Revonzy Mini Shell

a

q�qe��@s�dd
lZddl
mZmZ
ddlmZ
ddlmZ
ddlm	Z	
ddl
mZ
dd	lm
Z
mZ
d
ZdZdZd
ZdZdZGdd�de�Zd
S)�N)�List�Union�)
�InvalidCheckValue)
�AnyRBACRule)
�
RBACRuleQuery�
)
�
CheckerModule)�ConfigDescriptor�ConfigSetDescriptor�source�target�
exempt_source�
exempt_target�
expect_source�
expect_targetcs�eZ
dZd
ZdZeeeee	e
ef�
Ze
d�
Ze
d�
Zedddd�Zedddd�Zedddd�Zedddd�Zdd�
�f
d	d
�Zed�
dd�Z�ZS)
�
AssertRBACz?Checker module for asserting a RBAC allow rule exists (or not).Zassert_rbacZlookup_roleFT)�strict�expandN)
�returncs�t��
|
||�
t�t�
|_|�t�
|_|�t	�
|_
|�t�
|_|�t
�
|_|�t�
|_|�t�
|_t|j|j
f�
s|td
�
�
|j|j@}|r�|j�d�d�dd�|D�
�
�
�

|j|j@}|r�|j�d�d�dd�|D�
�
�
�

dS)Nz5At least one of source or target options must be set.z.Overlap in expect_source and exempt_source: {}z, c
ss|]}
|
jV
qdS�
N�
�name��.0�
i�r�@/usr/lib64/python3.9/site-packages/setools/checker/assertrbac.py�	<genexpr>;�z&AssertRBAC.__init__.<locals>.<genexpr>z.Overlap in expect_target and exempt_target: {}c
ss|]}
|
jV
qdSrrrrrrr@r)�super�__init__�loggingZ	getLogger�__name__�log�get�
SOURCE_OPTr�
TARGET_OPTr
�EXEMPT_SRC_OPTr�EXEMPT_TGT_OPTr�EXPECT_SRC_OPTr�EXPECT_TGT_OPTr�anyr�info�format�join)�self�policyZ	checknameZconfigZsource_exempt_expect_overlapZtarget_exempt_expect_overlap�
�	__class__rrr!(s,







�



�



�zAssertRBAC.__init__c

Cs@
t|j
|jf�
sJd
�
�
|j�d�

t|j|j
|jdd�}
t|j�
}t|j	�
}g}t
|
���
D]x}t|j
���
}t|j���
}||8}||8}||j|j
r�||j	|jr�|�t|�
�

|�|�

q^|�t|�
�

q^|D]"}d�|�
}	|�|	�

|�|	�

q�|D]$}d�|�
}	|�|	�

|�|	�

�
q|j�d�|�
�

|S)Nz)AssertRBAC no options set, this is a bug.z#Checking RBAC allow rule assertion.)
Zallow)rr
Zruletypez)Expected rule with source "{}" not found.z)Expected rule with target "{}" not found.z
{} failure(s))r,rr
r$r-rr1�setrr�sorted�resultsrrrZlog_fail�str�appendZlog_okr.�debug)
r0�queryZunseen_sourcesZunseen_targetsZfailuresZruleZsrcsZtgts�itemZfailurerrr�runBs>



�









�











zAssertRBAC.run)r#�
__module__�__qualname__�__doc__Z
check_type�	frozensetr&r'r(r)r*r+Zcheck_configr
rr
rrrrrr!rr<�
__classcell__rrr2rrs


�



r)r"�typingrr�	exceptionrZ	policyreprZ
rbacrulequeryrZ
checkermoduler	Zdescriptorsr
rr&r'r(r)r*r+rrrrr�<module>s