| # Copyright 2014-2016, Tresys Technology, LLC |
| # |
| # This file is part of SETools. |
| # |
| # SETools is free software: you can redistribute it and/or modify |
| # it under the terms of the GNU Lesser General Public License as |
| # published by the Free Software Foundation, either version 2.1 of |
| # the License, or (at your option) any later version. |
| # |
| # SETools is distributed in the hope that it will be useful, |
| # but WITHOUT ANY WARRANTY; without even the implied warranty of |
| # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| # GNU Lesser General Public License for more details. |
| # |
| # You should have received a copy of the GNU Lesser General Public |
| # License along with SETools. If not, see |
| # <http://www.gnu.org/licenses/>. |
| # |
| from . import qpol |
| from .exception import ConstraintUseError, InvalidConstraintType |
| from .role import role_factory |
| from .symbol import PolicySymbol |
| from .objclass import class_factory |
| from .typeattr import type_or_attr_factory |
| from .user import user_factory |
| |
| |
| def _is_mls(policy, sym): |
| """Determine if this is a regular or MLS constraint/validatetrans.""" |
| # this can only be determined by inspecting the expression. |
| for expr_node in sym.expr_iter(policy): |
| sym_type = expr_node.sym_type(policy) |
| expr_type = expr_node.expr_type(policy) |
| |
| if expr_type == qpol.QPOL_CEXPR_TYPE_ATTR and sym_type >= qpol.QPOL_CEXPR_SYM_L1L2: |
| return True |
| |
| return False |
| |
| |
| def validate_ruletype(t): |
| """Validate constraint rule types.""" |
| if t not in ["constrain", "mlsconstrain", "validatetrans", "mlsvalidatetrans"]: |
| raise InvalidConstraintType("{0} is not a valid constraint type.".format(t)) |
| |
| return t |
| |
| |
| def constraint_factory(policy, sym): |
| """Factory function for creating constraint objects.""" |
| |
| try: |
| if _is_mls(policy, sym): |
| if isinstance(sym, qpol.qpol_constraint_t): |
| return Constraint(policy, sym, "mlsconstrain") |
| else: |
| return Validatetrans(policy, sym, "mlsvalidatetrans") |
| else: |
| if isinstance(sym, qpol.qpol_constraint_t): |
| return Constraint(policy, sym, "constrain") |
| else: |
| return Validatetrans(policy, sym, "validatetrans") |
| |
| except AttributeError: |
| raise TypeError("Constraints cannot be looked-up.") |
| |
| |
| class BaseConstraint(PolicySymbol): |
| |
| """Base class for constraint rules.""" |
| |
| _role_syms = [qpol.QPOL_CEXPR_SYM_ROLE, |
| qpol.QPOL_CEXPR_SYM_ROLE + qpol.QPOL_CEXPR_SYM_TARGET, |
| qpol.QPOL_CEXPR_SYM_ROLE + qpol.QPOL_CEXPR_SYM_XTARGET] |
| |
| _type_syms = [qpol.QPOL_CEXPR_SYM_TYPE, |
| qpol.QPOL_CEXPR_SYM_TYPE + qpol.QPOL_CEXPR_SYM_TARGET, |
| qpol.QPOL_CEXPR_SYM_TYPE + qpol.QPOL_CEXPR_SYM_XTARGET] |
| |
| _user_syms = [qpol.QPOL_CEXPR_SYM_USER, |
| qpol.QPOL_CEXPR_SYM_USER + qpol.QPOL_CEXPR_SYM_TARGET, |
| qpol.QPOL_CEXPR_SYM_USER + qpol.QPOL_CEXPR_SYM_XTARGET] |
| |
| def __init__(self, policy, qpol_symbol, ruletype): |
| PolicySymbol.__init__(self, policy, qpol_symbol) |
| self.ruletype = ruletype |
| |
| def __str__(self): |
| raise NotImplementedError |
| |
| # There is no levels function as specific |
| # levels cannot be used in expressions, only |
| # the l1, h1, etc. symbols |
| |
| @property |
| def roles(self): |
| """The roles used in the expression.""" |
| return set(self._get_symbols(self._role_syms, role_factory)) |
| |
| @property |
| def perms(self): |
| raise NotImplementedError |
| |
| def statement(self): |
| return str(self) |
| |
| @property |
| def tclass(self): |
| """Object class for this constraint.""" |
| return class_factory(self.policy, self.qpol_symbol.object_class(self.policy)) |
| |
| @property |
| def types(self): |
| """The types and type attributes used in the expression.""" |
| |
| return set(self._get_symbols(self._type_syms, type_or_attr_factory)) |
| |
| @property |
| def users(self): |
| """The users used in the expression.""" |
| return set(self._get_symbols(self._user_syms, user_factory)) |
| |
| def expression(self): |
| """ |
| The constraint's expression in infix notation. |
| |
| Return: list |
| """ |
| |
| _precedence = { |
| "not": 4, |
| "and": 2, |
| "or": 1, |
| "==": 3, |
| "!=": 3, |
| "dom": 3, |
| "domby": 3, |
| "incomp": 3} |
| |
| _max_precedence = 4 |
| |
| _operands = ["u1", "u2", "u3", |
| "r1", "r2", "r3", |
| "t1", "t2", "t3", |
| "l1", "l2", |
| "h1", "h2"] |
| |
| # qpol representation is in postfix notation. This code |
| # converts it to infix notation. Parentheses are added |
| # to ensure correct expressions, though they may end up |
| # being overused. Set previous operator at start to the |
| # highest precedence (op) so if there is a single binary |
| # operator, no parentheses are output |
| stack = [] |
| prev_op_precedence = _max_precedence |
| for op in self.postfix_expression(): |
| if isinstance(op, frozenset) or op in _operands: |
| # operands |
| stack.append(op) |
| else: |
| # operators |
| if op == "not": |
| # unary operator |
| operator = op |
| operand = stack.pop() |
| op_precedence = _precedence[op] |
| stack.append([operator, "(", operand, ")"]) |
| else: |
| # binary operators |
| operand2 = stack.pop() |
| operand1 = stack.pop() |
| operator = op |
| |
| # if previous operator is of higher precedence |
| # no parentheses are needed. |
| if _precedence[op] < prev_op_precedence: |
| stack.append([operand1, operator, operand2]) |
| else: |
| stack.append(["(", operand1, operator, operand2, ")"]) |
| |
| prev_op_precedence = _precedence[op] |
| |
| return self._flatten_expression(stack) |
| |
| def postfix_expression(self): |
| """ |
| The constraint's expression in postfix notation. |
| |
| Return: list |
| """ |
| |
| _expr_type_to_text = { |
| qpol.QPOL_CEXPR_TYPE_NOT: "not", |
| qpol.QPOL_CEXPR_TYPE_AND: "and", |
| qpol.QPOL_CEXPR_TYPE_OR: "or"} |
| |
| _expr_op_to_text = { |
| qpol.QPOL_CEXPR_OP_EQ: "==", |
| qpol.QPOL_CEXPR_OP_NEQ: "!=", |
| qpol.QPOL_CEXPR_OP_DOM: "dom", |
| qpol.QPOL_CEXPR_OP_DOMBY: "domby", |
| qpol.QPOL_CEXPR_OP_INCOMP: "incomp"} |
| |
| _sym_to_text = { |
| qpol.QPOL_CEXPR_SYM_USER: "u1", |
| qpol.QPOL_CEXPR_SYM_ROLE: "r1", |
| qpol.QPOL_CEXPR_SYM_TYPE: "t1", |
| qpol.QPOL_CEXPR_SYM_USER + qpol.QPOL_CEXPR_SYM_TARGET: "u2", |
| qpol.QPOL_CEXPR_SYM_ROLE + qpol.QPOL_CEXPR_SYM_TARGET: "r2", |
| qpol.QPOL_CEXPR_SYM_TYPE + qpol.QPOL_CEXPR_SYM_TARGET: "t2", |
| qpol.QPOL_CEXPR_SYM_USER + qpol.QPOL_CEXPR_SYM_XTARGET: "u3", |
| qpol.QPOL_CEXPR_SYM_ROLE + qpol.QPOL_CEXPR_SYM_XTARGET: "r3", |
| qpol.QPOL_CEXPR_SYM_TYPE + qpol.QPOL_CEXPR_SYM_XTARGET: "t3", |
| qpol.QPOL_CEXPR_SYM_L1L2: "l1", |
| qpol.QPOL_CEXPR_SYM_L1H2: "l1", |
| qpol.QPOL_CEXPR_SYM_H1L2: "h1", |
| qpol.QPOL_CEXPR_SYM_H1H2: "h1", |
| qpol.QPOL_CEXPR_SYM_L1H1: "l1", |
| qpol.QPOL_CEXPR_SYM_L2H2: "l2", |
| qpol.QPOL_CEXPR_SYM_L1L2 + qpol.QPOL_CEXPR_SYM_TARGET: "l2", |
| qpol.QPOL_CEXPR_SYM_L1H2 + qpol.QPOL_CEXPR_SYM_TARGET: "h2", |
| qpol.QPOL_CEXPR_SYM_H1L2 + qpol.QPOL_CEXPR_SYM_TARGET: "l2", |
| qpol.QPOL_CEXPR_SYM_H1H2 + qpol.QPOL_CEXPR_SYM_TARGET: "h2", |
| qpol.QPOL_CEXPR_SYM_L1H1 + qpol.QPOL_CEXPR_SYM_TARGET: "h1", |
| qpol.QPOL_CEXPR_SYM_L2H2 + qpol.QPOL_CEXPR_SYM_TARGET: "h2"} |
| |
| expression = [] |
| for expr_node in self.qpol_symbol.expr_iter(self.policy): |
| op = expr_node.op(self.policy) |
| sym_type = expr_node.sym_type(self.policy) |
| expr_type = expr_node.expr_type(self.policy) |
| |
| if expr_type == qpol.QPOL_CEXPR_TYPE_ATTR: |
| # logical operator with symbols (e.g. u1 == u2) |
| operand1 = _sym_to_text[sym_type] |
| operand2 = _sym_to_text[sym_type + qpol.QPOL_CEXPR_SYM_TARGET] |
| operator = _expr_op_to_text[op] |
| |
| expression.extend([operand1, operand2, operator]) |
| elif expr_type == qpol.QPOL_CEXPR_TYPE_NAMES: |
| # logical operator with type or attribute list (e.g. t1 == { spam_t eggs_t }) |
| operand1 = _sym_to_text[sym_type] |
| operator = _expr_op_to_text[op] |
| |
| names = list(expr_node.names_iter(self.policy)) |
| |
| if sym_type in self._role_syms: |
| operand2 = frozenset(role_factory(self.policy, n) for n in names) |
| elif sym_type in self._type_syms: |
| operand2 = frozenset(type_or_attr_factory(self.policy, n) for n in names) |
| else: |
| operand2 = frozenset(user_factory(self.policy, n) for n in names) |
| |
| expression.extend([operand1, operand2, operator]) |
| else: |
| # individual operators (and/or/not) |
| expression.append(_expr_type_to_text[expr_type]) |
| |
| return expression |
| |
| # |
| # Internal functions |
| # |
| def _flatten_expression(self, expr): |
| """Flatten the expression into a flat list.""" |
| ret = [] |
| |
| for i in expr: |
| if isinstance(i, list): |
| ret.extend(self._flatten_expression(i)) |
| else: |
| ret.append(i) |
| |
| return ret |
| |
| def _get_symbols(self, syms, factory): |
| """ |
| Internal generator for getting users/roles/types in a constraint |
| expression. Symbols will be yielded multiple times if they appear |
| in the expression multiple times. |
| |
| Parameters: |
| syms List of qpol symbol types. |
| factory The factory function related to these symbols. |
| """ |
| for expr_node in self.qpol_symbol.expr_iter(self.policy): |
| sym_type = expr_node.sym_type(self.policy) |
| expr_type = expr_node.expr_type(self.policy) |
| |
| if expr_type == qpol.QPOL_CEXPR_TYPE_NAMES and sym_type in syms: |
| for s in expr_node.names_iter(self.policy): |
| yield factory(self.policy, s) |
| |
| @staticmethod |
| def _expression_str(expr): |
| """Generate the string representation of the expression.""" |
| ret = [] |
| |
| for item in expr: |
| if isinstance(item, frozenset): |
| if len(item) > 1: |
| ret.append("{{ {0} }} ".format(" ".join(str(j) for j in item))) |
| else: |
| ret.append("{0}".format(" ".join(str(j) for j in item))) |
| else: |
| ret.append(item) |
| |
| return " ".join(ret) |
| |
| |
| class Constraint(BaseConstraint): |
| |
| """A constraint rule (constrain/mlsconstrain).""" |
| |
| def __str__(self): |
| rule_string = "{0.ruletype} {0.tclass} ".format(self) |
| |
| perms = self.perms |
| if len(perms) > 1: |
| rule_string += "{{ {0} }} (".format(' '.join(perms)) |
| else: |
| # convert to list since sets cannot be indexed |
| rule_string += "{0} (".format(list(perms)[0]) |
| |
| rule_string += "{0});".format(self._expression_str(self.expression())) |
| |
| return rule_string |
| |
| @property |
| def perms(self): |
| """The constraint's permission set.""" |
| return set(self.qpol_symbol.perm_iter(self.policy)) |
| |
| |
| class Validatetrans(BaseConstraint): |
| |
| """A validatetrans rule (validatetrans/mlsvalidatetrans).""" |
| |
| def __str__(self): |
| return "{0.ruletype} {0.tclass} ({1});".format(self, |
| self._expression_str(self.expression())) |
| |
| @property |
| def perms(self): |
| raise ConstraintUseError("{0} rules do not have permissions.".format(self.ruletype)) |
