← Back
Editing: rokmod.cpython-312.opt-1.pyc
� ���i� � � � U d dl mZ d dlZddlmZ ddlmZ ddlmZ ddl m Z d Z ej e ed < d Zej e ed < d Zej e ed< dZej ee df ed< G d� de� Zy)� )� defaultdictN� )� policyrep)� TERuleQuery� )� CheckerModule)�ConfigSetDescriptor�exempt_write_domain� EXEMPT_WRITE�exempt_load_domain� EXEMPT_LOAD� exempt_file� EXEMPT_FILE)�ReadOnlyKernelModules.�__all__c �f � � e Zd ZdZdZ eeeef� Z e e j ddd�� Z e e j ddd�� Z e e j ddd�� Zde j ded eeef d d f� fd � Zd ee j ee j, f fd �Zd ee j fd�Z� xZS )r z>Checker module for asserting all kernel modules are read-only.�ro_kmods�lookup_type_or_attrFT)�strict�expand�policy� checkname�config�returnNc �� �� t �| � |||� |j t � | _ |j t � | _ |j t � | _ y )N) �super�__init__�getr r r r r r )�selfr r r � __class__s ��=/usr/lib64/python3.12/site-packages/setools/checker/rokmod.pyr z ReadOnlyKernelModules.__init__$ sI �� � �����F�3�#)�:�:�l�#;�� �!�:�:�k�2���"(�*�*�[�"9�� � c �� � | j j d� | j j d| j ��� t | j ddd�� }t t j t t j f t � }|j � D ]� }t |j j � � | j z }t |j j � � | j z }||z }|r|s | j j d|� �� ��|D ]7 }| j j d|� d |� �� || j |� �9 �� |S ) Nz'Collecting list of kernel module types.zself.exempt_load_domain=��allow)�system)� module_load��ruletype�tclass�permsz!Ignoring empty module_load rule: z Determined z is a kernel module by: )�log�debugr r r r r �Type�set�AVRule�results�sourcer �targetr �add)r �query� collected�rule�sources�targets�ts r! �_collect_kernel_modsz*ReadOnlyKernelModules._collect_kernel_mods, s6 � � �����@�A� �����2�$�1�1�3�4�5��D�K�K�%/�#.�"2�4�� � ����I�4D�4D�0E� E�F�s�K� ��M�M�O�D��$�+�+�,�,�.�/�$�2I�2I�I�G��$�+�+�,�,�.�/�$�2B�2B�B�G� �w� �G� �'������!B�4�&� I�J�� ��������Q�C�/G��v� N�O� �!� � � ��&� � $�$ �r" c �> � | j j d� t | j ddd�� }| j � }t t � }|j � D ]� }| j j d|� d�� ||_ t |j � � D ]G }t |j j � � | j z s�4|| j |� �I �� t |j � � D ]� }| j j# d� | j j# d |� d �� | j j# d � t || � D ]! }| j j# d |� d �� �# | j j# d� t || � D ] }| j% t' |� � � �� | j j t) |� � d�� t |j � � S )Nz&Checking kernel modules are read-only.r$ )�file)�write�appendr( z Checking if kernel module type z is writable.z ------------ zKernel module type z is writable. zModule load rules: z * � z Write rules: z failure(s))r, �infor r r; r r/ �keysr- r3 �sortedr1 r2 r r r4 �outputr> �log_fail�str�len)r r5 �kmods�failures� kmod_typer7 s r! �runzReadOnlyKernelModules.runI s� � � ��� � �>�?��D�K�K�%/�#,�"5�7�� �)�)�+�� �s�#�� ��� �I� �H�H�N�N� <�Y�K�}�U� V�$�E�L� �u�}�}��/���t�{�{�)�)�+�,�t�/G�/G�G� �Y�'�+�+�D�1� 0� &� �� � ��0�I� �K�K� � � 2� 3� �K�K� � � 3�I�;�>O� P� Q� �K�K� � � 4� 5� �u�Y� /�0��� � �!�!�F�4�&��"3�4� 1� �K�K� � � 0� 1� �x� � 2�3��� � �c�$�i�(� 4� 1� �����#�h�-� � �4�5��h�m�m�o�&�&r" )�__name__� __module__� __qualname__�__doc__� check_type� frozensetr r r � check_configr r r. r r r � SELinuxPolicyrF �dictr r r/ r0 r; �listrK � __classcell__)r s @r! r r s� �� �H��J� �l�K�� E�F�L�=�-�i�n�n�=� �e�D�:��5�%�i�n�n�5� �e�D�:�K�<�,�Y�^�^�<� �e�D�:��:�y� 6� 6� :�3� :� �c�3�h� �:�,0�:��k�)�.�.�#�i�FV�FV�BW�2W�&X� �: '�T�)�.�.�)� 'r" r )� collectionsr �typing� r � terulequeryr � checkermoduler � descriptorsr r �FinalrF �__annotations__r r r �tupler � r" r! �<module>ra s{ �� $� � � %� (� ,�"7� �f�l�l�3� � 7�!5� �V�\�\�#� � 5�!.� �V�\�\�#� � .�)C��� � �e�C��H�o� &� C�Q'�M� Q'r"
Save File
Cancel