← Back
Editing: assertrbac.cpython-312.pyc
� ���ie � �~ � U d dl Z ddlmZmZ ddlmZ ddlmZ ddlm Z m Z dZ e j e ed < d Ze j e ed < d Ze j e ed < dZe j e ed< dZe j e ed< dZe j e ed< dZe j ee df ed< G d� de� Zy)� N� )� exception� policyrep)� RBACRuleQuery� )� CheckerModule)�ConfigDescriptor�ConfigSetDescriptor�source� SOURCE_OPT�target� TARGET_OPT� exempt_source�EXEMPT_SRC_OPT� exempt_target�EXEMPT_TGT_OPT� expect_source�EXPECT_SRC_OPT� expect_target�EXPECT_TGT_OPT)� AssertRBAC.�__all__c � � � e Zd ZdZdZ eeeee e e f� Z e ej d� Z e ej d� Z eej ddd�� Z eej ddd�� Z eej ddd�� Z eej ddd�� Zdej. ded eeef d d f� fd � Zd eej8 ez fd �Z � xZ S )r z?Checker module for asserting a RBAC allow rule exists (or not).� assert_rbac� lookup_roleFT)�strict�expand�policy� checkname�config�returnNc � �� t �| � |||� |j t � | _ |j t � | _ |j t � | _ |j t � | _ |j t � | _ |j t � | _ t | j | j f� st! j" d� �| j | j z }|r4| j$ j' ddj) d� |D � � � �� | j | j z }|r5| j$ j' ddj) d� |D � � � �� y y )Nz5At least one of source or target options must be set.z,Overlap in expect_source and exempt_source: z, c 3 �4 K � | ] }|j �� � y �w�N��name��.0�is �A/usr/lib64/python3.12/site-packages/setools/checker/assertrbac.py� <genexpr>z&AssertRBAC.__init__.<locals>.<genexpr>; � � �� �&T�7S�!�q�v�v�7S�� �z,Overlap in expect_target and exempt_target: c 3 �4 K � | ] }|j �� � y �wr$ r% r' s r* r+ z&AssertRBAC.__init__.<locals>.<genexpr>@ r, r- )�super�__init__�getr r r r r r r r r r r r �anyr �InvalidCheckValue�log�info�join)�selfr r r � source_exempt_expect_overlap� target_exempt_expect_overlap� __class__s �r* r0 zAssertRBAC.__init__( sD �� � �����F�3� �j�j��,�� � �j�j��,�� � #�Z�Z�� 7��� #�Z�Z�� 7��� #�Z�Z�� 7��� #�Z�Z�� 7����D�K�K����-�.��-�-�G�I� I� (,�'9�'9�D�<N�<N�'N�$� '� �H�H�M�M�H� !�Y�Y�&T�7S�&T� T� U�W� X� (,�'9�'9�D�<N�<N�'N�$� '� �H�H�M�M�H� !�Y�Y�&T�7S�&T� T� U�W� X� (� c � � t | j | j f� sJ d� �| j j d� t | j | j | j d�� }t | j � }t | j � }g }t |j � � D ]� }t |j j � � }t |j j � � }||z }||z }|| j z | j z rH|| j z | j z r,| j t! |� � |j# |� ��| j% t! |� � �� |D ]* }d|� d�} | j | � |j# | � �, |D ]* }d|� d�} | j | � |j# | � �, | j j' |� d�� |S ) Nz)AssertRBAC no options set, this is a bug.z#Checking RBAC allow rule assertion.)�allow)r r �ruletypezExpected rule with source "z " not found.zExpected rule with target "z failure(s))r2 r r r4 r5 r r �setr r �sorted�resultsr r r �log_fail�str�append�log_ok�debug) r7 �query�unseen_sources�unseen_targets�failures�rule�srcs�tgts�item�failures r* �runzAssertRBAC.runB s� � ��D�K�K����-�.�[�0[�[�.� ��� � �;�<� �d�k�k�%)�[�[�%)�[�[�'1�3�� �T� /� /�0�� �T� /� /�0��68���5�=�=�?�+�D��t�{�{�)�)�+�,�D��t�{�{�)�)�+�,�D� �d� "�N� �d� "�N��t�)�)�)�D�,>�,>�>��D� .� .�.��1C�1C�C�� � �c�$�i�(�����%�� � �C��I�&� ,� #�D�4�T�F�-�H�G� �M�M�'� "� �O�O�G� $� #� #�D�4�T�F�-�H�G� �M�M�'� "� �O�O�G� $� #� �����(��;�/�0��r; ) �__name__� __module__� __qualname__�__doc__� check_type� frozensetr r r r r r � check_configr r �Roler r r r r r r � SELinuxPolicyrC �dictr0 �list� AnyRBACRulerP � __classcell__)r: s @r* r r s �� �I� �J� �j�*�n�n� ,�n� >� ?�L� .� �i�n�n� -�m� <�F� -� �i�n�n� -�m� <�F�7�'� ���7� �e�\`�a�M�7�'� ���7� �e�\`�a�M�7�'� ���7� �d�[_�`�M�7�'� ���7� �d�[_�`�M�X�y� 6� 6� X�3� X� �c�3�h� �X�,0�X�4&�T�)�/�/�#�5�6� &r; r )�typing� r r � rbacrulequeryr � checkermoduler � descriptorsr r r �FinalrC �__annotations__r r r r r r �tupler � r; r* �<module>rg s� �� � #� )� (� >� (� �F�L�L�� � (� (� �F�L�L�� � (�$3��� � �S�!� 3�$3��� � �S�!� 3�$3��� � �S�!� 3�$3��� � �S�!� 3�)8��� � �e�C��H�o� &� 8�P� � Pr;
Save File
Cancel