← Back
Editing: roexec.cpython-312.opt-1.pyc
� ���iM � � � U d dl mZ d dlZddlmZ ddlmZ ddlmZ ddl m Z d Z ej e ed < d Zej e ed < d Zej e ed< dZej ee df ed< G d� de� Zy)� )� defaultdictN� )� policyrep)� TERuleQuery� )� CheckerModule)�ConfigSetDescriptor�exempt_write_domain� EXEMPT_WRITE�exempt_exec_domain� EXEMPT_EXEC� exempt_file� EXEMPT_FILE)�ReadOnlyExecutables.�__all__c �f � � e Zd ZdZdZ eeeef� Z e e j ddd�� Z e e j ddd�� Z e e j ddd�� Zde j ded eeef d d f� fd � Zd ee j ee j, f fd �Zd ee j fd�Z� xZS )r z@Checker module for asserting all executable files are read-only.�ro_execs�lookup_type_or_attrFT)�strict�expand�policy� checkname�config�returnNc �� �� t �| � |||� |j t � | _ |j t � | _ |j t � | _ y )N) �super�__init__�getr r r r r r )�selfr r r � __class__s ��=/usr/lib64/python3.12/site-packages/setools/checker/roexec.pyr z ReadOnlyExecutables.__init__$ sI �� � �����F�3�#)�:�:�l�#;�� �!�:�:�k�2���"(�*�*�[�"9�� � c �� � | j j d� | j j d| j ��� t | j ddd�� }t t j t t j f t � }|j � D ]� }t |j j � � | j z }t |j j � � | j z }|r|s | j j d|� �� ��|D ]7 }| j j d|� d |� �� || j |� �9 �� |S ) Nz)Collecting list of executable file types.zself.exempt_exec_domain=��allow��file)�execute�execute_no_trans��ruletype�tclass�permszIgnoring execute rule: z Determined z is executable by: )�log�debugr r r r r �Type�set�AVRule�results�sourcer �targetr �add)r �query� collected�rule�sources�targets�ts r! �_collect_executablesz(ReadOnlyExecutables._collect_executables, s+ � � �����B�C� �����2�$�1�1�3�4�5��D�K�K�%/�#,�"A�C�� � ����I�4D�4D�0E� E�F�s�K� ��M�M�O�D��$�+�+�,�,�.�/�$�2I�2I�I�G��$�+�+�,�,�.�/�$�2B�2B�B�G� �'������!8��� ?�@�� ��������Q�C�/B�4�&� I�J� �!� � � ��&� � $� �r" c �> � | j j d� t | j ddd�� }| j � }t t � }|j � D ]� }| j j d|� d�� ||_ t |j � � D ]G }t |j j � � | j z s�4|| j |� �I �� t |j � � D ]� }| j j# d� | j j# d |� d �� | j j# d � t || � D ]! }| j j# d |� d �� �# | j j# d� t || � D ] }| j% t' |� � � �� | j j t) |� � d�� t |j � � S )Nz#Checking executables are read-only.r$ r& )�write�appendr* z Checking if executable type z is writable.z ------------ zExecutable type z is writable. zExecute rules: z * � z Write rules: z failure(s))r. �infor r r= r r1 �keysr/ r5 �sortedr3 r4 r r r6 �outputr? �log_fail�str�len)r r7 � executables�failures� exec_typer9 s r! �runzReadOnlyExecutables.runF s� � � ��� � �;�<��D�K�K�%/�#,�"5�7�� �/�/�1� � �s�#��$�)�)�+�I� �H�H�N�N� 9�)��M�R� S�$�E�L� �u�}�}��/���t�{�{�)�)�+�,�t�/G�/G�G� �Y�'�+�+�D�1� 0� ,� �� � ��0�I� �K�K� � � 2� 3� �K�K� � � 0�� �;L� M� N� �K�K� � � 0� 1� �{�9� 5�6��� � �!�!�F�4�&��"3�4� 7� �K�K� � � 0� 1� �x� � 2�3��� � �c�$�i�(� 4� 1� �����#�h�-� � �4�5��h�m�m�o�&�&r" )�__name__� __module__� __qualname__�__doc__� check_type� frozensetr r r � check_configr r r0 r r r � SELinuxPolicyrG �dictr r r1 r2 r= �listrL � __classcell__)r s @r! r r s� �� �J��J� �l�K�� E�F�L�=�-�i�n�n�=� �e�D�:��5�%�i�n�n�5� �e�D�:�K�<�,�Y�^�^�<� �e�D�:��:�y� 6� 6� :�3� :� �c�3�h� �:�,0�:��k�)�.�.�#�i�FV�FV�BW�2W�&X� �4 '�T�)�.�.�)� 'r" r )� collectionsr �typing� r � terulequeryr � checkermoduler � descriptorsr r �FinalrG �__annotations__r r r �tupler � r" r! �<module>rb s{ �� $� � � %� (� ,�"7� �f�l�l�3� � 7�!5� �V�\�\�#� � 5�!.� �V�\�\�#� � .�)A��� � �e�C��H�o� &� A�N'�-� N'r"
Save File
Cancel