| Server IP : 172.67.201.108 / Your IP : 216.73.216.55 Web Server : Apache/2.4.68 (Amazon Linux) OpenSSL/3.5.7 System : Linux ip-172-31-69-123.ec2.internal 6.1.177-224.371.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Jul 27 20:28:29 UTC 2026 x86_64 User : ec2-user ( 1000) PHP Version : 8.4.24 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /lib64/python3.9/site-packages/setools/__pycache__/ |
Upload File : |
a
s� d�Z � @ s d dl Z d dlZd dlmZ d dlmZ d dlmZmZm Z m
Z
m Z m Z z d dl
Zd dlmZmZmZ W n" ey� e�e��d� Y n0 ddlmZmZ dd lmZm Z m Z m Z g d
�Z G d d � d e
�Z G d
d� de
�Z!ee! Z"ee e e f Z#G dd� d�Z$G dd� d�Z%dS )� N�� defaultdict)�suppress)� DefaultDict�Iterable�List�
NamedTuple�Optional�Union)�
NetworkXError�NetworkXNoPath� NodeNotFoundzNetworkX failed to import.� )� EdgeAttrDict� EdgeAttrList)� AnyTERule�
SELinuxPolicy�
TERuletype�Type)�DomainTransitionAnalysis�DomainTransition�DomainEntrypoint�DTAPathc @ s> e Zd ZU dZeed< ee ed< ee ed< ee ed< dS )r z0Entrypoint list entry named tuple output format.�name�
entrypoint�execute�type_transitionN)�__name__�
__module__� __qualname__�__doc__r �__annotations__r r � r" r" �1/usr/lib64/python3.9/site-packages/setools/dta.pyr s
r c @ s^ e Zd ZU dZeed< eed< ee ed< ee ed< ee ed< ee ed< ee ed< d S )
r z*Transition step output named tuple format.�source�target�
transition� entrypoints�setexec�
dyntransition�
setcurrentN) r r r r r r! r r r r" r" r" r# r # s
r c @ s� e Zd ZU dZee ed< eed< d,eee e
e ee f dd�dd�Z
eed �d
d ��Zejdd �d d ��Zeee d �d
d��Zeje e
e ee f dd�dd��Ze ee f e ee f e
e d�dd�Zd-e ee f e ee f ee
e d�dd�Ze ee f e ee f e
e d�dd�Ze ee f ed�dd �Ze d �d d �Zed ee d �d!d"��Zee ed#�d$d%�Z dd �d&d'�Z dd �d(d)�Z dd �d*d+�Z dS ).r zDomain transition analysis.�_exclude�_reverseFN)�policy�reverse�exclude�returnc C sv t �t�| _|| _|| _|| _d| _d| _zt �
� | _ | j � � | _
W n, typ | j�d� | j�d� � Y n0 dS )z�
Parameter:
policy The policy to analyze.
Keyword Parameters:
reverse True means reverse the direction of the analysis (find parent domains).
exclude An iterable of types to exclude from the analysis.
TzLNetworkX is not available. This is requried for Domain Transition Analysis.z2This is typically in the python3-networkx package.N)�logging� getLoggerr �logr- r/ r. � rebuildgraph�rebuildsubgraph�nxZDiGraph�G�copy�subG� NameErrorZcritical)�selfr- r. r/ r" r" r# �__init__> s
z!DomainTransitionAnalysis.__init__)r0 c C s | j S �N)r, �r; r" r" r# r. Y s z DomainTransitionAnalysis.reversec C s t |�| _d| _d S )NT)�boolr, r5 )r; � directionr" r" r# r. ] s
c C s | j S r= )r+ r> r" r" r# r/ b s z DomainTransitionAnalysis.exclude)�typesr0 c s* |r� fdd�|D �� _ ng � _ d� _d S )Nc s g | ]}� j �|��qS r" )r- � lookup_type)�.0�tr> r" r# �
<listcomp>i � z4DomainTransitionAnalysis.exclude.<locals>.<listcomp>T)r+ r5 )r; rA r" r> r# r/ f s )r$ r% r0 c c s� | j �|�}| j �|�}| jr&| �� | j�d�||�� ttt ��* | �
t j | j
||d��V W d � n1 st0 Y dS )a�
Generator which yields one shortest domain transition path
between the source and target types (there may be more).
Parameters:
source The source type.
target The target type.
Yield: generator(steps)
steps A generator that returns the tuple of
source, target, and rules for each
domain transition.
z8Generating one domain transition path from {0} to {1}...)r$ r% N)r- rB r5 �_build_subgraphr3 �info�formatr r r
�)_DomainTransitionAnalysis__generate_stepsr6 �
shortest_pathr9 )r; r$ r% �srD r" r" r# rK o s z&DomainTransitionAnalysis.shortest_path� )r$ r% �maxlenr0 c c s� |dk rt d��| j�|�}| j�|�}| jr6| �� | j�d�|||�� tt t
��4 t � | j
|||�D ]}| �|�V qjW d � n1 s�0 Y dS )a�
Generator which yields all domain transition paths between
the source and target up to the specified maximum path
length.
Parameters:
source The source type.
target The target type.
maxlen Maximum length of paths.
Yield: generator(steps)
steps A generator that returns the tuple of
source, target, and rules for each
domain transition.
r z%Maximum path length must be positive.zIGenerating all domain transition paths from {0} to {1}, max length {2}...N)�
ValueErrorr- rB r5 rG r3 rH rI r r r
r6 Zall_simple_pathsr9 rJ )r; r$ r% rN rL rD �pathr" r" r# � all_paths� s
� z"DomainTransitionAnalysis.all_pathsc c s� | j �|�}| j �|�}| jr&| �� | j�d�||�� ttt ��2 t
� | j ||�D ]}| �
|�V qVW d � n1 s|0 Y dS )a�
Generator which yields all shortest domain transition paths
between the source and target types.
Parameters:
source The source type.
target The target type.
Yield: generator(steps)
steps A generator that returns the tuple of
source, target, and rules for each
domain transition.
zBGenerating all shortest domain transition paths from {0} to {1}...N)r- rB r5 rG r3 rH rI r r r
r6 �all_shortest_pathsr9 rJ )r; r$ r% rL rD rP r" r" r# rR � s
� z+DomainTransitionAnalysis.all_shortest_paths)�type_r0 c
c s� | j �|�}| jr| �� | j�d�|| jr0dnd�� tt ��t | j
� |�D ]V\}}t | j
||�}| jrv|| }}n
|| }}t
|||j| �|�|j|j|j�V qNW d � n1 s�0 Y dS )aM
Generator which yields all domain transitions out of a
specified source type.
Parameters:
type_ The starting type.
Yield: generator(steps)
steps A generator that returns the tuple of
source, target, and rules for each
domain transition.
z)Generating all domain transitions {1} {0}zin tozout fromN)r- rB r5 rG r3 rH rI r. r r r9 Z out_edges�Edger r& �/_DomainTransitionAnalysis__generate_entrypointsr( r) r* )r; rS rL r$ r% �edge� real_source� real_targetr" r" r# � transitions� s(
�
�z$DomainTransitionAnalysis.transitionsc C s. | j r| �� dt�| j�� dt�| j�� �S )zR
Get the domain transition graph statistics.
Return: str
z
Graph nodes: z
Graph edges: )r4 � _build_graphr6 �number_of_nodesr7 �number_of_edgesr> r" r" r# � get_stats� s
�z"DomainTransitionAnalysis.get_statsrT )rV r0 c s � fdd�� j D �S )a�
Creates a list of entrypoint, execute, and
type_transition rules for each entrypoint.
Parameter:
data The dictionary of entrypoints.
Return: list of tuple(type, entry, exec, trans)
type The entrypoint type.
entry The list of entrypoint rules.
exec The list of execute rules.
trans The list of type_transition rules.
c s, g | ]$}t |� j| � j| � j| ��qS r" )r r r r )rC �e�rV r" r# rE s �zCDomainTransitionAnalysis.__generate_entrypoints.<locals>.<listcomp>)r r_ r" r_ r# Z__generate_entrypoints
s
�z/DomainTransitionAnalysis.__generate_entrypoints)rP r0 c c sz t dt|��D ]f}||d }|| }t| j||�}| jrF|| }}n
|| }}t|||j| �|�|j|j |j
�V qdS )a
Generator which yields the source, target, and associated rules
for each domain transition.
Parameter:
path A list of graph node names representing an information flow path.
Yield: tuple(source, target, transition, entrypoints,
setexec, dyntransition, setcurrent)
source The source type for this step of the domain transition.
target The target type for this step of the domain transition.
transition The list of transition rules.
entrypoints Generator which yields entrypoint-related rules.
setexec The list of setexec rules.
dyntranstion The list of dynamic transition rules.
setcurrent The list of setcurrent rules.
r N) �range�lenrT r9 r. r r& rU r( r) r* )r; rP rL r$ r% rV rW rX r" r" r# Z__generate_steps s
�z)DomainTransitionAnalysis.__generate_stepsc C s� | j �� d�| j�| j _| j�d�| j�� tt�}tt�}tdd� �}tdd� �}tdd� �}| j� � D �]}|j
t j k�r"|j
dvr�ql|j
dk�r�d |jv r�t�|j�� |j�� �D ].\}}||kr�t| j ||d
d �} | j�|� q�d |jv �rBt�|j�� |j�� �D ]2\}}||k�rt| j ||d
d �}
|
j�|� �qd
|jv �rn|j�� D ]}|| �|� �qXd|jv �r |j�� D ]}|| �|� �q�n�d|jv �r�t�|j�� |j�� �D ] \}}|| | �|� �q�d|jv �r|t�|j�� |j�� �D ] \}}|| | �|� �qql|j
t jkrl|j
dk�r<ql|j} t�|j�� |j�� �D ] \}}|| | | �|� �qZqlg } g }
g }| j �� D �]�\}}t| j ||�} d}d}| j�r�t|| � � �}t|| � � �}|� |�}|�s�d
}n�|D ]�}||v �s|| | �rF| j | || | 7 < | j | || | 7 < || | | �r�| j| || | | 7 < �q�||v �r�| j �!|| � | j �s�| j�s�d
}nd
}| j�r�||v �r�| j"�!|| � nd
}nd
}|�r�|�r�| �| � n"|�r|
�| � n|�r�|�| � �q�| j �#| � |
D ]} | `| ` | ` | `| ` �q*|D ]} | `| `"�qJd| _$d
| _%| j�d� | j�&d�t'�(| j �t'�)| j ��� d S )Nz Domain transition graph for {0}.z,Building domain transition graph from {0}...c S s t t�S r= �r �listr" r" r" r# �<lambda>� rF z7DomainTransitionAnalysis._build_graph.<locals>.<lambda>c S s t t�S r= rb r" r" r" r# rd � rF c S s t dd� �S )Nc S s t t�S r= rb r" r" r" r# rd � rF zIDomainTransitionAnalysis._build_graph.<locals>.<lambda>.<locals>.<lambda>r r" r" r" r# rd � rF )�process�filere r& T)�creater) r( r* r r Fz+Completed building domain transition graph.z$Graph stats: nodes: {0}, edges: {1}.)*r7 �clearrI r- r r3 rH r rc ZterulesZruletyper ZallowZtclassZperms� itertools�productr$ �expandr% rT r& �appendr) r �default�edges�set�keys� intersectionr r r( �extendr* �remove_edges_fromr4 r5 �debugr6 r[ r\ )r; r( r* r r Z
type_transZrulerL rD rV r^ �dZ invalid_edgeZclear_transitionZclear_dyntransitionZ
invalid_transZinvalid_dyntrans�entryZexe�match�mr" r" r# rZ { s�
�
�
"
�z%DomainTransitionAnalysis._build_graphc
C s� g }| j �� D ]�\}}t| j ||�}t|j�}|�| j� |s@q|D ]D}|j|= |j|= tt �� |j
|= W d � qD1 s~0 Y qD|js|j s|� |� q| j �
|� d S r= )r9 rn rT ro r �intersection_updater/ r r �KeyErrorr r) rl rs )r; Z
invalid_edgesr$ r% rV r' r^ r" r" r# Z __remove_excluded_entrypoints s
( z6DomainTransitionAnalysis.__remove_excluded_entrypointsc C s� | j r| �� | j�d� | j�d�| j�� | j�d�| j�� | jrZ| jjdd�| _ n | j�
� | _ | jr�| j � | j� | � � d| _
| j�d� | j�d�t�| j �t�| j ��� d S ) Nz$Building domain transition subgraph.z
Excluding {0}z Reverse {0}T)r8 Fz.Completed building domain transition subgraph.z'Subgraph stats: nodes: {0}, edges: {1}.)r4 rZ r3 rH rt rI r/ r. r7 r9 r8 Zremove_nodes_from�6_DomainTransitionAnalysis__remove_excluded_entrypointsr5 r6 r[ r\ r> r" r" r# rG + s"
�z(DomainTransitionAnalysis._build_subgraph)FN)rM ) r r r r r r r! r? r r r r
�strr< �propertyr. �setterr/ r rK �intrQ rR rY r] � staticmethodr rU rJ rZ r{ rG r" r" r" r# r 7 sD
�� "� � %� (^ r c @ sv e Zd ZdZed�Zed�Zed�Zed�Ze d�Z
e d�Z e d�Z de
e
ed
d �d d
�Zdd� Zee
d�dd�Zd
S )rT aS
A graph edge. Also used for returning domain transition steps.
Parameters:
graph The NetworkX graph.
source The source type of the edge.
target The target tyep of the edge.
Keyword Parameters:
create (T/F) create the edge if it does not exist.
The default is False.
r& r( r) r* r r r FN)r$ r% rg r0 c C sj || _ || _|| _| j �||�sf|s.td��n8| j �||� d | _d | _d | _d | _ d | _
d | _ d | _ d S )Nz Edge does not exist in graph)
r7 r$ r% Zhas_edgerO Zadd_edger& r r r r( r) r* )r; Zgraphr$ r% rg r" r" r# r< ^ s
z
Edge.__init__c s4 t |t�r&� fdd�t|�d�� D �S � �|�S d S )Nc s g | ]}� � |��qS r" )�_index_to_item)rC �ir> r" r# rE t rF z$Edge.__getitem__.<locals>.<listcomp>rM )�
isinstance�slicer` �indicesr� )r; �keyr" r> r# � __getitem__p s
zEdge.__getitem__)�indexr0 c C s. |dkr| j S |dkr | jS td�|���dS )z'Return source or target based on index.r r z,Invalid index (edges only have 2 items): {0}N)r$ r% �
IndexErrorrI )r; r� r" r" r# r� x s
zEdge._index_to_item)F)r r r r r r& r( r) r* r r r r r r? r< r� r r� r" r" r" r# rT G s
rT )&ri r1 � collectionsr �
contextlibr �typingr r r r r r
Znetworkxr6 Znetworkx.exceptionr r r
� ImportErrorr2 r rt Z descriptorsr r Z policyrepr r r r �__all__r r r ZRuleHashr rT r" r" r" r# �<module> s,