| Server IP : 104.21.21.239 / Your IP : 216.73.216.55 Web Server : Apache/2.4.68 (Amazon Linux) OpenSSL/3.5.7 System : Linux ip-172-31-69-123.ec2.internal 6.1.177-224.371.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Jul 27 20:28:29 UTC 2026 x86_64 User : ec2-user ( 1000) PHP Version : 8.4.24 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /lib64/python3.9/site-packages/setools/__pycache__/ |
Upload File : |
a
��c� � @ s� d dl Z d dlZd dlmZmZ ddlmZmZ ddlm Z ddl
m Z m Z ddl
mZmZ ddlmZ dd lmZ G d
d � d e e e�ZdS ) � N)�Iterable�Set� )�CriteriaDescriptor�CriteriaSetDescriptor)�ConstraintUseError)�
MatchObjClass�MatchPermission)�
AnyConstraint�ConstraintRuletype)� PolicyQuery)� match_in_setc s� e Zd ZU dZeed�Zedd�ZdZ e
e d< edd�Z dZ
e
e d< dZe
e d < ed
d �ZdZe
e d
< dZe
e d < d
d�� fdd� Zdd� Zee d�dd�Z� ZS )�ConstraintQuerya�
Query constraint rules, (mls)constrain/(mls)validatetrans.
Parameter:
policy The policy to query.
Keyword Parameters/Class attributes:
ruletype The list of rule type(s) to match.
tclass The object class(es) to match.
tclass_regex If true, use a regular expression for
matching the rule's object class.
perms The permission(s) to match.
perms_equal If true, the permission set of the rule
must exactly match the permissions
criteria. If false, any set intersection
will match.
perms_regex If true, regular expression matching will be used
on the permission names instead of set logic.
role The name of the role to match in the
constraint expression.
role_indirect If true, members of an attribute will be
matched rather than the attribute itself.
role_regex If true, regular expression matching will
be used on the role.
type_ The name of the type/attribute to match in the
constraint expression.
type_indirect If true, members of an attribute will be
matched rather than the attribute itself.
type_regex If true, regular expression matching will
be used on the type/attribute.
user The name of the user to match in the
constraint expression.
user_regex If true, regular expression matching will
be used on the user.
)�
enum_class�
user_regexZ lookup_userF�
role_regexZ lookup_roleT�
role_indirect�
type_regexZlookup_type_or_attr�
type_indirectN)�returnc s( t t| �j|fi |�� t�t�| _d S )N)�superr �__init__�loggingZ getLogger�__name__�log)�self�policy�kwargs�� __class__� �=/usr/lib64/python3.9/site-packages/setools/constraintquery.pyr A s zConstraintQuery.__init__c C s4 |r$t � }|D ]}|�|�� � qn|}t|||�S )ay
Match roles/types/users in a constraint expression,
optionally by expanding the contents of attributes.
Parameters:
expr The expression to match.
criteria The criteria to match.
indirect If attributes in the expression should be expanded.
regex If regular expression matching should be used.
)�set�update�expandr
)r �exprZcriteriaZindirectZregex�obj�itemr r r! � _match_exprE s zConstraintQuery._match_exprc c sB | j �d�| �� | j �d�| �� | �| j � | �| j � | j �d�| �� | j �d�| �� | j �d�| �� | j�� D ]�}| jr�|j| jvr�q|| � |�s�q|z| �
|�s�W q|W n t y� Y q|Y n0 | j r�| �
|jj| j | j| j�s�q|| j�r| �
|jj| j| j| j��sq|| j�r6| �
|jj| jd| j��s6q||V q|dS )z6Generator which yields all matching constraints rules.z-Generating constraint results from {0.policy}zRuletypes: {0.ruletype}z'User: {0.user!r}, regex: {0.user_regex}z'Role: {0.role!r}, regex: {0.role_regex}z(Type: {0.type_!r}, regex: {0.type_regex}FN)r �info�format�debugZ_match_object_class_debugZ_match_perms_debugr � constraints�ruletypeZ_match_object_classZ _match_permsr �roler( Z
expressionZrolesr r �type_�typesr r �userZusersr )r �cr r r! �resultsZ sP
� � �zConstraintQuery.results)r �
__module__� __qualname__�__doc__r r r- r r1 r �bool�__annotations__r. r r r/ r r r r( r r
r3 �
__classcell__r r r r! r s
$
r )r �re�typingr r Z descriptorsr r � exceptionr Zmixinsr r Z policyrepr
r �queryr �utilr
r r r r r! �<module> s