File Manager - BorneoXploit

Editing: permmap.py

# Copyright 2014-2015, Tresys Technology, LLC
#
# SPDX-License-Identifier: LGPL-2.1-only
#
import logging
import copy
from collections import OrderedDict
from collections.abc import Iterable
from contextlib import suppress
from dataclasses import dataclass
from importlib import resources as pkg_resources
import pathlib
import typing

from . import exception, policyrep
from .descriptors import PermissionMapDescriptor

# This is the filename in the Python package
DEFAULT_PERM_MAP: typing.Final[str] = "perm_map"

INFOFLOW_DIRECTIONS: typing.Final = ("r", "w", "b", "n", "u")
MIN_WEIGHT: typing.Final[int] = 1
MAX_WEIGHT: typing.Final[int] = 10

__all__: typing.Final[tuple[str, ...]] = ("RuleWeight", "Mapping", "PermissionMap")

@dataclass
class RuleWeight:

"""The read and write weights for a rule, given all of its permissions."""

read: int
    write: int

#
# Settings validation functions for Mapping descriptors
#
def validate_weight(weight: int) -> int:
    if not MIN_WEIGHT <= weight <= MAX_WEIGHT:
        raise ValueError(f"Permission weights must be 1-10: {weight}")

return weight

def validate_direction(direction: str) -> str:
    if direction not in INFOFLOW_DIRECTIONS:
        raise ValueError(f"Invalid information flow direction: {direction}")

return direction

# Internal data structure for permission map
MapStruct = dict[str, dict[str, dict[str, bool | str | int]]]

class Mapping:

"""A mapping for a permission in the permission map."""

weight = PermissionMapDescriptor(validate_weight)
    direction = PermissionMapDescriptor(validate_direction)
    enabled = PermissionMapDescriptor(bool)
    class_: str
    perm: str

def __init__(self, perm_map: MapStruct, classname: str, permission: str,
                 create: bool = False) -> None:

self._perm_map = perm_map
        self.class_ = classname
        self.perm = permission

if create:
            if classname not in self._perm_map:
                self._perm_map[classname] = OrderedDict()

self._perm_map[classname][permission] = {'direction': 'u',
                                                     'weight': 1,
                                                     'enabled': True}

else:
            if classname not in self._perm_map:
                raise exception.UnmappedClass(f"{classname} is not mapped.")

if permission not in self._perm_map[classname]:
                raise exception.UnmappedPermission(f"{classname}:{permission} is not mapped.")

def __lt__(self, other) -> bool:
        if self.class_ == other.class_:
            return self.perm < other.perm

return self.class_ < other.class_

class PermissionMap:

"""Permission Map for information flow analysis."""

MIN_WEIGHT: typing.Final[int] = MIN_WEIGHT
    MAX_WEIGHT: typing.Final[int] = MAX_WEIGHT

def __init__(self, permmapfile: str | pathlib.Path | None = None) -> None:
        """
        Parameter:
        permmapfile     The path to the permission map to load.
        """
        self.log = logging.getLogger(__name__)
        self._permmap: MapStruct = OrderedDict()
        self._permmapfile: pathlib.Path

if permmapfile:
            self.load(permmapfile)
        else:
            package_location = pkg_resources.files("setools")
            with pkg_resources.as_file(package_location / DEFAULT_PERM_MAP) as path:
                self.load(path)

def __str__(self) -> str:
        return str(self._permmapfile)

def __deepcopy__(self, memo) -> 'PermissionMap':
        newobj = PermissionMap.__new__(PermissionMap)
        newobj.log = self.log
        newobj._permmap = copy.deepcopy(self._permmap)
        newobj._permmapfile = self._permmapfile
        memo[id(self)] = newobj
        return newobj

def __iter__(self) -> Iterable[Mapping]:
        for cls in self.classes():
            for mapping in self.perms(cls):
                yield mapping

def load(self, permmapfile: str | pathlib.Path) -> None:
        """
        Parameter:
        permmapfile     The path to the permission map to load.
        """
        self.log.info(f"Opening permission map \"{permmapfile}\"")

# state machine
        # 1 = read number of classes
        # 2 = read class name and number of perms
        # 3 = read perms
        with open(permmapfile, "r", encoding="utf-8") as mapfile:
            total_perms = 0
            class_count = 0
            num_classes = 0
            state = 1

self._permmap.clear()

for line_num, line in enumerate(mapfile, start=1):
                entry = line.split()

if len(entry) == 0 or entry[0][0] == '#':
                    continue

if state == 1:
                    try:
                        num_classes = int(entry[0])
                    except ValueError as ex:
                        raise exception.PermissionMapParseError(
                            f"{permmapfile}:{line_num}:Invalid number of classes: "
                            f"{entry[0]}") from ex

if num_classes < 1:
                        raise exception.PermissionMapParseError(
                            f"{permmapfile}:{line_num}:Number of classes must be positive: "
                            f"{num_classes}")

state = 2

elif state == 2:
                    if len(entry) != 3 or entry[0] != "class":
                        raise exception.PermissionMapParseError(
                            f"{permmapfile}:{line_num}:Invalid class declaration: {entry}")

class_name = str(entry[1])

try:
                        num_perms = int(entry[2])
                    except ValueError as ex:
                        raise exception.PermissionMapParseError(
                            f"{permmapfile}:{line_num}:Invalid number of permissions: "
                            f"{entry[2]}") from ex

if num_perms < 1:
                        raise exception.PermissionMapParseError(
                            f"{permmapfile}:{line_num}:Number of permissions must be positive: "
                            f"{num_perms}")

class_count += 1
                    if class_count > num_classes:
                        raise exception.PermissionMapParseError(
                            f"{permmapfile}:{line_num}:Extra class found: {class_name}")

self._permmap[class_name] = OrderedDict()
                    perm_count = 0
                    state = 3

elif state == 3:
                    perm_name = str(entry[0])

flow_direction = str(entry[1])
                    if flow_direction not in INFOFLOW_DIRECTIONS:
                        raise exception.PermissionMapParseError(
                            f"{permmapfile}:{line_num}:Invalid information flow direction: "
                            f"{flow_direction}")

try:
                        weight = int(entry[2])
                    except ValueError as ex:
                        raise exception.PermissionMapParseError(
                            f"{permmapfile}:{line_num}:Invalid permission weight: "
                            f"{entry[2]}") from ex

if not MIN_WEIGHT <= weight <= MAX_WEIGHT:
                        raise exception.PermissionMapParseError(
                            f"{permmapfile}:{line_num}:Permission weight must be "
                            f"{MIN_WEIGHT}-{MAX_WEIGHT}: {weight}")

self.log.debug(f"Read {class_name}:{perm_name} {flow_direction} {weight}")

if flow_direction == 'u':
                        self.log.info(f"Permission {class_name}:{perm_name} is unmapped.")

mapping = Mapping(self._permmap, class_name, perm_name, create=True)
                    mapping.direction = flow_direction
                    mapping.weight = weight

total_perms += 1
                    perm_count += 1
                    if perm_count >= num_perms:
                        state = 2

self._permmapfile = pathlib.Path(permmapfile)
        self.log.info(f"Successfully opened permission map \"{permmapfile}\"")
        self.log.debug(f"Read {class_count} classes and {total_perms} total permissions.")

def save(self, permmapfile: str) -> None:
        """
        Save the permission map to the specified path.  Existing files
        will be overwritten.

Parameter:
        permmapfile         The path to write the permission map.
        """
        with open(permmapfile, "w", encoding="utf-8") as mapfile:
            self.log.info(f"Writing permission map to \"{permmapfile}\"")
            mapfile.write(f"{len(self._permmap)}\n\n")

for classname, perms in self._permmap.items():
                mapfile.write(f"class {classname} {len(perms)}\n")

for permname, settings in perms.items():
                    direction = typing.cast(str, settings['direction'])
                    weight = typing.cast(int, settings['weight'])

assert MIN_WEIGHT <= weight <= MAX_WEIGHT, \
                        f"{classname}:{permname} weight is out of range ({weight}). " \
                        "This is an SETools bug."

assert direction in INFOFLOW_DIRECTIONS, \
                        f"{classname}:{permname} flow direction ({direction}) is invalid. " \
                        "This is an SETools bug."

if direction == 'u':
                        self.log.warning(
                            f"Warning: permission {permname} in class {classname} is unmapped.")

mapfile.write(f"{permname:>20} {direction:>9} {weight:>9}\n")

mapfile.write("\n")

self.log.info(f"Successfully wrote permission map to \"{permmapfile}\"")

def classes(self) -> Iterable[str]:
        """
        Generate class names in the permission map.

Yield:
        class       An object class name.
        """
        yield from self._permmap.keys()

def perms(self, class_: str) -> Iterable[Mapping]:
        """
        Generate permission mappings for the specified class.

Parameter:
        class_      An object class name.

Yield:
        Mapping     A permission's complete map (weight, direction, enabled)
        """
        try:
            for perm in self._permmap[class_].keys():
                yield Mapping(self._permmap, class_, perm)
        except KeyError as ex:
            raise exception.UnmappedClass(f"{class_} is not mapped.") from ex

def mapping(self, class_: str, perm: str) -> Mapping:
        """Retrieve a specific permission's mapping."""
        return Mapping(self._permmap, class_, perm)

def exclude_class(self, class_: str) -> None:
        """
        Exclude all permissions in an object class for calculating rule weights.

Parameter:
        class_              The object class to exclude.

Exceptions:
        UnmappedClass       The specified object class is not mapped.
        """
        for perm in self.perms(class_):
            perm.enabled = False

def exclude_permission(self, class_: str, permission: str) -> None:
        """
        Exclude a permission for calculating rule weights.

Parameter:
        class_              The object class of the permission.
        permission          The permission name to exclude.

Exceptions:
        UnmappedClass       The specified object class is not mapped.
        UnmappedPermission  The specified permission is not mapped for the object class.
        """
        Mapping(self._permmap, class_, permission).enabled = False

def include_class(self, class_: str) -> None:
        """
        Include all permissions in an object class for calculating rule weights.

Parameter:
        class_              The object class to include.

Exceptions:
        UnmappedClass       The specified object class is not mapped.
        """

for perm in self.perms(class_):
            perm.enabled = True

def include_permission(self, class_: str, permission: str) -> None:
        """
        Include a permission for calculating rule weights.

Parameter:
        class_              The object class of the permission.
        permission          The permission name to include.

Exceptions:
        UnmappedClass       The specified object class is not mapped.
        UnmappedPermission  The specified permission is not mapped for the object class.
        """

Mapping(self._permmap, class_, permission).enabled = True

def map_policy(self, policy: policyrep.SELinuxPolicy) -> None:
        """Create mappings for all classes and permissions in the specified policy."""
        for class_ in policy.classes():
            class_name = str(class_)

if class_name not in self._permmap:
                self.log.debug(f"Adding unmapped class {class_name} from {policy}")
                self._permmap[class_name] = OrderedDict()

perms = class_.perms

with suppress(exception.NoCommon):
                perms |= class_.common.perms

for perm_name in perms:
                if perm_name not in self._permmap[class_name]:
                    self.log.debug(
                        f"Adding unmapped permission {perm_name} in {class_name} from {policy}")
                    Mapping(self._permmap, class_name, perm_name, create=True)

def rule_weight(self, rule: policyrep.AVRule) -> RuleWeight:
        """
        Get the type enforcement rule's information flow read and write weights.

Parameter:
        rule            A type enforcement rule.

Return: Tuple(read_weight, write_weight)
        read_weight     The type enforcement rule's read weight.
        write_weight    The type enforcement rule's write weight.
        """

write_weight = 0
        read_weight = 0
        class_name = str(rule.tclass)

if rule.ruletype != policyrep.TERuletype.allow:
            raise exception.RuleTypeError(
                f"{rule.ruletype} rules cannot be used for calculating a weight")

# iterate over the permissions and determine the
        # weight of the rule in each direction. The result
        # is the largest-weight permission in each direction
        for perm_name in rule.perms:
            mapping = Mapping(self._permmap, class_name, perm_name)

if not mapping.enabled:
                continue

if mapping.direction == "r":
                read_weight = max(read_weight, mapping.weight)
            elif mapping.direction == "w":
                write_weight = max(write_weight, mapping.weight)
            elif mapping.direction == "b":
                read_weight = max(read_weight, mapping.weight)
                write_weight = max(write_weight, mapping.weight)

return RuleWeight(read_weight, write_weight)

def set_direction(self, class_: str, permission: str, direction: str) -> None:
        """
        Set the information flow direction of a permission.

Parameter:
        class_              The object class of the permission.
        permission          The permission name.
        direction           The information flow direction the permission (r/w/b/n).

def set_weight(self, class_: str, permission: str, weight: int) -> None:
        """
        Set the weight of a permission.

Parameter:
        class_              The object class of the permission.
        permission          The permission name.
        weight              The weight of the permission (1-10).

Cancel