |
| if av: |
| self.from_av(av) |
| |
| def __rule_type_str(self): |
| if self.rule_type == self.ALLOW: |
| return "allow" |
| elif self.rule_type == self.DONTAUDIT: |
| return "dontaudit" |
| else: |
| return "auditallow" |
| |
| def from_av(self, av): |
| """Add the access from an access vector to this allow |
| rule. |
| """ |
| self.src_types.add(av.src_type) |
| if av.src_type == av.tgt_type: |
| self.tgt_types.add("self") |
| else: |
| self.tgt_types.add(av.tgt_type) |
| self.obj_classes.add(av.obj_class) |
| self.perms.update(av.perms) |
| |
| def to_string(self): |
| """Return a string representation of the rule |
| that is a valid policy language representation (assuming |
| that the types, object class, etc. are valie). |
| """ |
| return "%s %s %s:%s %s;" % (self.__rule_type_str(), |
| self.src_types.to_space_str(), |
| self.tgt_types.to_space_str(), |
| self.obj_classes.to_space_str(), |
| self.perms.to_space_str()) |
| class TypeRule(Leaf): |
| """SELinux type rules. |
| |
| This class is very similar to the AVRule class, but is for representing |
| the type rules (type_trans, type_change, and type_member). The major |
| difference is the lack of perms and only and sing destination type. |
| """ |
| TYPE_TRANSITION = 0 |
| TYPE_CHANGE = 1 |
| TYPE_MEMBER = 2 |
| |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.src_types = IdSet() |
| self.tgt_types = IdSet() |
| self.obj_classes = IdSet() |
| self.dest_type = "" |
| self.rule_type = self.TYPE_TRANSITION |
| |
| def __rule_type_str(self): |
| if self.rule_type == self.TYPE_TRANSITION: |
| return "type_transition" |
| elif self.rule_type == self.TYPE_CHANGE: |
| return "type_change" |
| else: |
| return "type_member" |
| |
| def to_string(self): |
| return "%s %s %s:%s %s;" % (self.__rule_type_str(), |
| self.src_types.to_space_str(), |
| self.tgt_types.to_space_str(), |
| self.obj_classes.to_space_str(), |
| self.dest_type) |
| class TypeBound(Leaf): |
| """SElinux typebound statement. |
| |
| This class represents a typebound statement. |
| """ |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.type = "" |
| self.tgt_types = IdSet() |
| |
| def to_string(self): |
| return "typebounds %s %s;" % (self.type, self.tgt_types.to_comma_str()) |
| |
| |
| class RoleAllow(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.src_roles = IdSet() |
| self.tgt_roles = IdSet() |
| |
| def to_string(self): |
| return "allow %s %s;" % (self.src_roles.to_comma_str(), |
| self.tgt_roles.to_comma_str()) |
| |
| class RoleType(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.role = "" |
| self.types = IdSet() |
| |
| def to_string(self): |
| s = "" |
| for t in self.types: |
| s += "role %s types %s;\n" % (self.role, t) |
| return s |
| |
| class ModuleDeclaration(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.name = "" |
| self.version = "" |
| self.refpolicy = False |
| |
| def to_string(self): |
| if self.refpolicy: |
| return "policy_module(%s, %s)" % (self.name, self.version) |
| else: |
| return "module %s %s;" % (self.name, self.version) |
| |
| class Conditional(Node): |
| def __init__(self, parent=None): |
| Node.__init__(self, parent) |
| self.cond_expr = [] |
| |
| def to_string(self): |
| return "[If %s]" % list_to_space_str(self.cond_expr, cont=("", "")) |
| |
| class Bool(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.name = "" |
| self.state = False |
| |
| def to_string(self): |
| s = "bool %s " % self.name |
| if s.state: |
| return s + "true" |
| else: |
| return s + "false" |
| |
| class InitialSid(Leaf): |
| def __init(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.name = "" |
| self.context = None |
| |
| def to_string(self): |
| return "sid %s %s" % (self.name, str(self.context)) |
| |
| class GenfsCon(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.filesystem = "" |
| self.path = "" |
| self.context = None |
| |
| def to_string(self): |
| return "genfscon %s %s %s" % (self.filesystem, self.path, str(self.context)) |
| |
| class FilesystemUse(Leaf): |
| XATTR = 1 |
| TRANS = 2 |
| TASK = 3 |
| |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.type = self.XATTR |
| self.filesystem = "" |
| self.context = None |
| |
| def to_string(self): |
| s = "" |
| if self.type == XATTR: |
| s = "fs_use_xattr " |
| elif self.type == TRANS: |
| s = "fs_use_trans " |
| elif self.type == TASK: |
| s = "fs_use_task " |
| |
| return "%s %s %s;" % (s, self.filesystem, str(self.context)) |
| |
| class PortCon(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.port_type = "" |
| self.port_number = "" |
| self.context = None |
| |
| def to_string(self): |
| return "portcon %s %s %s" % (self.port_type, self.port_number, str(self.context)) |
| |
| class NodeCon(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.start = "" |
| self.end = "" |
| self.context = None |
| |
| def to_string(self): |
| return "nodecon %s %s %s" % (self.start, self.end, str(self.context)) |
| |
| class NetifCon(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.interface = "" |
| self.interface_context = None |
| self.packet_context = None |
| |
| def to_string(self): |
| return "netifcon %s %s %s" % (self.interface, str(self.interface_context), |
| str(self.packet_context)) |
| class PirqCon(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.pirq_number = "" |
| self.context = None |
| |
| def to_string(self): |
| return "pirqcon %s %s" % (self.pirq_number, str(self.context)) |
| |
| class IomemCon(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.device_mem = "" |
| self.context = None |
| |
| def to_string(self): |
| return "iomemcon %s %s" % (self.device_mem, str(self.context)) |
| |
| class IoportCon(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.ioport = "" |
| self.context = None |
| |
| def to_string(self): |
| return "ioportcon %s %s" % (self.ioport, str(self.context)) |
| |
| class PciDeviceCon(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.device = "" |
| self.context = None |
| |
| def to_string(self): |
| return "pcidevicecon %s %s" % (self.device, str(self.context)) |
| |
| class DeviceTreeCon(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.path = "" |
| self.context = None |
| |
| def to_string(self): |
| return "devicetreecon %s %s" % (self.path, str(self.context)) |
| |
| # Reference policy specific types |
| |
| def print_tree(head): |
| for node, depth in walktree(head, showdepth=True): |
| s = "" |
| for i in range(depth): |
| s = s + "\t" |
| print(s + str(node)) |
| |
| |
| class Headers(Node): |
| def __init__(self, parent=None): |
| Node.__init__(self, parent) |
| |
| def to_string(self): |
| return "[Headers]" |
| |
| |
| class Module(Node): |
| def __init__(self, parent=None): |
| Node.__init__(self, parent) |
| |
| def to_string(self): |
| return "" |
| |
| class Interface(Node): |
| """A reference policy interface definition. |
| |
| This class represents a reference policy interface definition. |
| """ |
| def __init__(self, name="", parent=None): |
| Node.__init__(self, parent) |
| self.name = name |
| |
| def to_string(self): |
| return "[Interface name: %s]" % self.name |
| |
| class TunablePolicy(Node): |
| def __init__(self, parent=None): |
| Node.__init__(self, parent) |
| self.cond_expr = [] |
| |
| def to_string(self): |
| return "[Tunable Policy %s]" % list_to_space_str(self.cond_expr, cont=("", "")) |
| |
| class Template(Node): |
| def __init__(self, name="", parent=None): |
| Node.__init__(self, parent) |
| self.name = name |
| |
| def to_string(self): |
| return "[Template name: %s]" % self.name |
| |
| class IfDef(Node): |
| def __init__(self, name="", parent=None): |
| Node.__init__(self, parent) |
| self.name = name |
| |
| def to_string(self): |
| return "[Ifdef name: %s]" % self.name |
| |
| class InterfaceCall(Leaf): |
| def __init__(self, ifname="", parent=None): |
| Leaf.__init__(self, parent) |
| self.ifname = ifname |
| self.args = [] |
| self.comments = [] |
| |
| def matches(self, other): |
| if self.ifname != other.ifname: |
| return False |
| if len(self.args) != len(other.args): |
| return False |
| for a,b in zip(self.args, other.args): |
| if a != b: |
| return False |
| return True |
| |
| def to_string(self): |
| s = "%s(" % self.ifname |
| i = 0 |
| for a in self.args: |
| if isinstance(a, list): |
| str = list_to_space_str(a) |
| else: |
| str = a |
| |
| if i != 0: |
| s = s + ", %s" % str |
| else: |
| s = s + str |
| i += 1 |
| return s + ")" |
| |
| class OptionalPolicy(Node): |
| def __init__(self, parent=None): |
| Node.__init__(self, parent) |
| |
| def to_string(self): |
| return "[Optional Policy]" |
| |
| class SupportMacros(Node): |
| def __init__(self, parent=None): |
| Node.__init__(self, parent) |
| self.map = None |
| |
| def to_string(self): |
| return "[Support Macros]" |
| |
| def __expand_perm(self, perm): |
| # Recursive expansion - the assumption is that these |
| # are ordered correctly so that no macro is used before |
| # it is defined |
| s = set() |
| if perm in self.map: |
| for p in self.by_name(perm): |
| s.update(self.__expand_perm(p)) |
| else: |
| s.add(perm) |
| return s |
| |
| def __gen_map(self): |
| self.map = {} |
| for x in self: |
| exp_perms = set() |
| for perm in x.perms: |
| exp_perms.update(self.__expand_perm(perm)) |
| self.map[x.name] = exp_perms |
| |
| def by_name(self, name): |
| if not self.map: |
| self.__gen_map() |
| return self.map[name] |
| |
| def has_key(self, name): |
| if not self.map: |
| self.__gen_map() |
| return name in self.map |
| |
| class Require(Leaf): |
| def __init__(self, parent=None): |
| Leaf.__init__(self, parent) |
| self.types = IdSet() |
| self.obj_classes = { } |
| self.roles = IdSet() |
| self.data = IdSet() |
| self.users = IdSet() |
| |
| def add_obj_class(self, obj_class, perms): |
| p = self.obj_classes.setdefault(obj_class, IdSet()) |
| p.update(perms) |
| |
| |
| def to_string(self): |
| s = [] |
| s.append("require {") |
| for type in self.types: |
| s.append("\ttype %s;" % type) |
| for obj_class, perms in self.obj_classes.items(): |
| s.append("\tclass %s %s;" % (obj_class, perms.to_space_str())) |
| for role in self.roles: |
| s.append("\trole %s;" % role) |
| for bool in self.data: |
| s.append("\tbool %s;" % bool) |
| for user in self.users: |
| s.append("\tuser %s;" % user) |
| s.append("}") |
| |
| # Handle empty requires |
| if len(s) == 2: |
| return "" |
| |
| return "\n".join(s) |
| |
| |
| class ObjPermSet: |
| def __init__(self, name): |
| self.name = name |
| self.perms = set() |
| |
| def to_string(self): |
| return "define(`%s', `%s')" % (self.name, self.perms.to_space_str()) |
| |
| class ClassMap: |
| def __init__(self, obj_class, perms): |
| self.obj_class = obj_class |
| self.perms = perms |
| |
| def to_string(self): |
| return self.obj_class + ": " + self.perms |
| |
| class Comment: |
| def __init__(self, l=None): |
| if l: |
| self.lines = l |
| else: |
| self.lines = [] |
| |
| def to_string(self): |
| # If there are no lines, treat this as a spacer between |
| # policy statements and return a new line. |
| if len(self.lines) == 0: |
| return "" |
| else: |
| out = [] |
| for line in self.lines: |
| out.append("#" + line) |
| return "\n".join(out) |
| |
| def merge(self, other): |
| if len(other.lines): |
| for line in other.lines: |
| if line != "": |
| self.lines.append(line) |
| |
| def __str__(self): |
| return self.to_string() |
| |
| |
