← Back
Editing: access_control.cpython-312.pyc
� %chl � �� � d Z ddlZddlZddlZddlmZ ddlmZ dgZ ej Z G d� d� Zy# e $ r� ddl Z ddl Z e j � d Z e j de� rdZ np e j d e� rdZ nZ e j d e� rd Z nD e j d e� rd Z n. e j de� rdZ n e j de� rdZ ndZ Y ��w xY w)z�Access control for setroubleshoot. For now this is only used for determining which users are allowed to connect to the server: see UserServerAccess for more information.� N)� get_config)� syslog_trace� ServerAccess� z^i\d86� z^x86_64z^(ppc|powerpc)� z ^(alpha|mips)� z^sparc�@ z^parisci@ c �L � e Zd ZdZddiddid�Zd� Zd� Zd� Zd � Zd � Z d � Z d � Z y )r zg Determine if a user should be given access to the server based on the configuration file. �wildcardTF)�client�fix_cmdc � � i | _ t t j j � � D ] }| j |� | j |< �" y )N)� privileges�listr �keys�init_privilege��self� privileges �B/usr/lib/python3.12/site-packages/setroubleshoot/access_control.py�__init__zServerAccess.__init__L sB � � ��� �l� 5� 5� :� :� <�=�I�)-�)<�)<�Y�)G�D�O�O�I� &� >� c � � t dd|z � j d� D �cg c] }|j � �� }}|S c c}w )N�accessz%s_users�,)r �split�strip)r r �name� cfg_namess r r zServerAccess.init_privilegeW sM � � ��*�y�*@�A�G�G��L�N�L� '+�T�Z�Z�\�L� � N����Ns �<c �| � |t j v }|ryt j t j d|z � y)NTz unknown access privilege (%s)F)r r �syslog�LOG_ERR)r r �valids r �valid_privilegez ServerAccess.valid_privilege\ s3 � ��\� 4� 4�4�� ��� � �f�n�n�&E� �&Q�R�r c �v � | j |� syt j | d syd| j | v S )NFr �*)r% r r r s r �unrestricted_privilegez#ServerAccess.unrestricted_privilegec s= � ��#�#�I�.���&�&�y�1�*�=���d�o�o�i�0�0�0r c �p � | j |� sy| j |� ry|| j | v ryy)z� Determine if the given user name is allowed access. Returns True if access should be given, False if not. FT)r% r( r )r r �users r � user_allowedzServerAccess.user_allowedk s= � � �#�#�I�.�� � &� &�y� 1�� �4�?�?�9�-� -��r c � � | j |� sy| j |� ry ddl}|j |� }| j ||d � S # t $ r Y yw xY w)z� Determine if the given uid is allowed access. No error is returned if the uid is invalid (False is returned). Returns True if access should be given, False if not. FTr N)r% r( �pwd�getpwuid�KeyErrorr+ )r r �uidr- � pwd_entrys r � uid_allowedzServerAccess.uid_allowedz sk � � �#�#�I�.�� � &� &�y� 1�� � �� � �S�)�I� � � ��I�a�L�9�9�� � � � �s �A � A �A c � � dx}x}} |j }|t j k7 r||fS d}t j |� } |j t j t |� }t j ||� \ }}}|dk( rd}|dk( rd}|dk( rd}||fS # t $ r Y �{w xY w# t $ rW} dx}x}}ddl } t | j � � t j t j d| z � Y d} ~ ||fS d} ~ ww xY w)z�Obtain the effective user and group IDs of the process on the other end of a socket. SO_PEERCRED is used so the information returned is generally trustworthy (though root processes can impersonate any uid/gid).N�III���r zget_credentials(): %s)�family�Socket�AF_UNIX�AttributeError�struct�calcsize� getsockopt� SOL_SOCKET� SO_PEERCRED�unpack� Exception� tracebackr � format_excr" r# ) r �sock�pidr0 �gidr6 � format_ucred� sizeof_ucred�ucred�erA s r �get_credentialsz ServerAccess.get_credentials� s! � � � �� �c�C� ��[�[�F��� � �'��C�x�� (� � � ���|�4� � G��O�O�F�$5�$5�{�L�Q�E� "�M�M�,�� >�M�C��c��b�y����b�y����b�y��� �C�x���- � � � �� � G� "� "�C� "�#�� � ��-�-�/� 0� �M�M�&�.�.�*A�A�*E� F� F��C�x��� G�s+ �"B �AB+ � B(�'B(�+ D �4A D�D N) �__name__� __module__� __qualname__�__doc__r r r r% r( r+ r2 rJ � r r r r B sD � �� (�� .� (�%� 0��J� H�� �1� � :�,"r )rN r: �socketr7 r" �setroubleshoot.configr �setroubleshoot.utilr �__all__r> r9 �os�re�uname�machine�searchr rO r r �<module>rY s� ��(*� � � � ,� ,� � ����$�$�K�,p� p��+ � � � ��b�h�h�j��m�G��r�y�y��G�$�� � ����:�w� '�� � ����$�g� .�� � ����#�W� -�� � ����9�g� &� � � ����:�w� '� � �� ��#�s � 6 �B'C � C
Save File
Cancel