File manager - Edit - /home/u478019808/domains/bestandroidphones.store/public_html/static/img/logo/sepolgen.tar
Back
__pycache__/interfaces.cpython-39.opt-1.pyc 0000644 00000030460 15025012421 0014462 0 ustar 00 a z fP@ � @ s� d Z ddlZddlZddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G d d � d �Z d d � Z d d� Z dd� Z dd� Zdd� ZG dd� d�ZG dd� d�ZG dd� d�ZG dd � d �ZdS ) z7 Classes for representing and manipulating interfaces. � N� )�access)� refpolicy)� objectmodel)�matching)�_c @ sH e Zd ZdZdd� Zdd� Zdd� Zeee�Zedd � d �Z d d � Z d S )�Paramz; Object representing a parameter for an interface. c C s" d| _ tj| _t�� | _d| _d S )N� T)� _Param__namer �SRC_TYPE�type�IdSet� obj_classes�required��self� r �7/usr/lib/python3.9/site-packages/sepolgen/interfaces.py�__init__& s zParam.__init__c C s t �|�std| ��|| _d S )NzName [%s] is not a param)r � is_idparam� ValueErrorr )r �namer r r �set_name, s zParam.set_namec C s | j S �N)r r r r r �get_name1 s zParam.get_namec C s t | jdd � �S �Nr )�intr r r r r �<lambda>6 � zParam.<lambda>)�fgetc C s d| j tj| j d�| j�f S )Nz0<sepolgen.policygen.Param instance [%s, %s, %s]>� )r r � field_to_strr �joinr r r r r �__repr__8 s �zParam.__repr__N) �__name__� __module__� __qualname__�__doc__r r r �propertyr �numr# r r r r r " s r c C s� d}| |v r�|| }||j kr"d S |tjks6|tjkr�|j tjksN|j tjkr�d}|r`|jg}ng }t�|j|�D ]}|tj v rrd} q�qrtj|_ q�d}n t � }| |_ ||_ |||j < |r�|j� |j� |S �Nr r ) r r r �TGT_TYPE� obj_class� itertools�chainr r Zimplicitly_typed_objectsr r �add)r r �av�params�ret�pZavobjs�objr r r �__param_insert> s6 � � r5 c C s~ d}d}t �| j�r.t| jtj| |�dkr.d}t �| j�rTt| jtj| |�dkrTd}t �| j�rzt| jtj | |�dkrzd}|S )aj Extract the parameters from an access vector. Extract the parameters (in the form $N) from an access vector, storing them as Param objects in a dictionary. Some attempt is made at resolving conflicts with other entries in the dict, but if an unresolvable conflict is found it is reported to the caller. The goal here is to figure out how interface parameters are actually used in the interface - e.g., that $1 is a domain used as a SRC_TYPE. In general an interface will look like this: interface(`foo', ` allow $1 foo : file read; ') This is simple to figure out - $1 is a SRC_TYPE. A few interfaces are more complex, for example: interface(`foo_trans',` domain_auto_trans($1,fingerd_exec_t,fingerd_t) allow $1 fingerd_t:fd use; allow fingerd_t $1:fd use; allow fingerd_t $1:fifo_file rw_file_perms; allow fingerd_t $1:process sigchld; ') Here the usage seems ambiguous, but it is not. $1 is still domain and therefore should be returned as a SRC_TYPE. Returns: 0 - success 1 - conflict found r Fr ) r r �src_typer5 r r �tgt_typer+ r, � OBJ_CLASS)r0 r1 r2 Z found_srcr r r �av_extract_paramsj s $ r9 c C s" t �| j�r t| jtjd |�S d S r )r r �roler5 r ZROLE)r: r1 r r r �role_extract_params� s r; c sl � fdd�}d}|| j tj�r"d}|| jtj�r4d}|| jtj�rFd}t�| j �rht | j tj d � �rhd}|S )Nc s. d}| D ] }t �|�rt||d � �rd}q|S r* )r r r5 )�setr r2 �x�r1 r r �extract_from_set� s z2type_rule_extract_params.<locals>.extract_from_setr r ) � src_typesr r � tgt_typesr+ r r8 r r Z dest_typer5 Z DEST_TYPE)�ruler1 r? r2 r r> r �type_rule_extract_params� s rC c C s2 d}| j D ]"}t�|�r t|tjd |�r d}q |S r* )�argsr r r5 r r )�ifcallr1 r2 �argr r r �ifcall_extract_params� s rG c @ s e Zd Zdd� Zdd� ZdS )�AttributeVectorc C s d| _ t�� | _d S )Nr )r r �AccessVectorSetr r r r r � s zAttributeVector.__init__c C s | j �|� d S r )r �add_av�r r0 r r r rJ � s zAttributeVector.add_avN)r$ r% r& r rJ r r r r rH � s rH c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )� AttributeSetc C s i | _ d S r )� attributesr r r r r � s zAttributeSet.__init__c C s || j |j< d S r )rM r )r �attrr r r �add_attr� s zAttributeSet.add_attrc C sz dd� }d }|D ]V}|d d� }|d dkrD|r:| � |� ||�}q|r|�d�}t�|�}|�|� q|rv| � |� d S )Nc S sH | dd� � � }t|�dks(|d dkr4td| ��t� }|d |_|S )Nr ���� r Z Attributez#Syntax error Attribute statement %s)�split�len� SyntaxErrorrH r )�line�fields�ar r r � parse_attr� s z*AttributeSet.from_file.<locals>.parse_attrrP r �[�,)rO rR r � AccessVectorrJ )r �fdrX rW rU �lr0 r r r � from_file� s zAttributeSet.from_fileN)r$ r% r& r rO r^ r r r r rL � s rL c @ sF e Zd Zdi fdd�Zi fdd�Zdd� Zdd � Zd d � Zd d � ZdS )�InterfaceVectorNc C s6 d| _ d| _t�� | _i | _|r,| �||� d| _d S )NTr F)�enabledr r rI r1 �from_interface�expanded)r � interfacerM r r r r � s zInterfaceVector.__init__c C s" |j | _ |�� D ]>}|jtjjkr$qd|j v r0qt�|�}|D ]}| �|� q>q|r�|� � D ]n}|j D ]b}||j vrvqf|j | }|jD ]@} t � | �}|j |j kr�|j |_ |j|j kr�|j |_| �|� q�qfq\|�� D ]} t| | j�r�q�|�� D ]} t| | j�r�q�|�� D ]} t| | j��r�qd S )NZ dontaudit)r ZavrulesZ rule_typer ZAVRuleZALLOWr Zavrule_to_access_vectorsrJ ZtypeattributesrM �copyr6 r r7 Zrolesr; r1 Z typerulesrC �interface_callsrG ) r rc rM ZavruleZavsr0 Z typeattributerN Zattr_vecrW r: rB rE r r r ra � s> z InterfaceVector.from_interfacec C s t || j�dkr| j�|� d S r )r9 r1 r rJ rK r r r rJ 3 s zInterfaceVector.add_avc C s8 g }|� d| j � | jD ]}|� t|�� qd�|�S )Nz[InterfaceVector %s]� )�appendr r �strr" )r �sr0 r r r � to_string9 s zInterfaceVector.to_stringc C s | � � S r )r# r r r r �__str__@ s zInterfaceVector.__str__c C s d| j | jf S )Nz<InterfaceVector %s:%s>)r r` r r r r r# C s zInterfaceVector.__repr__) r$ r% r& r ra rJ rj rk r# r r r r r_ � s 4r_ c @ sx e Zd Zddd�Zdd� Zdd� Zdd � Zd d � Zd d � Zi fdd�Z di fdd�Z dd� Z dd� Z dd� Z dd� ZdS )� InterfaceSetNc C s i | _ i | _g | _|| _d S r )� interfaces� tgt_type_map� tgt_type_all�output)r rp r r r r H s zInterfaceSet.__init__c C s | j r| j �|d � d S )Nrf )rp �write)r rh r r r �oN s zInterfaceSet.oc C s� t | j�� dd� d�D ]�}|�d|j � t |j�� dd� d�D ] }|�d|jtj|j f � q@|�d� t |j � � �}|D ] }|�d� |�� |�d � q~qd S ) Nc S s | j S r �r �r= r r r r S r z&InterfaceSet.to_file.<locals>.<lambda>)�keyz[InterfaceVector %s c S s | j S r rs rt r r r r U r z%s:%s z] rZ rf ) �sortedrm �valuesrq r r1 r r! r r Zto_listr" )r r\ Ziv�paramZavlr0 r r r �to_fileR s zInterfaceSet.to_filec C s� dd� }d }|D ]V}|d d� }|d dkrD|r:| � |� ||�}q|r|�d�}t�|�}|�|� q|rv| � |� | �� d S )Nc S s� | dd� � � }t|�dk s(|d dkr4td| ��t� }|d |_t|�dkrTd S |dd � D ]R}|� d�}t|�dkr�td| ��t� }|d |_tj|d |_||j |j< q`|S ) Nr rP rQ r r_ z)Syntax error InterfaceVector statement %s�:z-Invalid param in InterfaceVector statement %s) rR rS rT r_ r r r Z str_to_fieldr r1 )rU rV �ifvZfieldr3 rx r r r � parse_ifv^ s z)InterfaceSet.from_file.<locals>.parse_ifvrP r rY rZ )�add_ifvrR r r[ rJ �index)r r\ r| r{ rU r] r0 r r r r^ ] s zInterfaceSet.from_filec C s || j |j< d S r )rm r )r r{ r r r r} � s zInterfaceSet.add_ifvc C sv | j �� D ]f}t� }|jD ]2}t�|j�r@| j�|� t� } qN|�|j� q|D ] }| j � |g �}|�|� qRq d S r ) rm rw r< r r r7 ro rg r/ rn � setdefault)r r{ rA r0 r r] r r r r~ � s zInterfaceSet.indexc C s t ||�}| �|� d S r )r_ r} )r rc rM r{ r r r r/ � s zInterfaceSet.addc C s< t �|�� |�� �D ]}| �||� q| �|� | �� d S r )r- r. rm � templatesr/ �expand_ifcallsr~ )r �headersrp rM �ir r r � add_headers� s zInterfaceSet.add_headersc C sZ t �|�rPt|dd � �}|t|j�kr,d S |j|d }t|t�rH|S |gS n|gS d S r )r r r rS rD � isinstance�list)r �idrE r) rF r r r � map_param� s zInterfaceSet.map_paramc C s� | � |j|�}|d u rd S | � |j|�}|d u r4d S | � |j|�}|d u rNd S t�� }|jD ]&}| � ||�} | d u rxq\q\|�| � q\t|�dkr�d S |D ]*} |D ] } |D ]} |j � | | | |� q�q�q�d S )Nr ) r� r6 r7 r, r r Zperms�updaterS r r/ ) r r{ r0 rE r@ rA r Z new_permsZpermr3 r6 r7 r, r r r � map_add_av� s* zInterfaceSet.map_add_avc C s� |d fg}| j |j }d|_t|�dkr�|�d�\}}| j |j }||krl|jD ]}| �|||� qP|jrlq |�� D ]l} | j|jkr�| � t d�� d S z|| j } W n* t y� | � t d| j �� Y qtY n0 |� | | f� qtq d S )NTr rP z Found circular interface classz#Missing interface definition for %s) rm r rb rS �popr r� re Zifnamerr r �KeyErrorrg ) r rc � if_by_name�stackr{ ZcurZ cur_ifcallZcur_ifvr0 rE Znewifr r r �do_expand_ifcalls� s* z InterfaceSet.do_expand_ifcallsc C sR i }t �|�� |�� �D ]}|||j< qt �|�� |�� �D ]}| �||� q<d S r )r- r. rm r� r r� )r r� r� r� rc r r r r� � s zInterfaceSet.expand_ifcalls)N)r$ r% r& r rr ry r^ r} r~ r/ r� r� r� r� r� r r r r rl G s # $rl )r' rd r- r r r r r Z sepolgeni18nr r r5 r9 r; rC rG rH rL r_ rl r r r r �<module> s" ,4 Z __pycache__/sepolgeni18n.cpython-39.opt-1.pyc 0000644 00000000612 15025012421 0014647 0 ustar 00 a z f� � @ s< z"d dl Z e jdddd�Zej ZW n dd� ZY n0 dS )� Nzselinux-pythonz/usr/share/localeT)� localedir�fallbackc C s | S )N� )�strr r �9/usr/lib/python3.9/site-packages/sepolgen/sepolgeni18n.py�_ s r )�gettext� translation�tr r r r r �<module> s � __pycache__/audit.cpython-39.pyc 0000644 00000041554 15025012421 0012514 0 ustar 00 a z f�U � @ s� d dl Z d dlZddlmZ ddlmZ ddlmZ dd� Zdd � Zd d � ZG d d � d �Z G dd� de �Z G dd� de �Z d dl m Z i ZG dd� de �ZG dd� de �ZG dd� de �ZG dd� de �ZG dd� d�ZG d d � d �ZG d d � d �ZdS ) � N� )� refpolicy)�access)�utilc C s� ddl } ddl}tdd�}t|�� �� d �}|j |�|�� | �}|�d|�}|�d|�}| j ddd d ||g| j d �� � d }t j r�t �|�}|S ) � Obtain all of the avc and policy load messages from the audit log. This function uses ausearch and requires that the current process have sufficient rights to run ausearch. Returns: string contain all of the audit messages returned by ausearch. r Nz /proc/uptime�rz%xz%X�/sbin/ausearch�-m�5AVC,USER_AVC,MAC_POLICY_LOAD,DAEMON_START,SELINUX_ERRz-ts��stdout)� subprocess�time�open�float�read�split�close� localtime�strftime�Popen�PIPE� communicater �PY3� decode_input)r r �fdZoff�sZbootdateZboottime�output� r �2/usr/lib/python3.9/site-packages/sepolgen/audit.py�get_audit_boot_msgs s �� r c C s8 ddl } | jg d�| jd��� d }tjr4t�|�}|S )r r N)r r r r �r r r r r r r �r r r r r �get_audit_msgs2 s �� r# c C s6 ddl } | jdg| jd��� d }tjr2t�|�}|S )z�Obtain all of the avc and policy load messages from /bin/dmesg. Returns: string contain all of the audit messages returned by dmesg. r Nz /bin/dmesgr r! r" r r r �get_dmesg_msgsA s �� r$ c @ s e Zd ZdZdd� Zdd� ZdS )� AuditMessagez�Base class for all objects representing audit messages. AuditMessage is a base class for all audit messages and only provides storage for the raw message (as a string) and a parsing function that does nothing. c C s || _ d| _d S �N� )�message�header��selfr( r r r �__init__W s zAuditMessage.__init__c C s^ |D ]T}|� d�}t|�dkr<|dd� dkr|| _ dS q|d dkr|d | _ dS qdS ) z�Parse a string that has been split into records by space into an audit message. This method should be overridden by subclasses. Error reporting should be done by raise ValueError exceptions. �=� N� zaudit(r �msgr )r �lenr) �r+ �recsr0 �fieldsr r r �from_split_string[ s z AuditMessage.from_split_stringN��__name__� __module__� __qualname__�__doc__r, r5 r r r r r% P s r% c @ s e Zd ZdZdd� ZdS )�InvalidMessagez�Class representing invalid audit messages. This is used to differentiate between audit messages that aren't recognized (that should return None from the audit message parser) and a message that is recognized but is malformed in some way. c C s t �| |� d S �N�r% r, r* r r r r, v s zInvalidMessage.__init__N�r7 r8 r9 r: r, r r r r r; p s r; c @ s e Zd ZdZdd� Zdd� ZdS )� PathMessagez!Class representing a path messagec C s t �| |� d| _d S r& )r% r, �pathr* r r r r, { s zPathMessage.__init__c C sV t �| |� |D ]@}|�d�}t|�dkr,q|d dkr|d dd� | _ d S qd S )Nr- r. r r@ r ���)r% r5 r r1 r@ r2 r r r r5 s z PathMessage.from_split_stringNr6 r r r r r? y s r? c @ s0 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd S ) � AVCMessagea� AVC message representing an access denial or granted message. This is a very basic class and does not represent all possible fields in an avc message. Currently the fields are: scontext - context for the source (process) that generated the message tcontext - context for the target tclass - object class for the target (only one) comm - the process name exe - the on-disc binary path - the path of the target access - list of accesses that were allowed or denied denial - boolean indicating whether this was a denial (True) or granted (False) message. ioctlcmd - ioctl 'request' parameter An example audit message generated from the audit daemon looks like (line breaks added): 'type=AVC msg=audit(1155568085.407:10877): avc: denied { search } for pid=677 comm="python" name="modules" dev=dm-0 ino=13716388 scontext=user_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=dir' An example audit message stored in syslog (not processed by the audit daemon - line breaks added): 'Sep 12 08:26:43 dhcp83-5 kernel: audit(1158064002.046:4): avc: denied { read } for pid=2 496 comm="bluez-pin" name=".gdm1K3IFT" dev=dm-0 ino=3601333 scontext=user_u:system_r:bluetooth_helper_t:s0-s0:c0 tcontext=system_u:object_r:xdm_tmp_t:s0 tclass=file c C s\ t �| |� t�� | _t�� | _d| _d| _d| _d| _ d| _ g | _ d| _ d | _ tj| _d S )Nr' T)r% r, r �SecurityContext�scontext�tcontext�tclass�comm�exer@ �name�accesses�denial�ioctlcmd� audit2why�TERULE�typer* r r r r, � s zAVCMessage.__init__c C sx d}|}|t |�d kr&td| j ��|t |�k r^|| dkrDd}q^| j�|| � |d }q&|sptd| j ��|d S )NFr �#AVC message in invalid format [%s] �}T)r1 � ValueErrorr( rJ �append)r+ r3 �startZ found_close�ir r r Z__parse_access� s zAVCMessage.__parse_accessc C s� t �| |� d}d}d}d}tt|��D �]R}|| dkrR| �||d �}d}q(n|| dkrdd| _|| �d�}t|�dkr�q(|d d kr�t�|d �| _ d}q(|d d kr�t�|d �| _ d}q(|d d kr�|d | _ d}q(|d d k�r|d dd � | _ q(|d dk�r$|d dd � | _ q(|d dk�rF|d dd � | _q(|d dkr(zt|d d�| _W q( t�yz Y q(0 q(|�r�|�r�|�r�|�s�td| j ��| �� d S )NF�{r TZgrantedr- r. r rD rE rF rG rA rH rI rL � rP )r% r5 �ranger1 �_AVCMessage__parse_accessrK r r rC rD rE rF rG rH rI �intrL rR r( �analyze)r+ r3 Z found_srcZ found_tgtZ found_classZ found_accessrU r4 r r r r5 � sL z AVCMessage.from_split_stringc C s� | j �� }| j�� }t| j�}g | _||| j|ft�� v rXt||| j|f \| _ | _�n�t � ||| j| j�\| _ | _| j t j kr�t j | _ | j t jkr�td| ��| j t jkr�td| ��| j t jkr�td| j ��| j t jkr�tdd�| j� ��| j t jk�rtd��| j t jk�r�| jg| _| jj| j jk�rR| j�d| jj d| j j f� | jj| j jk�r�| j jdk�r�| j�d | jj d | j j f� | jj| j jk�r�| j�d | jj d | j j f� | j | jft||| j|f< d S ) NzInvalid Target Context %s zInvalid Source Context %s zInvalid Type Class %s zInvalid permission %s � z&Error during access vector computationz user (%s)Zobject_rz role (%s)z level (%s))rE Z to_stringrD �tuplerJ �datarF �avcdict�keysrO rM r[ ZNOPOLICYrN ZBADTCONrR ZBADSCONZBADPERM�joinZ BADCOMPUTEZ CONSTRAINT�userrS �role�level)r+ rE rD Z access_tupler r r r[ � s8 zAVCMessage.analyzeN)r7 r8 r9 r: r, rY r5 r[ r r r r rB � s -rB c @ s e Zd ZdZdd� ZdS )�PolicyLoadMessagez6Audit message indicating that the policy was reloaded.c C s t �| |� d S r< r= r* r r r r, s zPolicyLoadMessage.__init__Nr> r r r r re s re c @ s e Zd ZdZdd� Zdd� ZdS )�DaemonStartMessagez3Audit message indicating that a daemon was started.c C s t �| |� d| _d S �NF)r% r, �auditdr* r r r r, % s zDaemonStartMessage.__init__c C s t �| |� d|v rd| _d S )Nrh T)r% r5 rh �r+ r3 r r r r5 ) s z$DaemonStartMessage.from_split_stringNr6 r r r r rf # s rf c @ s( e Zd ZdZdd� Zdd� Zdd� ZdS ) �ComputeSidMessagea� Audit message indicating that a sid was not valid. Compute sid messages are generated on attempting to create a security context that is not valid. Security contexts are invalid if the role is not authorized for the user or the type is not authorized for the role. This class does not store all of the fields from the compute sid message - just the type and role. c C s4 t �| |� t�� | _t�� | _t�� | _d| _d S r& )r% r, r rC �invalid_contextrD rE rF r* r r r r, 9 s zComputeSidMessage.__init__c C s� t �| |� t|�dk r td��z\t�|d �| _t�|d �d�d �| _t�|d �d�d �| _ |d �d�d | _ W n td��Y n0 d S ) N� z;Split string does not represent a valid compute sid message� � r- r � � ) r% r5 r1 rR r rC rk r rD rE rF ri r r r r5 @ s z#ComputeSidMessage.from_split_stringc C s d| j | jf S )Nzrole %s types %s; )rc rO �r+ r r r r L s zComputeSidMessage.outputN)r7 r8 r9 r: r, r5 r r r r r rj / s rj c @ s^ e Zd ZdZddd�Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z ddd�Z ddd�Z dS )� AuditParsera� Parser for audit messages. This class parses audit messages and stores them according to their message type. This is not a general purpose audit message parser - it only extracts selinux related messages. Each audit messages are stored in one of four lists: avc_msgs - avc denial or granted messages. Messages are stored in AVCMessage objects. comput_sid_messages - invalid sid messages. Messages are stored in ComputSidMessage objects. invalid_msgs - selinux related messages that are not valid. Messages are stored in InvalidMessageObjects. policy_load_messages - policy load messages. Messages are stored in PolicyLoadMessage objects. These lists will be reset when a policy load message is seen if AuditParser.last_load_only is set to true. It is assumed that messages are fed to the parser in chronological order - time stamps are not parsed. Fc C s | � � || _d S r< )�_AuditParser__initialize�last_load_only)r+ rt r r r r, g s zAuditParser.__init__c C s. g | _ g | _g | _g | _g | _i | _d| _d S rg )�avc_msgs�compute_sid_msgs� invalid_msgs�policy_load_msgs� path_msgs� by_header�check_input_filerq r r r Z __initializek s zAuditParser.__initializec C s� dd� |� � D �}|D ]�}d}|dks6|dks6|dkrDt|�}d}n^|dkrZt|�}d}nH|d ksj|d krxt|�}d}n*|d kr�t|�}d}n|d kr�tt�}d}|rd| _z|�|� W n t y� t |�}Y n0 | S qd S ) Nc S s g | ]}|� d ��qS )u )�strip)�.0�xr r r � <listcomp>� � z,AuditParser.__parse_line.<locals>.<listcomp>Fzavc:z message=avc:z msg='avc:Tzsecurity_compute_sid:ztype=MAC_POLICY_LOADz type=1403z type=AVC_PATHztype=DAEMON_START) r rB rj re r? rf �listr{ r5 rR r; )r+ �lineZrecrU �foundr0 r r r Z __parse_line� s4 zAuditParser.__parse_linec C s� | � |�}|d u rd S t|t�r0| jr�| �� n�t|t�r\|jrN| jrN| �� | j�|� n^t|t �rt| j �|� nFt|t �r�| j �|� n.t|t �r�| j�|� nt|t�r�| j�|� |jdkr�|j| jv r�| j|j �|� n|g| j|j< d S r& )�_AuditParser__parse_line� isinstancere rt rs rf rh rx rS rB ru rj rv r; rw r? ry r) rz )r+ r� r0 r r r Z__parse� s, zAuditParser.__parsec C sl | j �� D ]\}g }d }|D ](}t|t�r.|}qt|t�r|�|� qt|�dkr |r |D ] }|j|_qXq d S )Nr )rz �valuesr� r? rB rS r1 r@ )r+ �value�avcr@ r0 �ar r r Z__post_process� s zAuditParser.__post_processc C sH |� � }|r | �|� |� � }q| js<tj�d� t�d� | �� dS )zpParse the contents of a file object. This method can be called multiple times (along with parse_string).zNothing to do r N)�readline�_AuditParser__parser{ �sys�stderr�write�exit�_AuditParser__post_process)r+ �inputr� r r r � parse_file� s zAuditParser.parse_filec C s* |� d�}|D ]}| �|� q| �� dS )z�Parse a string containing audit messages - messages should be separated by new lines. This method can be called multiple times (along with parse_file).� N)r r� r� )r+ r� �lines�lr r r � parse_string� s zAuditParser.parse_stringNc C s: t �� }| jD ]&}|r |�|�r|�|jj|jj� q|S )ao Return RoleAllowSet statements matching the specified filter Filter out types that match the filer, or all roles Params: role_filter - [optional] Filter object used to filter the output. Returns: Access vector set representing the denied access in the audit logs parsed by this object. )r Z RoleTypeSetrv �filter�addrk rc rO )r+ Z role_filterZ role_types�csr r r �to_role� s zAuditParser.to_roleTc C s� t �� }| jD ]�}|jdkr"|r"q|r0|�|�rt �|jj|jj|j g|j �}|j |_ |j|_|j r�t �� }|�|j � ||jd< |j||d� q|S )a� Convert the audit logs access into a an access vector set. Convert the audit logs into an access vector set, optionally filtering the restults with the passed in filter object. Filter objects are object instances with a .filter method that takes and access vector and returns True if the message should be included in the final output and False otherwise. Params: avc_filter - [optional] Filter object used to filter the output. Returns: Access vector set representing the denied access in the audit logs parsed by this object. TZioctl)Z audit_msg)r ZAccessVectorSetru rK r� Z AccessVectorrD rO rE rF rJ r^ rL r ZXpermSetr� ZxpermsZadd_av)r+ Z avc_filterZ only_denialsZav_setr� �avZ xperm_setr r r � to_access� s$ �� zAuditParser.to_access)F)N)NT) r7 r8 r9 r: r, rs r� r� r� r� r� r� r� r r r r rr Q s $% rr c @ s e Zd Zdd� Zdd� ZdS )� AVCTypeFilterc C s t �|�| _d S r< ��re�compile�regex�r+ r� r r r r, % s zAVCTypeFilter.__init__c C s, | j �|jj�rdS | j �|jj�r(dS dS �NTF)r� �matchrD rO rE �r+ r� r r r r� ( s zAVCTypeFilter.filterN�r7 r8 r9 r, r� r r r r r� $ s r� c @ s e Zd Zdd� Zdd� ZdS )�ComputeSidTypeFilterc C s t �|�| _d S r< r� r� r r r r, 0 s z ComputeSidTypeFilter.__init__c C s@ | j �|jj�rdS | j �|jj�r(dS | j �|jj�r<dS dS r� )r� r� rk rO rD rE r� r r r r� 3 s zComputeSidTypeFilter.filterNr� r r r r r� / s r� )r� r� r' r r r r r# r$ r% r; r? Zselinux.audit2whyrM r_ rB re rf rj rr r� r� r r r r �<module> s* " T __pycache__/output.cpython-39.opt-1.pyc 0000644 00000006731 15025012421 0013703 0 ustar 00 a z f, � @ sp d Z ddlmZ ddlmZ ejr.ddlmZ G dd� d�Zdd� Zd d � Zd d � Z d d� Z dd� Z dd� Z dS )ai Classes and functions for the output of reference policy modules. This module takes a refpolicy.Module object and formats it for output using the ModuleWriter object. By separating the output in this way the other parts of Madison can focus solely on generating policy. This keeps the semantic / syntactic issues cleanly separated from the formatting issues. � )� refpolicy)�util)�cmpc @ s e Zd Zdd� Zdd� ZdS )� ModuleWriterc C s d | _ d | _d| _d| _d S )NT)�fd�module�sort�requires)�self� r �3/usr/lib/python3.9/site-packages/sepolgen/output.py�__init__& s zModuleWriter.__init__c C sF || _ | jrt| j � tj| j dd�D ]\}}|�dt|� � q&d S )NT)Z showdepthz%s )r r � sort_filterr Zwalktree�write�str)r r r �node�depthr r r r , s zModuleWriter.writeN)�__name__� __module__� __qualname__r r r r r r r % s r c C s� t �| �}|�� t �|�}|�� t|�t|�krFt|d |d �S t||�D ]*}|d |d krPt|d |d � S qPdS )N� r )r Z set_to_listr �lenr �zip)�x�yZxlZyl�vr r r � id_set_cmp= s r c C sR t | j|j�}|dkr|S t | j|j�}|dkr4|S t | j|j�}|dkrN|S dS �Nr )r � src_typesZ tgt_typesZ obj_classes)�a�b�retr r r � avrule_cmpK s r" c C s8 | j d |j d kr*t| j d |j d �S t| j|j�S r )�argsr Zifname�r r r r r � ifcall_cmpZ s r% c C sr t | tj�r8t |tj�r"t| |�S t| jd g|j�S n6t |tj�sPt |tj�rZt | |�S t| j|jd g�S d S r ) � isinstancer � InterfaceCallr% r r# r ZAVRuleZ AVExtRuler" r$ r r r �rule_cmp` s r( c C s t | j|j�S )N)r Zroler$ r r r � role_type_cmpl s r) c C s" dd� }| � � D ] }||� qdS )z/Sort and group the output for readability. c S s� g }| � � D ] }|�|� |�t�� � q | �� D ]}|�|� q2|�t�� � g }|�| �� � |�| �� � |�| �� � |j t � t �d� d }g }|D ]t}t |tj�r�|jd }n t �|j�}||k�r|r�|�t�� � |}t�� } | j�d| � |�| � |�|� q�|�|� g } | �| �� � | j t � t�d� t| ��rht�� } | j�d� |�| � |�| � | jD ]} | |v�rx|�| � �qx|| _d S )N)�keyr z ============= %s ==============z"============= ROLES ==============)Zmodule_declarations�appendr �Commentr �extendZavrulesZ avextrulesZinterface_callsr r � cmp_to_keyr( r& r' r# �firstr �linesZ role_typesr) r Zchildren) r �c�modZrequireZrulesZcurZ sep_rulesZruler ZcommentZras�childr r r � sort_noder sN z sort_filter.<locals>.sort_nodeN)Znodes)r r4 r r r r r o s = r N) �__doc__� r r ZPY3r r r r" r% r( r) r r r r r �<module> s __pycache__/objectmodel.cpython-39.opt-1.pyc 0000644 00000007603 15025012421 0014631 0 ustar 00 a z fw � @ sb d Z g d�ZdZdZdZeeB Zeeeed�Zedededed iZG d d � d �ZG d d � d �Z dS )z� This module provides knowledge object classes and permissions. It should be used to keep this knowledge from leaking into the more generic parts of the policy generation. ) Zsocket�fdZprocess�fileZlnk_fileZ fifo_fileZdbusZ capabilityZunix_stream_socket� � � )�n�r�w�br r r r c @ s e Zd ZdZdd� Zdd� ZdS )�PermMapa A mapping between a permission and its information flow properties. PermMap represents the information flow properties of a single permission including the direction (read, write, etc.) and an abstract representation of the bandwidth of the flow (weight). c C s || _ || _|| _d S �N)�perm�dir�weight)�selfr r r � r �8/usr/lib/python3.9/site-packages/sepolgen/objectmodel.py�__init__T s zPermMap.__init__c C s d| j t| j | jf S )Nz'<sepolgen.objectmodel.PermMap %s %s %d>)r � dir_to_strr r �r r r r �__repr__Y s �zPermMap.__repr__N)�__name__� __module__� __qualname__�__doc__r r r r r r r M s r c @ s@ e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dS )� PermMappingsz�The information flow properties of a set of object classes and permissions. PermMappings maps one or more classes and permissions to their PermMap objects describing their information flow characteristics. c C s i | _ d| _t| _d S )N� )�classes�default_weight� FLOW_BOTH� default_dirr r r r r d s zPermMappings.__init__c C s� d}|D ]�}|� � }t|�dkst|�dks|d dkr:q|d dkrv|d }|| jv r`td��i | j|< | j| }qt|�dkr�td��|du r�td ��t|d t|d t|d ��}|||j< qdS ) zsRead the permission mappings from a file. This reads the format used by Apol in the setools suite. Nr r �#�classzduplicate class in perm map� z!error in object class permissionszpermission outside of classr )�split�lenr � ValueErrorr � str_to_dir�intr )r r Zcur�line�fields�c�pmr r r � from_filei s" $ zPermMappings.from_filec C s | j | | S )z�Get the permission map for the object permission. Returns: PermMap representing the permission Raises: KeyError if the object or permission is not defined )r )r �objr r r r �get� s zPermMappings.getc C s: z| j | | }W n" ty4 t|| j| j� Y S 0 |S )a Get the permission map for the object permission or a default. getdefault is the same as get except that a default PermMap is returned if the object class or permission is not defined. The default is FLOW_BOTH with a weight of 5. )r �KeyErrorr r r )r r- r r+ r r r � getdefault� s zPermMappings.getdefaultc C s( t }|D ]}| �||�}||jB }q|S r )� FLOW_NONEr0 r )r r- �permsr r r+ r r r �getdefault_direction� s z!PermMappings.getdefault_directionc C s( d}|D ]}| � ||�}||j7 }q|S )Nr )r0 r )r r- r2 �totalr r+ r r r �getdefault_distance� s z PermMappings.getdefault_distanceN) r r r r r r, r. r0 r3 r5 r r r r r ^ s r N) r Zimplicitly_typed_objectsr1 Z FLOW_READZ FLOW_WRITEr r& r r r r r r r �<module> s __pycache__/defaults.cpython-39.opt-1.pyc 0000644 00000004372 15025012421 0014151 0 ustar 00 a z fU � @ sT d dl Z d dlZG dd� de�Zdd� Zdd� Zdd � Zd d � Zd d � Zdd� Z dS )� Nc @ s e Zd Zdd� Zddd�ZdS )� PathChooserc C s� t � | _tj�|�s(d| _d| jd< d S || _t�d�}t�d�}t|d��f}t |�D ]L\}}|� |�rjqV|� |�}|s�t d||d f ��|� d �| j|� d�< qVW d � n1 s�0 Y d S ) Nz (defaults)zJ/usr/share/selinux/default:/usr/share/selinux/mls:/usr/share/selinux/devel�SELINUX_DEVEL_PATHz ^\s*(?:#.+)?$z^\s*(\w+)\s*=\s*(.+?)\s*$�rz(%s:%d: line is not in key = value format� � ) �dict�config�os�path�exists�config_pathname�re�compile�open� enumerate�match� ValueError�group)�self�pathname�ignoreZconsider�fd�lineno�line�mo� r �5/usr/lib/python3.9/site-packages/sepolgen/defaults.py�__init__ s zPathChooser.__init__r c C sp | j �|d �}|d u r(td|| jf ��|�d�}|D ]&}tj�||�}tj�|�r6| S q6tj�|d |�S )Nz%s was not in %s�:r ) r �getr r �splitr r �joinr )r Z testfilenameZpathset�paths�p�targetr r r �__call__, s zPathChooser.__call__N)r )�__name__� __module__� __qualname__r r% r r r r r s r c C s dS )Nz/var/lib/sepolgenr r r r r �data_dir; s r) c C s t � d S )Nz /perm_map�r) r r r r �perm_map> s r+ c C s t � d S )Nz/interface_infor* r r r r �interface_infoA s r, c C s t � d S )Nz/attribute_infor* r r r r �attribute_infoD s r- c C s( t d�} | d�}tj�|�s$| d�}|S )N�/etc/selinux/sepolgen.confZMakefilezinclude/Makefile)r r r r )�chooser�resultr r r �refpolicy_makefileG s r1 c C s t d�} | d�S )Nr. Zinclude)r )r/ r r r �headersN s r2 ) r r �objectr r) r+ r, r- r1 r2 r r r r �<module> s " __pycache__/classperms.cpython-39.opt-1.pyc 0000644 00000004647 15025012421 0014523 0 ustar 00 a z f � @ s� d dl Z dZddiZdZdZdZdZd Zd Zd Z d Z d Z dd� Z dd� Z ddlmZ e�� dd� Zdd� Zdd� Zdd� Zd d � Zdd lmZ e�� ed �Ze�� Ze�� d Zd!Z e� e�Z e e � dS )"� N) �DEFINE�NAMEZTICKZSQUOTEZOBRACEZCBRACE�SEMIZOPARENZCPAREN�COMMAZdefiner z\`z\'z\{z\}z\;z\(z\)z\,z c C s t �| jd�| _| S )z[a-zA-Z_][a-zA-Z0-9_]*r )�reserved�get�value�type��t� r �7/usr/lib/python3.9/site-packages/sepolgen/classperms.py�t_NAME. s r c C s t d| jd � | �d� d S )NzIllegal character '%s'r � )�printr �skipr r r r �t_error3 s r r )�lexc C s8 t | �dkr | d g| d< n| d g| d g | d< dS )zHstatements : define_stmt | define_stmt statements � r r N��len��pr r r � p_statements: s r c C s | d | d g| d< dS )zOdefine_stmt : DEFINE OPAREN TICK NAME SQUOTE COMMA TICK list SQUOTE CPAREN � � r Nr r r r r � p_define_stmtC s r c C s, | d dkr| d | d< n| d g| d< dS )z2list : NAME | OBRACE names CBRACE r �{r r Nr r r r r �p_listJ s r c C s6 t | �dkr | d g| d< n| d g| d | d< dS )z+names : NAME | NAME names r r r Nr r r r r �p_namesS s r c C s t d| j| j| jf � d S )Nz$Syntax error on line %d %s [type=%s])r �linenor r r r r r �p_error\ s r! )�yaccz all_perms.sptz%define(`foo',`{ read write append }')a2 define(`all_filesystem_perms',`{ mount remount unmount getattr relabelfrom relabelto transition associate quotamod quotaget }') define(`all_security_perms',`{ compute_av compute_create compute_member check_context load_policy compute_relabel compute_user setenforce setbool setsecparam setcheckreqprot }') ) �sys�tokensr Zt_TICKZt_SQUOTEZt_OBRACEZt_CBRACEZt_SEMIZt_OPARENZt_CPARENZt_COMMAZt_ignorer r � r r r r r r! r" �open�f�readZtxt�close�testZtest2�parse�resultr r r r r �<module> s< � __pycache__/util.cpython-39.pyc 0000644 00000014334 15025012421 0012357 0 ustar 00 a z fj � @ s� d dl Z d dlZejd dkZer,eZeZneZeZG dd� d�Z dd� Z ddd �Z d d � Z d d � Z G dd� d�Zejdk r�dd� Zn d dlmZ dd� Zedkr�d dlZe ejdd�Ze�d� ed�D ]Ze�� e�d� q�dS ) � N� c @ s* e Zd Zd dd�Zd dd�Zd d d �ZdS )�ConsoleProgressBar�d �#c C s( d| _ d| _|| _|| _|| _d| _d S )Nr F)�blocks�current�steps� indicator�out�done)�selfr r r � r �1/usr/lib/python3.9/site-packages/sepolgen/util.py�__init__" s zConsoleProgressBar.__init__Nc C s* d| _ |r| j�d| � | j�d� d S )NFz %s: z3%--10---20---30---40---50---60---70---80---90--100 )r r �write)r �messager r r �start* s zConsoleProgressBar.start� c C s� | j |7 _ | j}tt| j t| j� d �d �| _| jdkrFd| _| j| }| j�| j| � | j� � | jdkr�| j s�d| _ | j�d� d S )Nr � �2 T� ) r r �int�round�floatr r r r �flushr )r �n�old�newr r r �step0 s " zConsoleProgressBar.step)r r )N)r )�__name__� __module__� __qualname__r r r r r r r r ! s r c C s g }|� | � |S �N)�extend)�s�lr r r � set_to_listB s r& Fc C s@ t | �std��|r,t| �}|�� |d S | D ] }| S dS )a� Return the first element of a set. It sometimes useful to return the first element from a set but, because sets are not indexable, this is rather hard. This function will return the first element from a set. If sorted is True, then the set will first be sorted (making this an expensive operation). Otherwise a random element will be returned (as sets are not ordered). zempty containerr N)�len� IndexErrorr& �sort)r$ �sortedr% �xr r r �firstG s r, c C s8 t �� }z| �|�}W n ty2 | �d�}Y n0 |S )z/Encode given text via preferred system encoding�utf-8)�locale�getpreferredencoding�encode� UnicodeError)�text�encodingZ encoded_textr r r � encode_input\ s r4 c C s8 t �� }z| �|�}W n ty2 | �d�}Y n0 |S )z/Decode given text via preferred system encodingr- )r. r/ �decoder1 )r2 r3 Z decoded_textr r r � decode_inputi s r6 c @ sH e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dS )� Comparisonz�Class used when implementing rich comparison. Inherit from this class if you want to have a rich comparison within the class, afterwards implement _compare function within your class.c C s t S r" )�NotImplemented)r �other�methodr r r �_compare} s zComparison._comparec C s | � |dd� �S )Nc S s | |kS r" r ��a�br r r �<lambda>� � z#Comparison.__eq__.<locals>.<lambda>�r; �r r9 r r r �__eq__� s zComparison.__eq__c C s | � |dd� �S )Nc S s | |k S r" r r< r r r r? � r@ z#Comparison.__lt__.<locals>.<lambda>rA rB r r r �__lt__� s zComparison.__lt__c C s | � |dd� �S )Nc S s | |kS r" r r< r r r r? � r@ z#Comparison.__le__.<locals>.<lambda>rA rB r r r �__le__� s zComparison.__le__c C s | � |dd� �S )Nc S s | |kS r" r r< r r r r? � r@ z#Comparison.__ge__.<locals>.<lambda>rA rB r r r �__ge__� s zComparison.__ge__c C s | � |dd� �S )Nc S s | |kS r" r r< r r r r? � r@ z#Comparison.__gt__.<locals>.<lambda>rA rB r r r �__gt__� s zComparison.__gt__c C s | � |dd� �S )Nc S s | |kS r" r r< r r r r? � r@ z#Comparison.__ne__.<locals>.<lambda>rA rB r r r �__ne__� s zComparison.__ne__N) r r r! �__doc__r; rC rD rE rF rG rH r r r r r7 v s r7 )r � c s G � fdd�d�}|S )z,Convert a cmp= function into a key= functionc s\ e Zd Zdd� Z� fdd�Z� fdd�Z� fdd�Z� fd d �Z� fd d �Z� fd d�Z dS )zcmp_to_key.<locals>.Kc W s || _ d S r" ��obj)r rL �argsr r r r � s z cmp_to_key.<locals>.K.__init__c s � | j |j �dk S �Nr rK rB ��mycmpr r rD � s z cmp_to_key.<locals>.K.__lt__c s � | j |j �dkS rN rK rB rO r r rG � s z cmp_to_key.<locals>.K.__gt__c s � | j |j �dkS rN rK rB rO r r rC � s z cmp_to_key.<locals>.K.__eq__c s � | j |j �dkS rN rK rB rO r r rE � s z cmp_to_key.<locals>.K.__le__c s � | j |j �dkS rN rK rB rO r r rF � s z cmp_to_key.<locals>.K.__ge__c s � | j |j �dkS rN rK rB rO r r rH � s z cmp_to_key.<locals>.K.__ne__N) r r r! r rD rG rC rE rF rH r rO r r �K� s rQ r )rP rQ r rO r � cmp_to_key� s rR )rR c C s | |k|| k S r" r )r, �secondr r r �cmp� s rT �__main__i� )r z computing pig����MbP?)F)r. �sys� version_infoZPY3�bytesZ bytes_type�strZ string_typeZunicoder r& r, r4 r6 r7 rR � functoolsrT r �time�stdout�pr �range�ir �sleepr r r r �<module> s0 ! __pycache__/lex.cpython-39.pyc 0000644 00000051601 15025012421 0012170 0 ustar 00 a z f�� � @ s: d Z dZddlZddlZddlZddlZddlZddlZzejej fZ W n e yb e e fZ Y n0 e�d�ZG dd� de�ZG dd� de�ZG d d � d e�ZG d d � d e�ZG d d� d�Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Z G dd � d e�Z ddd d d e ej �d dddf d d �Z d%d!d"�Z!d#d$� Z"e"Z#dS )&z3.11z3.10� Nz^[a-zA-Z0-9_]+$c @ s e Zd Zdd� ZdS )�LexErrorc C s |f| _ || _d S �N)�args�text)�self�message�s� r �0/usr/lib/python3.9/site-packages/sepolgen/lex.py�__init__: s zLexError.__init__N)�__name__� __module__� __qualname__r r r r r r 9 s r c @ s e Zd Zdd� Zdd� ZdS )�LexTokenc C s d| j | j| j| jf S )NzLexToken(%s,%r,%d,%d))�type�value�lineno�lexpos�r r r r �__str__A s zLexToken.__str__c C s t | �S r )�strr r r r �__repr__D s zLexToken.__repr__N)r r r r r r r r r r @ s r c @ s4 e Zd Zdd� Zdd� Zdd� Zdd� ZeZeZd S ) � PlyLoggerc C s || _ d S r ��f)r r r r r r L s zPlyLogger.__init__c O s | j �|| d � d S )N� �r �write�r �msgr �kwargsr r r �criticalO s zPlyLogger.criticalc O s | j �d|| d � d S )Nz WARNING: r r r r r r �warningR s zPlyLogger.warningc O s | j �d|| d � d S )NzERROR: r r r r r r �errorU s zPlyLogger.errorN) r r r r r! r" r# �info�debugr r r r r K s r c @ s e Zd Zdd� Zdd� ZdS )� NullLoggerc C s | S r r )r �namer r r �__getattribute__^ s zNullLogger.__getattribute__c O s | S r r )r r r r r r �__call__a s zNullLogger.__call__N)r r r r( r) r r r r r& ] s r& c @ s| e Zd Zdd� Zd dd�Zd dd�Zd d � Zd d � Zd d� Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd � ZeZdS ) �Lexerc C s� d | _ d | _i | _i | _i | _d| _g | _d | _i | _i | _ i | _ d| _ d | _ d| _ d| _d | _d | _d | _d| _d| _d | _d| _d| _d S )N�INITIALr � � F)�lexre� lexretext� lexstatere�lexstateretext�lexstaterenames�lexstate� lexstatestack� lexstateinfo�lexstateignore�lexstateerrorf� lexstateeoff� lexreflags�lexdatar �lexlen� lexerrorf�lexeoff� lextokens� lexignore� lexliterals� lexmoduler � lexoptimizer r r r r t s. zLexer.__init__Nc C s� t � | �}|r�i }| j�� D ]t\}}g }|D ]L\}}g } |D ]:} | rL| d sX| �| � q<| �t|| d j�| d f� q<q,|�|| f� |||< q ||_i |_| j�� D ]\}} t|| j�|j|< q�||_|S �Nr r- )�copyr0 �items�append�getattrr r7 rA ) r �object�cZnewtab�keyZritemZnewreZcreZfindexZ newfindexr �efr r r �clone� s( " z Lexer.cloner, c C s� t |tj�rtd��|�d�d }tj�||�d }t|d����}|� d|t f � |� dt t � � |� dt t t| j��� � |� d t t| j�� � |� d t | j� � |� d t | j� � i }| j�� D ]P\}}g } t|| j| | j| �D ]"\\} } } } | �| t| | �f� q�| ||< q�|� d t |� � |� d t | j� � i }| j �� D ] \}}|�rj|j nd ||< �qV|� dt |� � i }| j �� D ] \}}|�r�|j nd ||< �q�|� dt |� � W d � n1 �s�0 Y d S )Nz&Won't overwrite existing lextab module�.���z.py�wzJ# %s.py. This file automatically created by PLY (version %s). Don't edit! z_tabversion = %s z_lextokens = set(%s) z_lexreflags = %s z_lexliterals = %s z_lexstateinfo = %s z_lexstatere = %s z_lexstateignore = %s z_lexstateerrorf = %s z_lexstateeoff = %s ) � isinstance�types� ModuleType�IOError�split�os�path�join�openr � __version__�repr�__tabversion__�tuple�sortedr> �intr9 r@ r5 r0 rE �zipr1 r2 rF �_funcs_to_namesr6 r7 r r8 )r �lextab� outputdirZ basetabmodule�filenameZtfZtabre� statename�lre�titem�pat�funcZretext�renamesZtaberrrK Ztabeofr r r �writetab� s6 & zLexer.writetabc C sB t |tj�r|}ntd| � tj| }t|dd�tkr@td��|j | _ |j | _ |j | _| j t| j�B | _|j| _|j| _i | _i | _|j�� D ]P\}}g }g }|D ]&\}} |�t�||j �t | |�f� q�|| j|< || j|< q�i | _ |j �� D ]\}} || | j |< q�i | _ |j �� D ]\}} || | j |< �q| �!d� d S )N� import %sZ _tabversionz0.0zInconsistent PLY versionr+ )"rP rQ rR �exec�sys�modulesrG r[ � ImportErrorZ _lextokensr> Z _lexreflagsr9 Z _lexliteralsr@ �set� lextokens_allZ _lexstateinfor5 Z_lexstateignorer6 r0 r1 Z _lexstatererE rF �re�compile�_names_to_funcsr7 Z_lexstateerrorfr8 Z _lexstateeoff�begin) r Ztabfile�fdictra rd re rf Ztxtitemrg Z func_namerK r r r �readtab� s8 z Lexer.readtabc C s8 |d d� }t |t�s td��|| _d| _t|�| _d S )Nr- zExpected a stringr )rP � StringTypes� ValueErrorr: r �lenr; )r r rI r r r �input� s z Lexer.inputc C sd || j vrtd��| j | | _| j| | _| j�|d�| _| j�|d �| _ | j �|d �| _ || _ d S )NzUndefined stater, ) r0 ry r. r1 r/ r6 �getr? r7 r< r8 r= r3 �r �stater r r ru s z Lexer.beginc C s | j �| j� | �|� d S r )r4 rF r3 ru r} r r r � push_state s zLexer.push_statec C s | � | j�� � d S r )ru r4 �popr r r r � pop_state s zLexer.pop_statec C s | j S r )r3 r r r r � current_state! s zLexer.current_statec C s | j |7 _ d S r )r )r �nr r r �skip' s z Lexer.skipc C s~ | j }| j}| j}| j}||k �r|| |v r8|d7 }q| jD ]�\}}|�||�}|sXq>t� }|�� |_| j |_ ||_ |j } || \} |_ | s�|j r�|� � | _ | S |� � } q|� � }| |_ || _|| _ | |�} | s�| j }| j} q| j�s(| j | jv�r(td| jj| jj| j| j f ||d � ��| S || | jv �rtt� }|| |_| j |_ |j|_ ||_ |d | _ |S | j�r�t� }| j|d � |_| j |_ d|_ | |_ ||_ || _ | �|�} || j k�r�td|| ||d � ��| j }| �s�q| S || _ td|| |f ||d � ��q| j�r\t� }d|_ d|_| j |_ ||_ | |_ || _ | �|�} | S |d | _ | jd u �rztd��d S ) Nr- z4%s:%d: Rule '%s' returned an unknown token type '%s'r# z&Scanning error. Illegal character '%s'z"Illegal character '%s' at index %d�eofr, z"No input string given with input())r r; r? r: r. �matchr �groupr r � lastindexr �end�lexerZlexmatchrB rq r �__code__� co_filename�co_firstlinenor r@ r< r= � RuntimeError) r r r; r? r: r. � lexindexfunc�m�tok�irh Znewtokr r r �token1 s� � � z Lexer.tokenc C s | S r r r r r r �__iter__� s zLexer.__iter__c C s | � � }|d u rt�|S r )r� � StopIteration)r �tr r r �next� s z Lexer.next)N)r, )r r r r rL rj rw r{ ru r r� r� r� r� r� r� �__next__r r r r r* s s %( nr* c C s t | d| j�S )N�regex)rG �__doc__)rh r r r � _get_regex� s r� c C s0 t �| �}|j�� }|j|jkr,|�|j� |S r )rm � _getframe� f_globalsrD �f_locals�update)Zlevelsr �ldictr r r �get_caller_module_dict� s r� c C sF g }t | |�D ]2\}}|r6|d r6|�||d f� q|�|� q|S rC )r_ rF )Zfunclist�namelist�resultr r' r r r r` � s r` c C sD g }| D ]6}|r4|d r4|� ||d |d f� q|� |� q|S rC )rF )r� rv r� r� r r r rt � s rt c C sd | sg S d� | �}z�t�||�}d gt|j�� �d }|d d � }|j�� D ]z\}} |�|d �} t| �t j t j fv r�| || f|| < ||| < qN| d urN||| < |� d�dkr�d|| < qNd || f|| < qN||fg|g|gfW S t �y^ tt| �d �} | dk�r d} t| d | � |||�\} } }t| | d � |||�\}}}| | | | || f Y S 0 d S )N�|r- �ignore_r )NN� )rW rr rs �max� groupindex�valuesrE r| r rQ � FunctionType� MethodType�find� Exceptionr^ rz �_form_master_re)Zrelist�reflagsr� �toknamesr� r. r� Z lexindexnamesr r� Zhandler� Zllistre ZlnamesZrlistZrreZrnamesr r r r� � s2 r� c C s� | � d�}t|dd � d�D ] \}}||vr |dkr q:q |dkrTt|d|� �}nd}d|v rht|�}d�||d � �}||fS )N�_r- �ANY)r+ )rT � enumerater\ rW )r �names�partsr� �part�statesZ tokennamer r r � _statetoken s r� c @ sf e Zd Zddd�Zdd� Zdd� Zd d � Zd d � Zd d� Zdd� Z dd� Z dd� Z dd� Z dd� Z dS )� LexerReflectNr c C sL || _ d | _g | _|| _ddi| _t� | _d| _|d u rBtt j �n|| _ d S )Nr+ � inclusiveF) r� Z error_func�tokensr� � stateinforp rn r# r rm �stderr�log)r r� r� r� r r r r . s zLexerReflect.__init__c C s$ | � � | �� | �� | �� d S r )� get_tokens� get_literals� get_states� get_rulesr r r r �get_all9 s zLexerReflect.get_allc C s | � � | �� | �� | jS r )�validate_tokens�validate_literals�validate_rulesr# r r r r � validate_all@ s zLexerReflect.validate_allc C sp | j �dd �}|s(| j�d� d| _d S t|ttf�sL| j�d� d| _d S |sf| j�d� d| _d S || _d S )Nr� zNo token list is definedTz tokens must be a list or tupleztokens is empty)r� r| r� r# rP �listr\ r� )r r� r r r r� G s zLexerReflect.get_tokensc C sP i }| j D ]@}t�|�s,| j�d|� d| _||v rB| j�d|� d||< q d S )NzBad token name '%s'TzToken '%s' multiply definedr- )r� �_is_identifierr� r� r# r" )r Z terminalsr� r r r r� [ s z LexerReflect.validate_tokensc C s | j �dd�| _| js d| _d S )N�literalsr, )r� r| r� r r r r r� f s zLexerReflect.get_literalsc C sh z>| j D ]2}t|t�r"t|�dkr| j�dt|�� d| _qW n$ tyb | j�d� d| _Y n0 d S )Nr- z.Invalid literal %s. Must be a single characterTzIInvalid literals specification. literals must be a sequence of characters)r� rP rx rz r� r# rZ � TypeError)r rI r r r r� l s z LexerReflect.validate_literalsc C s� | j �dd �| _| jr�t| jttf�s:| j�d� d| _n�| jD ]�}t|t�rZt|�dkrt| j�dt |�� d| _q@|\}}t|t �s�| j�dt |�� d| _q@|dks�|dks�| j�d |� d| _q@|| j v r�| j�d |� d| _q@|| j |< q@d S ) Nr� z)states must be defined as a tuple or listTr� zMInvalid state specifier %s. Must be a tuple (statename,'exclusive|inclusive')z State name %s must be a stringr� � exclusivez:State type for state %s must be 'inclusive' or 'exclusive'zState '%s' already defined) r� r| r� rP r\ r� r� r# rz rZ rx r� )r r r' Z statetyper r r r� w s0 zLexerReflect.get_statesc C s, dd� | j D �}i | _i | _i | _i | _i | _i | _| jD ]}g | j|< g | j|< q:t|�dkrv| j � d� d| _ d S |D �]d}| j | }t || j�\}}|| j|< t |d��rD|dkr�|D ]}|| j|< q�nt|dkr�|D ]}|| j|< q�nV|d k�r"|j j}|j j}| j � d |||j� d| _ n |D ]}| j| �||f� �q&qzt|t��r�|d k�r�|D ]}|| j|< �q^d |v �r�| j �d |� n@|dk�r�| j � d |� d| _ n |D ]}| j| �||f� �q�qz| j � d|� d| _ qz| j�� D ]}|jdd� d� �q�| j�� D ]}|jdd� dd� �qd S )Nc S s g | ]}|d d� dkr|�qS )Nr� Zt_r )�.0r r r r � <listcomp>� � z*LexerReflect.get_rules.<locals>.<listcomp>r z+No rules of the form t_rulename are definedTr) r# r� �ignorez,%s:%d: Rule '%s' must be defined as a string�\z#%s contains a literal backslash '\'�'Rule '%s' must be defined as a functionz&%s not defined as a function or stringc S s | d j jS �Nr- )r� r� ��xr r r �<lambda>� r� z(LexerReflect.get_rules.<locals>.<lambda>)rJ c S s t | d �S r� )rz r� r r r r� � r� )rJ �reverse)r� r� �funcsym�strsymr� �errorf�eoffr� rz r� r# r� �hasattrr� r� r� r rF rP rx r" r� �sort) r Ztsymbolsr r r� r� �tokname�line�filer r r r� � sb zLexerReflect.get_rulesc C s~ | j D �]X}| j| D �]n\}}|jj}|jj}t�|�}| j�|� | j | }t |t j �rbd}nd}|jj } | |kr�| j�d|||j� d| _q| |k r�| j�d|||j� d| _qt|�s�| j�d|||j� d| _qzDt�d|t|�f | j�} | �d��r | j�d |||j� d| _W q tj�y� } zJ| j�d |||j| � d t|�v �rj| j�d |||j� d| _W Y d } ~ qd } ~ 0 0 q| j| D ]�\} } | j | }|d k�r�| j�d| � d| _�q�|| jv�r�|�d�dk �r�| j�d| |� d| _�q�z:t�d| | f | j�} | �d��r4| j�d| � d| _W nV tj�y� } z:| j�d| | � d | v �rr| j�d| � d| _W Y d } ~ n d } ~ 0 0 �q�| j| �s�| j| �s�| j�d|� d| _| j�|d �}|r|}|jj}|jj}t�|�}| j�|� t |t j ��rd}nd}|jj } | |k�r>| j�d|||j� d| _| |k r| j�d|||j� d| _q| jD ]}| �|� �qhd S )Nr� r- z'%s:%d: Rule '%s' has too many argumentsTz%%s:%d: Rule '%s' requires an argumentz2%s:%d: No regular expression defined for rule '%s'� (?P<%s>%s)r, z<%s:%d: Regular expression for rule '%s' matches empty stringz3%s:%d: Invalid regular expression for rule '%s'. %s�#z6%s:%d. Make sure '#' in rule '%s' is escaped with '\#'r# r� r� r z-Rule '%s' defined for an unspecified token %sz5Regular expression for rule '%s' matches empty stringz,Invalid regular expression for rule '%s'. %sz/Make sure '#' in rule '%s' is escaped with '\#'z No rules defined for state '%s') r� r� r� r� r� �inspectZ getmodulern �addr� rP rQ r� � co_argcountr� r# r r� rr rs r� r� r� r� r� r� r| �validate_module)r r~ �fnamer r� r� �moduler� Zreqargs�nargsrI �er' �rZefuncr r r r� � s� zLexerReflect.validate_rulesc C s� zt �|�\}}W n ty& Y d S 0 t�d�}t�d�}i }|d7 }|D ]n}|�|�}|sh|�|�}|r�|�d�} |�| �} | s�||| < n$t �|�} | j � d| || | � d| _ |d7 }qLd S )Nz \s*def\s+(t_[a-zA-Z_0-9]*)\(z\s*(t_[a-zA-Z_0-9]*)\s*=r- z7%s:%d: Rule %s redefined. Previously defined on line %dT) r� ZgetsourcelinesrS rr rs r� r� r| Z getsourcefiler� r# ) r r� �linesZlinenZfreZsreZ counthashr� r� r' �prevrc r r r r� ? s* z LexerReflect.validate_module)Nr )r r r r r� r� r� r� r� r� r� r� r� r� r r r r r� - s Bgr� Fra c # sv |d u r d}d } ddi} t � } || _| d u r6ttj�} |rL|d u rLttj�}|rT|� � r�� fdd�t� �D �} t| �} d| vr�tj| d j| d< nt d�} | � d �}|r�t |t �r�d |vr�|d | }t | | |d �}|�� |s�|�� r�td ��|�r6|�r6z"| �|| � | ja| ja| a| W S t�y4 Y n0 |�rf|�d |j� |�d|j� |�d|j� t� | _|jD ]}| j� |� �qtt |jt t f��r�t |jd �� � |j�| _!n|j| _!| jt| j!�B | _"|j} i }| D ]�}g }|j#| D ]:\}}|�$d|t%|�f � |�r�|�d|t%|�|� �q�|j&| D ]2\}}|�$d||f � |�r6|�d|||� �q6|||< �q�|�r�|�d� |D ]h}t'|| || |j(�\}}}|| j)|< || j*|< || j+|< |�r�t,|�D ]\}} |�d||| � �qԐq�| �-� D ]`\}} |dk�r�| dk�r�| j)| �.| j)d � | j*| �.| j*d � | j+| �.| j+d � �q�| | _/| j)d | _0| j*d | _1|| _2|j3| _4| j4� dd�| _5|j6| _7|j6� dd �| _8| j8�s�| �9d� |j:| _;|j:� dd �| _<| �-� D ]�\} } | dk�r0| |j6v�r| �9d| � | |j3v�rz| j5�rz| �9d| � nJ| dk�r�| |j6v�rZ|j6� dd �|j6| < | |j3v�r�|j3� dd�|j3| < �q�| ja| ja| a|�rr|�rr|d u �rt |t=j>��r�|j} nNd |v�r�| d } n:|�?d �} d � | d d� �}!t@d|! � tAtj|! dd�} tBjC�D| �}z$| �E||� |tjv �r6tj|= W n8 tF�yp }" z | �9d ||"f � W Y d }"~"n d }"~"0 0 | S ) Nra r+ r� c s g | ]}|t � |�f�qS r )rG )r� �k�r� r r r� y r� zlex.<locals>.<listcomp>�__file__r r� � __package__rM )r� r� zCan't build lexerzlex: tokens = %rzlex: literals = %rzlex: states = %rr r� z(lex: Adding rule %s -> '%s' (state '%s')z#lex: ==== MASTER REGEXS FOLLOW ====z"lex: state '%s' : regex[%d] = '%s'r, zNo t_error rule is definedr� z1No error rule is defined for exclusive state '%s'z2No ignore rule is defined for exclusive state '%s'rN rk z#Couldn't write lextab module %r. %s)Gr* rB r rm r� �dir�dictrn r� r� r| rP r r� r� r� � SyntaxErrorrw r� r{ r� ro r$ r� r� r� rp r> r� r� r\ r rW r@ rq r� rF r� r� r� r� r0 r1 r2 r� rE �extendr5 r. r/ r9 r� r6 r? r� r7 r< r" r� r8 r= rQ rR rT rl rG rU rV �dirnamerj rS )#r� rH r% �optimizera r� Znowarnrb ZdebuglogZerrorlogr� r� ZlexobjZ_items�pkgZlinfor� Zregexsr~ Z regex_listr� r r' r� r. Zre_textZre_namesr� r �styper Zsrcfiler� Zpkgnamer� r r� r �lex^ s� (r� c C s� |sTz&t jd }t|�}|�� }|�� W n( tyR t j�d� t j�� }Y n0 | r`| j }nt }||� | rx| j }nt }|� }|s�q�t j�d|j |j |j |jf � q|d S )Nr- z/Reading from standard input (type EOF to end): z(%s,%r,%d,%d) )rm �argvrX �read�close� IndexError�stdoutr �stdinr{ r� r r r r )r� �datarc r Z_inputZ_tokenr� r r r �runmain s( r c s � fdd�}|S )Nc s t � d�rt� �| _n� | _| S )Nr) )r� r� r� r �r� r r � set_regexA s zTOKEN.<locals>.set_regexr )r� r r r r �TOKEN@ s r )NN)$rY r[ rr rm rQ rD rU r� Z StringTypeZ UnicodeTyperx �AttributeErrorr �bytesrs r� r� r rH r r r& r* r� r� r` rt r� r� r� r^ �VERBOSEr� r r �Tokenr r r r �<module>" sF F ( 3 � A " __pycache__/interfaces.cpython-39.pyc 0000644 00000030460 15025012421 0013523 0 ustar 00 a z fP@ � @ s� d Z ddlZddlZddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G d d � d �Z d d � Z d d� Z dd� Z dd� Zdd� ZG dd� d�ZG dd� d�ZG dd� d�ZG dd � d �ZdS ) z7 Classes for representing and manipulating interfaces. � N� )�access)� refpolicy)� objectmodel)�matching)�_c @ sH e Zd ZdZdd� Zdd� Zdd� Zeee�Zedd � d �Z d d � Z d S )�Paramz; Object representing a parameter for an interface. c C s" d| _ tj| _t�� | _d| _d S )N� T)� _Param__namer �SRC_TYPE�type�IdSet� obj_classes�required��self� r �7/usr/lib/python3.9/site-packages/sepolgen/interfaces.py�__init__& s zParam.__init__c C s t �|�std| ��|| _d S )NzName [%s] is not a param)r � is_idparam� ValueErrorr )r �namer r r �set_name, s zParam.set_namec C s | j S �N)r r r r r �get_name1 s zParam.get_namec C s t | jdd � �S �Nr )�intr r r r r �<lambda>6 � zParam.<lambda>)�fgetc C s d| j tj| j d�| j�f S )Nz0<sepolgen.policygen.Param instance [%s, %s, %s]>� )r r � field_to_strr �joinr r r r r �__repr__8 s �zParam.__repr__N) �__name__� __module__� __qualname__�__doc__r r r �propertyr �numr# r r r r r " s r c C s� d}| |v r�|| }||j kr"d S |tjks6|tjkr�|j tjksN|j tjkr�d}|r`|jg}ng }t�|j|�D ]}|tj v rrd} q�qrtj|_ q�d}n t � }| |_ ||_ |||j < |r�|j� |j� |S �Nr r ) r r r �TGT_TYPE� obj_class� itertools�chainr r Zimplicitly_typed_objectsr r �add)r r �av�params�ret�pZavobjs�objr r r �__param_insert> s6 � � r5 c C s~ d}d}t �| j�r.t| jtj| |�dkr.d}t �| j�rTt| jtj| |�dkrTd}t �| j�rzt| jtj | |�dkrzd}|S )aj Extract the parameters from an access vector. Extract the parameters (in the form $N) from an access vector, storing them as Param objects in a dictionary. Some attempt is made at resolving conflicts with other entries in the dict, but if an unresolvable conflict is found it is reported to the caller. The goal here is to figure out how interface parameters are actually used in the interface - e.g., that $1 is a domain used as a SRC_TYPE. In general an interface will look like this: interface(`foo', ` allow $1 foo : file read; ') This is simple to figure out - $1 is a SRC_TYPE. A few interfaces are more complex, for example: interface(`foo_trans',` domain_auto_trans($1,fingerd_exec_t,fingerd_t) allow $1 fingerd_t:fd use; allow fingerd_t $1:fd use; allow fingerd_t $1:fifo_file rw_file_perms; allow fingerd_t $1:process sigchld; ') Here the usage seems ambiguous, but it is not. $1 is still domain and therefore should be returned as a SRC_TYPE. Returns: 0 - success 1 - conflict found r Fr ) r r �src_typer5 r r �tgt_typer+ r, � OBJ_CLASS)r0 r1 r2 Z found_srcr r r �av_extract_paramsj s $ r9 c C s" t �| j�r t| jtjd |�S d S r )r r �roler5 r ZROLE)r: r1 r r r �role_extract_params� s r; c sl � fdd�}d}|| j tj�r"d}|| jtj�r4d}|| jtj�rFd}t�| j �rht | j tj d � �rhd}|S )Nc s. d}| D ] }t �|�rt||d � �rd}q|S r* )r r r5 )�setr r2 �x�r1 r r �extract_from_set� s z2type_rule_extract_params.<locals>.extract_from_setr r ) � src_typesr r � tgt_typesr+ r r8 r r Z dest_typer5 Z DEST_TYPE)�ruler1 r? r2 r r> r �type_rule_extract_params� s rC c C s2 d}| j D ]"}t�|�r t|tjd |�r d}q |S r* )�argsr r r5 r r )�ifcallr1 r2 �argr r r �ifcall_extract_params� s rG c @ s e Zd Zdd� Zdd� ZdS )�AttributeVectorc C s d| _ t�� | _d S )Nr )r r �AccessVectorSetr r r r r � s zAttributeVector.__init__c C s | j �|� d S r )r �add_av�r r0 r r r rJ � s zAttributeVector.add_avN)r$ r% r& r rJ r r r r rH � s rH c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )� AttributeSetc C s i | _ d S r )� attributesr r r r r � s zAttributeSet.__init__c C s || j |j< d S r )rM r )r �attrr r r �add_attr� s zAttributeSet.add_attrc C sz dd� }d }|D ]V}|d d� }|d dkrD|r:| � |� ||�}q|r|�d�}t�|�}|�|� q|rv| � |� d S )Nc S sH | dd� � � }t|�dks(|d dkr4td| ��t� }|d |_|S )Nr ���� r Z Attributez#Syntax error Attribute statement %s)�split�len� SyntaxErrorrH r )�line�fields�ar r r � parse_attr� s z*AttributeSet.from_file.<locals>.parse_attrrP r �[�,)rO rR r � AccessVectorrJ )r �fdrX rW rU �lr0 r r r � from_file� s zAttributeSet.from_fileN)r$ r% r& r rO r^ r r r r rL � s rL c @ sF e Zd Zdi fdd�Zi fdd�Zdd� Zdd � Zd d � Zd d � ZdS )�InterfaceVectorNc C s6 d| _ d| _t�� | _i | _|r,| �||� d| _d S )NTr F)�enabledr r rI r1 �from_interface�expanded)r � interfacerM r r r r � s zInterfaceVector.__init__c C s" |j | _ |�� D ]>}|jtjjkr$qd|j v r0qt�|�}|D ]}| �|� q>q|r�|� � D ]n}|j D ]b}||j vrvqf|j | }|jD ]@} t � | �}|j |j kr�|j |_ |j|j kr�|j |_| �|� q�qfq\|�� D ]} t| | j�r�q�|�� D ]} t| | j�r�q�|�� D ]} t| | j��r�qd S )NZ dontaudit)r ZavrulesZ rule_typer ZAVRuleZALLOWr Zavrule_to_access_vectorsrJ ZtypeattributesrM �copyr6 r r7 Zrolesr; r1 Z typerulesrC �interface_callsrG ) r rc rM ZavruleZavsr0 Z typeattributerN Zattr_vecrW r: rB rE r r r ra � s> z InterfaceVector.from_interfacec C s t || j�dkr| j�|� d S r )r9 r1 r rJ rK r r r rJ 3 s zInterfaceVector.add_avc C s8 g }|� d| j � | jD ]}|� t|�� qd�|�S )Nz[InterfaceVector %s]� )�appendr r �strr" )r �sr0 r r r � to_string9 s zInterfaceVector.to_stringc C s | � � S r )r# r r r r �__str__@ s zInterfaceVector.__str__c C s d| j | jf S )Nz<InterfaceVector %s:%s>)r r` r r r r r# C s zInterfaceVector.__repr__) r$ r% r& r ra rJ rj rk r# r r r r r_ � s 4r_ c @ sx e Zd Zddd�Zdd� Zdd� Zdd � Zd d � Zd d � Zi fdd�Z di fdd�Z dd� Z dd� Z dd� Z dd� ZdS )� InterfaceSetNc C s i | _ i | _g | _|| _d S r )� interfaces� tgt_type_map� tgt_type_all�output)r rp r r r r H s zInterfaceSet.__init__c C s | j r| j �|d � d S )Nrf )rp �write)r rh r r r �oN s zInterfaceSet.oc C s� t | j�� dd� d�D ]�}|�d|j � t |j�� dd� d�D ] }|�d|jtj|j f � q@|�d� t |j � � �}|D ] }|�d� |�� |�d � q~qd S ) Nc S s | j S r �r �r= r r r r S r z&InterfaceSet.to_file.<locals>.<lambda>)�keyz[InterfaceVector %s c S s | j S r rs rt r r r r U r z%s:%s z] rZ rf ) �sortedrm �valuesrq r r1 r r! r r Zto_listr" )r r\ Ziv�paramZavlr0 r r r �to_fileR s zInterfaceSet.to_filec C s� dd� }d }|D ]V}|d d� }|d dkrD|r:| � |� ||�}q|r|�d�}t�|�}|�|� q|rv| � |� | �� d S )Nc S s� | dd� � � }t|�dk s(|d dkr4td| ��t� }|d |_t|�dkrTd S |dd � D ]R}|� d�}t|�dkr�td| ��t� }|d |_tj|d |_||j |j< q`|S ) Nr rP rQ r r_ z)Syntax error InterfaceVector statement %s�:z-Invalid param in InterfaceVector statement %s) rR rS rT r_ r r r Z str_to_fieldr r1 )rU rV �ifvZfieldr3 rx r r r � parse_ifv^ s z)InterfaceSet.from_file.<locals>.parse_ifvrP r rY rZ )�add_ifvrR r r[ rJ �index)r r\ r| r{ rU r] r0 r r r r^ ] s zInterfaceSet.from_filec C s || j |j< d S r )rm r )r r{ r r r r} � s zInterfaceSet.add_ifvc C sv | j �� D ]f}t� }|jD ]2}t�|j�r@| j�|� t� } qN|�|j� q|D ] }| j � |g �}|�|� qRq d S r ) rm rw r< r r r7 ro rg r/ rn � setdefault)r r{ rA r0 r r] r r r r~ � s zInterfaceSet.indexc C s t ||�}| �|� d S r )r_ r} )r rc rM r{ r r r r/ � s zInterfaceSet.addc C s< t �|�� |�� �D ]}| �||� q| �|� | �� d S r )r- r. rm � templatesr/ �expand_ifcallsr~ )r �headersrp rM �ir r r � add_headers� s zInterfaceSet.add_headersc C sZ t �|�rPt|dd � �}|t|j�kr,d S |j|d }t|t�rH|S |gS n|gS d S r )r r r rS rD � isinstance�list)r �idrE r) rF r r r � map_param� s zInterfaceSet.map_paramc C s� | � |j|�}|d u rd S | � |j|�}|d u r4d S | � |j|�}|d u rNd S t�� }|jD ]&}| � ||�} | d u rxq\q\|�| � q\t|�dkr�d S |D ]*} |D ] } |D ]} |j � | | | |� q�q�q�d S )Nr ) r� r6 r7 r, r r Zperms�updaterS r r/ ) r r{ r0 rE r@ rA r Z new_permsZpermr3 r6 r7 r, r r r � map_add_av� s* zInterfaceSet.map_add_avc C s� |d fg}| j |j }d|_t|�dkr�|�d�\}}| j |j }||krl|jD ]}| �|||� qP|jrlq |�� D ]l} | j|jkr�| � t d�� d S z|| j } W n* t y� | � t d| j �� Y qtY n0 |� | | f� qtq d S )NTr rP z Found circular interface classz#Missing interface definition for %s) rm r rb rS �popr r� re Zifnamerr r �KeyErrorrg ) r rc � if_by_name�stackr{ ZcurZ cur_ifcallZcur_ifvr0 rE Znewifr r r �do_expand_ifcalls� s* z InterfaceSet.do_expand_ifcallsc C sR i }t �|�� |�� �D ]}|||j< qt �|�� |�� �D ]}| �||� q<d S r )r- r. rm r� r r� )r r� r� r� rc r r r r� � s zInterfaceSet.expand_ifcalls)N)r$ r% r& r rr ry r^ r} r~ r/ r� r� r� r� r� r r r r rl G s # $rl )r' rd r- r r r r r Z sepolgeni18nr r r5 r9 r; rC rG rH rL r_ rl r r r r �<module> s" ,4 Z __pycache__/access.cpython-39.opt-1.pyc 0000644 00000026141 15025012421 0013601 0 ustar 00 a z f�. � @ sz d Z ddlmZ ddlmZ ddlmZ dd� ZG dd � d ej�Zd d � Z G d d � d �Z dd� Z dd� Z G dd� d�Z dS )aW Classes representing basic access. SELinux - at the most basic level - represents access as the 4-tuple subject (type or context), target (type or context), object class, permission. The policy language elaborates this basic access to facilitate more concise rules (e.g., allow rules can have multiple source or target types - see refpolicy for more information). This module has objects for representing the most basic access (AccessVector) and sets of that access (AccessVectorSet). These objects are used in Madison in a variety of ways, but they are the fundamental representation of access. � )� refpolicy)�util� )� audit2whyc C sN t | �dkrF| d dkrFzt| dd� � W n ty@ Y dS 0 dS dS dS )z�Determine if an id is a parameter in the form $N, where N is an integer. Returns: True if the id is a parameter False if the id is not a parameter r r �$NFT)�len�int� ValueError)�id� r �3/usr/lib/python3.9/site-packages/sepolgen/access.py� is_idparam' s r c @ sJ e Zd ZdZddd�Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )� AccessVectora An access vector is the basic unit of access in SELinux. Access vectors are the most basic representation of access within SELinux. It represents the access a source type has to a target type in terms of an object class and a set of permissions. Access vectors are distinct from AVRules in that they can only store a single source type, target type, and object class. The simplicity of AccessVectors makes them useful for storing access in a form that is easy to search and compare. The source, target, and object are stored as string. No checking done to verify that the strings are valid SELinux identifiers. Identifiers in the form $N (where N is an integer) are reserved as interface parameters and are treated as wild cards in many circumstances. Properties: .src_type - The source type allowed access. [String or None] .tgt_type - The target type to which access is allowed. [String or None] .obj_class - The object class to which access is allowed. [String or None] .perms - The permissions allowed to the object class. [IdSet] .audit_msgs - The audit messages that generated this access vector [List of strings] .xperms - Extended permissions attached to the AV. [Dictionary {operation: xperm set}] Nc C sV |r| � |� n d | _d | _d | _t�� | _g | _tj | _ g | _ i | _ d | _ d | _d S �N)� from_list�src_type�tgt_type� obj_classr �IdSet�perms� audit_msgsr �TERULE�type�data�xperms�__hash__Z info_flow_dir)�selfZ init_listr r r �__init__S s zAccessVector.__init__c C sR t |�dk r tdt|� ��|d | _|d | _|d | _t�|dd� �| _dS )ax Initialize an access vector from a list. Initialize an access vector from a list treating the list as positional arguments - i.e., 0 = src_type, 1 = tgt_type, etc. All of the list elements 3 and greater are treated as perms. For example, the list ['foo_t', 'bar_t', 'file', 'read', 'write'] would create an access vector list with the source type 'foo_t', target type 'bar_t', object class 'file', and permissions 'read' and 'write'. This format is useful for very simple storage to strings or disc (see to_list) and for initializing access vectors. � z+List must contain at least four elements %sr r � � N) r r �strr r r r r r )r �listr r r r h s zAccessVector.from_listc C s$ | j | j| jg}|�t| j�� |S )z� Convert an access vector to a list. Convert an access vector to a list treating the list as positional values. See from_list for more information on how an access vector is represented in a list. )r r r �extend�sortedr )r �lr r r �to_list} s zAccessVector.to_listc C sL | j �|j � |jD ]2}|| jvr0t�� | j|< | j| �|j| � qdS )z0Add permissions and extended permissions from AVN)r �updater r ZXpermSetr# )r �av�opr r r �merge� s zAccessVector.mergec C s | � � S r )� to_string�r r r r �__str__� s zAccessVector.__str__c C s d| j | j| j| j�� f S )Nzallow %s %s:%s %s;)r r r r Z to_space_strr, r r r r+ � s �zAccessVector.to_stringc C st zTt | j�}| j| j| j|f}t |j�}|�� |�� |j|j|j|f}|||�W S ttfyn t Y S 0 d S r ) r" r r r r �sort�AttributeError� TypeError�NotImplemented)r �other�method�x�a�y�br r r �_compare� s zAccessVector._compare)N) �__name__� __module__� __qualname__�__doc__r r r& r* r- r+ r8 r r r r r 8 s r c C sj t | t�r| gS g }| jD ]J}| jD ]>}| jD ]2}t� }||_||_||_| j� � |_|� |� q.q$q|S )aR Convert an avrule into a list of access vectors. AccessVectors and AVRules are similarly, but differ in that an AVRule can more than one source type, target type, and object class. This function expands a single avrule into a list of one or more AccessVectors representing the access defined in the AVRule. ) � isinstancer Z src_typesZ tgt_typesZ obj_classesr r r r �copy�append)Zavruler5 r r r �accessr r r �avrule_to_access_vectors� s rA c @ sT e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd e j g fd d�Z ddd�Z d S )�AccessVectorSeta/ A non-overlapping set of access vectors. An AccessVectorSet is designed to store one or more access vectors that are non-overlapping. Access can be added to the set incrementally and access vectors will be added or merged as necessary. For example, adding the following access vectors using add_av: allow $1 etc_t : read; allow $1 etc_t : write; allow $1 var_log_t : read; Would result in an access vector set with the access vectors: allow $1 etc_t : { read write}; allow $1 var_log_t : read; c C s i | _ d| _dS )z)Initialize an access vector set. N)�srcZinfo_dirr, r r r r � s zAccessVectorSet.__init__c c s6 | j �� D ]&}|�� D ]}|�� D ] }|V q"qq dS )z9Iterate over all of the unique access vectors in the set.N)rC �values)r �tgts�objsr( r r r �__iter__� s zAccessVectorSet.__iter__c C s2 d}| j �� D ] }|�� D ]}|t|�7 }qq|S )a6 Return the number of unique access vectors in the set. Because of the internal representation of the access vector set, __len__ is not a constant time operation. Worst case is O(N) where N is the number of unique access vectors, but the common case is probably better. r )rC rD r )r r% rE rF r r r �__len__� s zAccessVectorSet.__len__c C s g }| D ]}|� |�� � q|S )ab Return the unique access vectors in the set as a list. The format of the returned list is a set of nested lists, each access vector represented by a list. This format is designed to be simply serializable to a file. For example, consider an access vector set with the following access vectors: allow $1 user_t : file read; allow $1 etc_t : file { read write}; to_list would return the following: [[$1, user_t, file, read] [$1, etc_t, file, read, write]] See AccessVector.to_list for more information. )r? r& �r r% r( r r r r& � s zAccessVectorSet.to_listc C s |D ]}| � t|�� qdS )a Add access vectors stored in a list. See to list for more information on the list format that this method accepts. This will add all of the access from the list. Any existing access vectors in the set will be retained. N)�add_avr rI r r r r s zAccessVectorSet.from_listNc C s: t � }||_||_||_||_||_||_| �||� dS )z)Add an access vector to the set. N)r r r r r r r rJ ) r r r r r � audit_msgZavc_typer r( r r r �add s zAccessVectorSet.addc C sv | j �|ji �}|�|ji �}|j|jf|v rF||j|jf �|� n|||j|jf< |rr||j|jf j�|� dS )z Add an access vector to the set.N) rC � setdefaultr r r r r* r r? )r r( rK Ztgt�clsr r r rJ s zAccessVectorSet.add_av)N) r9 r: r; r< r rG rH r& r r r rL rJ r r r r rB � s rB c C s. t �� }| D ] }|�|j� |�|j� q |S r )r r rL r r )�avs�typesr( r r r �avs_extract_types* s rQ c C sF i }| D ]8}|j |v r"||j }nt�� }|||j < |�|j� q|S r )r r r r' r )rO r r( �sr r r �avs_extract_obj_perms2 s rS c @ s0 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd S ) � RoleTypeSetz�A non-overlapping set of role type statements. This class allows the incremental addition of role type statements and maintains a non-overlapping list of statements. c C s i | _ dS )z Initialize an access vector set.N)� role_typesr, r r r r C s zRoleTypeSet.__init__c c s | j �� D ] }|V q dS )zAIterate over all of the unique role allows statements in the set.N)rU rD )r � role_typer r r rG G s zRoleTypeSet.__iter__c C s t | j�� �S )z2Return the unique number of role allow statements.)r rU �keysr, r r r rH L s zRoleTypeSet.__len__c C s> || j v r| j | }nt�� }||_|| j |< |j�|� d S r )rU r ZRoleType�rolerP rL )r rX r rV r r r rL P s zRoleTypeSet.addN)r9 r: r; r< r rG rH rL r r r r rT = s rT N)r< � r r Zselinuxr r Z Comparisonr rA rB rQ rS rT r r r r �<module> s oj __pycache__/defaults.cpython-39.pyc 0000644 00000004372 15025012421 0013212 0 ustar 00 a z fU � @ sT d dl Z d dlZG dd� de�Zdd� Zdd� Zdd � Zd d � Zd d � Zdd� Z dS )� Nc @ s e Zd Zdd� Zddd�ZdS )� PathChooserc C s� t � | _tj�|�s(d| _d| jd< d S || _t�d�}t�d�}t|d��f}t |�D ]L\}}|� |�rjqV|� |�}|s�t d||d f ��|� d �| j|� d�< qVW d � n1 s�0 Y d S ) Nz (defaults)zJ/usr/share/selinux/default:/usr/share/selinux/mls:/usr/share/selinux/devel�SELINUX_DEVEL_PATHz ^\s*(?:#.+)?$z^\s*(\w+)\s*=\s*(.+?)\s*$�rz(%s:%d: line is not in key = value format� � ) �dict�config�os�path�exists�config_pathname�re�compile�open� enumerate�match� ValueError�group)�self�pathname�ignoreZconsider�fd�lineno�line�mo� r �5/usr/lib/python3.9/site-packages/sepolgen/defaults.py�__init__ s zPathChooser.__init__r c C sp | j �|d �}|d u r(td|| jf ��|�d�}|D ]&}tj�||�}tj�|�r6| S q6tj�|d |�S )Nz%s was not in %s�:r ) r �getr r �splitr r �joinr )r Z testfilenameZpathset�paths�p�targetr r r �__call__, s zPathChooser.__call__N)r )�__name__� __module__� __qualname__r r% r r r r r s r c C s dS )Nz/var/lib/sepolgenr r r r r �data_dir; s r) c C s t � d S )Nz /perm_map�r) r r r r �perm_map> s r+ c C s t � d S )Nz/interface_infor* r r r r �interface_infoA s r, c C s t � d S )Nz/attribute_infor* r r r r �attribute_infoD s r- c C s( t d�} | d�}tj�|�s$| d�}|S )N�/etc/selinux/sepolgen.confZMakefilezinclude/Makefile)r r r r )�chooser�resultr r r �refpolicy_makefileG s r1 c C s t d�} | d�S )Nr. Zinclude)r )r/ r r r �headersN s r2 ) r r �objectr r) r+ r, r- r1 r2 r r r r �<module> s " __pycache__/module.cpython-39.pyc 0000644 00000016002 15025012421 0012661 0 ustar 00 a z fv � @ s� d Z ddlZddlZzddlmZ W n eyB ddlmZ Y n0 ddlZddlZddl Z ddl Z ddl m Z dd� Z G dd � d �Zd d � ZG d d � d �ZdS )zU Utilities for dealing with the compilation of modules and creation of module tress. � N)�getstatusoutput� )�defaultsc C s0 t �d| �}t|�dkr(| d �� r(dS dS dS )z'Check that a module name is valid. z[^a-zA-Z0-9_\-\.]r TFN)�re�findall�len�isalpha)�modname�m� r �3/usr/lib/python3.9/site-packages/sepolgen/module.py� is_valid_name( s r c @ sN e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z ddd�Z dS )� ModuleTreec C s || _ d | _d S �N)r �dirname)�selfr r r r �__init__2 s zModuleTree.__init__c C s | j S r �r �r r r r �dir_name6 s zModuleTree.dir_namec C s | j d | j d S )N�/z.te�r r r r r r �te_name9 s zModuleTree.te_namec C s | j d | j d S )Nr z.fcr r r r r �fc_name< s zModuleTree.fc_namec C s | j d | j d S )Nr z.ifr r r r r �if_name? s zModuleTree.if_namec C s | j d | j d S )Nr �.ppr r r r r � package_nameB s zModuleTree.package_namec C s | j d S )Nz /Makefiler r r r r � makefile_nameE s zModuleTree.makefile_nameNc C s� |d | j | _t�| j� t| �� d�}|r>|�d| � n|�dt�� � |� � t| � � d�� � t| � � d�� � t| � � d�� � d S )Nr �wzinclude ) r r �os�mkdir�openr �writer �refpolicy_makefile�closer r r )r Zparent_dirnameZmakefile_include�fdr r r �createH s zModuleTree.create)N) �__name__� __module__� __qualname__r r r r r r r r& r r r r r 1 s r c C s t j�t j�| �d �d S )Nr r )r �path�splitext�split)� sourcenamer r r �modname_from_sourcenameX s r. c @ sT e Zd ZdZddd�Zdd� Zdd� Zd d � Zdd d �Zdd� Z dd� Z dd� Z dS )�ModuleCompileras ModuleCompiler eases running of the module compiler. The ModuleCompiler class encapsulates running the commandline module compiler (checkmodule) and module packager (semodule_package). You are likely interested in the create_module_package method. Several options are controlled via parameters (only effects the non-refpol builds): .mls [boolean] Generate an MLS module (by passed -M to checkmodule). True to generate an MLS module, false otherwise. .module [boolean] Generate a module instead of a base module. True to generate a module, false to generate a base. .checkmodule [string] Fully qualified path to the module compiler. Default is /usr/bin/checkmodule. .semodule_package [string] Fully qualified path to the module packager. Defaults to /usr/bin/semodule_package. .output [file object] File object used to write verbose output of the compililation and packaging process. Nc C s< t �� | _d| _d| _d| _|| _d| _t� � | _ d| _ dS )z�Create a ModuleCompiler instance, optionally with an output file object for verbose output of the compilation process. Tz/usr/bin/checkmodulez/usr/bin/semodule_package� z /usr/bin/makeN) �selinuxZis_selinux_mls_enabled�mls�module� checkmodule�semodule_package�output� last_outputr r# �refpol_makefile�make)r r6 r r r r t s zModuleCompiler.__init__c C s | j r| j �|d � || _d S )N� )r6 r" r7 )r �strr r r �o� s zModuleCompiler.oc C s$ | � |� t|�\}}| � |� |S r )r< r )r �command�rcr6 r r r �run� s zModuleCompiler.runc C sJ |� d�}t|�dk r td|��d�|dd� �}|d }|d }||fS )z�Generate the module and policy package filenames from a source file name. The source file must be in the form of "foo.te". This will generate "foo.mod" and "foo.pp". Returns a tuple with (modname, policypackage). �.� z,invalid sourcefile name %s (must end in .te)r ���z.modr )r, r � RuntimeError�join)r r- Z splitname�basenamer � packagenamer r r � gen_filenames� s z ModuleCompiler.gen_filenamesTc C sD |r| � |� n0| �|�\}}| �||� | �||� t�|� dS )a� Create a module package saved in a packagename from a sourcename. The create_module_package creates a module package saved in a file named sourcename (.pp is the standard extension) from a source file (.te is the standard extension). The source file should contain SELinux policy statements appropriate for a base or non-base module (depending on the setting of .module). Only file names are accepted, not open file objects or descriptors because the command line SELinux tools are used. On error a RuntimeError will be raised with a descriptive error message. N)� refpol_buildrG �compile�packager �unlink)r r- Z refpolicyr rF r r r �create_module_package� s z$ModuleCompiler.create_module_packagec C s4 | j d | j }| �|�}|dkr0td| j ��d S )Nz -f r �compilation failed: %s)r9 r8 r? rC r7 )r r- r= r> r r r rH � s zModuleCompiler.refpol_buildc C sp | j g}| jr|�d� | jr(|�d� |�d� |�|� |�|� | �d�|��}|dkrltd| j ��d S )Nz-M�-m�-o� r rM )r4 r2 �appendr3 r? rD rC r7 )r r- r �sr> r r r rI � s zModuleCompiler.compilec C sZ | j g}|�d� |�|� |�d� |�|� | �d�|��}|dkrVtd| j ��d S )NrO rN rP r zpackaging failed [%s])r5 rQ r? rD rC r7 )r r rF rR r> r r r rJ � s zModuleCompiler.package)N)T) r' r( r) �__doc__r r< r? rG rL rH rI rJ r r r r r/ [ s r/ )rS r Ztempfile� subprocessr � ImportErrorZcommandsr Zos.path�shutilr1 r0 r r r r. r/ r r r r �<module> s ' __pycache__/classperms.cpython-39.pyc 0000644 00000004647 15025012421 0013564 0 ustar 00 a z f � @ s� d dl Z dZddiZdZdZdZdZd Zd Zd Z d Z d Z dd� Z dd� Z ddlmZ e�� dd� Zdd� Zdd� Zdd� Zd d � Zdd lmZ e�� ed �Ze�� Ze�� d Zd!Z e� e�Z e e � dS )"� N) �DEFINE�NAMEZTICKZSQUOTEZOBRACEZCBRACE�SEMIZOPARENZCPAREN�COMMAZdefiner z\`z\'z\{z\}z\;z\(z\)z\,z c C s t �| jd�| _| S )z[a-zA-Z_][a-zA-Z0-9_]*r )�reserved�get�value�type��t� r �7/usr/lib/python3.9/site-packages/sepolgen/classperms.py�t_NAME. s r c C s t d| jd � | �d� d S )NzIllegal character '%s'r � )�printr �skipr r r r �t_error3 s r r )�lexc C s8 t | �dkr | d g| d< n| d g| d g | d< dS )zHstatements : define_stmt | define_stmt statements � r r N��len��pr r r � p_statements: s r c C s | d | d g| d< dS )zOdefine_stmt : DEFINE OPAREN TICK NAME SQUOTE COMMA TICK list SQUOTE CPAREN � � r Nr r r r r � p_define_stmtC s r c C s, | d dkr| d | d< n| d g| d< dS )z2list : NAME | OBRACE names CBRACE r �{r r Nr r r r r �p_listJ s r c C s6 t | �dkr | d g| d< n| d g| d | d< dS )z+names : NAME | NAME names r r r Nr r r r r �p_namesS s r c C s t d| j| j| jf � d S )Nz$Syntax error on line %d %s [type=%s])r �linenor r r r r r �p_error\ s r! )�yaccz all_perms.sptz%define(`foo',`{ read write append }')a2 define(`all_filesystem_perms',`{ mount remount unmount getattr relabelfrom relabelto transition associate quotamod quotaget }') define(`all_security_perms',`{ compute_av compute_create compute_member check_context load_policy compute_relabel compute_user setenforce setbool setsecparam setcheckreqprot }') ) �sys�tokensr Zt_TICKZt_SQUOTEZt_OBRACEZt_CBRACEZt_SEMIZt_OPARENZt_CPARENZt_COMMAZt_ignorer r � r r r r r r! r" �open�f�readZtxt�close�testZtest2�parse�resultr r r r r �<module> s< � __pycache__/__init__.cpython-39.pyc 0000644 00000000220 15025012421 0013126 0 ustar 00 a z f � @ s d S )N� r r r �5/usr/lib/python3.9/site-packages/sepolgen/__init__.py�<module> � __pycache__/refpolicy.cpython-39.pyc 0000644 00000116355 15025012421 0013404 0 ustar 00 a z f�} � @ sZ d dl Z d dlZd ZdZdZdZdZdZg d�Zeeeeeed�Z G dd � d �Z G d d � d e �Z G d d � d e �Z dsdd�Z dtdd�Zdudd�Zdd� ZG dd� de�ZG dd � d e �ZG d d � d e �ZG d d � d �ZG d!d"� d"e �ZG d#d$� d$e �ZG d%d&� d&e �ZG d'd(� d(e �ZG d)d*� d*e �ZG d+d,� d,e �ZG d-d.� d.e �Z G d/d0� d0e �Z G d1d2� d2e �Z G d3d4� d4e �Z G d5d6� d6e �Z G d7d8� d8e �Z!G d9d:� d:e �Z"G d;d<� d<e �Z#G d=d>� d>e �Z$G d?d@� d@e �Z%G dAdB� dBe �Z&G dCdD� dDe �Z'G dEdF� dFe �Z(G dGdH� dHe �Z)G dIdJ� dJe �Z*G dKdL� dLe �Z+G dMdN� dNe �Z,G dOdP� dPe �Z-G dQdR� dRe �Z.G dSdT� dTe �Z/G dUdV� dVe �Z0dWdX� Z1G dYdZ� dZe �Z2G d[d\� d\e �Z3G d]d^� d^e �Z4G d_d`� d`e �Z5G dadb� dbe �Z6G dcdd� dde �Z7G dedf� dfe �Z8G dgdh� dhe �Z9G didj� dje �Z:G dkdl� dle �Z;G dmdn� dn�Z<G dodp� dp�Z=G dqdr� dr�Z>dS )v� N� � � � � )�source�target�objectZ permission�roleZ destinationc @ s e Zd Zddd�ZdS )� PolicyBaseNc C s d | _ d | _d S �N)�parent�comment��selfr � r �6/usr/lib/python3.9/site-packages/sepolgen/refpolicy.py�__init__5 s zPolicyBase.__init__)N)�__name__� __module__� __qualname__r r r r r r 4 s r c @ s� e Zd ZdZd/dd�Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� ZdS )0�Nodea� Base class objects produced from parsing the reference policy. The Node class is used as the base class for any non-leaf object produced by parsing the reference policy. This object should contain a reference to its parent (or None for a top-level object) and 0 or more children. The general idea here is to have a very simple tree structure. Children are not separated out by type. Instead the tree structure represents fairly closely the real structure of the policy statements. The object should be iterable - by default over all children but subclasses are free to provide additional iterators over a subset of their childre (see Interface for example). Nc C s t �| |� g | _d S r )r r �childrenr r r r r J s z Node.__init__c C s t | j�S r )�iterr �r r r r �__iter__N s z Node.__iter__c C s t dd� t| ��S )Nc S s t | t�S r )� isinstancer ��xr r r �<lambda>W � z Node.nodes.<locals>.<lambda>��filter�walktreer r r r �nodesV s z Node.nodesc C s t dd� t| ��S )Nc S s t | t�S r )r �Moduler r r r r Z r z Node.modules.<locals>.<lambda>r! r r r r �modulesY s z Node.modulesc C s t dd� t| ��S )Nc S s t | t�S r )r � Interfacer r r r r ] r z!Node.interfaces.<locals>.<lambda>r! r r r r � interfaces\ s zNode.interfacesc C s t dd� t| ��S )Nc S s t | t�S r )r �Templater r r r r ` r z Node.templates.<locals>.<lambda>r! r r r r � templates_ s zNode.templatesc C s t dd� t| ��S )Nc S s t | t�S r )r � SupportMacrosr r r r r c r z%Node.support_macros.<locals>.<lambda>r! r r r r �support_macrosb s zNode.support_macrosc C s t dd� t| ��S )Nc S s t | t�S r )r �ModuleDeclarationr r r r r h r z*Node.module_declarations.<locals>.<lambda>r! r r r r �module_declarationsg s zNode.module_declarationsc C s t dd� t| ��S )Nc S s t | t�S r )r � InterfaceCallr r r r r k r z&Node.interface_calls.<locals>.<lambda>r! r r r r �interface_callsj s zNode.interface_callsc C s t dd� t| ��S )Nc S s t | t�S r )r �AVRuler r r r r n r z Node.avrules.<locals>.<lambda>r! r r r r �avrulesm s z Node.avrulesc C s t dd� t| ��S )Nc S s t | t�S r )r � AVExtRuler r r r r q r z!Node.avextrules.<locals>.<lambda>r! r r r r � avextrulesp s zNode.avextrulesc C s t dd� t| ��S )Nc S s t | t�S r )r �TypeRuler r r r r t r z Node.typerules.<locals>.<lambda>r! r r r r � typeruless s zNode.typerulesc C s t dd� t| ��S )Nc S s t | t�S r )r � TypeBoundr r r r r w r z!Node.typebounds.<locals>.<lambda>r! r r r r � typeboundsv s zNode.typeboundsc C s t dd� t| ��S )zAIterate over all of the TypeAttribute children of this Interface.c S s t | t�S r )r � TypeAttributer r r r r { r z%Node.typeattributes.<locals>.<lambda>r! r r r r �typeattributesy s zNode.typeattributesc C s t dd� t| ��S )zAIterate over all of the RoleAttribute children of this Interface.c S s t | t�S r )r � RoleAttributer r r r r r z%Node.roleattributes.<locals>.<lambda>r! r r r r �roleattributes} s zNode.roleattributesc C s t dd� t| ��S )Nc S s t | t�S r )r �Requirer r r r r � r z Node.requires.<locals>.<lambda>r! r r r r �requires� s z Node.requiresc C s t dd� t| ��S )Nc S s t | t�S r )r �Roler r r r r � r z Node.roles.<locals>.<lambda>r! r r r r �roles� s z Node.rolesc C s t dd� t| ��S )Nc S s t | t�S r )r � RoleAllowr r r r r � r z"Node.role_allows.<locals>.<lambda>r! r r r r � role_allows� s zNode.role_allowsc C s t dd� t| ��S )Nc S s t | t�S r )r �RoleTyper r r r r � r z!Node.role_types.<locals>.<lambda>r! r r r r � role_types� s zNode.role_typesc C s( | j r t| j �d | �� S | �� S d S �N� �r �str� to_stringr r r r �__str__� s z Node.__str__c C s d| j j| �� f S �Nz<%s(%s)>�� __class__r rI r r r r �__repr__� s z Node.__repr__c C s dS �N� r r r r r rI � s zNode.to_string)N)r r r �__doc__r r r$ r& r( r* r, r. r0 r2 r4 r6 r8 r: r< r> r@ rB rD rJ rN rI r r r r r 9 s. r c @ s. e Zd Zd dd�Zdd� Zdd� Zdd � ZdS ) �LeafNc C s t �| |� d S r )r r r r r r r � s z Leaf.__init__c C s( | j r t| j �d | �� S | �� S d S rE rG r r r r rJ � s z Leaf.__str__c C s d| j j| �� f S rK rL r r r r rN � s z Leaf.__repr__c C s dS rO r r r r r rI � s zLeaf.to_string)N)r r r r rJ rN rI r r r r rR � s rR TFc c s� |r d}nd}| dfg}t |�dkr�|�|�\}}|rB||fV n|V t|t�rg }t |j�d } | dkr�|du s�t|j| |�r�|�|j| |d f� | d8 } qd|�|� qdS )a� Iterate over a Node and its Children. The walktree function iterates over a tree containing Nodes and leaf objects. The iteration can perform a depth first or a breadth first traversal of the tree (controlled by the depthfirst parameter. The passed in node will be returned. This function will only work correctly for trees - arbitrary graphs will likely cause infinite looping. ���r r N)�len�popr r r �append�extend) �nodeZ depthfirst� showdepth�type�index�stackZcur�depth�items�ir r r r# � s" r# c c s& | D ] }|du st ||�r|V qdS )a Iterate over the direct children of a Node. The walktree function iterates over the children of a Node. Unlike walktree it does note return the passed in node or the children of any Node objects (that is, it does not go beyond the current level in the tree). N)r )rX rZ r r r r �walknode� s r` ��{�}c C sR t | �}d}|dk r td��d�| �}|dkr2|S |d d | d |d S dS )z�Convert a set (or any sequence type) into a string representation formatted to match SELinux space separated list conventions. For example the list ['read', 'write'] would be converted into: '{ read write }' rP r z"cannot convert 0 len set to string� r N�rT � ValueError�join)�s�cont�lrH r r r �list_to_space_str� s rk c C s" t | �}|dk rtd��d�| �S )Nr z(cannot convert 0 len set to comma stringz, re )rh rj r r r �list_to_comma_str� s rl c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) �IdSetNc C s& |rt �| |� n t �| � d| _d S )NF)�setr Z compliment)r �listr r r r � s zIdSet.__init__c C s t t| ��S r )rk �sortedr r r r � to_space_str s zIdSet.to_space_strc C s t t| ��S r )rl rp r r r r � to_comma_str s zIdSet.to_comma_str)N)r r r r rq rr r r r r rm � s rm c @ s4 e Zd ZdZd dd�Zdd� Zdd� Zd d d �ZdS ) �SecurityContextz;An SELinux security context with optional MCS / MLS fields.Nc C s: t �| |� d| _d| _d| _d| _|dur6| �|� dS )z�Create a SecurityContext object, optionally from a string. Parameters: [context] - string representing a security context. Same format as a string passed to the from_string method. rP N)rR r �userr rZ �level� from_string)r �contextr r r r r s zSecurityContext.__init__c C s� t �|�}|d dkr |d }|�d�}t|�dk r@td| ��|d | _|d | _|d | _t|�dkr�d�|dd� �| _ nd| _ dS )z�Parse a string representing a context into a SecurityContext. The string should be in the standard format - e.g., 'user:role:type:level'. Raises ValueError if the string is not parsable as a security context. r r �:r z)context string [%s] not in a valid formatr N) �selinuxZ selinux_trans_to_raw_context�splitrT rf rt r rZ rg ru )r rw �raw�fieldsr r r rv s zSecurityContext.from_stringc C s0 | j |j ko.| j|jko.| j|jko.| j|jkS )a Compare two SecurityContext objects - all fields must be exactly the the same for the comparison to work. It is possible for the level fields to be semantically the same yet syntactically different - in this case this function will return false. )rt r rZ ru )r �otherr r r �__eq__4 s � � �zSecurityContext.__eq__c C s\ | j | j| jg}| jdu rF|du r:t�� dkrD|�d� qR|�|� n |�| j� d�|�S )a� Return a string representing this security context. By default, the string will contiain a MCS / MLS level potentially from the default which is passed in if none was set. Arguments: default_level - the default level to use if self.level is an empty string. Returns: A string represening the security context in the form 'user:role:type:level'. Nr Zs0rx )rt r rZ ru ry Zis_selinux_mls_enabledrV rg )r Z default_levelr| r r r rI ? s zSecurityContext.to_string)NN)N)r r r rQ r rv r~ rI r r r r rs s rs c @ s e Zd ZdZddd�ZdS )� ObjectClassa" SELinux object class and permissions. This class is a basic representation of an SELinux object class - it does not represent separate common permissions - just the union of the common and class specific permissions. It is meant to be convenient for policy generation. rP Nc C s t �| |� || _t� | _d S r )rR r �namerm �perms�r r� r r r r r a s zObjectClass.__init__)rP N)r r r rQ r r r r r r Y s r c @ s< e Zd ZdZddd�Zdd� Zdd� Zdd d �Zd d � Zd S )�XpermSeta) Extended permission set. This class represents one or more extended permissions represented by numeric values or ranges of values. The .complement attribute is used to specify all permission except those specified. Two xperm set can be merged using the .extend() method. Fc C s || _ g | _d S r )� complement�ranges)r r� r r r r p s zXpermSet.__init__c C s� | j �� d}|t| j �k r�|d t| j �k r�| j |d d | j | d d kr�| j | d t| j | d | j |d d �f| j |< | j |d = q q�q |d7 }qdS )z0Ensure that ranges are not overlapping. r r N)r� �sortrT �max)r r_ r r r Z__normalize_rangest s $� zXpermSet.__normalize_rangesc C s | j �|j � | �� dS )z%Add ranges from an xperm set N)r� rW �_XpermSet__normalize_ranges�r rh r r r rW � s zXpermSet.extendNc C s( |du r |}| j �||f� | �� dS )z7Add value of range of values to the xperm set. N)r� rV r� )r ZminimumZmaximumr r r �add� s z XpermSet.addc C sz | j s dS | jrdnd}t| j �dkrX| j d d | j d d krX|t| j d d � S tdd� | j �}d|d�|�f S ) NrP z~ r r c S s8 | d | d kr t | d �S dt | d �t | d �f S )Nr r z%s-%s)�hexr r r r r � r z$XpermSet.to_string.<locals>.<lambda>z%s{ %s }rd )r� r� rT r� �maprg )r ZcomplZvalsr r r rI � s *zXpermSet.to_string)F)N) r r r rQ r r� rW r� rI r r r r r� f s r� c @ s" e Zd ZdZddd�Zdd� ZdS )r9 z[SElinux typeattribute statement. This class represents a typeattribute statement. Nc C s t �| |� d| _t� | _d S rO )rR r rZ rm � attributesr r r r r � s zTypeAttribute.__init__c C s d| j | j�� f S )Nztypeattribute %s %s;)rZ r� rr r r r r rI � s zTypeAttribute.to_string)N�r r r rQ r rI r r r r r9 � s r9 c @ s" e Zd ZdZddd�Zdd� ZdS )r; z[SElinux roleattribute statement. This class represents a roleattribute statement. Nc C s t �| |� d| _t� | _d S rO )rR r r rm r< r r r r r � s zRoleAttribute.__init__c C s d| j | j�� f S )Nzroleattribute %s %s;)r r< rr r r r r rI � s zRoleAttribute.to_string)Nr� r r r r r; � s r; c @ s e Zd Zddd�Zdd� ZdS )r? Nc C s t �| |� d| _t� | _d S rO �rR r r rm �typesr r r r r � s z Role.__init__c C s& d}| j D ]}|d| j|f 7 }q |S �NrP zrole %s types %s; �r� r �r rh �tr r r rI � s zRole.to_string)N�r r r r rI r r r r r? � s r? c @ s e Zd Zddd�Zdd� ZdS )�TyperP Nc C s& t �| |� || _t� | _t� | _d S r )rR r r� rm r� �aliasesr� r r r r � s z Type.__init__c C sR d| j }t| j�dkr*|d| j�� }t| j�dkrJ|d| j�� }|d S )Nztype %sr zalias %s�, %s�;)r� rT r� rq r� rr r� r r r rI � s zType.to_string)rP Nr� r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )� TypeAliasNc C s t �| |� d| _t� | _d S rO )rR r rZ rm r� r r r r r � s zTypeAlias.__init__c C s d| j | j�� f S )Nztypealias %s alias %s;)rZ r� rq r r r r rI � s zTypeAlias.to_string)Nr� r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )� AttributerP Nc C s t �| |� || _d S r �rR r r� r� r r r r � s zAttribute.__init__c C s d| j S )Nz attribute %s;�r� r r r r rI � s zAttribute.to_string)rP Nr� r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )�Attribute_RolerP Nc C s t �| |� || _d S r r� r� r r r r � s zAttribute_Role.__init__c C s d| j S )Nzattribute_role %s;r� r r r r rI � s zAttribute_Role.to_string)rP Nr� r r r r r� � s r� c @ sB e Zd ZdZdZdZdZdZddd�Zd d � Z d d � Z d d� Z dS )r1 a� SELinux access vector (AV) rule. The AVRule class represents all varieties of AV rules including allow, dontaudit, and auditallow (indicated by the flags self.ALLOW, self.DONTAUDIT, and self.AUDITALLOW respectively). The source and target types, object classes, and perms are all represented by sets containing strings. Sets are used to make it simple to add strings repeatedly while avoiding duplicates. No checking is done to make certain that the symbols are valid or consistent (e.g., perms that don't match the object classes). It is even possible to put invalid types like '$1' into the rules to allow storage of the reference policy interfaces. r r r r Nc C sF t �| |� t� | _t� | _t� | _t� | _| j| _|rB| � |� d S r ) rR r rm � src_types� tgt_types� obj_classesr� �ALLOW� rule_type�from_av)r �avr r r r r s zAVRule.__init__c C sD | j | jkrdS | j | jkr dS | j | jkr0dS | j | jkr@dS d S )NZallowZ dontauditZ auditallowZ neverallow)r� r� � DONTAUDIT� AUDITALLOW� NEVERALLOWr r r r �__rule_type_str s zAVRule.__rule_type_strc C sV | j �|j� |j|jkr(| j�d� n| j�|j� | j�|j� | j�|j� dS )zIAdd the access from an access vector to this allow rule. r N) r� r� �src_type�tgt_typer� r� � obj_classr� �update)r r� r r r r� s zAVRule.from_avc C s. d| � � | j�� | j�� | j�� | j�� f S )z�Return a string representation of the rule that is a valid policy language representation (assuming that the types, object class, etc. are valie). �%s %s %s:%s %s;)�_AVRule__rule_type_strr� rq r� r� r� r r r r rI ) s �zAVRule.to_string)NN) r r r rQ r� r� r� r� r r� r� rI r r r r r1 � s r1 c @ sB e Zd ZdZdZdZdZdZddd�Zd d � Z d d � Z d d� Z dS )r3 aj Extended permission access vector rule. The AVExtRule class represents allowxperm, dontauditxperm, auditallowxperm, and neverallowxperm rules. The source and target types, and object classes are represented by sets containing strings. The operation is a single string, e.g. 'ioctl'. Extended permissions are represented by an XpermSet. r r r r Nc C sN t �| |� t� | _t� | _t� | _| j| _t� | _ || _ |rJ| � ||� d S r ) rR r rm r� r� r� � ALLOWXPERMr� r� �xperms� operationr� )r r� �opr r r r r C s zAVExtRule.__init__c C sD | j | jkrdS | j | jkr dS | j | jkr0dS | j | jkr@dS d S )NZ allowxpermZdontauditxpermZauditallowxpermZneverallowxperm)r� r� �DONTAUDITXPERM�AUDITALLOWXPERM�NEVERALLOWXPERMr r r r r� N s zAVExtRule.__rule_type_strc C sZ | j �|j� |j|jkr(| j�d� n| j�|j� | j�|j� || _|j| | _d S )Nr ) r� r� r� r� r� r� r� r� r� )r r� r� r r r r� X s zAVExtRule.from_avc C s2 d| � � | j�� | j�� | j�� | j| j�� f S )z�Return a string representation of the rule that is a valid policy language representation (assuming that the types, object class, etc. are valid). z%s %s %s:%s %s %s;)�_AVExtRule__rule_type_strr� rq r� r� r� r� rI r r r r rI b s �zAVExtRule.to_string)NNN) r r r rQ r� r� r� r� r r� r� rI r r r r r3 4 s r3 c @ s6 e Zd ZdZdZdZdZd dd�Zdd � Zd d � Z dS ) r5 z�SELinux type rules. This class is very similar to the AVRule class, but is for representing the type rules (type_trans, type_change, and type_member). The major difference is the lack of perms and only and sing destination type. r r r Nc C s6 t �| |� t� | _t� | _t� | _d| _| j| _d S rO ) rR r rm r� r� r� � dest_type�TYPE_TRANSITIONr� r r r r r y s zTypeRule.__init__c C s( | j | jkrdS | j | jkr dS dS d S )NZtype_transitionZ type_changeZ type_member)r� r� � TYPE_CHANGEr r r r r� � s zTypeRule.__rule_type_strc C s* d| � � | j�� | j�� | j�� | jf S )Nr� )�_TypeRule__rule_type_strr� rq r� r� r� r r r r rI � s �zTypeRule.to_string)N) r r r rQ r� r� Z TYPE_MEMBERr r� rI r r r r r5 n s r5 c @ s" e Zd ZdZddd�Zdd� ZdS )r7 zSSElinux typebound statement. This class represents a typebound statement. Nc C s t �| |� d| _t� | _d S rO )rR r rZ rm r� r r r r r � s zTypeBound.__init__c C s d| j | j�� f S )Nztypebounds %s %s;)rZ r� rr r r r r rI � s zTypeBound.to_string)Nr� r r r r r7 � s r7 c @ s e Zd Zddd�Zdd� ZdS )rA Nc C s t �| |� t� | _t� | _d S r )rR r rm � src_roles� tgt_rolesr r r r r � s zRoleAllow.__init__c C s d| j �� | j�� f S )Nz allow %s %s;)r� rr r� r r r r rI � s �zRoleAllow.to_string)Nr� r r r r rA � s rA c @ s e Zd Zddd�Zdd� ZdS )rC Nc C s t �| |� d| _t� | _d S rO r� r r r r r � s zRoleType.__init__c C s& d}| j D ]}|d| j|f 7 }q |S r� r� r� r r r rI � s zRoleType.to_string)Nr� r r r r rC � s rC c @ s e Zd Zddd�Zdd� ZdS )r- Nc C s" t �| |� d| _d| _d| _d S �NrP F)rR r r� �version� refpolicyr r r r r � s zModuleDeclaration.__init__c C s* | j rd| j| jf S d| j| jf S d S )Nzpolicy_module(%s, %s)z module %s %s;)r� r� r� r r r r rI � s zModuleDeclaration.to_string)Nr� r r r r r- � s r- c @ s e Zd Zddd�Zdd� ZdS )� ConditionalNc C s t �| |� g | _d S r �r r � cond_exprr r r r r � s zConditional.__init__c C s dt | jdd� S )Nz[If %s]�rP rP �ri �rk r� r r r r rI � s zConditional.to_string)Nr� r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )�BoolNc C s t �| |� d| _d| _d S r� )rR r r� �stater r r r r � s z Bool.__init__c C s$ d| j }|jr|d S |d S d S )Nzbool %s �trueZfalse)r� r� r� r r r rI � s zBool.to_string)Nr� r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )� InitialSidNc C s t �| |� d| _d | _d S rO )rR r r� rw r r r r Z__init� s zInitialSid.__initc C s d| j t| j�f S )Nz sid %s %s)r� rH rw r r r r rI � s zInitialSid.to_string)N)r r r Z_InitialSid__initrI r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )�GenfsConNc C s" t �| |� d| _d| _d | _d S rO )rR r � filesystem�pathrw r r r r r � s zGenfsCon.__init__c C s d| j | jt| j�f S )Nzgenfscon %s %s %s)r� r� rH rw r r r r rI � s zGenfsCon.to_string)Nr� r r r r r� � s r� c @ s* e Zd ZdZdZdZd dd�Zdd� ZdS ) � FilesystemUser r r Nc C s$ t �| |� | j| _d| _d | _d S rO )rR r �XATTRrZ r� rw r r r r r � s zFilesystemUse.__init__c C sN d}| j | jkrd}n"| j | jkr(d}n| j | jkr8d}d|| jt| j�f S )NrP z fs_use_xattr z fs_use_trans z fs_use_task z %s %s %s;)rZ r� �TRANS�TASKr� rH rw r� r r r rI � s zFilesystemUse.to_string)N)r r r r� r� r� r rI r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )�PortConNc C s" t �| |� d| _d| _d | _d S rO )rR r � port_type� port_numberrw r r r r r � s zPortCon.__init__c C s d| j | jt| j�f S )Nzportcon %s %s %s)r� r� rH rw r r r r rI s zPortCon.to_string)Nr� r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )�NodeConNc C s" t �| |� d| _d| _d | _d S rO )rR r �start�endrw r r r r r s zNodeCon.__init__c C s d| j | jt| j�f S )Nznodecon %s %s %s)r� r� rH rw r r r r rI s zNodeCon.to_string)Nr� r r r r r� s r� c @ s e Zd Zddd�Zdd� ZdS )�NetifConNc C s" t �| |� d| _d | _d | _d S rO )rR r � interface�interface_context�packet_contextr r r r r s zNetifCon.__init__c C s d| j t| j�t| j�f S )Nznetifcon %s %s %s)r� rH r� r� r r r r rI s �zNetifCon.to_string)Nr� r r r r r� s r� c @ s e Zd Zddd�Zdd� ZdS )�PirqConNc C s t �| |� d| _d | _d S rO )rR r � pirq_numberrw r r r r r s zPirqCon.__init__c C s d| j t| j�f S )Nz pirqcon %s %s)r� rH rw r r r r rI " s zPirqCon.to_string)Nr� r r r r r� s r� c @ s e Zd Zddd�Zdd� ZdS )�IomemConNc C s t �| |� d| _d | _d S rO )rR r � device_memrw r r r r r & s zIomemCon.__init__c C s d| j t| j�f S )Nziomemcon %s %s)r� rH rw r r r r rI + s zIomemCon.to_string)Nr� r r r r r� % s r� c @ s e Zd Zddd�Zdd� ZdS )� IoportConNc C s t �| |� d| _d | _d S rO )rR r �ioportrw r r r r r / s zIoportCon.__init__c C s d| j t| j�f S )Nzioportcon %s %s)r� rH rw r r r r rI 4 s zIoportCon.to_string)Nr� r r r r r� . s r� c @ s e Zd Zddd�Zdd� ZdS )� PciDeviceConNc C s t �| |� d| _d | _d S rO )rR r �devicerw r r r r r 8 s zPciDeviceCon.__init__c C s d| j t| j�f S )Nzpcidevicecon %s %s)r� rH rw r r r r rI = s zPciDeviceCon.to_string)Nr� r r r r r� 7 s r� c @ s e Zd Zddd�Zdd� ZdS )� DeviceTreeConNc C s t �| |� d| _d | _d S rO )rR r r� rw r r r r r A s zDeviceTreeCon.__init__c C s d| j t| j�f S )Nzdevicetreecon %s %s)r� rH rw r r r r rI F s zDeviceTreeCon.to_string)Nr� r r r r r� @ s r� c C sD t | dd�D ]2\}}d}t|�D ] }|d }q t|t|� � q d S )NT)rY rP � )r# �range�printrH )�headrX r] rh r_ r r r � print_treeK s r� c @ s e Zd Zddd�Zdd� ZdS )�HeadersNc C s t �| |� d S r �r r r r r r r T s zHeaders.__init__c C s dS )Nz [Headers]r r r r r rI W s zHeaders.to_string)Nr� r r r r r� S s r� c @ s e Zd Zddd�Zdd� ZdS )r% Nc C s t �| |� d S r r� r r r r r \ s zModule.__init__c C s dS rO r r r r r rI _ s zModule.to_string)Nr� r r r r r% [ s r% c @ s" e Zd ZdZddd�Zdd� ZdS ) r' zqA reference policy interface definition. This class represents a reference policy interface definition. rP Nc C s t �| |� || _d S r �r r r� r� r r r r g s zInterface.__init__c C s d| j S )Nz[Interface name: %s]r� r r r r rI k s zInterface.to_string)rP Nr� r r r r r' b s r' c @ s e Zd Zddd�Zdd� ZdS )� TunablePolicyNc C s t �| |� g | _d S r r� r r r r r o s zTunablePolicy.__init__c C s dt | jdd� S )Nz[Tunable Policy %s]r� r� r� r r r r rI s s zTunablePolicy.to_string)Nr� r r r r r� n s r� c @ s e Zd Zddd�Zdd� ZdS )r) rP Nc C s t �| |� || _d S r r� r� r r r r w s zTemplate.__init__c C s d| j S )Nz[Template name: %s]r� r r r r rI { s zTemplate.to_string)rP Nr� r r r r r) v s r) c @ s e Zd Zddd�Zdd� ZdS )�IfDefrP Nc C s t �| |� || _d S r r� r� r r r r s zIfDef.__init__c C s d| j S )Nz[Ifdef name: %s]r� r r r r rI � s zIfDef.to_string)rP Nr� r r r r r� ~ s r� c @ s& e Zd Zd dd�Zdd� Zdd� ZdS ) r/ rP Nc C s" t �| |� || _g | _g | _d S r )rR r �ifname�argsZcomments)r r� r r r r r � s zInterfaceCall.__init__c C sR | j |j krdS t| j�t|j�kr(dS t| j|j�D ]\}}||kr6 dS q6dS )NFT)r� rT r� �zip)r r} �a�br r r �matches� s zInterfaceCall.matchesc C s` d| j }d}| jD ]B}t|t�r,t|�}n|}|dkrF|d| }n|| }|d7 }q|d S )Nz%s(r r� r �))r� r� r ro rk )r rh r_ r� rH r r r rI � s zInterfaceCall.to_string)rP N)r r r r r� rI r r r r r/ � s r/ c @ s e Zd Zddd�Zdd� ZdS )�OptionalPolicyNc C s t �| |� d S r r� r r r r r � s zOptionalPolicy.__init__c C s dS )Nz[Optional Policy]r r r r r rI � s zOptionalPolicy.to_string)Nr� r r r r r� � s r� c @ s> e Zd Zddd�Zdd� Zdd� Zdd � Zd d � Zd d � ZdS )r+ Nc C s t �| |� d | _d S r )r r r� r r r r r � s zSupportMacros.__init__c C s dS )Nz[Support Macros]r r r r r rI � s zSupportMacros.to_stringc C s@ t � }|| jv r2| �|�D ]}|�| �|�� qn |�|� |S r )rn r� �by_namer� �_SupportMacros__expand_permr� )r �permrh �pr r r Z __expand_perm� s zSupportMacros.__expand_permc C sB i | _ | D ]2}t� }|jD ]}|�| �|�� q|| j |j< q d S r )r� rn r� r� r� r� )r r Z exp_permsr� r r r Z __gen_map� s zSupportMacros.__gen_mapc C s | j s| �� | j | S r �r� �_SupportMacros__gen_map�r r� r r r r� � s zSupportMacros.by_namec C s | j s| �� || j v S r r� r� r r r �has_key� s zSupportMacros.has_key)N) r r r r rI r� r� r� r� r r r r r+ � s r+ c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r= Nc C s6 t �| |� t� | _i | _t� | _t� | _t� | _d S r )rR r rm r� r� r@ �data�usersr r r r r � s zRequire.__init__c C s | j �|t� �}|�|� d S r )r� � setdefaultrm r� )r r� r� r� r r r � add_obj_class� s zRequire.add_obj_classc C s� g }|� d� | jD ]}|� d| � q| j�� D ] \}}|� d||�� f � q2| jD ]}|� d| � qX| jD ]}|� d| � qr| jD ]}|� d| � q�|� d� t|�dkr�d S d � |�S ) Nz require {z type %s;z class %s %s;z role %s;z bool %s;z user %s;rc r rP rF ) rV r� r� r^ rq r@ r� r rT rg )r rh rZ r� r� r �boolrt r r r rI � s zRequire.to_string)N)r r r r r rI r r r r r= � s r= c @ s e Zd Zdd� Zdd� ZdS )� ObjPermSetc C s || _ t� | _d S r )r� rn r� r� r r r r � s zObjPermSet.__init__c C s d| j | j�� f S )Nzdefine(`%s', `%s'))r� r� rq r r r r rI � s zObjPermSet.to_stringNr� r r r r r � s r c @ s e Zd Zdd� Zdd� ZdS )�ClassMapc C s || _ || _d S r �r� r� )r r� r� r r r r s zClassMap.__init__c C s | j d | j S )Nz: r r r r r rI s zClassMap.to_stringNr� r r r r r s r c @ s. e Zd Zd dd�Zdd� Zdd� Zdd � ZdS ) �CommentNc C s |r || _ ng | _ d S r )�lines)r rj r r r r s zComment.__init__c C s> t | j�dkrdS g }| jD ]}|�d| � q d�|�S d S )Nr rP �#rF )rT r rV rg )r �out�liner r r rI s zComment.to_stringc C s. t |j�r*|jD ]}|dkr| j�|� qd S rO )rT r rV )r r} r r r r �merge s z Comment.mergec C s | � � S r )rI r r r r rJ s zComment.__str__)N)r r r r rI r rJ r r r r r s r )TFN)N)ra )?�stringry ZSRC_TYPEZTGT_TYPEZ OBJ_CLASSZPERMSZROLEZ DEST_TYPEZ field_to_strZ str_to_fieldr r rR r# r` rk rl rn rm rs r r� r9 r; r? r� r� r� r� r1 r3 r5 r7 rA rC r- r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r% r' r� r) r� r/ r� r+ r= r r r r r r r �<module> s~ �a & P < @:! !&$ __pycache__/policygen.cpython-39.pyc 0000644 00000031170 15025012421 0013370 0 ustar 00 a z f�; � @ s� d Z ddlZddlZddlmZ z ddlT W n Y n0 ddlmZ ddlmZ ddlm Z ddlm Z dd lm Z dd lm Z dZ dZd ZG d d � d �Zdefdd�Zdd� ZG dd� d�Zdd� ZdS )z> classes and algorithms for the generation of SELinux policy. � N)�*� )� refpolicy)� objectmodel)�access)� interfaces)�matching)�util� c @ s� e Zd ZdZd dd�Zd dd�Zd!dd �Zefd d �Zd d � Z dd� Z dd� Z d"dd�Z dd� Z dd� Zdd� Zdd � Zd d � ZdS )#�PolicyGeneratora� Generate a reference policy module from access vectors. PolicyGenerator generates a new reference policy module or updates an existing module based on requested access in the form of access vectors. It generates allow rules and optionally module require statements, reference policy interfaces, and extended permission access vector rules. By default only allow rules are generated. The methods .set_gen_refpol, .set_gen_requires and .set_gen_xperms turns on interface generation, requires generation, and xperms rules generation respectively. PolicyGenerator can also optionally add comments explaining why a particular access was allowed based on the audit messages that generated the access. The access vectors passed in must have the .audit_msgs field set correctly and .explain set to SHORT|LONG_EXPLANATION to enable this feature. The module created by PolicyGenerator can be passed to output.ModuleWriter to output a text representation. Nc C s> d| _ t| _d| _|r || _n t�� | _d| _d| _d| _ dS )z�Initialize a PolicyGenerator with an optional existing module. If the module parameter is not None then access will be added to the passed in module. Otherwise a new reference policy module will be created. NF) �ifgen�NO_EXPLANATION�explain� gen_requires�moduler ZModule� dontaudit�xperms�domains)�selfr � r �6/usr/lib/python3.9/site-packages/sepolgen/policygen.py�__init__E s zPolicyGenerator.__init__c C s* |rt ||�| _d| _nd| _| �� dS )a? Set whether reference policy interfaces are generated. To turn on interface generation pass in an interface set to use for interface generation. To turn off interface generation pass in None. If interface generation is enabled requires generation will also be enabled. TN)�InterfaceGeneratorr r �"_PolicyGenerator__set_module_style)r Zif_set� perm_mapsr r r �set_gen_refpolY s z PolicyGenerator.set_gen_refpolTc C s || _ dS )a& Set whether module requires are generated. Passing in true will turn on requires generation and False will disable generation. If requires generation is disabled interface generation will also be disabled and can only be re-enabled via .set_gen_refpol. N)r )r �statusr r r �set_gen_requiresk s z PolicyGenerator.set_gen_requiresc C s || _ dS )z)Set whether access is explained. N)r )r r r r r �set_gen_explainu s z PolicyGenerator.set_gen_explainc C s || _ d S �N)r )r r r r r �set_gen_dontauditz s z!PolicyGenerator.set_gen_dontauditc C s || _ dS )zSSet whether extended permission access vector rules are generated. N)r )r r r r r �set_gen_xperms} s z PolicyGenerator.set_gen_xpermsc C s* | j r d}nd}| j�� D ] }||_qd S )NTF)r r �module_declarationsr )r r �modr r r Z__set_module_style� s z"PolicyGenerator.__set_module_style�1.0c C sX d}| j �� D ]}|}q|s4t�� }| j j�d|� ||_||_| jrNd|_nd|_dS )z?Set the name of the module and optionally the version. Nr TF) r r" r ZModuleDeclaration�children�insert�name�versionr )r r' r( �mr# r r r �set_module_name� s z PolicyGenerator.set_module_namec C s | j rt | j� | jS r )r r )r r r r � get_module� s zPolicyGenerator.get_modulec C sn t �|�}| jr|j|_d|_| jr>tt �t || jd���|_|j t j krl| jd7 _|j rl| jd7 _|j t jkr�| jd7 _|j t jkr�t|j�dkr�| jdd�d d � |jD �� 7 _n | jd |jd d 7 _|j t jk�rL| jd 7 _| jd7 _| jd|jd 7 _|jdd� D ]}| jd| 7 _�q2�z |j t jk�rLd|jv �rLd|jv �s�d|jv �rL| j�s�ttdd�d d | _g }dd � tt gt|jt |jt |ji�D �D ] }|| jv�r�|� |� �q�t|�dk�r | jd|j|jd�|�f 7 _n0t|�dk�rL| jd|j|jd�|�f 7 _W n Y n0 | j j � |� dS )z Add access vector rule. � )� verbosityz0 #!!!! This avc is allowed in the current policyzN #!!!! This av rule may have been overridden by an extended permission av rulez: #!!!! This avc has a dontaudit rule in the current policyr zH #!!!! This avc can be allowed using one of the these booleans: # %sz, c S s g | ] }|d �qS )r r ��.0�xr r r � <listcomp>� � z1PolicyGenerator.__add_av_rule.<locals>.<listcomp>z5 #!!!! This avc can be allowed using the boolean '%s'r z� #!!!! This avc is a constraint violation. You would need to modify the attributes of either the source or target types to allow this access.z #Constraint rule: z # Nz? # Possible cause is the source %s and target %s are different.�write�dir�open�domain)r' �typesc S s g | ] }|t �qS r )ZTCONTEXTr. r r r r1 � r2 zL #!!!! The source type '%s' can write to a '%s' of the following type: # %s zM #!!!! The source type '%s' can write to a '%s' of the following types: # %s )!r ZAVRuler Z DONTAUDIT� rule_type�commentr �str�Comment�explain_access�type� audit2whyZALLOWr ZBOOLEAN�len�data�joinZ CONSTRAINTZTERULE�perms� obj_classr ZseinfoZ ATTRIBUTEZsesearchZSCONTEXT�src_typeZCLASSZPERMS�appendr r% )r �avZrule�reasonr7 �ir r r Z __add_av_rule� sV & ���, $&z PolicyGenerator.__add_av_rulec C s< |j �� D ],}t�||�}| jr(|j|_| jj� |� q dS )z5Add extended permission access vector rules. N) r �keysr Z AVExtRuler ZDONTAUDITXPERMr8 r r% rE )r rF �opZextruler r r Z__add_ext_av_rules� s z"PolicyGenerator.__add_ext_av_rulesc C s\ | j r*| j �|| j�\}}| jj�|� n|}|D ]$}| �|� | jr2|jr2| �|� q2dS )zJAdd the access from the access vector set to this module. N) r �genr r r% �extend� _PolicyGenerator__add_av_ruler �"_PolicyGenerator__add_ext_av_rules)r Zav_setZ raw_allow�ifcallsrF r r r � add_access� s zPolicyGenerator.add_accessc C s |D ]}| j j�|� qd S r )r r% rE )r Z role_type_set� role_typer r r �add_role_types� s z PolicyGenerator.add_role_types)N)NN)T)r$ )�__name__� __module__� __qualname__�__doc__r r r �SHORT_EXPLANATIONr r r! r r* r+ rM rN rP rR r r r r r - s 5 r c s g �� �fdd�}|t kr�| jD ]�}��d|j � ��dt|j�t|j�f � ��d|jt� |j �f � ��d|j |j |j f � ��tjd|j d d d d d �� q |� nb|�r��d | j| j| j| j�� f � t| j�dk�r| jd }��d|j |j |j f � |� �S )a� Explain why a policy statement was generated. Return a string containing a text explanation of why a policy statement was generated. The string is commented and wrapped and can be directly inserted into a policy. Params: av - access vector representing the access. Should have .audit_msgs set appropriately. verbosity - the amount of explanation provided. Should be set to NO_EXPLANATION, SHORT_EXPLANATION, or LONG_EXPLANATION. Returns: list of strings - strings explaining the access or an empty string if verbosity=NO_EXPLANATION or there is not sufficient information to provide an explanation. c sJ � sd S �� d� � �� D ]*} t| j� j�}�� d|�� | jf � qd S )Nz Interface options:z %s # [%d])rE �all�call_interface� interfacerF Z to_stringZdist)�match�ifcall��ml�sr r �explain_interfaces s z*explain_access.<locals>.explain_interfacesz %sz scontext="%s" tcontext="%s"z class="%s" perms="%s"z comm="%s" exe="%s" path="%s"z message="�"�P z z )�initial_indent�subsequent_indentz) src="%s" tgt="%s" class="%s", perms="%s"r z comm="%s" exe="%s" path="%s")�LONG_EXPLANATIONZ audit_msgsrE �headerr: ZscontextZtcontextZtclassr Zlist_to_space_strZaccessesZcommZexe�pathrL �textwrap�wrap�messagerD �tgt_typerC rB Z to_space_strr? )rF r^ r- r` �msgr r] r r< � s2 ��� � r< c C s� g }g }|� | j�� � |jdd� dd� t�� }| j|_tt |��D ]z}|| j tj krj|j � |j� qF|| j tjkr�|j � |j� qF|| j tjkr�|j � |j� qFt|| j � dsFJ �qFt |j �dks�J �|S )Nc S s | j S r ��num�Zparamr r r �<lambda>9 r2 z call_interface.<locals>.<lambda>T��key�reverser )rL �params�values�sortr Z InterfaceCallr' Zifname�ranger? r= �SRC_TYPE�argsrE rD �TGT_TYPErk � OBJ_CLASSrC �print)rZ rF rt ry r\ rH r r r rY 4 s" rY c @ s. e Zd Zd dd�Zdd� Zdd� Zdd � ZdS ) r Nc C s& || _ | �|� t�|�| _g | _d S r )�ifs�hack_check_ifsr Z AccessMatcher�matcher�calls)r r} r r r r r N s zInterfaceGenerator.__init__c C s� |j �� D ]|}g }|�|j�� � |jdd� dd� tt|��D ]D}|d || jkr`d|_ q || j t j t j t j fvr@d|_ q q@q d S )Nc S s | j S r rm ro r r r rp \ r2 z3InterfaceGenerator.hack_check_ifs.<locals>.<lambda>Trq r F)r ru rL rt rv rw r? rn Zenabledr= r rx rz r{ )r r} r0 rt rH r r r r~ T s �z!InterfaceGenerator.hack_check_ifsc C s� | � |�}g }| jD ]>}t|�� j|j�}|rDt�t|j||��|_ |� ||f� qg }|D ]L\}}d} |D ],} | � |�rl| j r�|j r�| j � |j � d} ql| s\|� |� q\||fS )NFT) r[ r� rY ZbestrZ rF r r; r< r9 rE �matches�merge) r �avsr- �raw_avrO r^ r\ �dr} �foundZo_ifcallr r r rK k s$ zInterfaceGenerator.genc C sL g }|D ]>}t �� }| j�| j||� t|�r<| j�|� q|�|� q|S r )r Z MatchListr Z search_ifsr} r? r� rE )r r� r� rF Zansr r r r[ � s zInterfaceGenerator.match)N)rS rT rU r r~ rK r[ r r r r r M s r c C s" dd� }| � � D ] }||� qdS )z*Add require statements to the module. c S s� t �� }| �� D ]:}|j�|j� |j�|j� |jD ]}|�||j � q6q| � � D ] }|j D ]}|j� |� q^qT| � � D ] }|j� |j� |j�|j� qz|j�d� | j�d|� d S )Nr r )r ZRequireZavrulesr7 �updateZ src_typesZ tgt_typesZ obj_classesZ add_obj_classrB Zinterface_callsry �addZ role_typesZrolesZrole�discardr% r& )�node�rZavrule�objr\ �argrQ r r r �collect_requires� s z&gen_requires.<locals>.collect_requiresN)Znodes)r r� r� r r r r � s r )rV � itertoolsrh Zselinux.audit2whyr> Zsetoolsr, r r r r r r r rW re r r< rY r r r r r r �<module> s, Q7B __pycache__/refparser.cpython-39.pyc 0000644 00000071113 15025012421 0013371 0 ustar 00 a z fez � 6 @ s� d dl Z d dlZd dlZd dlZddlmZ ddlmZ ddlmZ ddlmZ ddlm Z dZ d d d d d ddddddddddddddd d d d d d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>�5Z d?Z d@Z dAZdBZdCZdDZdEZdFZdGZdHZdIZdJZdKZdLZdMZdNZdOZ dPZ dQZ dRdS� Z dTdU� Z dVdW� Z!dXdY� Z"dZd[� Z#d\d]� Z$d^d_� Z%d`da� Z&dbdc� Z'da(da)dda*da+dea,d�dfdg�Z-dhdi� Z.djdk� Z/dldm� Z0dndo� Z1dpdq� Z2drds� Z3dtdu� Z4dvdw� Z5dxdy� Z6dzd{� Z7d|d}� Z8d~d� Z9d�d�� Z:d�d�� Z;d�d�� Z<d�d�� Z=d�d�� Z>d�d�� Z?d�d�� Z@d�d�� ZAd�d�� ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�� ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�� ZOd�d�� ZPd�d�� ZQd�d�� ZRd�d�� ZSd�d�� ZTd�d�� ZUd�d�� ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�� ZZd�dÄ Z[d�dń Z\d�dDŽ Z]d�dɄ Z^d�d˄ Z_d�d̈́ Z`d�dτ Zad�dф Zbd�dӄ Zcd�dՄ Zdd�dׄ Zed�dل Zfd�dۄ Zgd�d݄ Zhd�d߄ Zid�d� Zjd�d� Zkd�d� Zld�d� Zmd�d� Znd�d� Zod�d� Zpdaqdard�d� Zsd�d�d�Ztd�d� Zud�d�d��ZvdS )�� N� )�access)�defaults)�lex)� refpolicy)�yacc)JZTICKZSQUOTEZOBRACEZCBRACE�SEMI�COLONZOPARENZCPAREN�COMMA�MINUS�TILDEZASTERISKZAMPZBARZEXPL�EQUAL�FILENAME� IDENTIFIER�NUMBER�PATHZ IPV6_ADDR�MODULE� POLICY_MODULE�REQUIRE�SID�GENFSCON� FS_USE_XATTR� FS_USE_TRANS� FS_USE_TASK�PORTCON�NODECON�NETIFCON�PIRQCON�IOMEMCON� IOPORTCON� PCIDEVICECON� DEVICETREECON�CLASS� TYPEATTRIBUTE� ROLEATTRIBUTE�TYPE� ATTRIBUTE�ATTRIBUTE_ROLE�ALIAS� TYPEALIAS�BOOL�TRUE�FALSE�IF�ELSE�ROLE�TYPES�ALLOW� DONTAUDIT� AUDITALLOW� NEVERALLOW� PERMISSIVE� TYPEBOUNDS�TYPE_TRANSITION� TYPE_CHANGE� TYPE_MEMBER�RANGE_TRANSITION�ROLE_TRANSITION� OPT_POLICY� INTERFACE�TUNABLE_POLICY�GEN_REQ�TEMPLATE� GEN_CONTEXT� GEN_TUNABLE�IFELSE�IFDEF�IFNDEF�DEFINEr r r r r r r r r r r r r r r r! r" r# r$ r% r& r' r( r) r* r+ r, r- r. r/ r0 r1 r2 r3 r4 r5 r6 r7 r8 r9 r: r; r< r= r> r? r@ rA rB rC rE rD rF )5�moduleZ policy_moduleZrequireZsidZgenfscon� fs_use_xattr� fs_use_trans� fs_use_taskZportconZnodeconZnetifconZpirqconZiomemconZ ioportconZ pcideviceconZ devicetreecon�classZ typeattributeZ roleattribute�typeZ attributeZattribute_role�aliasZ typealias�bool�trueZfalse�if�else�role�typesZallow� dontaudit� auditallow� neverallowZ permissiveZ typeboundsZtype_transition� type_change� type_memberZrange_transitionZrole_transitionZoptional_policy� interfaceZtunable_policyZ gen_require�templateZ gen_contextZ gen_tunableZifelseZifndef�ifdefZdefinez\`z\'z\{z\}z\;+z\:z\(z\)z\,z\-z\~z\*z\&z\|z\!z\=z[0-9\.]+z/[a-zA-Z0-9)_\.\*/\$]*z c C s | S )z2[a-fA-F0-9]{0,4}:[a-fA-F0-9]{0,4}:([a-fA-F0-9]|:)*� ��tr\ r\ �6/usr/lib/python3.9/site-packages/sepolgen/refparser.py� t_IPV6_ADDR� s r` c C s | j jd7 _dS )zdnl.*\nr N��lexer�linenor] r\ r\ r_ � t_m4comment� s rd c C s | � d� dS )zdefine.*refpolicywarn\(.*\nr N)�skipr] r\ r\ r_ �t_refpolicywarn1� s rf c C s | j jd7 _dS )zrefpolicywarn\(.*\nr Nra r] r\ r\ r_ �t_refpolicywarn� s rg c C s t �| jd�| _| S )z#[a-zA-Z_\$][a-zA-Z0-9_\-\+\.\$\*~]*r ��reserved�get�valuerL r] r\ r\ r_ � t_IDENTIFIER s rl c C s t �| jd�| _| S )z"\"[a-zA-Z0-9_\-\+\.\$\*~ :\[\]]+\"r rh r] r\ r\ r_ � t_FILENAME s rm c C s | j jd7 _dS )z\#.*\nr Nra r] r\ r\ r_ � t_comment s rn c C s t d| jd � | �d� d S )NzIllegal character '%s'r r )�printrk re r] r\ r\ r_ �t_error s rp c C s | j jt| j�7 _dS )z\n+N)rb rc �lenrk r] r\ r\ r_ � t_newline s rr � Tc C sT | d u r d S | D ]>}|d u r q||_ |d ur@|j�d||f� q|j�d|� qd S )Nr )�parent�children�insert)Zstmtsrt �val�sr\ r\ r_ �collect/ s ry c C s4 | D ]*}t �|�r$|�t �|�� q|�|� qd S �N)�sptZhas_key�updateZby_name�add)Zidsrx �idr\ r\ r_ �expand; s r c C sN t | �dkr&| d r&tj�| d � n$t | �dkrJ| d rJtj�| d � dS )z^statements : statement | statements statement | empty � r N)rq �mru �append��pr\ r\ r_ � p_statementsC s r� c C s | d | d< dS )z�statement : interface | template | obj_perm_set | policy | policy_module_stmt | module_stmt r r Nr\ r� r\ r\ r_ � p_statementM s r� c C s dS )zempty :Nr\ r� r\ r\ r_ �p_emptyW s r� c C s. t �� }| d |_| d |_d|_ || d< dS )zHpolicy_module_stmt : POLICY_MODULE OPAREN IDENTIFIER COMMA NUMBER CPAREN� � Tr N�r ZModuleDeclaration�name�version�r� r� r\ r\ r_ �p_policy_module_stmtb s r� c C s( t �| d �}t| d |� || d< dS )zainterface : INTERFACE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN � � r N)r � Interfacery �r� �xr\ r\ r_ � p_interfacej s r� c C s( t �| d �}t| d |� || d< dS )z�template : TEMPLATE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN | DEFINE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN r� r� r N)r ZTemplatery r� r\ r\ r_ � p_templateq s r� c C s d| d< dS )z4define : DEFINE OPAREN TICK IDENTIFIER SQUOTE CPARENNr r\ r� r\ r\ r_ �p_definey s r� c C sz t | �dkr"| d r"| d | d< nTt | �dkrv| d sL| d rv| d | d< n*| d sb| d | d< n| d | d | d< dS )zlinterface_stmts : policy | interface_stmts policy | empty r� r r N�rq r� r\ r\ r_ �p_interface_stmts� s r� c C sF t �� }t| d |dd� t| �dkr8t| d |dd� |g| d< dS ) z�optional_policy : OPT_POLICY OPAREN TICK interface_stmts SQUOTE CPAREN | OPT_POLICY OPAREN TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN r� T�rw � r� Fr N)r ZOptionalPolicyry rq )r� �or\ r\ r_ �p_optional_policy� s r� c C sP t �� }| d |_t| d |dd� t| �dkrBt| d |dd� |g| d< d S ) z�tunable_policy : TUNABLE_POLICY OPAREN TICK cond_expr SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN | TUNABLE_POLICY OPAREN TICK cond_expr SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN r� r� Tr� � � Fr N)r Z TunablePolicy� cond_exprry rq r� r\ r\ r_ �p_tunable_policy� s r� c C s dS )a� ifelse : IFELSE OPAREN TICK IDENTIFIER SQUOTE COMMA COMMA TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi | IFELSE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi | IFELSE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi Nr\ r� r\ r\ r_ �p_ifelse� s r� c C sb t �| d �}| d dkr d}nd}t| d ||d� t| �dkrTt| d |dd� |g| d < d S ) aJ ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi r� r r[ TFr� r� r� r N)r ZIfDefry rq )r� r� �vr\ r\ r_ �p_ifdef� s r� c C s8 t j| d d�}t| �dkr,|j�| d � || d< dS )z�interface_call : IDENTIFIER OPAREN interface_call_param_list CPAREN | IDENTIFIER OPAREN CPAREN | IDENTIFIER OPAREN interface_call_param_list CPAREN SEMIr )Zifnamer� r� r N)r Z InterfaceCallrq �args�extend)r� �ir\ r\ r_ �p_interface_call� s r� c C s6 t | �dkr| d | d< n| d d| d g| d< dS )z�interface_call_param : IDENTIFIER | IDENTIFIER MINUS IDENTIFIER | nested_id_set | TRUE | FALSE | FILENAME r� r r �-r� Nr� r� r\ r\ r_ �p_interface_call_param� s r� c C s6 t | �dkr | d g| d< n| d | d g | d< dS )z�interface_call_param_list : interface_call_param | interface_call_param_list COMMA interface_call_param r� r r r� Nr� r� r\ r\ r_ �p_interface_call_param_list� s r� c C s$ t �| d �}| d |_|| d< dS )zRobj_perm_set : DEFINE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK names SQUOTE CPARENr� r� r N)r Z ObjPermSet�perms�r� rx r\ r\ r_ �p_obj_perm_set� s r� c C s | d | d< dS )z�policy : policy_stmt | optional_policy | tunable_policy | ifdef | ifelse | conditional r r Nr\ r� r\ r\ r_ �p_policy� s r� c C s | d r| d g| d< dS )a� policy_stmt : gen_require | avrule_def | typerule_def | typebound_def | typeattribute_def | roleattribute_def | interface_call | role_def | role_allow | permissive | type_def | typealias_def | attribute_def | attribute_role_def | range_transition_def | role_transition_def | bool | gen_tunable | define | initial_sid | genfscon | fs_use | portcon | nodecon | netifcon | pirqcon | iomemcon | ioportcon | pcidevicecon | devicetreecon r r Nr\ r� r\ r\ r_ � p_policy_stmt� s r� c C s. t �� }| d |_| d |_d|_ || d< dS )z+module_stmt : MODULE IDENTIFIER NUMBER SEMIr� r� Fr Nr� r� r\ r\ r_ � p_module_stmt s r� c C s dS )zlgen_require : GEN_REQ OPAREN TICK requires SQUOTE CPAREN | REQUIRE OBRACE requires CBRACENr\ r� r\ r\ r_ � p_gen_require$ s r� c C s dS )zsrequires : require | requires require | ifdef | requires ifdef Nr\ r� r\ r\ r_ � p_requires, s r� c C s dS )z�require : TYPE comma_list SEMI | ROLE comma_list SEMI | ATTRIBUTE comma_list SEMI | ATTRIBUTE_ROLE comma_list SEMI | CLASS comma_list SEMI | BOOL comma_list SEMI Nr\ r� r\ r\ r_ � p_require4 s r� c C sH t �� }| d |_| d |_| d |_t| �dkr<| d |_|| d< dS )z�security_context : IDENTIFIER COLON IDENTIFIER COLON IDENTIFIER | IDENTIFIER COLON IDENTIFIER COLON IDENTIFIER COLON mls_range_defr r� r� � r� r N)r ZSecurityContext�userrR rL rq �levelr� r\ r\ r_ �p_security_context> s r� c C s | d }| d |_ || d< dS )zQgen_context : GEN_CONTEXT OPAREN security_context COMMA mls_range_def CPAREN r� r� r N)r� r� r\ r\ r_ � p_gen_contextK s r� c C s | d | d< dS )z<context : security_context | gen_context r r Nr\ r� r\ r\ r_ � p_contextV s r� c C s( t �� }| d |_| d |_|| d< dS )z$initial_sid : SID IDENTIFIER contextr� r� r N)r Z InitialSidr� �contextr� r\ r\ r_ � p_initial_sid\ s r� c C s2 t �� }| d |_| d |_| d |_|| d< dS )z+genfscon : GENFSCON IDENTIFIER PATH contextr� r� r� r N)r ZGenfsCon� filesystem�pathr� )r� �gr\ r\ r_ � p_genfsconc s r� c C sn t �� }| d dkr t jj|_n.| d dkr8t jj|_n| d dkrNt jj|_| d |_| d |_|| d< dS ) z�fs_use : FS_USE_XATTR IDENTIFIER context SEMI | FS_USE_TASK IDENTIFIER context SEMI | FS_USE_TRANS IDENTIFIER context SEMI r rH rJ rI r� r� r N)r Z FilesystemUseZXATTRrL ZTASKZTRANSr� r� )r� �fr\ r\ r_ �p_fs_usem s r� c C s` t �� }| d |_t| �dkr4| d |_| d |_n | d d | d |_| d |_|| d< dS )zkportcon : PORTCON IDENTIFIER NUMBER context | PORTCON IDENTIFIER NUMBER MINUS NUMBER contextr� r� r� r� r� r N)r ZPortConZ port_typerq Z port_numberr� �r� �cr\ r\ r_ � p_portcon s r� c C s2 t �� }| d |_| d |_| d |_|| d< dS )zanodecon : NODECON NUMBER NUMBER context | NODECON IPV6_ADDR IPV6_ADDR context r� r� r� r N)r ZNodeCon�start�endr� �r� �nr\ r\ r_ � p_nodecon� s r� c C s2 t �� }| d |_| d |_| d |_|| d< dS )z.netifcon : NETIFCON IDENTIFIER context contextr� r� r� r N)r ZNetifConrY Zinterface_contextZpacket_contextr� r\ r\ r_ � p_netifcon� s r� c C s( t �� }| d |_| d |_|| d< dS )z pirqcon : PIRQCON NUMBER contextr� r� r N)r ZPirqConZ pirq_numberr� r� r\ r\ r_ � p_pirqcon� s r� c C sV t �� }t| �dkr*| d |_| d |_n | d d | d |_| d |_|| d< dS )zYiomemcon : IOMEMCON NUMBER context | IOMEMCON NUMBER MINUS NUMBER contextr� r� r� r� r N)r ZIomemConrq Z device_memr� r� r\ r\ r_ � p_iomemcon� s r� c C sV t �� }t| �dkr*| d |_| d |_n | d d | d |_| d |_|| d< dS )z\ioportcon : IOPORTCON NUMBER context | IOPORTCON NUMBER MINUS NUMBER contextr� r� r� r� r N)r Z IoportConrq Zioportr� r� r\ r\ r_ � p_ioportcon� s r� c C s( t �� }| d |_| d |_|| d< dS )z*pcidevicecon : PCIDEVICECON NUMBER contextr� r� r N)r Z PciDeviceConZdevicer� r� r\ r\ r_ �p_pcidevicecon� s r� c C s( t �� }| d |_| d |_|| d< dS )z,devicetreecon : DEVICETREECON NUMBER contextr� r� r N)r Z DevicetTeeConr� r� r� r\ r\ r_ �p_devicetreecon� s r� c C s4 | d | d< t | �dkr0| d d | d | d< dS )z[mls_range_def : mls_level_def MINUS mls_level_def | mls_level_def r r r� r� r� Nr� r� r\ r\ r_ �p_mls_range_def� s r� c C s: | d | d< t | �dkr6| d d d�| d � | d< dS )zRmls_level_def : IDENTIFIER COLON comma_list | IDENTIFIER r r r� �:�,r� N)rq �joinr� r\ r\ r_ �p_mls_level_def� s r� c C s� t �| d �}t| �dkrD| d dkr8|j�| d � qv| d |_n2t| �dkrv| d |_t| �dkrv|j�| d � || d< dS ) z�type_def : TYPE IDENTIFIER COMMA comma_list SEMI | TYPE IDENTIFIER SEMI | TYPE IDENTIFIER ALIAS names SEMI | TYPE IDENTIFIER ALIAS names COMMA comma_list SEMI r� r� r� r� r� r� r N)r �Typerq � attributesr| �aliases�r� r^ r\ r\ r_ � p_type_def� s r� c C s t �| d �}|| d< dS )z)attribute_def : ATTRIBUTE IDENTIFIER SEMIr� r N)r Z Attribute�r� �ar\ r\ r_ �p_attribute_def� s r� c C s t �| d �}|| d< dS )z3attribute_role_def : ATTRIBUTE_ROLE IDENTIFIER SEMIr� r N)r ZAttribute_Roler� r\ r\ r_ �p_attribute_role_def� s r� c C s( t �� }| d |_| d |_|| d< dS )z5typealias_def : TYPEALIAS IDENTIFIER ALIAS names SEMIr� r� r N)r Z TypeAliasrL r� r� r\ r\ r_ �p_typealias_def� s r� c C s: t �� }| d |_t| �dkr.|j�| d � || d< dS )zWrole_def : ROLE IDENTIFIER TYPES comma_list SEMI | ROLE IDENTIFIER SEMIr� r� r N)r ZRolerR rq rS r| �r� �rr\ r\ r_ � p_role_def s r� c C s( t �� }| d |_| d |_|| d< dS )z#role_allow : ALLOW names names SEMIr� r� r N)r Z RoleAllowZ src_rolesZ tgt_rolesr� r\ r\ r_ � p_role_allow s r� c C s dS )z"permissive : PERMISSIVE names SEMINr\ r� r\ r\ r_ � p_permissive s r� c C s� t �� }| d dkr t jj|_n.| d dkr8t jj|_n| d dkrNt jj|_| d |_| d |_| d |_| d |_ || d < d S ) z�avrule_def : ALLOW names names COLON names names SEMI | DONTAUDIT names names COLON names names SEMI | AUDITALLOW names names COLON names names SEMI | NEVERALLOW names names COLON names names SEMI r rT rU rV r� r� r� r� r N) r �AVRuler2 � rule_typer3 r4 � src_types� tgt_types� obj_classesr� r� r\ r\ r_ � p_avrule_def s r� c C st t �� }| d dkr t jj|_n| d dkr6t jj|_| d |_| d |_| d |_| d |_| d |_ || d < d S ) a� typerule_def : TYPE_TRANSITION names names COLON names IDENTIFIER SEMI | TYPE_TRANSITION names names COLON names IDENTIFIER FILENAME SEMI | TYPE_TRANSITION names names COLON names IDENTIFIER IDENTIFIER SEMI | TYPE_CHANGE names names COLON names IDENTIFIER SEMI | TYPE_MEMBER names names COLON names IDENTIFIER SEMI r rW rX r� r� r� r� r� r N) r ZTypeRuler8 r� r9 r� r� r� Z dest_type� file_namer� r\ r\ r_ �p_typerule_def- s r� c C s. t �� }| d |_|j�| d � || d< dS )z5typebound_def : TYPEBOUNDS IDENTIFIER comma_list SEMIr� r� r N)r Z TypeBoundrL r� r| r� r\ r\ r_ �p_typebound_def@ s r� c C s8 t �� }| d |_| d dkr&d|_nd|_|| d< dS )zIbool : BOOL IDENTIFIER TRUE SEMI | BOOL IDENTIFIER FALSE SEMIr� r� rO TFr N�r ZBoolr� �state�r� �br\ r\ r_ �p_boolG s r� c C s8 t �� }| d |_| d dkr&d|_nd|_|| d< dS )z�gen_tunable : GEN_TUNABLE OPAREN TICK IDENTIFIER SQUOTE COMMA TRUE CPAREN | GEN_TUNABLE OPAREN TICK IDENTIFIER SQUOTE COMMA FALSE CPARENr� r� rO TFr Nr� r� r\ r\ r_ � p_gen_tunableR s r� c C sP t �� }| d |_t| d |dd� t| �dkrBt| d |dd� |g| d< d S ) z� conditional : IF OPAREN cond_expr CPAREN OBRACE interface_stmts CBRACE | IF OPAREN cond_expr CPAREN OBRACE interface_stmts CBRACE ELSE OBRACE interface_stmts CBRACE r� r� Tr� r� � Fr N)r Z Conditionalr� ry rq r� r\ r\ r_ � p_conditional] s r� c C s. t �� }| d |_|j�| d � || d< dS )z<typeattribute_def : TYPEATTRIBUTE IDENTIFIER comma_list SEMIr� r� r N)r Z TypeAttributerL r� r| r� r\ r\ r_ �p_typeattribute_defh s r� c C s. t �� }| d |_|j�| d � || d< dS )z<roleattribute_def : ROLEATTRIBUTE IDENTIFIER comma_list SEMIr� r� r N)r Z RoleAttributerR Zroleattributesr| r� r\ r\ r_ �p_roleattribute_defo s r� c C s dS )z�range_transition_def : RANGE_TRANSITION names names COLON names mls_range_def SEMI | RANGE_TRANSITION names names names SEMINr\ r� r\ r\ r_ �p_range_transition_defv s r� c C s dS )z<role_transition_def : ROLE_TRANSITION names names names SEMINr\ r� r\ r\ r_ �p_role_transition_def{ s r� c C sj t | �}|dkr | d g| d< nF|dkr@| d g| d | d< n&| d | d | d g | d | d< dS )a cond_expr : IDENTIFIER | EXPL cond_expr | cond_expr AMP AMP cond_expr | cond_expr BAR BAR cond_expr | cond_expr EQUAL EQUAL cond_expr | cond_expr EXPL EQUAL cond_expr r� r r r� r� Nr� )r� �lr\ r\ r_ � p_cond_expr s r� c C sr t �� }t| �dk r$t| d |� nBt| �dkrFt| d |� d|_n t| d g� |�d| d � || d< dS )z�names : identifier | nested_id_set | asterisk | TILDE identifier | TILDE nested_id_set | IDENTIFIER MINUS IDENTIFIER r� r r� Tr� r N)r ZIdSetrq r Z complimentr} r� r\ r\ r_ �p_names� s r� c C s | d g| d< dS )zidentifier : IDENTIFIERr r Nr\ r� r\ r\ r_ � p_identifier� s r� c C s | d g| d< dS )zasterisk : ASTERISKr r Nr\ r� r\ r\ r_ � p_asterisk� s r� c C s | d | d< dS )z1nested_id_set : OBRACE nested_id_list CBRACE r� r Nr\ r� r\ r\ r_ �p_nested_id_set� s r� c C s2 t | �dkr| d | d< n| d | d | d< dS )z`nested_id_list : nested_id_element | nested_id_list nested_id_element r� r r Nr� r� r\ r\ r_ �p_nested_id_list� s r� c C s4 t | �dkr| d | d< nd| d }|g| d< dS )zxnested_id_element : identifier | MINUS IDENTIFIER | nested_id_set r� r r r� Nr� )r� �strr\ r\ r_ �p_nested_id_element� s r c C s0 t | �dkr | d | d | d< | d | d< dS )zTcomma_list : nested_id_list | comma_list COMMA nested_id_list r� r r� r Nr� r� r\ r\ r_ � p_comma_list� s r c C s dS )z/optional_semi : SEMI | emptyNr\ r� r\ r\ r_ �p_optional_semi� s r c C s& dt | j| j| jf att� dad S )Nz(%s: Syntax error on line %d %s [type=%s]F)� parse_filerc rk rL �errorro �success)�tokr\ r\ r_ �p_error� s r c C s$ | si S i }| D ]}|||j < qd S rz )r� )r{ �mapr� r\ r\ r_ �prep_spt� s r c C sH t s t�� atjd|dd�a | d ur*| ant�� a|s@t�� an|ad S )NZLALRr )�method�debugZ write_tables) �parserr rb r r� r �Module� SupportMacrosr{ )rG �supportr r\ r\ r_ �create_globals� s r Fc C s� t |||� dt_daztj| |td� W nD tyn } z,d ad adt|� d t� � a W Y d }~n d }~0 0 ts�d adt }t |��t S )Nr T)r rb zinternal parser error: %s� zcould not parse text: "%s") r rb rc r r �parse� Exceptionr � traceback� format_excr � ValueErrorr� )�textrG r r �e�msgr\ r\ r_ r s .r c C s� g }d }t �| �D ]�\}}}|D ]~}t j�|�}t j�||�}|d dkr�|dkrX|}q�tt�d|d ��r�|�|d |f� q |d dkr |�|d |f� q q||fS )Nr z.sptzobj_perm_sets.spt�patternsr z.if) �os�walkr� �splitextr� rq �re�findallr� ) �root�modules�support_macros�dirpath�dirnames� filenamesr� �modname�filenamer\ r\ r_ � list_headers s r) c s0 ddl m} t�� }g }d }tj�| �r|tj�| �d }|dkrLtd| ��tj� |�} |� | d | f� t t � � �\} }n t | �\}}|r�|s�td���fdd��d� �fd d � } d } |�r&�d | � t�� } | || � |j� | � t�d �} t�g d ��}| j� t�|�� |j� | � �d� ��rP� �sP|jtjt|�d�}|�d� g }|D ]�}t�� }|d |_z*|�r�| |d || � n| |d |� W nR t�y� } z8�t|�d � |� |d � W Y d }~�qXW Y d }~n d }~0 0 |j� |� ��rX� �sX|� � �qXt|��r,�dd� |� � |S )Nr )�utilrs zInvalid file name %sr z1could not find support macros (obj_perm_sets.spt)c s � r� � | � d S rz )�write)r )�outputr\ r_ r� A s zparse_headers.<locals>.oc s� � r�d| � z.t | �}|�� }|�� | at|||� � W n\ tyd } zW Y d }~d S d }~0 ty� } z td| t|�f ��W Y d }~n d }~0 0 d S )Nzparsing file %s zerror parsing file %s: %s)�open�read�closer r �IOErrorr r )r� rG r{ �fdZtxtr )r r� r\ r_ r E s z!parse_headers.<locals>.parse_filez Parsing support macros (%s): �can_exec) z$1z$2�fileZexecute_no_transr- r. �getattr�lockZexecuteZioctlzdone. )ZstepszParsing interface filesr z!failed to parse some headers: %s z, )N) rs r* r ZHeadersr r� �isfile�splitr r r� r) r �headersr ru r� r Z AccessVectorr� ZConsoleProgressBar�sys�stdoutrq r� r r� r �stepr� )r! r, r r r* r8 r" r# r� r' Z all_modulesr r{ r2 �av�statusZfailuresr� r� r r\ )r r� r, r_ � parse_headers, s` $ r> )N)NNF)NTF)wr9 r r r rs r r r r r �tokensri Zt_TICKZt_SQUOTEZt_OBRACEZt_CBRACEZt_SEMIZt_COLONZt_OPARENZt_CPARENZt_COMMAZt_MINUSZt_TILDEZ t_ASTERISKZt_AMPZt_BARZt_EXPLZt_EQUALZt_NUMBERZt_PATHZt_ignorer` rd rf rg rl rm rn rp rr r� r r r{ r ry r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r rb r r r) r> r\ r\ r\ r_ �<module> sT \�E # __pycache__/refpolicy.cpython-39.opt-1.pyc 0000644 00000116355 15025012421 0014343 0 ustar 00 a z f�} � @ sZ d dl Z d dlZd ZdZdZdZdZdZg d�Zeeeeeed�Z G dd � d �Z G d d � d e �Z G d d � d e �Z dsdd�Z dtdd�Zdudd�Zdd� ZG dd� de�ZG dd � d e �ZG d d � d e �ZG d d � d �ZG d!d"� d"e �ZG d#d$� d$e �ZG d%d&� d&e �ZG d'd(� d(e �ZG d)d*� d*e �ZG d+d,� d,e �ZG d-d.� d.e �Z G d/d0� d0e �Z G d1d2� d2e �Z G d3d4� d4e �Z G d5d6� d6e �Z G d7d8� d8e �Z!G d9d:� d:e �Z"G d;d<� d<e �Z#G d=d>� d>e �Z$G d?d@� d@e �Z%G dAdB� dBe �Z&G dCdD� dDe �Z'G dEdF� dFe �Z(G dGdH� dHe �Z)G dIdJ� dJe �Z*G dKdL� dLe �Z+G dMdN� dNe �Z,G dOdP� dPe �Z-G dQdR� dRe �Z.G dSdT� dTe �Z/G dUdV� dVe �Z0dWdX� Z1G dYdZ� dZe �Z2G d[d\� d\e �Z3G d]d^� d^e �Z4G d_d`� d`e �Z5G dadb� dbe �Z6G dcdd� dde �Z7G dedf� dfe �Z8G dgdh� dhe �Z9G didj� dje �Z:G dkdl� dle �Z;G dmdn� dn�Z<G dodp� dp�Z=G dqdr� dr�Z>dS )v� N� � � � � )�source�target�objectZ permission�roleZ destinationc @ s e Zd Zddd�ZdS )� PolicyBaseNc C s d | _ d | _d S �N)�parent�comment��selfr � r �6/usr/lib/python3.9/site-packages/sepolgen/refpolicy.py�__init__5 s zPolicyBase.__init__)N)�__name__� __module__� __qualname__r r r r r r 4 s r c @ s� e Zd ZdZd/dd�Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� ZdS )0�Nodea� Base class objects produced from parsing the reference policy. The Node class is used as the base class for any non-leaf object produced by parsing the reference policy. This object should contain a reference to its parent (or None for a top-level object) and 0 or more children. The general idea here is to have a very simple tree structure. Children are not separated out by type. Instead the tree structure represents fairly closely the real structure of the policy statements. The object should be iterable - by default over all children but subclasses are free to provide additional iterators over a subset of their childre (see Interface for example). Nc C s t �| |� g | _d S r )r r �childrenr r r r r J s z Node.__init__c C s t | j�S r )�iterr �r r r r �__iter__N s z Node.__iter__c C s t dd� t| ��S )Nc S s t | t�S r )� isinstancer ��xr r r �<lambda>W � z Node.nodes.<locals>.<lambda>��filter�walktreer r r r �nodesV s z Node.nodesc C s t dd� t| ��S )Nc S s t | t�S r )r �Moduler r r r r Z r z Node.modules.<locals>.<lambda>r! r r r r �modulesY s z Node.modulesc C s t dd� t| ��S )Nc S s t | t�S r )r � Interfacer r r r r ] r z!Node.interfaces.<locals>.<lambda>r! r r r r � interfaces\ s zNode.interfacesc C s t dd� t| ��S )Nc S s t | t�S r )r �Templater r r r r ` r z Node.templates.<locals>.<lambda>r! r r r r � templates_ s zNode.templatesc C s t dd� t| ��S )Nc S s t | t�S r )r � SupportMacrosr r r r r c r z%Node.support_macros.<locals>.<lambda>r! r r r r �support_macrosb s zNode.support_macrosc C s t dd� t| ��S )Nc S s t | t�S r )r �ModuleDeclarationr r r r r h r z*Node.module_declarations.<locals>.<lambda>r! r r r r �module_declarationsg s zNode.module_declarationsc C s t dd� t| ��S )Nc S s t | t�S r )r � InterfaceCallr r r r r k r z&Node.interface_calls.<locals>.<lambda>r! r r r r �interface_callsj s zNode.interface_callsc C s t dd� t| ��S )Nc S s t | t�S r )r �AVRuler r r r r n r z Node.avrules.<locals>.<lambda>r! r r r r �avrulesm s z Node.avrulesc C s t dd� t| ��S )Nc S s t | t�S r )r � AVExtRuler r r r r q r z!Node.avextrules.<locals>.<lambda>r! r r r r � avextrulesp s zNode.avextrulesc C s t dd� t| ��S )Nc S s t | t�S r )r �TypeRuler r r r r t r z Node.typerules.<locals>.<lambda>r! r r r r � typeruless s zNode.typerulesc C s t dd� t| ��S )Nc S s t | t�S r )r � TypeBoundr r r r r w r z!Node.typebounds.<locals>.<lambda>r! r r r r � typeboundsv s zNode.typeboundsc C s t dd� t| ��S )zAIterate over all of the TypeAttribute children of this Interface.c S s t | t�S r )r � TypeAttributer r r r r { r z%Node.typeattributes.<locals>.<lambda>r! r r r r �typeattributesy s zNode.typeattributesc C s t dd� t| ��S )zAIterate over all of the RoleAttribute children of this Interface.c S s t | t�S r )r � RoleAttributer r r r r r z%Node.roleattributes.<locals>.<lambda>r! r r r r �roleattributes} s zNode.roleattributesc C s t dd� t| ��S )Nc S s t | t�S r )r �Requirer r r r r � r z Node.requires.<locals>.<lambda>r! r r r r �requires� s z Node.requiresc C s t dd� t| ��S )Nc S s t | t�S r )r �Roler r r r r � r z Node.roles.<locals>.<lambda>r! r r r r �roles� s z Node.rolesc C s t dd� t| ��S )Nc S s t | t�S r )r � RoleAllowr r r r r � r z"Node.role_allows.<locals>.<lambda>r! r r r r � role_allows� s zNode.role_allowsc C s t dd� t| ��S )Nc S s t | t�S r )r �RoleTyper r r r r � r z!Node.role_types.<locals>.<lambda>r! r r r r � role_types� s zNode.role_typesc C s( | j r t| j �d | �� S | �� S d S �N� �r �str� to_stringr r r r �__str__� s z Node.__str__c C s d| j j| �� f S �Nz<%s(%s)>�� __class__r rI r r r r �__repr__� s z Node.__repr__c C s dS �N� r r r r r rI � s zNode.to_string)N)r r r �__doc__r r r$ r& r( r* r, r. r0 r2 r4 r6 r8 r: r< r> r@ rB rD rJ rN rI r r r r r 9 s. r c @ s. e Zd Zd dd�Zdd� Zdd� Zdd � ZdS ) �LeafNc C s t �| |� d S r )r r r r r r r � s z Leaf.__init__c C s( | j r t| j �d | �� S | �� S d S rE rG r r r r rJ � s z Leaf.__str__c C s d| j j| �� f S rK rL r r r r rN � s z Leaf.__repr__c C s dS rO r r r r r rI � s zLeaf.to_string)N)r r r r rJ rN rI r r r r rR � s rR TFc c s� |r d}nd}| dfg}t |�dkr�|�|�\}}|rB||fV n|V t|t�rg }t |j�d } | dkr�|du s�t|j| |�r�|�|j| |d f� | d8 } qd|�|� qdS )a� Iterate over a Node and its Children. The walktree function iterates over a tree containing Nodes and leaf objects. The iteration can perform a depth first or a breadth first traversal of the tree (controlled by the depthfirst parameter. The passed in node will be returned. This function will only work correctly for trees - arbitrary graphs will likely cause infinite looping. ���r r N)�len�popr r r �append�extend) �nodeZ depthfirst� showdepth�type�index�stackZcur�depth�items�ir r r r# � s" r# c c s& | D ] }|du st ||�r|V qdS )a Iterate over the direct children of a Node. The walktree function iterates over the children of a Node. Unlike walktree it does note return the passed in node or the children of any Node objects (that is, it does not go beyond the current level in the tree). N)r )rX rZ r r r r �walknode� s r` ��{�}c C sR t | �}d}|dk r td��d�| �}|dkr2|S |d d | d |d S dS )z�Convert a set (or any sequence type) into a string representation formatted to match SELinux space separated list conventions. For example the list ['read', 'write'] would be converted into: '{ read write }' rP r z"cannot convert 0 len set to string� r N�rT � ValueError�join)�s�cont�lrH r r r �list_to_space_str� s rk c C s" t | �}|dk rtd��d�| �S )Nr z(cannot convert 0 len set to comma stringz, re )rh rj r r r �list_to_comma_str� s rl c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) �IdSetNc C s& |rt �| |� n t �| � d| _d S )NF)�setr Z compliment)r �listr r r r � s zIdSet.__init__c C s t t| ��S r )rk �sortedr r r r � to_space_str s zIdSet.to_space_strc C s t t| ��S r )rl rp r r r r � to_comma_str s zIdSet.to_comma_str)N)r r r r rq rr r r r r rm � s rm c @ s4 e Zd ZdZd dd�Zdd� Zdd� Zd d d �ZdS ) �SecurityContextz;An SELinux security context with optional MCS / MLS fields.Nc C s: t �| |� d| _d| _d| _d| _|dur6| �|� dS )z�Create a SecurityContext object, optionally from a string. Parameters: [context] - string representing a security context. Same format as a string passed to the from_string method. rP N)rR r �userr rZ �level� from_string)r �contextr r r r r s zSecurityContext.__init__c C s� t �|�}|d dkr |d }|�d�}t|�dk r@td| ��|d | _|d | _|d | _t|�dkr�d�|dd� �| _ nd| _ dS )z�Parse a string representing a context into a SecurityContext. The string should be in the standard format - e.g., 'user:role:type:level'. Raises ValueError if the string is not parsable as a security context. r r �:r z)context string [%s] not in a valid formatr N) �selinuxZ selinux_trans_to_raw_context�splitrT rf rt r rZ rg ru )r rw �raw�fieldsr r r rv s zSecurityContext.from_stringc C s0 | j |j ko.| j|jko.| j|jko.| j|jkS )a Compare two SecurityContext objects - all fields must be exactly the the same for the comparison to work. It is possible for the level fields to be semantically the same yet syntactically different - in this case this function will return false. )rt r rZ ru )r �otherr r r �__eq__4 s � � �zSecurityContext.__eq__c C s\ | j | j| jg}| jdu rF|du r:t�� dkrD|�d� qR|�|� n |�| j� d�|�S )a� Return a string representing this security context. By default, the string will contiain a MCS / MLS level potentially from the default which is passed in if none was set. Arguments: default_level - the default level to use if self.level is an empty string. Returns: A string represening the security context in the form 'user:role:type:level'. Nr Zs0rx )rt r rZ ru ry Zis_selinux_mls_enabledrV rg )r Z default_levelr| r r r rI ? s zSecurityContext.to_string)NN)N)r r r rQ r rv r~ rI r r r r rs s rs c @ s e Zd ZdZddd�ZdS )� ObjectClassa" SELinux object class and permissions. This class is a basic representation of an SELinux object class - it does not represent separate common permissions - just the union of the common and class specific permissions. It is meant to be convenient for policy generation. rP Nc C s t �| |� || _t� | _d S r )rR r �namerm �perms�r r� r r r r r a s zObjectClass.__init__)rP N)r r r rQ r r r r r r Y s r c @ s< e Zd ZdZddd�Zdd� Zdd� Zdd d �Zd d � Zd S )�XpermSeta) Extended permission set. This class represents one or more extended permissions represented by numeric values or ranges of values. The .complement attribute is used to specify all permission except those specified. Two xperm set can be merged using the .extend() method. Fc C s || _ g | _d S r )� complement�ranges)r r� r r r r p s zXpermSet.__init__c C s� | j �� d}|t| j �k r�|d t| j �k r�| j |d d | j | d d kr�| j | d t| j | d | j |d d �f| j |< | j |d = q q�q |d7 }qdS )z0Ensure that ranges are not overlapping. r r N)r� �sortrT �max)r r_ r r r Z__normalize_rangest s $� zXpermSet.__normalize_rangesc C s | j �|j � | �� dS )z%Add ranges from an xperm set N)r� rW �_XpermSet__normalize_ranges�r rh r r r rW � s zXpermSet.extendNc C s( |du r |}| j �||f� | �� dS )z7Add value of range of values to the xperm set. N)r� rV r� )r ZminimumZmaximumr r r �add� s z XpermSet.addc C sz | j s dS | jrdnd}t| j �dkrX| j d d | j d d krX|t| j d d � S tdd� | j �}d|d�|�f S ) NrP z~ r r c S s8 | d | d kr t | d �S dt | d �t | d �f S )Nr r z%s-%s)�hexr r r r r � r z$XpermSet.to_string.<locals>.<lambda>z%s{ %s }rd )r� r� rT r� �maprg )r ZcomplZvalsr r r rI � s *zXpermSet.to_string)F)N) r r r rQ r r� rW r� rI r r r r r� f s r� c @ s" e Zd ZdZddd�Zdd� ZdS )r9 z[SElinux typeattribute statement. This class represents a typeattribute statement. Nc C s t �| |� d| _t� | _d S rO )rR r rZ rm � attributesr r r r r � s zTypeAttribute.__init__c C s d| j | j�� f S )Nztypeattribute %s %s;)rZ r� rr r r r r rI � s zTypeAttribute.to_string)N�r r r rQ r rI r r r r r9 � s r9 c @ s" e Zd ZdZddd�Zdd� ZdS )r; z[SElinux roleattribute statement. This class represents a roleattribute statement. Nc C s t �| |� d| _t� | _d S rO )rR r r rm r< r r r r r � s zRoleAttribute.__init__c C s d| j | j�� f S )Nzroleattribute %s %s;)r r< rr r r r r rI � s zRoleAttribute.to_string)Nr� r r r r r; � s r; c @ s e Zd Zddd�Zdd� ZdS )r? Nc C s t �| |� d| _t� | _d S rO �rR r r rm �typesr r r r r � s z Role.__init__c C s& d}| j D ]}|d| j|f 7 }q |S �NrP zrole %s types %s; �r� r �r rh �tr r r rI � s zRole.to_string)N�r r r r rI r r r r r? � s r? c @ s e Zd Zddd�Zdd� ZdS )�TyperP Nc C s& t �| |� || _t� | _t� | _d S r )rR r r� rm r� �aliasesr� r r r r � s z Type.__init__c C sR d| j }t| j�dkr*|d| j�� }t| j�dkrJ|d| j�� }|d S )Nztype %sr zalias %s�, %s�;)r� rT r� rq r� rr r� r r r rI � s zType.to_string)rP Nr� r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )� TypeAliasNc C s t �| |� d| _t� | _d S rO )rR r rZ rm r� r r r r r � s zTypeAlias.__init__c C s d| j | j�� f S )Nztypealias %s alias %s;)rZ r� rq r r r r rI � s zTypeAlias.to_string)Nr� r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )� AttributerP Nc C s t �| |� || _d S r �rR r r� r� r r r r � s zAttribute.__init__c C s d| j S )Nz attribute %s;�r� r r r r rI � s zAttribute.to_string)rP Nr� r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )�Attribute_RolerP Nc C s t �| |� || _d S r r� r� r r r r � s zAttribute_Role.__init__c C s d| j S )Nzattribute_role %s;r� r r r r rI � s zAttribute_Role.to_string)rP Nr� r r r r r� � s r� c @ sB e Zd ZdZdZdZdZdZddd�Zd d � Z d d � Z d d� Z dS )r1 a� SELinux access vector (AV) rule. The AVRule class represents all varieties of AV rules including allow, dontaudit, and auditallow (indicated by the flags self.ALLOW, self.DONTAUDIT, and self.AUDITALLOW respectively). The source and target types, object classes, and perms are all represented by sets containing strings. Sets are used to make it simple to add strings repeatedly while avoiding duplicates. No checking is done to make certain that the symbols are valid or consistent (e.g., perms that don't match the object classes). It is even possible to put invalid types like '$1' into the rules to allow storage of the reference policy interfaces. r r r r Nc C sF t �| |� t� | _t� | _t� | _t� | _| j| _|rB| � |� d S r ) rR r rm � src_types� tgt_types� obj_classesr� �ALLOW� rule_type�from_av)r �avr r r r r s zAVRule.__init__c C sD | j | jkrdS | j | jkr dS | j | jkr0dS | j | jkr@dS d S )NZallowZ dontauditZ auditallowZ neverallow)r� r� � DONTAUDIT� AUDITALLOW� NEVERALLOWr r r r �__rule_type_str s zAVRule.__rule_type_strc C sV | j �|j� |j|jkr(| j�d� n| j�|j� | j�|j� | j�|j� dS )zIAdd the access from an access vector to this allow rule. r N) r� r� �src_type�tgt_typer� r� � obj_classr� �update)r r� r r r r� s zAVRule.from_avc C s. d| � � | j�� | j�� | j�� | j�� f S )z�Return a string representation of the rule that is a valid policy language representation (assuming that the types, object class, etc. are valie). �%s %s %s:%s %s;)�_AVRule__rule_type_strr� rq r� r� r� r r r r rI ) s �zAVRule.to_string)NN) r r r rQ r� r� r� r� r r� r� rI r r r r r1 � s r1 c @ sB e Zd ZdZdZdZdZdZddd�Zd d � Z d d � Z d d� Z dS )r3 aj Extended permission access vector rule. The AVExtRule class represents allowxperm, dontauditxperm, auditallowxperm, and neverallowxperm rules. The source and target types, and object classes are represented by sets containing strings. The operation is a single string, e.g. 'ioctl'. Extended permissions are represented by an XpermSet. r r r r Nc C sN t �| |� t� | _t� | _t� | _| j| _t� | _ || _ |rJ| � ||� d S r ) rR r rm r� r� r� � ALLOWXPERMr� r� �xperms� operationr� )r r� �opr r r r r C s zAVExtRule.__init__c C sD | j | jkrdS | j | jkr dS | j | jkr0dS | j | jkr@dS d S )NZ allowxpermZdontauditxpermZauditallowxpermZneverallowxperm)r� r� �DONTAUDITXPERM�AUDITALLOWXPERM�NEVERALLOWXPERMr r r r r� N s zAVExtRule.__rule_type_strc C sZ | j �|j� |j|jkr(| j�d� n| j�|j� | j�|j� || _|j| | _d S )Nr ) r� r� r� r� r� r� r� r� r� )r r� r� r r r r� X s zAVExtRule.from_avc C s2 d| � � | j�� | j�� | j�� | j| j�� f S )z�Return a string representation of the rule that is a valid policy language representation (assuming that the types, object class, etc. are valid). z%s %s %s:%s %s %s;)�_AVExtRule__rule_type_strr� rq r� r� r� r� rI r r r r rI b s �zAVExtRule.to_string)NNN) r r r rQ r� r� r� r� r r� r� rI r r r r r3 4 s r3 c @ s6 e Zd ZdZdZdZdZd dd�Zdd � Zd d � Z dS ) r5 z�SELinux type rules. This class is very similar to the AVRule class, but is for representing the type rules (type_trans, type_change, and type_member). The major difference is the lack of perms and only and sing destination type. r r r Nc C s6 t �| |� t� | _t� | _t� | _d| _| j| _d S rO ) rR r rm r� r� r� � dest_type�TYPE_TRANSITIONr� r r r r r y s zTypeRule.__init__c C s( | j | jkrdS | j | jkr dS dS d S )NZtype_transitionZ type_changeZ type_member)r� r� � TYPE_CHANGEr r r r r� � s zTypeRule.__rule_type_strc C s* d| � � | j�� | j�� | j�� | jf S )Nr� )�_TypeRule__rule_type_strr� rq r� r� r� r r r r rI � s �zTypeRule.to_string)N) r r r rQ r� r� Z TYPE_MEMBERr r� rI r r r r r5 n s r5 c @ s" e Zd ZdZddd�Zdd� ZdS )r7 zSSElinux typebound statement. This class represents a typebound statement. Nc C s t �| |� d| _t� | _d S rO )rR r rZ rm r� r r r r r � s zTypeBound.__init__c C s d| j | j�� f S )Nztypebounds %s %s;)rZ r� rr r r r r rI � s zTypeBound.to_string)Nr� r r r r r7 � s r7 c @ s e Zd Zddd�Zdd� ZdS )rA Nc C s t �| |� t� | _t� | _d S r )rR r rm � src_roles� tgt_rolesr r r r r � s zRoleAllow.__init__c C s d| j �� | j�� f S )Nz allow %s %s;)r� rr r� r r r r rI � s �zRoleAllow.to_string)Nr� r r r r rA � s rA c @ s e Zd Zddd�Zdd� ZdS )rC Nc C s t �| |� d| _t� | _d S rO r� r r r r r � s zRoleType.__init__c C s& d}| j D ]}|d| j|f 7 }q |S r� r� r� r r r rI � s zRoleType.to_string)Nr� r r r r rC � s rC c @ s e Zd Zddd�Zdd� ZdS )r- Nc C s" t �| |� d| _d| _d| _d S �NrP F)rR r r� �version� refpolicyr r r r r � s zModuleDeclaration.__init__c C s* | j rd| j| jf S d| j| jf S d S )Nzpolicy_module(%s, %s)z module %s %s;)r� r� r� r r r r rI � s zModuleDeclaration.to_string)Nr� r r r r r- � s r- c @ s e Zd Zddd�Zdd� ZdS )� ConditionalNc C s t �| |� g | _d S r �r r � cond_exprr r r r r � s zConditional.__init__c C s dt | jdd� S )Nz[If %s]�rP rP �ri �rk r� r r r r rI � s zConditional.to_string)Nr� r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )�BoolNc C s t �| |� d| _d| _d S r� )rR r r� �stater r r r r � s z Bool.__init__c C s$ d| j }|jr|d S |d S d S )Nzbool %s �trueZfalse)r� r� r� r r r rI � s zBool.to_string)Nr� r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )� InitialSidNc C s t �| |� d| _d | _d S rO )rR r r� rw r r r r Z__init� s zInitialSid.__initc C s d| j t| j�f S )Nz sid %s %s)r� rH rw r r r r rI � s zInitialSid.to_string)N)r r r Z_InitialSid__initrI r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )�GenfsConNc C s" t �| |� d| _d| _d | _d S rO )rR r � filesystem�pathrw r r r r r � s zGenfsCon.__init__c C s d| j | jt| j�f S )Nzgenfscon %s %s %s)r� r� rH rw r r r r rI � s zGenfsCon.to_string)Nr� r r r r r� � s r� c @ s* e Zd ZdZdZdZd dd�Zdd� ZdS ) � FilesystemUser r r Nc C s$ t �| |� | j| _d| _d | _d S rO )rR r �XATTRrZ r� rw r r r r r � s zFilesystemUse.__init__c C sN d}| j | jkrd}n"| j | jkr(d}n| j | jkr8d}d|| jt| j�f S )NrP z fs_use_xattr z fs_use_trans z fs_use_task z %s %s %s;)rZ r� �TRANS�TASKr� rH rw r� r r r rI � s zFilesystemUse.to_string)N)r r r r� r� r� r rI r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )�PortConNc C s" t �| |� d| _d| _d | _d S rO )rR r � port_type� port_numberrw r r r r r � s zPortCon.__init__c C s d| j | jt| j�f S )Nzportcon %s %s %s)r� r� rH rw r r r r rI s zPortCon.to_string)Nr� r r r r r� � s r� c @ s e Zd Zddd�Zdd� ZdS )�NodeConNc C s" t �| |� d| _d| _d | _d S rO )rR r �start�endrw r r r r r s zNodeCon.__init__c C s d| j | jt| j�f S )Nznodecon %s %s %s)r� r� rH rw r r r r rI s zNodeCon.to_string)Nr� r r r r r� s r� c @ s e Zd Zddd�Zdd� ZdS )�NetifConNc C s" t �| |� d| _d | _d | _d S rO )rR r � interface�interface_context�packet_contextr r r r r s zNetifCon.__init__c C s d| j t| j�t| j�f S )Nznetifcon %s %s %s)r� rH r� r� r r r r rI s �zNetifCon.to_string)Nr� r r r r r� s r� c @ s e Zd Zddd�Zdd� ZdS )�PirqConNc C s t �| |� d| _d | _d S rO )rR r � pirq_numberrw r r r r r s zPirqCon.__init__c C s d| j t| j�f S )Nz pirqcon %s %s)r� rH rw r r r r rI " s zPirqCon.to_string)Nr� r r r r r� s r� c @ s e Zd Zddd�Zdd� ZdS )�IomemConNc C s t �| |� d| _d | _d S rO )rR r � device_memrw r r r r r & s zIomemCon.__init__c C s d| j t| j�f S )Nziomemcon %s %s)r� rH rw r r r r rI + s zIomemCon.to_string)Nr� r r r r r� % s r� c @ s e Zd Zddd�Zdd� ZdS )� IoportConNc C s t �| |� d| _d | _d S rO )rR r �ioportrw r r r r r / s zIoportCon.__init__c C s d| j t| j�f S )Nzioportcon %s %s)r� rH rw r r r r rI 4 s zIoportCon.to_string)Nr� r r r r r� . s r� c @ s e Zd Zddd�Zdd� ZdS )� PciDeviceConNc C s t �| |� d| _d | _d S rO )rR r �devicerw r r r r r 8 s zPciDeviceCon.__init__c C s d| j t| j�f S )Nzpcidevicecon %s %s)r� rH rw r r r r rI = s zPciDeviceCon.to_string)Nr� r r r r r� 7 s r� c @ s e Zd Zddd�Zdd� ZdS )� DeviceTreeConNc C s t �| |� d| _d | _d S rO )rR r r� rw r r r r r A s zDeviceTreeCon.__init__c C s d| j t| j�f S )Nzdevicetreecon %s %s)r� rH rw r r r r rI F s zDeviceTreeCon.to_string)Nr� r r r r r� @ s r� c C sD t | dd�D ]2\}}d}t|�D ] }|d }q t|t|� � q d S )NT)rY rP � )r# �range�printrH )�headrX r] rh r_ r r r � print_treeK s r� c @ s e Zd Zddd�Zdd� ZdS )�HeadersNc C s t �| |� d S r �r r r r r r r T s zHeaders.__init__c C s dS )Nz [Headers]r r r r r rI W s zHeaders.to_string)Nr� r r r r r� S s r� c @ s e Zd Zddd�Zdd� ZdS )r% Nc C s t �| |� d S r r� r r r r r \ s zModule.__init__c C s dS rO r r r r r rI _ s zModule.to_string)Nr� r r r r r% [ s r% c @ s" e Zd ZdZddd�Zdd� ZdS ) r' zqA reference policy interface definition. This class represents a reference policy interface definition. rP Nc C s t �| |� || _d S r �r r r� r� r r r r g s zInterface.__init__c C s d| j S )Nz[Interface name: %s]r� r r r r rI k s zInterface.to_string)rP Nr� r r r r r' b s r' c @ s e Zd Zddd�Zdd� ZdS )� TunablePolicyNc C s t �| |� g | _d S r r� r r r r r o s zTunablePolicy.__init__c C s dt | jdd� S )Nz[Tunable Policy %s]r� r� r� r r r r rI s s zTunablePolicy.to_string)Nr� r r r r r� n s r� c @ s e Zd Zddd�Zdd� ZdS )r) rP Nc C s t �| |� || _d S r r� r� r r r r w s zTemplate.__init__c C s d| j S )Nz[Template name: %s]r� r r r r rI { s zTemplate.to_string)rP Nr� r r r r r) v s r) c @ s e Zd Zddd�Zdd� ZdS )�IfDefrP Nc C s t �| |� || _d S r r� r� r r r r s zIfDef.__init__c C s d| j S )Nz[Ifdef name: %s]r� r r r r rI � s zIfDef.to_string)rP Nr� r r r r r� ~ s r� c @ s& e Zd Zd dd�Zdd� Zdd� ZdS ) r/ rP Nc C s" t �| |� || _g | _g | _d S r )rR r �ifname�argsZcomments)r r� r r r r r � s zInterfaceCall.__init__c C sR | j |j krdS t| j�t|j�kr(dS t| j|j�D ]\}}||kr6 dS q6dS )NFT)r� rT r� �zip)r r} �a�br r r �matches� s zInterfaceCall.matchesc C s` d| j }d}| jD ]B}t|t�r,t|�}n|}|dkrF|d| }n|| }|d7 }q|d S )Nz%s(r r� r �))r� r� r ro rk )r rh r_ r� rH r r r rI � s zInterfaceCall.to_string)rP N)r r r r r� rI r r r r r/ � s r/ c @ s e Zd Zddd�Zdd� ZdS )�OptionalPolicyNc C s t �| |� d S r r� r r r r r � s zOptionalPolicy.__init__c C s dS )Nz[Optional Policy]r r r r r rI � s zOptionalPolicy.to_string)Nr� r r r r r� � s r� c @ s> e Zd Zddd�Zdd� Zdd� Zdd � Zd d � Zd d � ZdS )r+ Nc C s t �| |� d | _d S r )r r r� r r r r r � s zSupportMacros.__init__c C s dS )Nz[Support Macros]r r r r r rI � s zSupportMacros.to_stringc C s@ t � }|| jv r2| �|�D ]}|�| �|�� qn |�|� |S r )rn r� �by_namer� �_SupportMacros__expand_permr� )r �permrh �pr r r Z __expand_perm� s zSupportMacros.__expand_permc C sB i | _ | D ]2}t� }|jD ]}|�| �|�� q|| j |j< q d S r )r� rn r� r� r� r� )r r Z exp_permsr� r r r Z __gen_map� s zSupportMacros.__gen_mapc C s | j s| �� | j | S r �r� �_SupportMacros__gen_map�r r� r r r r� � s zSupportMacros.by_namec C s | j s| �� || j v S r r� r� r r r �has_key� s zSupportMacros.has_key)N) r r r r rI r� r� r� r� r r r r r+ � s r+ c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r= Nc C s6 t �| |� t� | _i | _t� | _t� | _t� | _d S r )rR r rm r� r� r@ �data�usersr r r r r � s zRequire.__init__c C s | j �|t� �}|�|� d S r )r� � setdefaultrm r� )r r� r� r� r r r � add_obj_class� s zRequire.add_obj_classc C s� g }|� d� | jD ]}|� d| � q| j�� D ] \}}|� d||�� f � q2| jD ]}|� d| � qX| jD ]}|� d| � qr| jD ]}|� d| � q�|� d� t|�dkr�d S d � |�S ) Nz require {z type %s;z class %s %s;z role %s;z bool %s;z user %s;rc r rP rF ) rV r� r� r^ rq r@ r� r rT rg )r rh rZ r� r� r �boolrt r r r rI � s zRequire.to_string)N)r r r r r rI r r r r r= � s r= c @ s e Zd Zdd� Zdd� ZdS )� ObjPermSetc C s || _ t� | _d S r )r� rn r� r� r r r r � s zObjPermSet.__init__c C s d| j | j�� f S )Nzdefine(`%s', `%s'))r� r� rq r r r r rI � s zObjPermSet.to_stringNr� r r r r r � s r c @ s e Zd Zdd� Zdd� ZdS )�ClassMapc C s || _ || _d S r �r� r� )r r� r� r r r r s zClassMap.__init__c C s | j d | j S )Nz: r r r r r rI s zClassMap.to_stringNr� r r r r r s r c @ s. e Zd Zd dd�Zdd� Zdd� Zdd � ZdS ) �CommentNc C s |r || _ ng | _ d S r )�lines)r rj r r r r s zComment.__init__c C s> t | j�dkrdS g }| jD ]}|�d| � q d�|�S d S )Nr rP �#rF )rT r rV rg )r �out�liner r r rI s zComment.to_stringc C s. t |j�r*|jD ]}|dkr| j�|� qd S rO )rT r rV )r r} r r r r �merge s z Comment.mergec C s | � � S r )rI r r r r rJ s zComment.__str__)N)r r r r rI r rJ r r r r r s r )TFN)N)ra )?�stringry ZSRC_TYPEZTGT_TYPEZ OBJ_CLASSZPERMSZROLEZ DEST_TYPEZ field_to_strZ str_to_fieldr r rR r# r` rk rl rn rm rs r r� r9 r; r? r� r� r� r� r1 r3 r5 r7 rA rC r- r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r% r' r� r) r� r/ r� r+ r= r r r r r r r �<module> s~ �a & P < @:! !&$ __pycache__/module.cpython-39.opt-1.pyc 0000644 00000016002 15025012421 0013620 0 ustar 00 a z fv � @ s� d Z ddlZddlZzddlmZ W n eyB ddlmZ Y n0 ddlZddlZddl Z ddl Z ddl m Z dd� Z G dd � d �Zd d � ZG d d � d �ZdS )zU Utilities for dealing with the compilation of modules and creation of module tress. � N)�getstatusoutput� )�defaultsc C s0 t �d| �}t|�dkr(| d �� r(dS dS dS )z'Check that a module name is valid. z[^a-zA-Z0-9_\-\.]r TFN)�re�findall�len�isalpha)�modname�m� r �3/usr/lib/python3.9/site-packages/sepolgen/module.py� is_valid_name( s r c @ sN e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z ddd�Z dS )� ModuleTreec C s || _ d | _d S �N)r �dirname)�selfr r r r �__init__2 s zModuleTree.__init__c C s | j S r �r �r r r r �dir_name6 s zModuleTree.dir_namec C s | j d | j d S )N�/z.te�r r r r r r �te_name9 s zModuleTree.te_namec C s | j d | j d S )Nr z.fcr r r r r �fc_name< s zModuleTree.fc_namec C s | j d | j d S )Nr z.ifr r r r r �if_name? s zModuleTree.if_namec C s | j d | j d S )Nr �.ppr r r r r � package_nameB s zModuleTree.package_namec C s | j d S )Nz /Makefiler r r r r � makefile_nameE s zModuleTree.makefile_nameNc C s� |d | j | _t�| j� t| �� d�}|r>|�d| � n|�dt�� � |� � t| � � d�� � t| � � d�� � t| � � d�� � d S )Nr �wzinclude ) r r �os�mkdir�openr �writer �refpolicy_makefile�closer r r )r Zparent_dirnameZmakefile_include�fdr r r �createH s zModuleTree.create)N) �__name__� __module__� __qualname__r r r r r r r r& r r r r r 1 s r c C s t j�t j�| �d �d S )Nr r )r �path�splitext�split)� sourcenamer r r �modname_from_sourcenameX s r. c @ sT e Zd ZdZddd�Zdd� Zdd� Zd d � Zdd d �Zdd� Z dd� Z dd� Z dS )�ModuleCompileras ModuleCompiler eases running of the module compiler. The ModuleCompiler class encapsulates running the commandline module compiler (checkmodule) and module packager (semodule_package). You are likely interested in the create_module_package method. Several options are controlled via parameters (only effects the non-refpol builds): .mls [boolean] Generate an MLS module (by passed -M to checkmodule). True to generate an MLS module, false otherwise. .module [boolean] Generate a module instead of a base module. True to generate a module, false to generate a base. .checkmodule [string] Fully qualified path to the module compiler. Default is /usr/bin/checkmodule. .semodule_package [string] Fully qualified path to the module packager. Defaults to /usr/bin/semodule_package. .output [file object] File object used to write verbose output of the compililation and packaging process. Nc C s< t �� | _d| _d| _d| _|| _d| _t� � | _ d| _ dS )z�Create a ModuleCompiler instance, optionally with an output file object for verbose output of the compilation process. Tz/usr/bin/checkmodulez/usr/bin/semodule_package� z /usr/bin/makeN) �selinuxZis_selinux_mls_enabled�mls�module� checkmodule�semodule_package�output� last_outputr r# �refpol_makefile�make)r r6 r r r r t s zModuleCompiler.__init__c C s | j r| j �|d � || _d S )N� )r6 r" r7 )r �strr r r �o� s zModuleCompiler.oc C s$ | � |� t|�\}}| � |� |S r )r< r )r �command�rcr6 r r r �run� s zModuleCompiler.runc C sJ |� d�}t|�dk r td|��d�|dd� �}|d }|d }||fS )z�Generate the module and policy package filenames from a source file name. The source file must be in the form of "foo.te". This will generate "foo.mod" and "foo.pp". Returns a tuple with (modname, policypackage). �.� z,invalid sourcefile name %s (must end in .te)r ���z.modr )r, r � RuntimeError�join)r r- Z splitname�basenamer � packagenamer r r � gen_filenames� s z ModuleCompiler.gen_filenamesTc C sD |r| � |� n0| �|�\}}| �||� | �||� t�|� dS )a� Create a module package saved in a packagename from a sourcename. The create_module_package creates a module package saved in a file named sourcename (.pp is the standard extension) from a source file (.te is the standard extension). The source file should contain SELinux policy statements appropriate for a base or non-base module (depending on the setting of .module). Only file names are accepted, not open file objects or descriptors because the command line SELinux tools are used. On error a RuntimeError will be raised with a descriptive error message. N)� refpol_buildrG �compile�packager �unlink)r r- Z refpolicyr rF r r r �create_module_package� s z$ModuleCompiler.create_module_packagec C s4 | j d | j }| �|�}|dkr0td| j ��d S )Nz -f r �compilation failed: %s)r9 r8 r? rC r7 )r r- r= r> r r r rH � s zModuleCompiler.refpol_buildc C sp | j g}| jr|�d� | jr(|�d� |�d� |�|� |�|� | �d�|��}|dkrltd| j ��d S )Nz-M�-m�-o� r rM )r4 r2 �appendr3 r? rD rC r7 )r r- r �sr> r r r rI � s zModuleCompiler.compilec C sZ | j g}|�d� |�|� |�d� |�|� | �d�|��}|dkrVtd| j ��d S )NrO rN rP r zpackaging failed [%s])r5 rQ r? rD rC r7 )r r rF rR r> r r r rJ � s zModuleCompiler.package)N)T) r' r( r) �__doc__r r< r? rG rL rH rI rJ r r r r r/ [ s r/ )rS r Ztempfile� subprocessr � ImportErrorZcommandsr Zos.path�shutilr1 r0 r r r r. r/ r r r r �<module> s ' __pycache__/yacc.cpython-39.opt-1.pyc 0000644 00000147615 15025012421 0013271 0 ustar 00 a z fd � @ s d dl Z d dlZd dlZd dlZd dlZd dlZdZdZdZ dZ dZ dZ dZ d Zd Zd Zejd dk rleZneZejZG d d � d e�ZG d d� de�ZG dd� de�Zdd� Z dd� Z da da da dZ!dd� Z"dd� Z#dd� Z$d d � Z%G d d � d �Z&G d d!� d!�Z'G d"d#� d#�Z(e �)d$�Z*G d%d&� d&e�Z+G d'd(� d(e�Z,G d)d*� d*e�Z-d+d,� Z.G d-d.� d.e�Z/G d/d0� d0e�Z0G d1d2� d2e�Z1G d3d4� d4e�Z2d5d6� Z3d7d8� Z4G d9d:� d:e�Z5G d;d<� d<e2�Z6d=d>� Z7d?d@� Z8G dAdB� dBe�Z9de de ddd de ddddf dCdD�Z:dS )E� Nz3.11z3.10Tz parser.out�parsetab�LALR� F�( c @ s4 e Zd Zdd� Zdd� ZeZdd� Zdd� ZeZd S ) � PlyLoggerc C s || _ d S �N)�f)�selfr � r �1/usr/lib/python3.9/site-packages/sepolgen/yacc.py�__init__m s zPlyLogger.__init__c O s | j �|| d � d S )N� �r �write�r �msg�args�kwargsr r r �debugp s zPlyLogger.debugc O s | j �d|| d � d S )Nz WARNING: r r r r r r �warningu s zPlyLogger.warningc O s | j �d|| d � d S )NzERROR: r r r r r r �errorx s zPlyLogger.errorN) �__name__� __module__� __qualname__r r �infor r Zcriticalr r r r r l s r c @ s e Zd Zdd� Zdd� ZdS )� NullLoggerc C s | S r r )r �namer r r �__getattribute__ s zNullLogger.__getattribute__c O s | S r r )r r r r r r �__call__� s zNullLogger.__call__N)r r r r r r r r r r ~ s r c @ s e Zd ZdS )� YaccErrorN�r r r r r r r r � s r c C sP t | �}d|v rt |�}t|�tkr4|d t� d }dt| �jt| �|f }|S )Nr z ...z<%s @ 0x%x> (%s))�repr�len� resultlimit�typer �id)�r�repr_str�resultr r r � format_result� s r) c C sB t | �}d|v rt |�}t|�dk r(|S dt| �jt| �f S d S )Nr � z <%s @ 0x%x>)r! r" r$ r r% )r& r' r r r �format_stack_entry� s r+ a PLY: Don't use global functions errok(), token(), and restart() in p_error(). Instead, invoke the methods on the associated parser instance: def p_error(p): ... # Use parser.errok(), parser.token(), parser.restart() ... parser = yacc.yacc() c C s t �t� t� S r )�warnings�warn�_warnmsg�_errokr r r r �errok� s r0 c C s t �t� t� S r )r, r- r. �_restartr r r r �restart� s r2 c C s t �t� t� S r )r, r- r. �_tokenr r r r �token� s r4 c C s< |j a|ja|ja| |�}z bbbW n ty6 Y n0 |S r )r0 r/ r4 r3 r2 r1 � NameError)� errorfuncr4 �parserr& r r r �call_errorfunc� s r8 c @ s e Zd Zdd� Zdd� ZdS )� YaccSymbolc C s | j S r �r$ �r r r r �__str__� s zYaccSymbol.__str__c C s t | �S r ��strr; r r r �__repr__� s zYaccSymbol.__repr__N)r r r r< r? r r r r r9 � s r9 c @ sn e Zd Zddd�Zdd� Zdd� Zdd � Zd d � Zd d � Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� ZdS )�YaccProductionNc C s || _ || _d | _d | _d S r )�slice�stack�lexerr7 )r �srB r r r r � s zYaccProduction.__init__c C sB t |t�r dd� | j| D �S |dkr2| j| jS | j| jS d S )Nc S s g | ] }|j �qS r ��value��.0rD r r r � <listcomp>� � z.YaccProduction.__getitem__.<locals>.<listcomp>r )� isinstancerA rF rB �r �nr r r � __getitem__� s zYaccProduction.__getitem__c C s || j | _d S r )rA rF )r rM �vr r r � __setitem__� s zYaccProduction.__setitem__c C s dd� | j ||� D �S )Nc S s g | ] }|j �qS r rE rG r r r rI � rJ z/YaccProduction.__getslice__.<locals>.<listcomp>)rA )r �i�jr r r � __getslice__� s zYaccProduction.__getslice__c C s t | j�S r )r" rA r; r r r �__len__� s zYaccProduction.__len__c C s t | j| dd�S )N�linenor ��getattrrA rL r r r rU s zYaccProduction.linenoc C s || j | _d S r )rA rU )r rM rU r r r � set_lineno s zYaccProduction.set_linenoc C s, t | j| dd�}t | j| d|�}||fS )NrU r � endlinenorV )r rM � startlineZendliner r r �linespan s zYaccProduction.linespanc C s t | j| dd�S )N�lexposr rV rL r r r r\ s zYaccProduction.lexposc C s || j | _d S r )rA r\ )r rM r\ r r r � set_lexpos s zYaccProduction.set_lexposc C s, t | j| dd�}t | j| d|�}||fS )Nr\ r � endlexposrV )r rM �startpos�endposr r r �lexspan s zYaccProduction.lexspanc C s t �d S r )� SyntaxErrorr; r r r r s zYaccProduction.error)N)r r r r rN rP rS rT rU rX r[ r\ r] ra r r r r r r@ � s r@ c @ s\ e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zdd d�Zddd�Z ddd�Z ddd�Z d S )�LRParserc C s0 |j | _|j| _|j| _|| _| �� d| _d S �NT) �lr_productions� productions� lr_action�action�lr_goto�gotor6 �set_defaulted_states�errorok)r ZlrtabZerrorfr r r r s zLRParser.__init__c C s d| _ d S rd )rl r; r r r r0 ( s zLRParser.errokc C s@ | j d d �= | jd d �= t� }d|_| j�|� | j �d� d S )N�$endr )� statestack�symstackr9 r$ �append)r �symr r r r2 + s zLRParser.restartc C sP i | _ | j�� D ]:\}}t|�� �}t|�dkr|d dk r|d | j |< qd S �N� r )�defaulted_statesrh �items�list�valuesr" )r �state�actionsZrulesr r r rk ; s z LRParser.set_defaulted_statesc C s i | _ d S r )rt r; r r r �disable_defaulted_statesB s z!LRParser.disable_defaulted_statesNFc C sZ |st r.t|t�r ttj�}| �|||||�S |rD| �|||||�S | �|||||�S d S r ) � yaccdevelrK �intr �sys�stderr� parsedebug�parseopt�parseopt_notrack)r �inputrC r �tracking� tokenfuncr r r �parseE s zLRParser.parsec C s� d }g }| j }| j} | j} | j} td �} d} |�d� |sLddlm} |j}|| _| | _ |d urj|� |� |d u rz|j }n|}|| _ g }|| _ g }|| _ || _d }|�d� t� }d|_|�|� d}|�d� |�d|� || v�r(|�s|s�|� }n|�� }|�st� }d|_|j}|| �|�}n| | }|�d|| � |�d d d �d d � |D �dd � �t|�f �� � |d u�r�|dk�r�|�|� |}|�d|� |�|� d }| r�| d8 } q�|dk �rD| | }|j}|j}t� }||_d |_|�r<|�d|jdd�dd � || d � D �� d | |d| | � n |�d|jg | |d | � |�r�|| d d � }||d< |�r�|d }|j|_|j |_ |d }t |d|j�|_ t |d|j �|_ || _ zd|| d �= || _!|�"| � || d �= |�dt#| d �� |�|� | |d | }|�|� W q� t$�y� |�|� |�%|dd� � |�� |d }d|_d|_|}t&} d| _'Y q�0 q�n�|�r�|j|_|j |_ |g}|| _ zL|| _!|�"| � |�dt#| d �� |�|� | |d | }|�|� W q� t$�y@ |�|� |�� |d }d|_d|_|}t&} d| _'Y q�0 q�|dk�r�|d } t | dd �} |�dt#| �� |�d � | S |d u �r�|�(d d d �d d � |D �dd � �t|�f �� � | dk�s�| j'�r�t&} d| _'|}|jdk�r�d }| j)�r6|�rt*|d ��s||_|| _!t+| j)|| �} | j'�r�| }d }q�n`|�r�t*|d ��rP|j} nd} | �rrt,j-�.d!| |jf � nt,j-�.d"|j � nt,j-�.d#� d S nt&} t|�dk�r�|jdk�r�d }d }d}|d d �= q�|jdk�r�d S |jdk�r�|d }|jdk�r*|�r$t |d |j�|_ t |d$|j �|_ d }q�t� }d|_t*|d ��rP|j |_|_ t*|d$��rj|j |_ |_ ||_|�|� |}q�|�� }|�r�|j|_|j |_ |�� |d }q�t/d%��q�d S )&Nr zPLY: PARSE DEBUG STARTrs ��lexrm � z State : %sz#Defaulted state %s: Reduce using %dz Stack : %sz%s . %s� c S s g | ] }|j �qS r r: �rH �xxr r r rI � rJ z'LRParser.parsedebug.<locals>.<listcomp>z Action : Shift and goto state %sz3Action : Reduce rule [%s] with %s and goto state %d�[�,c S s g | ]}t |j��qS r )r+ rF )rH Z_vr r r rI � rJ �]���rY r^ z Result : %sr FrF zDone : Returning %szPLY: PARSE DEBUG ENDz Error : %sc S s g | ] }|j �qS r r: r� r r r rI D rJ rC rU �(yacc: Syntax error at line %d, token=%s � yacc: Syntax error, token=%s� yacc: Parse error in input. EOF r\ � yacc: internal parser error!!! )0rh rj rf rt r@ r r� r� rC r7 r� r4 rn ro rB rp r9 r$ r �pop�get�joinr> �lstripr r" rF rU r\ rW rY r^ rA rx �callabler) rb �extend� error_countrl r r6 �hasattrr8 r} r~ r � RuntimeError� r r� rC r r� r� � lookahead�lookaheadstackry rj �prodrt �pslice� errorcountr� � get_tokenrn ro �errtokenrq rx �ltype�t�p�pname�plen�targ�t1rM r( �tokrU r r r r ^ s� *� $� � *� zLRParser.parsedebugc C sj d }g }| j }| j} | j} | j} td �} d} |sBddlm} |j}|| _| | _|d ur`|� |� |d u rp|j }n|}|| _ g }|| _ g }|| _ || _ d }|�d� t� }d|_|�|� d}|| v�r|s�|s�|� }n|�� }|s�t� }d|_|j}|| �|�}n| | }|d u�r`|dk�rJ|�|� |}|�|� d }| r�| d8 } q�|dk �r>| | }|j}|j}t� }||_d |_|�r�|| d d � }||d< |�r�|d }|j|_|j|_|d }t|d|j�|_t|d|j�|_|| _zP|| d �= || _ |� | � || d �= |�|� | |d | }|�|� W q� t �y� |�|� |� |dd� � |�� |d }d|_d|_|}t } d | _!Y q�0 q�n�|�r�|j|_|j|_|g}|| _z8|| _ |� | � |�|� | |d | }|�|� W q� t �y: |�|� |�� |d }d|_d|_|}t } d | _!Y q�0 q�|dk�r`|d } t| d d �} | S |d u �r\| dk�s|| j!�rDt } d | _!|}|jdk�r�d }| j"�r�|�r�t#|d ��s�||_|| _ t$| j"|| �} | j!�rB| }d }q�n`|�r2t#|d ��r�|j} nd} | �r t%j&�'d | |jf � nt%j&�'d|j � nt%j&�'d� d S nt } t|�dk�rz|jdk�rzd }d }d}|d d �= q�|jdk�r�d S |jdk�r,|d }|jdk�r�|�r�t|d |j�|_t|d|j�|_d }q�t� }d|_t#|d ��r�|j |_|_t#|d��r|j |_|_||_|�|� |}q�|�� }|�rJ|j|_|j|_|�� |d }q�t(d��q�d S )Nr rs r� rm r� rY r^ r FrF rC rU r� r� r� r\ r� ))rh rj rf rt r@ r� r� rC r7 r� r4 rn ro rB rp r9 r$ r� r� r r" rF rU r\ rW rY r^ rA rx r� rb r� r� rl r6 r� r8 r} r~ r r� r� r r r r� � sV zLRParser.parseoptc C s� d }g }| j }| j} | j} | j} td �} d} |sBddlm} |j}|| _| | _|d ur`|� |� |d u rp|j }n|}|| _ g }|| _ g }|| _ || _ d }|�d� t� }d|_|�|� d}|| v�r|s�|s�|� }n|�� }|s�t� }d|_|j}|| �|�}n| | }|d u�r|dk�rJ|�|� |}|�|� d }| r�| d8 } q�|dk �r�| | }|j}|j}t� }||_d |_|�rR|| d d � }||d< || _zP|| d �= || _|�| � || d �= |�|� | |d | }|�|� W q� t�yL |�|� |�|dd� � |�� |d }d|_d|_|}t} d| _ Y q�0 q�n�|g}|| _z8|| _|�| � |�|� | |d | }|�|� W q� t�y� |�|� |�� |d }d|_d|_|}t} d| _ Y q�0 q�|dk�r|d }t |dd �} | S |d u �r�| dk�s | j �r�t} d| _ |}|jdk�r>d }| j �r�|�r^t |d ��s^||_|| _t | j || �} | j �r�| }d }q�n`|�r�t |d ��r�|j!} nd} | �r�t"j#�$d | |jf � nt"j#�$d |j � nt"j#�$d � d S nt} t|�dk�r |jdk�r d }d }d}|d d �= q�|jdk�r.d S |jdk�r�|d }|jdk�rTd }q�t� }d|_t |d ��rz|j! |_!|_%t |d��r�|j& |_&|_'||_|�|� |}q�|�� }|�� |d }q�t(d��q�d S )Nr rs r� rm r� r FrF rC rU r� r� r� r\ r� ))rh rj rf rt r@ r� r� rC r7 r� r4 rn ro rB rp r9 r$ r� r� r r" rF rA rx r� rb r� r� rl rW r6 r� r8 rU r} r~ r rY r\ r^ r� ) r r� rC r r� r� r� r� ry rj r� rt r� r� r� r� rn ro r� rq rx r� r� r� r� r� r� rM r( r� rU r r r r� � s6 zLRParser.parseopt_notrack)NNFFN)NNFFN)NNFFN)NNFFN) r r r r r0 r2 rk rz r� r r� r� r r r r rc s ] 4rc z^[a-zA-Z0-9_-]+$c @ sR e Zd ZdZddd�Zdd� Zd d � Zd d � Zd d� Zdd� Z dd� Z dd� Z dS )� Productionr ��rightr Nr� c C s� || _ t|�| _|| _|| _d | _|| _|| _|| _t | j�| _ g | _ | jD ]}|| j vrL| j � |� qLg | _ d | _ | jr�d| j d�| j�f | _n d| j | _d S �N�%s -> %sr� z %s -> <empty>)r �tupler� �number�funcr� �file�line�precr" �usymsrp �lr_items�lr_nextr� r> ) r r� r r� � precedencer� r� r� rD r r r r ! s$ zProduction.__init__c C s | j S r r= r; r r r r< ? s zProduction.__str__c C s dt | � d S )Nz Production(�)r= r; r r r r? B s zProduction.__repr__c C s t | j�S r )r" r� r; r r r rT E s zProduction.__len__c C s dS �Nrs r r; r r r � __nonzero__H s zProduction.__nonzero__c C s | j | S r )r� �r �indexr r r rN K s zProduction.__getitem__c C s� |t | j�krd S t| |�}z| j|j|d |_W n ttfyR g |_Y n0 z|j|d |_W n ty� d |_Y n0 |S r� )r" r� �LRItem� Prodnames�lr_after� IndexError�KeyError� lr_before)r rM r� r r r �lr_itemO s zProduction.lr_itemc C s | j r|| j | _d S r �r� r� �r �pdictr r r �bind_ s zProduction.bind)r� Nr� r ) r r r �reducedr r< r? rT r� rN r� r� r r r r r� s r� c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S ) �MiniProductionc C s. || _ || _|| _d | _|| _|| _|| _d S r )r r" r� r� r� r� r> )r r> r r" r� r� r� r r r r h s zMiniProduction.__init__c C s | j S r r= r; r r r r< q s zMiniProduction.__str__c C s d| j S )NzMiniProduction(%s)r= r; r r r r? t s zMiniProduction.__repr__c C s | j r|| j | _d S r r� r� r r r r� x s zMiniProduction.bindN)r r r r r< r? r� r r r r r� g s r� c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )r� c C sZ |j | _ t|j�| _|j| _|| _i | _| j�|d� t| j�| _t| j�| _|j | _ d S )N�.) r rv r� r� �lr_index� lookaheads�insertr� r" r� )r r� rM r r r r � s zLRItem.__init__c C s, | j r d| jd�| j �f }n d| j }|S r� )r� r r� )r rD r r r r< � s zLRItem.__str__c C s dt | � d S )NzLRItem(r� r= r; r r r r? � s zLRItem.__repr__N)r r r r r< r? r r r r r� � s r� c C s6 t | �d }|dkr2| | |v r(| | S |d8 }q d S rr )r" )Zsymbols� terminalsrQ r r r �rightmost_terminal� s r� c @ s e Zd ZdS )� GrammarErrorNr r r r r r� � s r� c @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd$d d �Zd%dd�Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zd d � Zd d � Zd&d d!�Zd"d#� Zd S )'�Grammarc C sb d g| _ i | _i | _i | _|D ]}g | j|< q g | jd< i | _i | _i | _i | _t� | _ d | _ d S �Nr ) � Productionsr� �Prodmap� Terminals� Nonterminals�First�Follow� Precedence�set�UsedPrecedence�Start)r r� �termr r r r � s zGrammar.__init__c C s t | j�S r )r" r� r; r r r rT � s zGrammar.__len__c C s | j | S r )r� r� r r r rN � s zGrammar.__getitem__c C s8 || j v rtd| ��|dvr&td��||f| j |< d S )Nz,Precedence already specified for terminal %r)�leftr� �nonassocz:Associativity must be one of 'left','right', or 'nonassoc')r� r� )r r� �assoc�levelr r r �set_precedence� s zGrammar.set_precedenceNr� r c C s� || j v r td|||f ��|dkr6td|||f ��t�|�sRtd|||f ��t|�D ]�\}}|d dv r�zLt|�}t|�dkr�td||||f ��|| j vr�g | j |< |||< W qZW n ty� Y n0 t�|�sZ|d krZtd ||||f ��qZd |v �r�|d d k�r td ||f ��|d d k�r<td||f ��|d } | j� | �} | �sjtd||| f ��n | j � | � |d d �= nt || j �} | j� | d�} d||f } | | j v �r�| j | } td||| f d| j| jf ��t| j�} || jv�r g | j|< |D ]J}|| j v �r&| j | �| � n&|| jv�r<g | j|< | j| �| � �qt| ||| |||�}| j�|� || j | < z| j| �|� W n t�y� |g| j|< Y n0 d S )Nz7%s:%d: Illegal rule name %r. Already defined as a tokenr z5%s:%d: Illegal rule name %r. error is a reserved wordz%s:%d: Illegal rule name %rr z'"rs zA%s:%d: Literal token %s in rule %r may only be a single characterz%precz!%s:%d: Illegal name %r in rule %rr� z+%s:%d: Syntax error. Nothing follows %%prec���zH%s:%d: Syntax error. %%prec can only appear at the end of a grammar rulez/%s:%d: Nothing known about the precedence of %rr� r� z%s:%d: Duplicate rule %s. z Previous definition at %s:%d)r� r� �_is_identifier�match� enumerate�evalr" rb r� r� r� �addr� r� r� r� r� r� rp r� r� r� )r �prodname�symsr� r� r� rM rD �cZprecnameZprodprec�map�mZpnumberr� r� r r r �add_production sv � � � zGrammar.add_productionc C sT |s| j d j}|| jvr&td| ��tdd|g�| j d< | j| �d� || _d S )Nrs zstart symbol %s undefinedr �S')r� r r� r� r� rp r� )r �startr r r � set_startc s zGrammar.set_startc s> � ��fdd�� t � �� �jd jd � �fdd��jD �S )Nc sB | �v r d S �� | � �j�| g �D ]}|jD ] }� |� q.q$d S r )r� r� r� r� )rD r� r& ��mark_reachable_from� reachabler r r r� v s z5Grammar.find_unreachable.<locals>.mark_reachable_fromr c s g | ]}|� vr|�qS r r rG )r� r r rI � rJ z,Grammar.find_unreachable.<locals>.<listcomp>)r� r� r� r� r; r r� r �find_unreachables s zGrammar.find_unreachablec C s� i }| j D ] }d||< q d|d< | jD ] }d||< q&d}| j�� D ]N\}}|D ]@}|jD ]}|| sXd} qrqXd}|rN|| s�d||< d} qBqNqB|s4q�q4g } |�� D ]4\}} | s�|| jvr�|| j vr�|dkr�q�| �|� q�| S )NTrm Fr )r� r� r� ru r� rp ) r Z terminatesr� rM � some_change�plr� rD Z p_terminates�infiniter� r r r �infinite_cycles� s8 zGrammar.infinite_cyclesc C sP g }| j D ]@}|sq |jD ].}|| jvr|| jvr|dkr|�||f� qq |S r� )r� r� r� r� rp )r r( r� rD r r r �undefined_symbols� s zGrammar.undefined_symbolsc C s2 g }| j �� D ] \}}|dkr|s|�|� q|S r� )r� ru rp )r Z unused_tokrD rO r r r �unused_terminals� s zGrammar.unused_terminalsc C s8 g }| j �� D ]$\}}|s| j| d }|�|� q|S �Nr )r� ru r� rp )r Z unused_prodrD rO r� r r r � unused_rules� s zGrammar.unused_rulesc C s@ g }| j D ]0}|| jv s || jv s |�|| j | d f� q |S r )r� r� r� rp )r ZunusedZtermnamer r r �unused_precedence� s zGrammar.unused_precedencec C sZ g }|D ]B}d}| j | D ]$}|dkr,d}q||vr|�|� q|rFq qVq|�d� |S )NF�<empty>T)r� rp )r Zbetar( �xZx_produces_emptyr r r r �_first s zGrammar._firstc C s� | j r | j S | jD ]}|g| j |< qdg| j d< | jD ]}g | j |< q6d}| jD ]H}| j| D ]8}| �|j�D ]&}|| j | vrn| j | �|� d}qnq^qP|sFq�qF| j S )Nrm FT)r� r� r� r� r r� rp )r r� rM r� r� r r r r � compute_first. s" zGrammar.compute_firstc C s< | j r | j S | js| �� | jD ]}g | j |< q |s@| jd j}dg| j |< d}| jdd � D ]�}t|j�D ]�\}}|| jv rl| �|j|d d � �}d}|D ]:} | dkr�| | j | vr�| j | � | � d}| dkr�d}q�|s�|t |j�d krl| j |j D ]*} | | j | v� r�| j | � | � d}� q�qlq^|sL�q6qL| j S )Nrs rm Fr T) r� r� r r� r� r r� r� r rp r" ) r r� �k�didaddr� rQ �BZfstZhasemptyr r r r �compute_followS s: zGrammar.compute_followc C s� | j D ]�}|}d}g }|t|�kr(d }npt||�}z| j|j|d |_W n ttfyh g |_Y n0 z|j|d |_W n ty� d |_Y n0 ||_ |s�q�|� |� |}|d7 }q||_ qd S �Nr rs ) r� r" r� r� r� r� r� r� r� r� rp r� )r r� ZlastlrirQ r� Zlrir r r � build_lritems� s, zGrammar.build_lritems)Nr� r )N)N)r r r r rT rN r� r� r� r� r� r� r� r r r r r r r r r r r� � s $ T @#% ;r� c @ s e Zd ZdS )� VersionErrorNr r r r r r � s r c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S ) �LRTablec C s d | _ d | _d | _d | _d S r )rg ri re � lr_methodr; r r r r � s zLRTable.__init__c C sz t |tj�r|}ntd| � tj| }|jtkr:td��|j | _ |j | _ g | _ |jD ]}| j �t|� � qV|j| _|jS )N� import %s�&yacc table file version is out of date)rK �types� ModuleType�execr} �modulesZ _tabversion�__tabversion__r Z _lr_actionrg Z_lr_gotori re Z_lr_productionsrp r� Z _lr_methodr Z _lr_signature)r �moduler r� r r r � read_table� s zLRTable.read_tablec C s� z dd l }W n ty& dd l}Y n0 tj�|�s8t�t|d�}|�|�}|tkr\t d��|�|�| _ |�|�}|�|�| _ |�|�| _ |�|�}g | _ |D ]}| j �t|� � q�|�� |S )Nr �rbr )�cPickle� ImportError�pickle�os�path�exists�open�loadr r r rg ri re rp r� �close)r �filenamer Zin_fZ tabversion� signaturerf r� r r r � read_pickle� s( zLRTable.read_picklec C s | j D ]}|�|� qd S r )re r� )r r� r� r r r �bind_callables� s zLRTable.bind_callablesN)r r r r r r% r& r r r r r � s r c C sL i }| D ] }d||< qg }i }| D ]$}|| dkr"t ||||| ||� q"|S r )�traverse)�X�R�FP�Nr rB �Fr r r �digraph s r- c C s� |� | � t|�}||| < || �|| < || �}|D ]f} || dkrVt| ||||||� t|| || �|| < |�| g �D ] } | || vrx|| � | � qxq2|| |kr�t||d < || ||d < |�� } | | kr�t||d < || ||d < |�� } q�d S )Nr r� )rp r" r' �minr� �MAXINTr� ) r r+ rB r, r( r) r* �d�rel�y�a�elementr r r r' s( r' c @ s e Zd ZdS )� LALRErrorNr r r r r r5 + s r5 c @ s� e Zd Zd$dd�Zdd� Zdd� Zd d � Zd d � Zd d� Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd � Zd d � Zd%d d!�Zd&d"d#�ZdS )'�LRGeneratedTabler Nc C s� |dvrt d| ��|| _|| _|s*t� }|| _i | _i | _|j| _i | _ i | _ d| _ d| _ d| _ g | _g | _g | _| j�� | j�� | j�� | �� d S )N)ZSLRr zUnsupported method %sr )r5 �grammarr r �logrg ri r� re � lr_goto_cache� lr0_cidhash� _add_countZ sr_conflictZ rr_conflict� conflicts� sr_conflicts� rr_conflictsr r r �lr_parse_table)r r7 �methodr8 r r r r 6 s, zLRGeneratedTable.__init__c C sn | j d7 _ |d d � }d}|rjd}|D ]<}|jD ]0}t|dd�| j krLq4|�|j� | j |_d}q4q*q |S )Nrs TF� lr0_addedr )r; r� rW rp r� rA )r �I�Jr rR r r r r � lr0_closure[ s z LRGeneratedTable.lr0_closurec C s� | j �t|�|f�}|r |S | j �|�}|s:i }|| j |< g }|D ]H}|j}|rB|j|krB|�t|��}|s|i }||t|�< |�|� |}qB|�d�}|s�|r�| �|�}||d< n||d< || j t|�|f< |S )Nrm )r9 r� r% r� r� rp rD ) r rB r �grD Zgsr� rM �s1r r r �lr0_gotou s2 zLRGeneratedTable.lr0_gotoc C s� | � | jjd jg�g}d}|D ]}|| jt|�< |d7 }q d}|t|�k r�|| }|d7 }i }|D ]}|jD ] }d ||< qnqd|D ]@}| �||�}|r�t|�| jv r�q�t|�| jt|�< |� |� q�q@|S r ) rD r7 r� r� r: r% r" r� rG rp ) r �CrQ rB Zasyms�iirD r rE r r r � lr0_items� s( zLRGeneratedTable.lr0_itemsc C sx t � }d}| jjdd � D ]@}|jdkr6|�|j� q|jD ]}||vr< qq<|�|j� qt|�|krjqtt|�}q |S r )r� r7 r� r" r� r r� )r �nullableZ num_nullabler� r� r r r � compute_nullable_nonterminals� s z.LRGeneratedTable.compute_nullable_nonterminalsc C sj g }t |�D ]X\}}|D ]J}|j|jd k r||j|jd f}|d | jjv r||vr|�|� qq |S r� )r� r� r" r� r7 r� rp )r rH �transZstatenorx r� r� r r r � find_nonterminal_transitions� s z-LRGeneratedTable.find_nonterminal_transitionsc C s� |\}}g }| � || |�}|D ]B}|j|jd k r |j|jd } | | jjv r | |vr |�| � q |dkr�|| jjd jd kr�|�d� |S )Nrs r rm )rG r� r" r� r7 r� rp r� ) r rH rM rK rx r+ �termsrE r� r3 r r r � dr_relation s z LRGeneratedTable.dr_relationc C sr g }|\}}| � || |�}| j�t|�d�}|D ]:} | j| jd k r2| j| jd } | |v r2|�|| f� q2|S )Nr� rs )rG r: r� r% r� r" r� rp ) r rH rM �emptyr1 rx r+ rE rR r� r3 r r r �reads_relation s z LRGeneratedTable.reads_relationc C s� i }i }i }|D ] }d||< q|D �]�\}} g } g } || D �],} | j | krNq<| j} |}| | jd k r�| d } | j| }||f|v r�| d }|| jk r�| j| | jjv r�q�| j| |vr�q�|d }q�| �||f� | �|| |�}| j� t |�d�}qX|| D ]j}|j | j k�rq�|j| jk�r"q�d}||jk �rZ|j| | j|d k�rNq�|d }�q&| �||f� q�q<| D ]*}||v�r�g ||< || �|| f� �qp| ||| f< q"||fS )Nrs r� r ) r r� r" r� r7 r� rp rG r: r� r% )r rH rM rK ZlookdictZ includedictZdtransr� rx r+ ZlookbZincludesr� r� rR ZlirE r& rQ r r r �compute_lookback_includesD sX z*LRGeneratedTable.compute_lookback_includesc s0 � ��fdd�}� ��fdd�}t |||�}|S )Nc s �� � | ��S r )rP �r �rH rK r r r �<lambda>� rJ z4LRGeneratedTable.compute_read_sets.<locals>.<lambda>c s �� � | ��S r )rR rT rU r r rV � rJ �r- )r rH �ntransrK r* r) r, r rU r �compute_read_sets� s z"LRGeneratedTable.compute_read_setsc s( �fdd�}� fdd�}t |||�}|S )Nc s � | S r r rT )�readsetsr r rV � rJ z6LRGeneratedTable.compute_follow_sets.<locals>.<lambda>c s � � | g �S r )r� rT )�inclsetsr r rV � rJ rW )r rX rZ r[ r* r) r, r )r[ rZ r �compute_follow_sets� s z$LRGeneratedTable.compute_follow_setsc C sl |� � D ]^\}}|D ]P\}}||jvr0g |j|< |�|g �}|D ]"}||j| vr@|j| �|� q@qqd S r )ru r� r� rp ) r Z lookbacksZ followsetrM Zlbrx r� r r3 r r r �add_lookaheads� s z LRGeneratedTable.add_lookaheadsc C sP | � � }| �|�}| �|||�}| �|||�\}}| �|||�}| �||� d S r )rL rN rY rS r\ r] )r rH rK rM rZ ZlookdZincludedZ followsetsr r r �add_lalr_lookaheads� s z$LRGeneratedTable.add_lalr_lookaheadsc $ C s | j j}| j j}| j}| j}| j}i }|�d| j� | �� }| jdkrP| � |� d}|D �]�} g } i } i } i } |�d� |�d|� |�d� | D ]}|�d|j |� q�|�d� | D �]�}|j |j d k�r|j dkr�d| d < || d < �q�| jdk�r|j| }n| j j|j }|D �]�}| �||d |j |f f� | �|�}|d u�r�|dk�r*|�|d �\}}||j j\}}||k �s�||k�r�|d k�r�|j | |< || |< |�s�|�s�|�d |� | j�||df� ||j jd7 _nB||k�r|dk�rd | |< n$|�s�|�d|� | j�||df� n�|dk �r�|| }||j }|j|jk�r�|j | |< || |< || }}||j jd7 _||j jd8 _n || }}| j�|||f� |�d|| | j | | � n td| ��n(|j | |< || |< ||j jd7 _�qq�|j }|j|d }|| j jv r�| �| |�}| j�t |�d�} | dkr�| �||d| f� | �|�}|d u�r�|dk�r�|| k�r�td| ��n�|dk �r�|�|d �\}}|| | j j\}}||k�s�||k�r<|dk�r<|| | j jd8 _| | |< || |< |�s�|�d|� | j�||df� nH||k�rZ|dk�rZd | |< n*|�s�|�s�|�d |� | j�||df� n td| ��q�| | |< || |< q�i } | D ]>\}}} || v �r�|| | u �r�|�d|| � d| || f< �q�|�d� d} | D ]P\}}} || v �r || | u�r || f| v�r |� d|| � d} d| || f< �q | �rb|� d� i } | D ]*}!|!j D ] }"|"| j j v �rtd | |"< �qt�qj| D ]D}#| �| |#�}| j�t |�d�} | dk�r�| | |#< |�d|#| � �q�| ||< | ||< | ||< |d7 }qXd S )NzParsing method: %sr r r� zstate %dz (%d) %srs r� rm zreduce using rule %d (%s)r� r� z3 ! shift/reduce conflict for %s resolved as reduce�reducer� z2 ! shift/reduce conflict for %s resolved as shift�shiftz= ! reduce/reduce conflict for %s resolved using rule %d (%s)z Unknown conflict in state %dr� zshift and go to state %dz Shift/shift conflict in state %dr� z %-15s %sz ! %-15s [ %s ]z" %-30s shift and go to state %d) r7 r� r� ri rg r8 r r rJ r^ r� r" r� r r� r� rp r� r� r= r� r� r> r5 r� r� rG r: r% r r� r� )$r r� r� rj rh r8 ZactionprH �strB ZactlistZ st_actionZ st_actionpZst_gotor� Zlaheadsr3 r& ZsprecZslevelZrprecZrlevelZoldp�ppZchosenpZrejectprQ rE rR Z _actprintr� Znot_usedZnkeysrI rD rM r r r r? � s � z LRGeneratedTable.lr_parse_tabler� c C s� t |tj�rtd��|�d�d }tj�||�d }�z8t|d�}|� dtj� |�t | j |f � d}|�r`i }| j �� D ]T\} } | �� D ]B\} } |�| �} | s�g g f} | || < | d �| � | d �| � q�qz|� d � |�� D ]f\}} |� d | � | d D ]} |� d | � �q |� d � | d D ]} |� d | � �q(|� d � q�|� d� |� d� nF|� d� | j �� D ]&\}} |� d|d |d | f � �qt|� d� |�r�i }| j�� D ]Z\} } | �� D ]F\} } |�| �} | �s�g g f} | || < | d �| � | d �| � �qʐq�|� d� |�� D ]h\}} |� d | � | d D ]} |� d | � �qF|� d � | d D ]} |� d | � �qn|� d � �q(|� d� |� d� nF|� d� | j�� D ]&\}} |� d|d |d | f � �q�|� d� |� d� | jD ]Z}|j�r:|� d|j|j|j|jtj� |j�|jf � n |� dt|�|j|jf � �q�|� d� |�� W n( t�y� } z� W Y d }~n d }~0 0 d S )Nz"Won't overwrite existing tabmoduler� r� z.py�wz� # %s # This file is automatically generated. Do not edit. # pylint: disable=W,C,R _tabversion = %r _lr_method = %r _lr_signature = %r rs r z _lr_action_items = {z%r:([z%r,z],[z]),z} z� _lr_action = {} for _k, _v in _lr_action_items.items(): for _x,_y in zip(_v[0],_v[1]): if not _x in _lr_action: _lr_action[_x] = {} _lr_action[_x][_k] = _y del _lr_action_items z _lr_action = { z (%r,%r):%r,z _lr_goto_items = {z� _lr_goto = {} for _k, _v in _lr_goto_items.items(): for _x, _y in zip(_v[0], _v[1]): if not _x in _lr_goto: _lr_goto[_x] = {} _lr_goto[_x][_k] = _y del _lr_goto_items z _lr_goto = { z_lr_productions = [ z (%r,%r,%d,%r,%r,%d), z (%r,%r,%d,None,None,None), z] )rK r r �IOError�splitr r r� r r �basenamer r rg ru r� rp ri re r� r> r r" r� r� r" )r � tabmodule� outputdirr$ Zbasemodulenamer# r Zsmallerru rD Zndr rO rQ r r� �er r r � write_table� s� � � z LRGeneratedTable.write_tablec C s z dd l }W n ty& dd l}Y n0 t|d���}|�t|t� |�| j|t� |�||t� |�| j|t� |�| j |t� g }| j D ]T}|j r�|� |j |j|j|j tj�|j�|jf� q�|� t |�|j|jd d d f� q�|�||t� W d � n1 �s0 Y d S )Nr �wb)r r r r �dumpr �pickle_protocolr rg ri re r� rp r> r r" r r rf r� r� )r r# r$ r ZoutfZoutpr� r r r � pickle_table" s , z LRGeneratedTable.pickle_table)r N)r� r� )r� )r r r r rD rG rJ rL rN rP rR rS rY r\ r] r^ r? rj rn r r r r r6 5 s" %#8 +P B {r6 c C s0 t �| �}|j�� }|j|jkr,|�|j� |S r )r} � _getframe� f_globals�copy�f_locals�update)Zlevelsr Zldictr r r �get_caller_module_dictE s rt c C s� g }| � � }d }|}|D ]�}|d7 }|�� }|s2qz�|d dkrf|sTtd||f ��|} |dd � } n@|d } | }|dd � } |d } | dkr�| dkr�td||f ��|�||| | f� W q ty� � Y q ty� td |||�� f ��Y q0 q|S ) Nrs r �|z%s:%d: Misplaced '|'� �:z::=z!%s:%d: Syntax error. Expected ':'z %s:%d: Syntax error in rule %r)� splitlinesre rb rp � Exception�strip) �docr� r� r7 ZpstringsZlastpZdlineZpsr� r� r� Zassignr r r � parse_grammarQ s6 r| c @ s� e Zd Zd dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zd d � Zd d � ZdS )!� ParserReflectNc C sL || _ d | _d | _d | _t� | _g | _d| _|d u rBtt j �| _ n|| _ d S )NF) r� r� � error_func�tokensr� r r7 r r r} r~ r8 )r r� r8 r r r r { s zParserReflect.__init__c C s, | � � | �� | �� | �� | �� d S r )� get_start�get_error_func� get_tokens�get_precedence�get_pfunctionsr; r r r �get_all� s zParserReflect.get_allc C s6 | � � | �� | �� | �� | �� | �� | jS r )�validate_start�validate_error_func�validate_tokens�validate_precedence�validate_pfunctions�validate_modulesr r; r r r � validate_all� s zParserReflect.validate_allc C s� g }zr| j r|�| j � | jr:|�d�dd� | jD ��� | jrR|�d�| j�� | jD ]}|d rX|�|d � qXW n ttfy� Y n0 d�|�S )Nr� c S s g | ]}d � |��qS )r� )r� )rH r� r r r rI � rJ z+ParserReflect.signature.<locals>.<listcomp>r� r )r� rp r� r� r �pfuncs� TypeError� ValueError)r �partsr r r r r$ � s zParserReflect.signaturec C s� t �d�}| jD ]�}zt�|�\}}W n ty< Y qY n0 i }t|�D ]^\}}|d7 }|�|�}|rJ|�d�}|� |�} | s�|||< qJt� |�} | j � d| ||| � qJqd S )Nz \s*def\s+(p_[a-zA-Z_0-9]*)\(rs z;%s:%d: Function %s redefined. Previously defined on line %d) �re�compiler �inspectZgetsourcelinesrd r� r� �groupr� � getsourcefiler8 r ) r Zfrer �linesZlinenZ counthashr� r� r �prevr# r r r r� � s& �z ParserReflect.validate_modulesc C s | j �d�| _d S )Nr� )r� r� r� r; r r r r� � s zParserReflect.get_startc C s& | j d ur"t| j t�s"| j�d� d S )Nz'start' must be a string)r� rK � string_typesr8 r r; r r r r� � s z ParserReflect.validate_startc C s | j �d�| _d S )N�p_error)r� r� r~ r; r r r r� � s z ParserReflect.get_error_funcc C s� | j r�t| j tj�rd}n*t| j tj�r.d}n| j�d� d| _d S | j jj}| j jj }t � | j �}| j � |� | j jj| }|dkr�| j�d||� d| _d S )Nr rs z2'p_error' defined, but is not a function or methodTz$%s:%d: p_error() requires 1 argument)r~ rK r � FunctionType� MethodTyper8 r �__code__�co_firstlineno� co_filenamer� � getmoduler r� � co_argcount)r ZismethodZelineZefiler Zargcountr r r r� � s z!ParserReflect.validate_error_funcc C sr | j �d�}|s&| j�d� d| _d S t|ttf�sJ| j�d� d| _d S |sd| j�d� d| _d S t|�| _d S )Nr zNo token list is definedTz tokens must be a list or tupleztokens is empty) r� r� r8 r rK rv r� �sortedr )r r r r r r� � s zParserReflect.get_tokensc C sV d| j v r | j�d� d| _d S t� }| j D ]$}||v rF| j�d|� |�|� q,d S )Nr z.Illegal token name 'error'. Is a reserved wordTzToken %r multiply defined)r r8 r r� r r� )r r� rM r r r r� s z ParserReflect.validate_tokensc C s | j �d�| _d S )Nr� )r� r� r� r; r r r r� s z ParserReflect.get_precedencec C s g }| j �rt| j ttf�s2| j�d� d| _d S t| j �D ]�\}}t|ttf�sj| j�d� d| _ d S t|�dk r�| j�d|� d| _ d S |d }t|t�s�| j�d� d| _ d S |dd � D ]<}t|t�s�| j�d � d| _ d S |� |||d f� q�q<|| _ d S ) Nz"precedence must be a list or tupleTzBad precedence tablerv z?Malformed precedence entry %s. Must be (assoc, term, ..., term)r z)precedence associativity must be a stringrs z precedence items must be strings) r� rK rv r� r8 r r� r" r� rp �preclist)r r� r� r� r� r� r r r r� s6 z!ParserReflect.validate_precedencec C s� g }| j �� D ]\\}}|�d�r|dkr*qt|tjtjf�rt|d|jj �}t � |�}|� ||||j f� q|jdd� d� || _d S )N�p_r� r� c S s | d t | d �| d | d fS )Nr rs rv r r= )Z p_functionr r r rV F s �z.ParserReflect.get_pfunctions.<locals>.<lambda>)�key)r� ru � startswithrK r r� r� rW r� r� r� r� rp �__doc__�sortr� )r Z p_functionsr �itemr� r r r r r� 9 s z ParserReflect.get_pfunctionsc C sN g }t | j�dkr(| j�d� d| _d S | jD �]\}}}}t�|�}| j| }t|tj �rbd}nd}|j j |kr�| j�d|||j � d| _q.|j j |k r�| j�d|||j � d| _q.|j s�| j�d|||j � q.z(t|||�} | D ]} |�|| f� q�W n< t�y6 } z"| j�t| �� d| _W Y d } ~ n d } ~ 0 0 | j�|� q.| j�� D ]�\} } | �d ��r|t| tjtj f��r|�qP| �d ��r��qP| �d ��r�| d k�r�| j�d | � t| tj��r�| j j dk�s�t| tj ��rP| jj j dk�rP| j �rPz8| j �d �}|d dk�r(| j�d| j j| j j| � W n t �y> Y n0 �qP|| _ d S )Nr z+no rules of the form p_rulename are definedTrv rs z%%s:%d: Rule %r has too many argumentsz#%s:%d: Rule %r requires an argumentzA%s:%d: No documentation string specified in function %r (ignored)r� Zt_r� z %r not defined as a functionr� rw z9%s:%d: Possible grammar rule %r defined without p_ prefix) r" r� r8 r r� r� r� rK r r� r� r� r r� r r| rp rb r> r r� ru r� r� �__func__re r� r� r� r7 )r r7 r� r r r{ r� r� ZreqargsZparsed_grE ri rM rO r r r r� N sf � � � � z!ParserReflect.validate_pfunctions)N)r r r r r� r� r$ r� r� r� r� r� r� r� r� r� r� r� r r r r r} z s r} c < s� |d u r t }| rd}| d u r&ttj�} � r�� fdd�t� �D �} t| �}d|vrdtj|d j|d< d|vr�d|v r�ttj|d d�r�tj|d j |d< nt d�}| d u �r t |t j �r�|j}nLd|vr�|d }n:|�d�}d�|d d � �}td | � ttj| dd �}tj�|�} |�d�}|�rNt |t��rNd|v�rN|d | }|d u�r`||d < t|| d �}|�� |j�r�td��|�� }z�t � }| �r�|� | �}n |� |�}|�s�||k�rz&|� |j � t!||j"�}|j#a#|W W S t$�y } z| �%d|� W Y d }~n d }~0 0 W nF t&�yP } z| �%t|�� W Y d }~n d }~0 t'�yb Y n0 | d u �r�|�r�z tt(tj�| |�d��} W n> t)�y� } z$| �%d||f � t*� } W Y d }~n d }~0 0 nt*� } | �+dt,� d}|�-� �r�td��|j"�s | �%d� t.|j/�}|j0D ]R\}} } z|�1|| | � W n2 t2�yj } z| �%d|� W Y d }~n d }~0 0 �q |j3D ]d\} } | \} }!}"}#z|�4|"|#| | |!� W n6 t2�y� } z | �d|� d}W Y d }~n d }~0 0 �qvz&|d u �r�|�5|j6� n |�5|� W n8 t2�y: } z | �t|�� d}W Y d }~n d }~0 0 |�rJtd��|�7� }$|$D ]"\}%}&| �d|&j8|&j9|%� d}�qV|�:� }'|'�r�| �+d � | �+d� | �+d � |'D ] }| �%d|� | �+d|� �q�|�r| �+d � | �+d� | �+d � t;|j<�D ]\}(})| �+d |(|)� �q�|�=� }*|*D ] }&| �%d |&j8|&j9|&j>� �q t?|'�d k�rT| �%d � t?|'�d k�rr| �%d t?|'�� t?|*�d k�r�| �%d!� t?|*�d k�r�| �%d"t?|*�� |�rx| �+d � | �+d#� | �+d � t@|jA�}+|+�B� |+D ]*}| �+d$|d%�d&d� |jA| D ��� �q�| �+d � | �+d'� | �+d � t@|jC�},|,�B� |,D ]*}-| �+d$|-d%�d(d� |jC|- D ��� �qB| �+d � |�r�|�D� }.|.D ]}/| �%d)|/� �q�|�E� }0|0D ]}1| �d*|1� d}�q�|�F� }2|2D ] \}} | �d+| |� d}�q�|�r�td��|�r | �Gd,| � tH|| | �}|�r�t?|jI�}3|3d k�r>| �%d-� n|3d k�rT| �%d.|3� t?|jJ�}4|4d k�rt| �%d/� n|4d k�r�| �%d0|4� |�r�|jI�s�|jJ�r�| �%d � | �%d1� | �%d � |jID ] \}5}6}7| �%d2|6|5|7� �q�tK� }8|jJD ]x\}5}9}:|5tL|9�tL|:�f|8v �r�q�| �%d3|5|9� | �%d4|:|5� | �%d3|5|9� | �%d4|:|5� |8�M|5tL|9�tL|:�f� �q�g };|jJD ]@\}5}9}:|:jN�sr|:|;v�rr| �%d5|:� | �%d5|:� |;�O|:� �qr|� rz&|�P|| |� |tjv �r�tj|= W n8 t)� y } z | �%d6||f � W Y d }~n d }~0 0 | � rjz|�Q| |� W n8 t)� yh } z | �%d6| |f � W Y d }~n d }~0 0 |� |j � t!||j"�}|j#a#|S )7Nr c s g | ]}|t � |�f�qS r )rW )rH r �r r r rI � rJ zyacc.<locals>.<listcomp>�__file__r � __package__rv r� r� r r� r� )r8 zUnable to build parserz.There was a problem loading the table file: %rrc zCouldn't open %r. %sz5Created by PLY version %s (http://www.dabeaz.com/ply)Fz no p_error() function is definedz%sTz;%s:%d: Symbol %r used, but not defined as a token or a rulezUnused terminals:z Token %r defined, but not usedz %sr� z Rule %-5d %sz$%s:%d: Rule %r defined, but not usedrs zThere is 1 unused tokenzThere are %d unused tokenszThere is 1 unused rulezThere are %d unused rulesz'Terminals, with rules where they appearz %-20s : %sr� c S s g | ] }t |��qS r r= rG r r r rI M rJ z*Nonterminals, with rules where they appearc S s g | ] }t |��qS r r= rG r r r rI U rJ zSymbol %r is unreachablez)Infinite recursion detected for symbol %rz0Precedence rule %r defined for unknown symbol %rzGenerating %s tablesz1 shift/reduce conflictz%d shift/reduce conflictsz1 reduce/reduce conflictz%d reduce/reduce conflictsz Conflicts:z7shift/reduce conflict for %s in state %d resolved as %sz;reduce/reduce conflict in state %d resolved using rule (%s)z rejected rule (%s) in state %dzRule (%s) is never reducedzCouldn't create %r. %s)R� tab_moduler r} r~ �dir�dictr r� r� r� rt rK r r re r� r rW r r �dirnamer� r> r} r� r r r$ r r% r r& r� rc r~ r� ry r r r r rd r r � __version__r� r� r r� r� r� r7 r� r� r� r� r� r� r� r� r� r r r" rv r� r� r� r� r� r r r6 r= r> r� r% r� r� rp rj rn )<r@ r r rg r� Zcheck_recursion�optimizeZ write_tablesZ debugfilerh ZdebuglogZerrorlogZ picklefileZ_itemsr� Zsrcfiler� Zpkgname�pkgZpinfor$ ZlrZread_signaturer7 ri �errorsr7 r� r� r� �funcnameZgramr� r� r� r� r� rq r� r� rM r� r rO ZnontermsZnontermZ unreachable�ur� �infZ unused_precZnum_srZnum_rrrx r� Z resolutionZalready_reportedZruleZrejectedZ warned_neverr r� r �yacc� s� &" & ( ( (( r� );r� r r} Zos.pathr r� r, r� r Z yaccdebugZ debug_filer� Z default_lrr� r{ r# rm � version_infoZ basestringr� r> �maxsizer/ �objectr r ry r r) r+ r/ r3 r1 r. r0 r2 r4 r8 r9 r@ rc r� r� r� r� r� r� r� r� r r r- r' r5 r6 rt r| r} r� r r r r �<module>> s� 7 m H. rT ) � __pycache__/output.cpython-39.pyc 0000644 00000006731 15025012421 0012744 0 ustar 00 a z f, � @ sp d Z ddlmZ ddlmZ ejr.ddlmZ G dd� d�Zdd� Zd d � Zd d � Z d d� Z dd� Z dd� Z dS )ai Classes and functions for the output of reference policy modules. This module takes a refpolicy.Module object and formats it for output using the ModuleWriter object. By separating the output in this way the other parts of Madison can focus solely on generating policy. This keeps the semantic / syntactic issues cleanly separated from the formatting issues. � )� refpolicy)�util)�cmpc @ s e Zd Zdd� Zdd� ZdS )� ModuleWriterc C s d | _ d | _d| _d| _d S )NT)�fd�module�sort�requires)�self� r �3/usr/lib/python3.9/site-packages/sepolgen/output.py�__init__& s zModuleWriter.__init__c C sF || _ | jrt| j � tj| j dd�D ]\}}|�dt|� � q&d S )NT)Z showdepthz%s )r r � sort_filterr Zwalktree�write�str)r r r �node�depthr r r r , s zModuleWriter.writeN)�__name__� __module__� __qualname__r r r r r r r % s r c C s� t �| �}|�� t �|�}|�� t|�t|�krFt|d |d �S t||�D ]*}|d |d krPt|d |d � S qPdS )N� r )r Z set_to_listr �lenr �zip)�x�yZxlZyl�vr r r � id_set_cmp= s r c C sR t | j|j�}|dkr|S t | j|j�}|dkr4|S t | j|j�}|dkrN|S dS �Nr )r � src_typesZ tgt_typesZ obj_classes)�a�b�retr r r � avrule_cmpK s r" c C s8 | j d |j d kr*t| j d |j d �S t| j|j�S r )�argsr Zifname�r r r r r � ifcall_cmpZ s r% c C sr t | tj�r8t |tj�r"t| |�S t| jd g|j�S n6t |tj�sPt |tj�rZt | |�S t| j|jd g�S d S r ) � isinstancer � InterfaceCallr% r r# r ZAVRuleZ AVExtRuler" r$ r r r �rule_cmp` s r( c C s t | j|j�S )N)r Zroler$ r r r � role_type_cmpl s r) c C s" dd� }| � � D ] }||� qdS )z/Sort and group the output for readability. c S s� g }| � � D ] }|�|� |�t�� � q | �� D ]}|�|� q2|�t�� � g }|�| �� � |�| �� � |�| �� � |j t � t �d� d }g }|D ]t}t |tj�r�|jd }n t �|j�}||k�r|r�|�t�� � |}t�� } | j�d| � |�| � |�|� q�|�|� g } | �| �� � | j t � t�d� t| ��rht�� } | j�d� |�| � |�| � | jD ]} | |v�rx|�| � �qx|| _d S )N)�keyr z ============= %s ==============z"============= ROLES ==============)Zmodule_declarations�appendr �Commentr �extendZavrulesZ avextrulesZinterface_callsr r � cmp_to_keyr( r& r' r# �firstr �linesZ role_typesr) r Zchildren) r �c�modZrequireZrulesZcurZ sep_rulesZruler ZcommentZras�childr r r � sort_noder sN z sort_filter.<locals>.sort_nodeN)Znodes)r r4 r r r r r o s = r N) �__doc__� r r ZPY3r r r r" r% r( r) r r r r r �<module> s __pycache__/access.cpython-39.pyc 0000644 00000026141 15025012421 0012642 0 ustar 00 a z f�. � @ sz d Z ddlmZ ddlmZ ddlmZ dd� ZG dd � d ej�Zd d � Z G d d � d �Z dd� Z dd� Z G dd� d�Z dS )aW Classes representing basic access. SELinux - at the most basic level - represents access as the 4-tuple subject (type or context), target (type or context), object class, permission. The policy language elaborates this basic access to facilitate more concise rules (e.g., allow rules can have multiple source or target types - see refpolicy for more information). This module has objects for representing the most basic access (AccessVector) and sets of that access (AccessVectorSet). These objects are used in Madison in a variety of ways, but they are the fundamental representation of access. � )� refpolicy)�util� )� audit2whyc C sN t | �dkrF| d dkrFzt| dd� � W n ty@ Y dS 0 dS dS dS )z�Determine if an id is a parameter in the form $N, where N is an integer. Returns: True if the id is a parameter False if the id is not a parameter r r �$NFT)�len�int� ValueError)�id� r �3/usr/lib/python3.9/site-packages/sepolgen/access.py� is_idparam' s r c @ sJ e Zd ZdZddd�Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )� AccessVectora An access vector is the basic unit of access in SELinux. Access vectors are the most basic representation of access within SELinux. It represents the access a source type has to a target type in terms of an object class and a set of permissions. Access vectors are distinct from AVRules in that they can only store a single source type, target type, and object class. The simplicity of AccessVectors makes them useful for storing access in a form that is easy to search and compare. The source, target, and object are stored as string. No checking done to verify that the strings are valid SELinux identifiers. Identifiers in the form $N (where N is an integer) are reserved as interface parameters and are treated as wild cards in many circumstances. Properties: .src_type - The source type allowed access. [String or None] .tgt_type - The target type to which access is allowed. [String or None] .obj_class - The object class to which access is allowed. [String or None] .perms - The permissions allowed to the object class. [IdSet] .audit_msgs - The audit messages that generated this access vector [List of strings] .xperms - Extended permissions attached to the AV. [Dictionary {operation: xperm set}] Nc C sV |r| � |� n d | _d | _d | _t�� | _g | _tj | _ g | _ i | _ d | _ d | _d S �N)� from_list�src_type�tgt_type� obj_classr �IdSet�perms� audit_msgsr �TERULE�type�data�xperms�__hash__Z info_flow_dir)�selfZ init_listr r r �__init__S s zAccessVector.__init__c C sR t |�dk r tdt|� ��|d | _|d | _|d | _t�|dd� �| _dS )ax Initialize an access vector from a list. Initialize an access vector from a list treating the list as positional arguments - i.e., 0 = src_type, 1 = tgt_type, etc. All of the list elements 3 and greater are treated as perms. For example, the list ['foo_t', 'bar_t', 'file', 'read', 'write'] would create an access vector list with the source type 'foo_t', target type 'bar_t', object class 'file', and permissions 'read' and 'write'. This format is useful for very simple storage to strings or disc (see to_list) and for initializing access vectors. � z+List must contain at least four elements %sr r � � N) r r �strr r r r r r )r �listr r r r h s zAccessVector.from_listc C s$ | j | j| jg}|�t| j�� |S )z� Convert an access vector to a list. Convert an access vector to a list treating the list as positional values. See from_list for more information on how an access vector is represented in a list. )r r r �extend�sortedr )r �lr r r �to_list} s zAccessVector.to_listc C sL | j �|j � |jD ]2}|| jvr0t�� | j|< | j| �|j| � qdS )z0Add permissions and extended permissions from AVN)r �updater r ZXpermSetr# )r �av�opr r r �merge� s zAccessVector.mergec C s | � � S r )� to_string�r r r r �__str__� s zAccessVector.__str__c C s d| j | j| j| j�� f S )Nzallow %s %s:%s %s;)r r r r Z to_space_strr, r r r r+ � s �zAccessVector.to_stringc C st zTt | j�}| j| j| j|f}t |j�}|�� |�� |j|j|j|f}|||�W S ttfyn t Y S 0 d S r ) r" r r r r �sort�AttributeError� TypeError�NotImplemented)r �other�method�x�a�y�br r r �_compare� s zAccessVector._compare)N) �__name__� __module__� __qualname__�__doc__r r r& r* r- r+ r8 r r r r r 8 s r c C sj t | t�r| gS g }| jD ]J}| jD ]>}| jD ]2}t� }||_||_||_| j� � |_|� |� q.q$q|S )aR Convert an avrule into a list of access vectors. AccessVectors and AVRules are similarly, but differ in that an AVRule can more than one source type, target type, and object class. This function expands a single avrule into a list of one or more AccessVectors representing the access defined in the AVRule. ) � isinstancer Z src_typesZ tgt_typesZ obj_classesr r r r �copy�append)Zavruler5 r r r �accessr r r �avrule_to_access_vectors� s rA c @ sT e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd e j g fd d�Z ddd�Z d S )�AccessVectorSeta/ A non-overlapping set of access vectors. An AccessVectorSet is designed to store one or more access vectors that are non-overlapping. Access can be added to the set incrementally and access vectors will be added or merged as necessary. For example, adding the following access vectors using add_av: allow $1 etc_t : read; allow $1 etc_t : write; allow $1 var_log_t : read; Would result in an access vector set with the access vectors: allow $1 etc_t : { read write}; allow $1 var_log_t : read; c C s i | _ d| _dS )z)Initialize an access vector set. N)�srcZinfo_dirr, r r r r � s zAccessVectorSet.__init__c c s6 | j �� D ]&}|�� D ]}|�� D ] }|V q"qq dS )z9Iterate over all of the unique access vectors in the set.N)rC �values)r �tgts�objsr( r r r �__iter__� s zAccessVectorSet.__iter__c C s2 d}| j �� D ] }|�� D ]}|t|�7 }qq|S )a6 Return the number of unique access vectors in the set. Because of the internal representation of the access vector set, __len__ is not a constant time operation. Worst case is O(N) where N is the number of unique access vectors, but the common case is probably better. r )rC rD r )r r% rE rF r r r �__len__� s zAccessVectorSet.__len__c C s g }| D ]}|� |�� � q|S )ab Return the unique access vectors in the set as a list. The format of the returned list is a set of nested lists, each access vector represented by a list. This format is designed to be simply serializable to a file. For example, consider an access vector set with the following access vectors: allow $1 user_t : file read; allow $1 etc_t : file { read write}; to_list would return the following: [[$1, user_t, file, read] [$1, etc_t, file, read, write]] See AccessVector.to_list for more information. )r? r& �r r% r( r r r r& � s zAccessVectorSet.to_listc C s |D ]}| � t|�� qdS )a Add access vectors stored in a list. See to list for more information on the list format that this method accepts. This will add all of the access from the list. Any existing access vectors in the set will be retained. N)�add_avr rI r r r r s zAccessVectorSet.from_listNc C s: t � }||_||_||_||_||_||_| �||� dS )z)Add an access vector to the set. N)r r r r r r r rJ ) r r r r r � audit_msgZavc_typer r( r r r �add s zAccessVectorSet.addc C sv | j �|ji �}|�|ji �}|j|jf|v rF||j|jf �|� n|||j|jf< |rr||j|jf j�|� dS )z Add an access vector to the set.N) rC � setdefaultr r r r r* r r? )r r( rK Ztgt�clsr r r rJ s zAccessVectorSet.add_av)N) r9 r: r; r< r rG rH r& r r r rL rJ r r r r rB � s rB c C s. t �� }| D ] }|�|j� |�|j� q |S r )r r rL r r )�avs�typesr( r r r �avs_extract_types* s rQ c C sF i }| D ]8}|j |v r"||j }nt�� }|||j < |�|j� q|S r )r r r r' r )rO r r( �sr r r �avs_extract_obj_perms2 s rS c @ s0 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd S ) � RoleTypeSetz�A non-overlapping set of role type statements. This class allows the incremental addition of role type statements and maintains a non-overlapping list of statements. c C s i | _ dS )z Initialize an access vector set.N)� role_typesr, r r r r C s zRoleTypeSet.__init__c c s | j �� D ] }|V q dS )zAIterate over all of the unique role allows statements in the set.N)rU rD )r � role_typer r r rG G s zRoleTypeSet.__iter__c C s t | j�� �S )z2Return the unique number of role allow statements.)r rU �keysr, r r r rH L s zRoleTypeSet.__len__c C s> || j v r| j | }nt�� }||_|| j |< |j�|� d S r )rU r ZRoleType�rolerP rL )r rX r rV r r r rL P s zRoleTypeSet.addN)r9 r: r; r< r rG rH rL r r r r rT = s rT N)r< � r r Zselinuxr r Z Comparisonr rA rB rQ rS rT r r r r �<module> s oj __pycache__/refparser.cpython-39.opt-1.pyc 0000644 00000071113 15025012421 0014330 0 ustar 00 a z fez � 6 @ s� d dl Z d dlZd dlZd dlZddlmZ ddlmZ ddlmZ ddlmZ ddlm Z dZ d d d d d ddddddddddddddd d d d d d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>�5Z d?Z d@Z dAZdBZdCZdDZdEZdFZdGZdHZdIZdJZdKZdLZdMZdNZdOZ dPZ dQZ dRdS� Z dTdU� Z dVdW� Z!dXdY� Z"dZd[� Z#d\d]� Z$d^d_� Z%d`da� Z&dbdc� Z'da(da)dda*da+dea,d�dfdg�Z-dhdi� Z.djdk� Z/dldm� Z0dndo� Z1dpdq� Z2drds� Z3dtdu� Z4dvdw� Z5dxdy� Z6dzd{� Z7d|d}� Z8d~d� Z9d�d�� Z:d�d�� Z;d�d�� Z<d�d�� Z=d�d�� Z>d�d�� Z?d�d�� Z@d�d�� ZAd�d�� ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�� ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�� ZOd�d�� ZPd�d�� ZQd�d�� ZRd�d�� ZSd�d�� ZTd�d�� ZUd�d�� ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�� ZZd�dÄ Z[d�dń Z\d�dDŽ Z]d�dɄ Z^d�d˄ Z_d�d̈́ Z`d�dτ Zad�dф Zbd�dӄ Zcd�dՄ Zdd�dׄ Zed�dل Zfd�dۄ Zgd�d݄ Zhd�d߄ Zid�d� Zjd�d� Zkd�d� Zld�d� Zmd�d� Znd�d� Zod�d� Zpdaqdard�d� Zsd�d�d�Ztd�d� Zud�d�d��ZvdS )�� N� )�access)�defaults)�lex)� refpolicy)�yacc)JZTICKZSQUOTEZOBRACEZCBRACE�SEMI�COLONZOPARENZCPAREN�COMMA�MINUS�TILDEZASTERISKZAMPZBARZEXPL�EQUAL�FILENAME� IDENTIFIER�NUMBER�PATHZ IPV6_ADDR�MODULE� POLICY_MODULE�REQUIRE�SID�GENFSCON� FS_USE_XATTR� FS_USE_TRANS� FS_USE_TASK�PORTCON�NODECON�NETIFCON�PIRQCON�IOMEMCON� IOPORTCON� PCIDEVICECON� DEVICETREECON�CLASS� TYPEATTRIBUTE� ROLEATTRIBUTE�TYPE� ATTRIBUTE�ATTRIBUTE_ROLE�ALIAS� TYPEALIAS�BOOL�TRUE�FALSE�IF�ELSE�ROLE�TYPES�ALLOW� DONTAUDIT� AUDITALLOW� NEVERALLOW� PERMISSIVE� TYPEBOUNDS�TYPE_TRANSITION� TYPE_CHANGE� TYPE_MEMBER�RANGE_TRANSITION�ROLE_TRANSITION� OPT_POLICY� INTERFACE�TUNABLE_POLICY�GEN_REQ�TEMPLATE� GEN_CONTEXT� GEN_TUNABLE�IFELSE�IFDEF�IFNDEF�DEFINEr r r r r r r r r r r r r r r r! r" r# r$ r% r& r' r( r) r* r+ r, r- r. r/ r0 r1 r2 r3 r4 r5 r6 r7 r8 r9 r: r; r< r= r> r? r@ rA rB rC rE rD rF )5�moduleZ policy_moduleZrequireZsidZgenfscon� fs_use_xattr� fs_use_trans� fs_use_taskZportconZnodeconZnetifconZpirqconZiomemconZ ioportconZ pcideviceconZ devicetreecon�classZ typeattributeZ roleattribute�typeZ attributeZattribute_role�aliasZ typealias�bool�trueZfalse�if�else�role�typesZallow� dontaudit� auditallow� neverallowZ permissiveZ typeboundsZtype_transition� type_change� type_memberZrange_transitionZrole_transitionZoptional_policy� interfaceZtunable_policyZ gen_require�templateZ gen_contextZ gen_tunableZifelseZifndef�ifdefZdefinez\`z\'z\{z\}z\;+z\:z\(z\)z\,z\-z\~z\*z\&z\|z\!z\=z[0-9\.]+z/[a-zA-Z0-9)_\.\*/\$]*z c C s | S )z2[a-fA-F0-9]{0,4}:[a-fA-F0-9]{0,4}:([a-fA-F0-9]|:)*� ��tr\ r\ �6/usr/lib/python3.9/site-packages/sepolgen/refparser.py� t_IPV6_ADDR� s r` c C s | j jd7 _dS )zdnl.*\nr N��lexer�linenor] r\ r\ r_ � t_m4comment� s rd c C s | � d� dS )zdefine.*refpolicywarn\(.*\nr N)�skipr] r\ r\ r_ �t_refpolicywarn1� s rf c C s | j jd7 _dS )zrefpolicywarn\(.*\nr Nra r] r\ r\ r_ �t_refpolicywarn� s rg c C s t �| jd�| _| S )z#[a-zA-Z_\$][a-zA-Z0-9_\-\+\.\$\*~]*r ��reserved�get�valuerL r] r\ r\ r_ � t_IDENTIFIER s rl c C s t �| jd�| _| S )z"\"[a-zA-Z0-9_\-\+\.\$\*~ :\[\]]+\"r rh r] r\ r\ r_ � t_FILENAME s rm c C s | j jd7 _dS )z\#.*\nr Nra r] r\ r\ r_ � t_comment s rn c C s t d| jd � | �d� d S )NzIllegal character '%s'r r )�printrk re r] r\ r\ r_ �t_error s rp c C s | j jt| j�7 _dS )z\n+N)rb rc �lenrk r] r\ r\ r_ � t_newline s rr � Tc C sT | d u r d S | D ]>}|d u r q||_ |d ur@|j�d||f� q|j�d|� qd S )Nr )�parent�children�insert)Zstmtsrt �val�sr\ r\ r_ �collect/ s ry c C s4 | D ]*}t �|�r$|�t �|�� q|�|� qd S �N)�sptZhas_key�updateZby_name�add)Zidsrx �idr\ r\ r_ �expand; s r c C sN t | �dkr&| d r&tj�| d � n$t | �dkrJ| d rJtj�| d � dS )z^statements : statement | statements statement | empty � r N)rq �mru �append��pr\ r\ r_ � p_statementsC s r� c C s | d | d< dS )z�statement : interface | template | obj_perm_set | policy | policy_module_stmt | module_stmt r r Nr\ r� r\ r\ r_ � p_statementM s r� c C s dS )zempty :Nr\ r� r\ r\ r_ �p_emptyW s r� c C s. t �� }| d |_| d |_d|_ || d< dS )zHpolicy_module_stmt : POLICY_MODULE OPAREN IDENTIFIER COMMA NUMBER CPAREN� � Tr N�r ZModuleDeclaration�name�version�r� r� r\ r\ r_ �p_policy_module_stmtb s r� c C s( t �| d �}t| d |� || d< dS )zainterface : INTERFACE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN � � r N)r � Interfacery �r� �xr\ r\ r_ � p_interfacej s r� c C s( t �| d �}t| d |� || d< dS )z�template : TEMPLATE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN | DEFINE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN r� r� r N)r ZTemplatery r� r\ r\ r_ � p_templateq s r� c C s d| d< dS )z4define : DEFINE OPAREN TICK IDENTIFIER SQUOTE CPARENNr r\ r� r\ r\ r_ �p_definey s r� c C sz t | �dkr"| d r"| d | d< nTt | �dkrv| d sL| d rv| d | d< n*| d sb| d | d< n| d | d | d< dS )zlinterface_stmts : policy | interface_stmts policy | empty r� r r N�rq r� r\ r\ r_ �p_interface_stmts� s r� c C sF t �� }t| d |dd� t| �dkr8t| d |dd� |g| d< dS ) z�optional_policy : OPT_POLICY OPAREN TICK interface_stmts SQUOTE CPAREN | OPT_POLICY OPAREN TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN r� T�rw � r� Fr N)r ZOptionalPolicyry rq )r� �or\ r\ r_ �p_optional_policy� s r� c C sP t �� }| d |_t| d |dd� t| �dkrBt| d |dd� |g| d< d S ) z�tunable_policy : TUNABLE_POLICY OPAREN TICK cond_expr SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN | TUNABLE_POLICY OPAREN TICK cond_expr SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN r� r� Tr� � � Fr N)r Z TunablePolicy� cond_exprry rq r� r\ r\ r_ �p_tunable_policy� s r� c C s dS )a� ifelse : IFELSE OPAREN TICK IDENTIFIER SQUOTE COMMA COMMA TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi | IFELSE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi | IFELSE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi Nr\ r� r\ r\ r_ �p_ifelse� s r� c C sb t �| d �}| d dkr d}nd}t| d ||d� t| �dkrTt| d |dd� |g| d < d S ) aJ ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi r� r r[ TFr� r� r� r N)r ZIfDefry rq )r� r� �vr\ r\ r_ �p_ifdef� s r� c C s8 t j| d d�}t| �dkr,|j�| d � || d< dS )z�interface_call : IDENTIFIER OPAREN interface_call_param_list CPAREN | IDENTIFIER OPAREN CPAREN | IDENTIFIER OPAREN interface_call_param_list CPAREN SEMIr )Zifnamer� r� r N)r Z InterfaceCallrq �args�extend)r� �ir\ r\ r_ �p_interface_call� s r� c C s6 t | �dkr| d | d< n| d d| d g| d< dS )z�interface_call_param : IDENTIFIER | IDENTIFIER MINUS IDENTIFIER | nested_id_set | TRUE | FALSE | FILENAME r� r r �-r� Nr� r� r\ r\ r_ �p_interface_call_param� s r� c C s6 t | �dkr | d g| d< n| d | d g | d< dS )z�interface_call_param_list : interface_call_param | interface_call_param_list COMMA interface_call_param r� r r r� Nr� r� r\ r\ r_ �p_interface_call_param_list� s r� c C s$ t �| d �}| d |_|| d< dS )zRobj_perm_set : DEFINE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK names SQUOTE CPARENr� r� r N)r Z ObjPermSet�perms�r� rx r\ r\ r_ �p_obj_perm_set� s r� c C s | d | d< dS )z�policy : policy_stmt | optional_policy | tunable_policy | ifdef | ifelse | conditional r r Nr\ r� r\ r\ r_ �p_policy� s r� c C s | d r| d g| d< dS )a� policy_stmt : gen_require | avrule_def | typerule_def | typebound_def | typeattribute_def | roleattribute_def | interface_call | role_def | role_allow | permissive | type_def | typealias_def | attribute_def | attribute_role_def | range_transition_def | role_transition_def | bool | gen_tunable | define | initial_sid | genfscon | fs_use | portcon | nodecon | netifcon | pirqcon | iomemcon | ioportcon | pcidevicecon | devicetreecon r r Nr\ r� r\ r\ r_ � p_policy_stmt� s r� c C s. t �� }| d |_| d |_d|_ || d< dS )z+module_stmt : MODULE IDENTIFIER NUMBER SEMIr� r� Fr Nr� r� r\ r\ r_ � p_module_stmt s r� c C s dS )zlgen_require : GEN_REQ OPAREN TICK requires SQUOTE CPAREN | REQUIRE OBRACE requires CBRACENr\ r� r\ r\ r_ � p_gen_require$ s r� c C s dS )zsrequires : require | requires require | ifdef | requires ifdef Nr\ r� r\ r\ r_ � p_requires, s r� c C s dS )z�require : TYPE comma_list SEMI | ROLE comma_list SEMI | ATTRIBUTE comma_list SEMI | ATTRIBUTE_ROLE comma_list SEMI | CLASS comma_list SEMI | BOOL comma_list SEMI Nr\ r� r\ r\ r_ � p_require4 s r� c C sH t �� }| d |_| d |_| d |_t| �dkr<| d |_|| d< dS )z�security_context : IDENTIFIER COLON IDENTIFIER COLON IDENTIFIER | IDENTIFIER COLON IDENTIFIER COLON IDENTIFIER COLON mls_range_defr r� r� � r� r N)r ZSecurityContext�userrR rL rq �levelr� r\ r\ r_ �p_security_context> s r� c C s | d }| d |_ || d< dS )zQgen_context : GEN_CONTEXT OPAREN security_context COMMA mls_range_def CPAREN r� r� r N)r� r� r\ r\ r_ � p_gen_contextK s r� c C s | d | d< dS )z<context : security_context | gen_context r r Nr\ r� r\ r\ r_ � p_contextV s r� c C s( t �� }| d |_| d |_|| d< dS )z$initial_sid : SID IDENTIFIER contextr� r� r N)r Z InitialSidr� �contextr� r\ r\ r_ � p_initial_sid\ s r� c C s2 t �� }| d |_| d |_| d |_|| d< dS )z+genfscon : GENFSCON IDENTIFIER PATH contextr� r� r� r N)r ZGenfsCon� filesystem�pathr� )r� �gr\ r\ r_ � p_genfsconc s r� c C sn t �� }| d dkr t jj|_n.| d dkr8t jj|_n| d dkrNt jj|_| d |_| d |_|| d< dS ) z�fs_use : FS_USE_XATTR IDENTIFIER context SEMI | FS_USE_TASK IDENTIFIER context SEMI | FS_USE_TRANS IDENTIFIER context SEMI r rH rJ rI r� r� r N)r Z FilesystemUseZXATTRrL ZTASKZTRANSr� r� )r� �fr\ r\ r_ �p_fs_usem s r� c C s` t �� }| d |_t| �dkr4| d |_| d |_n | d d | d |_| d |_|| d< dS )zkportcon : PORTCON IDENTIFIER NUMBER context | PORTCON IDENTIFIER NUMBER MINUS NUMBER contextr� r� r� r� r� r N)r ZPortConZ port_typerq Z port_numberr� �r� �cr\ r\ r_ � p_portcon s r� c C s2 t �� }| d |_| d |_| d |_|| d< dS )zanodecon : NODECON NUMBER NUMBER context | NODECON IPV6_ADDR IPV6_ADDR context r� r� r� r N)r ZNodeCon�start�endr� �r� �nr\ r\ r_ � p_nodecon� s r� c C s2 t �� }| d |_| d |_| d |_|| d< dS )z.netifcon : NETIFCON IDENTIFIER context contextr� r� r� r N)r ZNetifConrY Zinterface_contextZpacket_contextr� r\ r\ r_ � p_netifcon� s r� c C s( t �� }| d |_| d |_|| d< dS )z pirqcon : PIRQCON NUMBER contextr� r� r N)r ZPirqConZ pirq_numberr� r� r\ r\ r_ � p_pirqcon� s r� c C sV t �� }t| �dkr*| d |_| d |_n | d d | d |_| d |_|| d< dS )zYiomemcon : IOMEMCON NUMBER context | IOMEMCON NUMBER MINUS NUMBER contextr� r� r� r� r N)r ZIomemConrq Z device_memr� r� r\ r\ r_ � p_iomemcon� s r� c C sV t �� }t| �dkr*| d |_| d |_n | d d | d |_| d |_|| d< dS )z\ioportcon : IOPORTCON NUMBER context | IOPORTCON NUMBER MINUS NUMBER contextr� r� r� r� r N)r Z IoportConrq Zioportr� r� r\ r\ r_ � p_ioportcon� s r� c C s( t �� }| d |_| d |_|| d< dS )z*pcidevicecon : PCIDEVICECON NUMBER contextr� r� r N)r Z PciDeviceConZdevicer� r� r\ r\ r_ �p_pcidevicecon� s r� c C s( t �� }| d |_| d |_|| d< dS )z,devicetreecon : DEVICETREECON NUMBER contextr� r� r N)r Z DevicetTeeConr� r� r� r\ r\ r_ �p_devicetreecon� s r� c C s4 | d | d< t | �dkr0| d d | d | d< dS )z[mls_range_def : mls_level_def MINUS mls_level_def | mls_level_def r r r� r� r� Nr� r� r\ r\ r_ �p_mls_range_def� s r� c C s: | d | d< t | �dkr6| d d d�| d � | d< dS )zRmls_level_def : IDENTIFIER COLON comma_list | IDENTIFIER r r r� �:�,r� N)rq �joinr� r\ r\ r_ �p_mls_level_def� s r� c C s� t �| d �}t| �dkrD| d dkr8|j�| d � qv| d |_n2t| �dkrv| d |_t| �dkrv|j�| d � || d< dS ) z�type_def : TYPE IDENTIFIER COMMA comma_list SEMI | TYPE IDENTIFIER SEMI | TYPE IDENTIFIER ALIAS names SEMI | TYPE IDENTIFIER ALIAS names COMMA comma_list SEMI r� r� r� r� r� r� r N)r �Typerq � attributesr| �aliases�r� r^ r\ r\ r_ � p_type_def� s r� c C s t �| d �}|| d< dS )z)attribute_def : ATTRIBUTE IDENTIFIER SEMIr� r N)r Z Attribute�r� �ar\ r\ r_ �p_attribute_def� s r� c C s t �| d �}|| d< dS )z3attribute_role_def : ATTRIBUTE_ROLE IDENTIFIER SEMIr� r N)r ZAttribute_Roler� r\ r\ r_ �p_attribute_role_def� s r� c C s( t �� }| d |_| d |_|| d< dS )z5typealias_def : TYPEALIAS IDENTIFIER ALIAS names SEMIr� r� r N)r Z TypeAliasrL r� r� r\ r\ r_ �p_typealias_def� s r� c C s: t �� }| d |_t| �dkr.|j�| d � || d< dS )zWrole_def : ROLE IDENTIFIER TYPES comma_list SEMI | ROLE IDENTIFIER SEMIr� r� r N)r ZRolerR rq rS r| �r� �rr\ r\ r_ � p_role_def s r� c C s( t �� }| d |_| d |_|| d< dS )z#role_allow : ALLOW names names SEMIr� r� r N)r Z RoleAllowZ src_rolesZ tgt_rolesr� r\ r\ r_ � p_role_allow s r� c C s dS )z"permissive : PERMISSIVE names SEMINr\ r� r\ r\ r_ � p_permissive s r� c C s� t �� }| d dkr t jj|_n.| d dkr8t jj|_n| d dkrNt jj|_| d |_| d |_| d |_| d |_ || d < d S ) z�avrule_def : ALLOW names names COLON names names SEMI | DONTAUDIT names names COLON names names SEMI | AUDITALLOW names names COLON names names SEMI | NEVERALLOW names names COLON names names SEMI r rT rU rV r� r� r� r� r N) r �AVRuler2 � rule_typer3 r4 � src_types� tgt_types� obj_classesr� r� r\ r\ r_ � p_avrule_def s r� c C st t �� }| d dkr t jj|_n| d dkr6t jj|_| d |_| d |_| d |_| d |_| d |_ || d < d S ) a� typerule_def : TYPE_TRANSITION names names COLON names IDENTIFIER SEMI | TYPE_TRANSITION names names COLON names IDENTIFIER FILENAME SEMI | TYPE_TRANSITION names names COLON names IDENTIFIER IDENTIFIER SEMI | TYPE_CHANGE names names COLON names IDENTIFIER SEMI | TYPE_MEMBER names names COLON names IDENTIFIER SEMI r rW rX r� r� r� r� r� r N) r ZTypeRuler8 r� r9 r� r� r� Z dest_type� file_namer� r\ r\ r_ �p_typerule_def- s r� c C s. t �� }| d |_|j�| d � || d< dS )z5typebound_def : TYPEBOUNDS IDENTIFIER comma_list SEMIr� r� r N)r Z TypeBoundrL r� r| r� r\ r\ r_ �p_typebound_def@ s r� c C s8 t �� }| d |_| d dkr&d|_nd|_|| d< dS )zIbool : BOOL IDENTIFIER TRUE SEMI | BOOL IDENTIFIER FALSE SEMIr� r� rO TFr N�r ZBoolr� �state�r� �br\ r\ r_ �p_boolG s r� c C s8 t �� }| d |_| d dkr&d|_nd|_|| d< dS )z�gen_tunable : GEN_TUNABLE OPAREN TICK IDENTIFIER SQUOTE COMMA TRUE CPAREN | GEN_TUNABLE OPAREN TICK IDENTIFIER SQUOTE COMMA FALSE CPARENr� r� rO TFr Nr� r� r\ r\ r_ � p_gen_tunableR s r� c C sP t �� }| d |_t| d |dd� t| �dkrBt| d |dd� |g| d< d S ) z� conditional : IF OPAREN cond_expr CPAREN OBRACE interface_stmts CBRACE | IF OPAREN cond_expr CPAREN OBRACE interface_stmts CBRACE ELSE OBRACE interface_stmts CBRACE r� r� Tr� r� � Fr N)r Z Conditionalr� ry rq r� r\ r\ r_ � p_conditional] s r� c C s. t �� }| d |_|j�| d � || d< dS )z<typeattribute_def : TYPEATTRIBUTE IDENTIFIER comma_list SEMIr� r� r N)r Z TypeAttributerL r� r| r� r\ r\ r_ �p_typeattribute_defh s r� c C s. t �� }| d |_|j�| d � || d< dS )z<roleattribute_def : ROLEATTRIBUTE IDENTIFIER comma_list SEMIr� r� r N)r Z RoleAttributerR Zroleattributesr| r� r\ r\ r_ �p_roleattribute_defo s r� c C s dS )z�range_transition_def : RANGE_TRANSITION names names COLON names mls_range_def SEMI | RANGE_TRANSITION names names names SEMINr\ r� r\ r\ r_ �p_range_transition_defv s r� c C s dS )z<role_transition_def : ROLE_TRANSITION names names names SEMINr\ r� r\ r\ r_ �p_role_transition_def{ s r� c C sj t | �}|dkr | d g| d< nF|dkr@| d g| d | d< n&| d | d | d g | d | d< dS )a cond_expr : IDENTIFIER | EXPL cond_expr | cond_expr AMP AMP cond_expr | cond_expr BAR BAR cond_expr | cond_expr EQUAL EQUAL cond_expr | cond_expr EXPL EQUAL cond_expr r� r r r� r� Nr� )r� �lr\ r\ r_ � p_cond_expr s r� c C sr t �� }t| �dk r$t| d |� nBt| �dkrFt| d |� d|_n t| d g� |�d| d � || d< dS )z�names : identifier | nested_id_set | asterisk | TILDE identifier | TILDE nested_id_set | IDENTIFIER MINUS IDENTIFIER r� r r� Tr� r N)r ZIdSetrq r Z complimentr} r� r\ r\ r_ �p_names� s r� c C s | d g| d< dS )zidentifier : IDENTIFIERr r Nr\ r� r\ r\ r_ � p_identifier� s r� c C s | d g| d< dS )zasterisk : ASTERISKr r Nr\ r� r\ r\ r_ � p_asterisk� s r� c C s | d | d< dS )z1nested_id_set : OBRACE nested_id_list CBRACE r� r Nr\ r� r\ r\ r_ �p_nested_id_set� s r� c C s2 t | �dkr| d | d< n| d | d | d< dS )z`nested_id_list : nested_id_element | nested_id_list nested_id_element r� r r Nr� r� r\ r\ r_ �p_nested_id_list� s r� c C s4 t | �dkr| d | d< nd| d }|g| d< dS )zxnested_id_element : identifier | MINUS IDENTIFIER | nested_id_set r� r r r� Nr� )r� �strr\ r\ r_ �p_nested_id_element� s r c C s0 t | �dkr | d | d | d< | d | d< dS )zTcomma_list : nested_id_list | comma_list COMMA nested_id_list r� r r� r Nr� r� r\ r\ r_ � p_comma_list� s r c C s dS )z/optional_semi : SEMI | emptyNr\ r� r\ r\ r_ �p_optional_semi� s r c C s& dt | j| j| jf att� dad S )Nz(%s: Syntax error on line %d %s [type=%s]F)� parse_filerc rk rL �errorro �success)�tokr\ r\ r_ �p_error� s r c C s$ | si S i }| D ]}|||j < qd S rz )r� )r{ �mapr� r\ r\ r_ �prep_spt� s r c C sH t s t�� atjd|dd�a | d ur*| ant�� a|s@t�� an|ad S )NZLALRr )�method�debugZ write_tables) �parserr rb r r� r �Module� SupportMacrosr{ )rG �supportr r\ r\ r_ �create_globals� s r Fc C s� t |||� dt_daztj| |td� W nD tyn } z,d ad adt|� d t� � a W Y d }~n d }~0 0 ts�d adt }t |��t S )Nr T)r rb zinternal parser error: %s� zcould not parse text: "%s") r rb rc r r �parse� Exceptionr � traceback� format_excr � ValueErrorr� )�textrG r r �e�msgr\ r\ r_ r s .r c C s� g }d }t �| �D ]�\}}}|D ]~}t j�|�}t j�||�}|d dkr�|dkrX|}q�tt�d|d ��r�|�|d |f� q |d dkr |�|d |f� q q||fS )Nr z.sptzobj_perm_sets.spt�patternsr z.if) �os�walkr� �splitextr� rq �re�findallr� ) �root�modules�support_macros�dirpath�dirnames� filenamesr� �modname�filenamer\ r\ r_ � list_headers s r) c s0 ddl m} t�� }g }d }tj�| �r|tj�| �d }|dkrLtd| ��tj� |�} |� | d | f� t t � � �\} }n t | �\}}|r�|s�td���fdd��d� �fd d � } d } |�r&�d | � t�� } | || � |j� | � t�d �} t�g d ��}| j� t�|�� |j� | � �d� ��rP� �sP|jtjt|�d�}|�d� g }|D ]�}t�� }|d |_z*|�r�| |d || � n| |d |� W nR t�y� } z8�t|�d � |� |d � W Y d }~�qXW Y d }~n d }~0 0 |j� |� ��rX� �sX|� � �qXt|��r,�dd� |� � |S )Nr )�utilrs zInvalid file name %sr z1could not find support macros (obj_perm_sets.spt)c s � r� � | � d S rz )�write)r )�outputr\ r_ r� A s zparse_headers.<locals>.oc s� � r�d| � z.t | �}|�� }|�� | at|||� � W n\ tyd } zW Y d }~d S d }~0 ty� } z td| t|�f ��W Y d }~n d }~0 0 d S )Nzparsing file %s zerror parsing file %s: %s)�open�read�closer r �IOErrorr r )r� rG r{ �fdZtxtr )r r� r\ r_ r E s z!parse_headers.<locals>.parse_filez Parsing support macros (%s): �can_exec) z$1z$2�fileZexecute_no_transr- r. �getattr�lockZexecuteZioctlzdone. )ZstepszParsing interface filesr z!failed to parse some headers: %s z, )N) rs r* r ZHeadersr r� �isfile�splitr r r� r) r �headersr ru r� r Z AccessVectorr� ZConsoleProgressBar�sys�stdoutrq r� r r� r �stepr� )r! r, r r r* r8 r" r# r� r' Z all_modulesr r{ r2 �av�statusZfailuresr� r� r r\ )r r� r, r_ � parse_headers, s` $ r> )N)NNF)NTF)wr9 r r r rs r r r r r �tokensri Zt_TICKZt_SQUOTEZt_OBRACEZt_CBRACEZt_SEMIZt_COLONZt_OPARENZt_CPARENZt_COMMAZt_MINUSZt_TILDEZ t_ASTERISKZt_AMPZt_BARZt_EXPLZt_EQUALZt_NUMBERZt_PATHZt_ignorer` rd rf rg rl rm rn rp rr r� r r r{ r ry r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r rb r r r) r> r\ r\ r\ r_ �<module> sT \�E # __pycache__/matching.cpython-39.pyc 0000644 00000014031 15025012421 0013166 0 ustar 00 a z f�! � @ sb d Z ddlZddlmZ ddlmZ ddlmZ G dd� dej�ZG d d � d �ZG d d � d �Z dS ) zI Classes and algorithms for matching requested access to access vectors. � N� )�access)� objectmodel)�utilc @ s e Zd Zddd�Zdd� ZdS )�MatchNr c C s || _ || _d| _d | _d S �NF)� interface�dist�info_dir_change�__hash__)�selfr r � r �5/usr/lib/python3.9/site-packages/sepolgen/matching.py�__init__ s zMatch.__init__c C sD z$| j | jf}|j |jf}|||�W S ttfy> t Y S 0 d S �N)r r �AttributeError� TypeError�NotImplemented)r �other�method�a�br r r �_compare( s zMatch._compare)Nr )�__name__� __module__� __qualname__r r r r r r r s r c @ sH e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dS )� MatchList� c C s$ g | _ g | _| j| _d| _d | _d S r )�children�bastards�DEFAULT_THRESHOLD� threshold�allow_info_dir_change�av�r r r r r 3 s zMatchList.__init__c C s, t | j�r| jd S t | j�r(| jd S d S �Nr ��lenr r r$ r r r �best< s zMatchList.bestc C s t | j�t | j� S r r& r$ r r r �__len__C s zMatchList.__len__c C s t | j�S r )�iterr r$ r r r �__iter__I s zMatchList.__iter__c C s t �| j| j�S r )� itertools�chainr r r$ r r r �allL s z MatchList.allc C sD |j | jkr4|jr| jr&| j�|� q@| j�|� n | j�|� d S r )r r! r r" r �appendr )r �matchr r r r/ O s zMatchList.appendc C s | j �� | j�� d S r )r �sortr r$ r r r r1 X s zMatchList.sortN) r r r r r r( r) r+ r. r/ r1 r r r r r 1 s r c @ s> e Zd Zddd�Zdd� Zdd� Zdd � Zd d � Zd d � ZdS )� AccessMatcherNc C s, d| _ d| _|r|| _n t�� | _d| _d S )N� �d )� type_penalty� obj_penalty� perm_mapsr Z PermMappings�info_dir_penalty)r r7 r r r r ^ s zAccessMatcher.__init__c C s" ||kst �|�rdS | j S d S r% )r � is_idparamr5 )r r r r r r � type_distancej s zAccessMatcher.type_distancec C sR |j �|j �}t|�dkr0| j�|j|�}| S |j �|j �}| j�|j|�S d S r% )�perms� differencer' r7 �getdefault_distance� obj_class)r Zav_reqZav_prov�diff�totalr r r � perm_distanceq s zAccessMatcher.perm_distancec C s� d}|| � |j|j�7 }|| � |j|j�7 }|j|jkrNt�|j�sN|| j8 }|dk rj| j�|j|j �}n | � ||�}|dk r�|dk r�|| S || S n |dkr�|dk r�|| S || S dS )a, Determine the 'distance' between 2 access vectors. This function is used to find an access vector that matches a 'required' access. To do this we comput a signed numeric value that indicates how close the req access is to the 'provided' access vector. The closer the value is to 0 the closer the match, with 0 being an exact match. A value over 0 indicates that the prov access vector provides more access than the req (in practice, this means that the source type, target type, and object class is the same and the perms in prov is a superset of those in req. A value under 0 indicates that the prov access less - or unrelated - access to the req access. A different type or object class will result in a very low value. The values other than 0 should only be interpreted relative to one another - they have no exact meaning and are likely to change. Params: req - [AccessVector] The access that is required. This is the access being matched. prov - [AccessVector] The access provided. This is the potential match that is being evaluated for req. Returns: 0 : Exact match between the access vectors. < 0 : The prov av does not provide all of the access in req. A smaller value indicates that the access is further. > 0 : The prov av provides more access than req. The larger the value the more access over req. r N) r: Zsrc_type�tgt_typer> r r9 r6 r7 r= r; rA )r ZreqZprovr Zpdistr r r � av_distance| s ' zAccessMatcher.av_distancec C s� d}|D ]^}| � ||�}|du r&|}q|dkrL|dkr@||7 }qf|| }q|dk r^||7 }q||8 }q| j�|j|j�}|jdu r�tj|_|D ] }|j| j�|j|j�B |_q�|tj@ dkr�|jtj@ r�|dk r�|| j 8 }n || j 7 }|S )z Nr ) rC r7 Zgetdefault_directionr> r; Zinfo_dirr Z FLOW_NONEZ FLOW_WRITEr8 )r Zav_setr# r �x�tmpZav_dirr r r � av_set_match� s0 � zAccessMatcher.av_set_matchc C sd ||_ t�|j|j�|jg ��D ]6}|js,q | �|j |�}|dkr t ||�}|� |� q |� � d S r% ) r# r, r- Z tgt_type_allZ tgt_type_map�getrB ZenabledrF r r r/ r1 )r Zifsetr# Z match_listZivr �mr r r � search_ifs� s � zAccessMatcher.search_ifs)N) r r r r r: rA rC rF rI r r r r r2 ] s H(r2 ) �__doc__r, � r r r Z Comparisonr r r2 r r r r �<module> s , __pycache__/sepolgeni18n.cpython-39.pyc 0000644 00000000612 15025012421 0013710 0 ustar 00 a z f� � @ s< z"d dl Z e jdddd�Zej ZW n dd� ZY n0 dS )� Nzselinux-pythonz/usr/share/localeT)� localedir�fallbackc C s | S )N� )�strr r �9/usr/lib/python3.9/site-packages/sepolgen/sepolgeni18n.py�_ s r )�gettext� translation�tr r r r r �<module> s � __pycache__/util.cpython-39.opt-1.pyc 0000644 00000014334 15025012421 0013316 0 ustar 00 a z fj � @ s� d dl Z d dlZejd dkZer,eZeZneZeZG dd� d�Z dd� Z ddd �Z d d � Z d d � Z G dd� d�Zejdk r�dd� Zn d dlmZ dd� Zedkr�d dlZe ejdd�Ze�d� ed�D ]Ze�� e�d� q�dS ) � N� c @ s* e Zd Zd dd�Zd dd�Zd d d �ZdS )�ConsoleProgressBar�d �#c C s( d| _ d| _|| _|| _|| _d| _d S )Nr F)�blocks�current�steps� indicator�out�done)�selfr r r � r �1/usr/lib/python3.9/site-packages/sepolgen/util.py�__init__" s zConsoleProgressBar.__init__Nc C s* d| _ |r| j�d| � | j�d� d S )NFz %s: z3%--10---20---30---40---50---60---70---80---90--100 )r r �write)r �messager r r �start* s zConsoleProgressBar.start� c C s� | j |7 _ | j}tt| j t| j� d �d �| _| jdkrFd| _| j| }| j�| j| � | j� � | jdkr�| j s�d| _ | j�d� d S )Nr � �2 T� ) r r �int�round�floatr r r r �flushr )r �n�old�newr r r �step0 s " zConsoleProgressBar.step)r r )N)r )�__name__� __module__� __qualname__r r r r r r r r ! s r c C s g }|� | � |S �N)�extend)�s�lr r r � set_to_listB s r& Fc C s@ t | �std��|r,t| �}|�� |d S | D ] }| S dS )a� Return the first element of a set. It sometimes useful to return the first element from a set but, because sets are not indexable, this is rather hard. This function will return the first element from a set. If sorted is True, then the set will first be sorted (making this an expensive operation). Otherwise a random element will be returned (as sets are not ordered). zempty containerr N)�len� IndexErrorr& �sort)r$ �sortedr% �xr r r �firstG s r, c C s8 t �� }z| �|�}W n ty2 | �d�}Y n0 |S )z/Encode given text via preferred system encoding�utf-8)�locale�getpreferredencoding�encode� UnicodeError)�text�encodingZ encoded_textr r r � encode_input\ s r4 c C s8 t �� }z| �|�}W n ty2 | �d�}Y n0 |S )z/Decode given text via preferred system encodingr- )r. r/ �decoder1 )r2 r3 Z decoded_textr r r � decode_inputi s r6 c @ sH e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dS )� Comparisonz�Class used when implementing rich comparison. Inherit from this class if you want to have a rich comparison within the class, afterwards implement _compare function within your class.c C s t S r" )�NotImplemented)r �other�methodr r r �_compare} s zComparison._comparec C s | � |dd� �S )Nc S s | |kS r" r ��a�br r r �<lambda>� � z#Comparison.__eq__.<locals>.<lambda>�r; �r r9 r r r �__eq__� s zComparison.__eq__c C s | � |dd� �S )Nc S s | |k S r" r r< r r r r? � r@ z#Comparison.__lt__.<locals>.<lambda>rA rB r r r �__lt__� s zComparison.__lt__c C s | � |dd� �S )Nc S s | |kS r" r r< r r r r? � r@ z#Comparison.__le__.<locals>.<lambda>rA rB r r r �__le__� s zComparison.__le__c C s | � |dd� �S )Nc S s | |kS r" r r< r r r r? � r@ z#Comparison.__ge__.<locals>.<lambda>rA rB r r r �__ge__� s zComparison.__ge__c C s | � |dd� �S )Nc S s | |kS r" r r< r r r r? � r@ z#Comparison.__gt__.<locals>.<lambda>rA rB r r r �__gt__� s zComparison.__gt__c C s | � |dd� �S )Nc S s | |kS r" r r< r r r r? � r@ z#Comparison.__ne__.<locals>.<lambda>rA rB r r r �__ne__� s zComparison.__ne__N) r r r! �__doc__r; rC rD rE rF rG rH r r r r r7 v s r7 )r � c s G � fdd�d�}|S )z,Convert a cmp= function into a key= functionc s\ e Zd Zdd� Z� fdd�Z� fdd�Z� fdd�Z� fd d �Z� fd d �Z� fd d�Z dS )zcmp_to_key.<locals>.Kc W s || _ d S r" ��obj)r rL �argsr r r r � s z cmp_to_key.<locals>.K.__init__c s � | j |j �dk S �Nr rK rB ��mycmpr r rD � s z cmp_to_key.<locals>.K.__lt__c s � | j |j �dkS rN rK rB rO r r rG � s z cmp_to_key.<locals>.K.__gt__c s � | j |j �dkS rN rK rB rO r r rC � s z cmp_to_key.<locals>.K.__eq__c s � | j |j �dkS rN rK rB rO r r rE � s z cmp_to_key.<locals>.K.__le__c s � | j |j �dkS rN rK rB rO r r rF � s z cmp_to_key.<locals>.K.__ge__c s � | j |j �dkS rN rK rB rO r r rH � s z cmp_to_key.<locals>.K.__ne__N) r r r! r rD rG rC rE rF rH r rO r r �K� s rQ r )rP rQ r rO r � cmp_to_key� s rR )rR c C s | |k|| k S r" r )r, �secondr r r �cmp� s rT �__main__i� )r z computing pig����MbP?)F)r. �sys� version_infoZPY3�bytesZ bytes_type�strZ string_typeZunicoder r& r, r4 r6 r7 rR � functoolsrT r �time�stdout�pr �range�ir �sleepr r r r �<module> s0 ! __pycache__/matching.cpython-39.opt-1.pyc 0000644 00000014031 15025012421 0014125 0 ustar 00 a z f�! � @ sb d Z ddlZddlmZ ddlmZ ddlmZ G dd� dej�ZG d d � d �ZG d d � d �Z dS ) zI Classes and algorithms for matching requested access to access vectors. � N� )�access)� objectmodel)�utilc @ s e Zd Zddd�Zdd� ZdS )�MatchNr c C s || _ || _d| _d | _d S �NF)� interface�dist�info_dir_change�__hash__)�selfr r � r �5/usr/lib/python3.9/site-packages/sepolgen/matching.py�__init__ s zMatch.__init__c C sD z$| j | jf}|j |jf}|||�W S ttfy> t Y S 0 d S �N)r r �AttributeError� TypeError�NotImplemented)r �other�method�a�br r r �_compare( s zMatch._compare)Nr )�__name__� __module__� __qualname__r r r r r r r s r c @ sH e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dS )� MatchList� c C s$ g | _ g | _| j| _d| _d | _d S r )�children�bastards�DEFAULT_THRESHOLD� threshold�allow_info_dir_change�av�r r r r r 3 s zMatchList.__init__c C s, t | j�r| jd S t | j�r(| jd S d S �Nr ��lenr r r$ r r r �best< s zMatchList.bestc C s t | j�t | j� S r r& r$ r r r �__len__C s zMatchList.__len__c C s t | j�S r )�iterr r$ r r r �__iter__I s zMatchList.__iter__c C s t �| j| j�S r )� itertools�chainr r r$ r r r �allL s z MatchList.allc C sD |j | jkr4|jr| jr&| j�|� q@| j�|� n | j�|� d S r )r r! r r" r �appendr )r �matchr r r r/ O s zMatchList.appendc C s | j �� | j�� d S r )r �sortr r$ r r r r1 X s zMatchList.sortN) r r r r r r( r) r+ r. r/ r1 r r r r r 1 s r c @ s> e Zd Zddd�Zdd� Zdd� Zdd � Zd d � Zd d � ZdS )� AccessMatcherNc C s, d| _ d| _|r|| _n t�� | _d| _d S )N� �d )� type_penalty� obj_penalty� perm_mapsr Z PermMappings�info_dir_penalty)r r7 r r r r ^ s zAccessMatcher.__init__c C s" ||kst �|�rdS | j S d S r% )r � is_idparamr5 )r r r r r r � type_distancej s zAccessMatcher.type_distancec C sR |j �|j �}t|�dkr0| j�|j|�}| S |j �|j �}| j�|j|�S d S r% )�perms� differencer' r7 �getdefault_distance� obj_class)r Zav_reqZav_prov�diff�totalr r r � perm_distanceq s zAccessMatcher.perm_distancec C s� d}|| � |j|j�7 }|| � |j|j�7 }|j|jkrNt�|j�sN|| j8 }|dk rj| j�|j|j �}n | � ||�}|dk r�|dk r�|| S || S n |dkr�|dk r�|| S || S dS )a, Determine the 'distance' between 2 access vectors. This function is used to find an access vector that matches a 'required' access. To do this we comput a signed numeric value that indicates how close the req access is to the 'provided' access vector. The closer the value is to 0 the closer the match, with 0 being an exact match. A value over 0 indicates that the prov access vector provides more access than the req (in practice, this means that the source type, target type, and object class is the same and the perms in prov is a superset of those in req. A value under 0 indicates that the prov access less - or unrelated - access to the req access. A different type or object class will result in a very low value. The values other than 0 should only be interpreted relative to one another - they have no exact meaning and are likely to change. Params: req - [AccessVector] The access that is required. This is the access being matched. prov - [AccessVector] The access provided. This is the potential match that is being evaluated for req. Returns: 0 : Exact match between the access vectors. < 0 : The prov av does not provide all of the access in req. A smaller value indicates that the access is further. > 0 : The prov av provides more access than req. The larger the value the more access over req. r N) r: Zsrc_type�tgt_typer> r r9 r6 r7 r= r; rA )r ZreqZprovr Zpdistr r r � av_distance| s ' zAccessMatcher.av_distancec C s� d}|D ]^}| � ||�}|du r&|}q|dkrL|dkr@||7 }qf|| }q|dk r^||7 }q||8 }q| j�|j|j�}|jdu r�tj|_|D ] }|j| j�|j|j�B |_q�|tj@ dkr�|jtj@ r�|dk r�|| j 8 }n || j 7 }|S )z Nr ) rC r7 Zgetdefault_directionr> r; Zinfo_dirr Z FLOW_NONEZ FLOW_WRITEr8 )r Zav_setr# r �x�tmpZav_dirr r r � av_set_match� s0 � zAccessMatcher.av_set_matchc C sd ||_ t�|j|j�|jg ��D ]6}|js,q | �|j |�}|dkr t ||�}|� |� q |� � d S r% ) r# r, r- Z tgt_type_allZ tgt_type_map�getrB ZenabledrF r r r/ r1 )r Zifsetr# Z match_listZivr �mr r r � search_ifs� s � zAccessMatcher.search_ifs)N) r r r r r: rA rC rF rI r r r r r2 ] s H(r2 ) �__doc__r, � r r r Z Comparisonr r r2 r r r r �<module> s , __pycache__/yacc.cpython-39.pyc 0000644 00000147734 15025012421 0012334 0 ustar 00 a z fd � @ s d dl Z d dlZd dlZd dlZd dlZd dlZdZdZdZ dZ dZ dZ dZ d Zd Zd Zejd dk rleZneZejZG d d � d e�ZG d d� de�ZG dd� de�Zdd� Z dd� Z da da da dZ!dd� Z"dd� Z#dd� Z$d d � Z%G d d � d �Z&G d d!� d!�Z'G d"d#� d#�Z(e �)d$�Z*G d%d&� d&e�Z+G d'd(� d(e�Z,G d)d*� d*e�Z-d+d,� Z.G d-d.� d.e�Z/G d/d0� d0e�Z0G d1d2� d2e�Z1G d3d4� d4e�Z2d5d6� Z3d7d8� Z4G d9d:� d:e�Z5G d;d<� d<e2�Z6d=d>� Z7d?d@� Z8G dAdB� dBe�Z9de de ddd de ddddf dCdD�Z:dS )E� Nz3.11z3.10Tz parser.out�parsetab�LALR� F�( c @ s4 e Zd Zdd� Zdd� ZeZdd� Zdd� ZeZd S ) � PlyLoggerc C s || _ d S �N)�f)�selfr � r �1/usr/lib/python3.9/site-packages/sepolgen/yacc.py�__init__m s zPlyLogger.__init__c O s | j �|| d � d S )N� �r �write�r �msg�args�kwargsr r r �debugp s zPlyLogger.debugc O s | j �d|| d � d S )Nz WARNING: r r r r r r �warningu s zPlyLogger.warningc O s | j �d|| d � d S )NzERROR: r r r r r r �errorx s zPlyLogger.errorN) �__name__� __module__� __qualname__r r �infor r Zcriticalr r r r r l s r c @ s e Zd Zdd� Zdd� ZdS )� NullLoggerc C s | S r r )r �namer r r �__getattribute__ s zNullLogger.__getattribute__c O s | S r r )r r r r r r �__call__� s zNullLogger.__call__N)r r r r r r r r r r ~ s r c @ s e Zd ZdS )� YaccErrorN�r r r r r r r r � s r c C sP t | �}d|v rt |�}t|�tkr4|d t� d }dt| �jt| �|f }|S )Nr z ...z<%s @ 0x%x> (%s))�repr�len� resultlimit�typer �id)�r�repr_str�resultr r r � format_result� s r) c C sB t | �}d|v rt |�}t|�dk r(|S dt| �jt| �f S d S )Nr � z <%s @ 0x%x>)r! r" r$ r r% )r& r' r r r �format_stack_entry� s r+ a PLY: Don't use global functions errok(), token(), and restart() in p_error(). Instead, invoke the methods on the associated parser instance: def p_error(p): ... # Use parser.errok(), parser.token(), parser.restart() ... parser = yacc.yacc() c C s t �t� t� S r )�warnings�warn�_warnmsg�_errokr r r r �errok� s r0 c C s t �t� t� S r )r, r- r. �_restartr r r r �restart� s r2 c C s t �t� t� S r )r, r- r. �_tokenr r r r �token� s r4 c C s< |j a|ja|ja| |�}z bbbW n ty6 Y n0 |S r )r0 r/ r4 r3 r2 r1 � NameError)� errorfuncr4 �parserr& r r r �call_errorfunc� s r8 c @ s e Zd Zdd� Zdd� ZdS )� YaccSymbolc C s | j S r �r$ �r r r r �__str__� s zYaccSymbol.__str__c C s t | �S r ��strr; r r r �__repr__� s zYaccSymbol.__repr__N)r r r r< r? r r r r r9 � s r9 c @ sn e Zd Zddd�Zdd� Zdd� Zdd � Zd d � Zd d � Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� ZdS )�YaccProductionNc C s || _ || _d | _d | _d S r )�slice�stack�lexerr7 )r �srB r r r r � s zYaccProduction.__init__c C sB t |t�r dd� | j| D �S |dkr2| j| jS | j| jS d S )Nc S s g | ] }|j �qS r ��value��.0rD r r r � <listcomp>� � z.YaccProduction.__getitem__.<locals>.<listcomp>r )� isinstancerA rF rB �r �nr r r � __getitem__� s zYaccProduction.__getitem__c C s || j | _d S r )rA rF )r rM �vr r r � __setitem__� s zYaccProduction.__setitem__c C s dd� | j ||� D �S )Nc S s g | ] }|j �qS r rE rG r r r rI � rJ z/YaccProduction.__getslice__.<locals>.<listcomp>)rA )r �i�jr r r � __getslice__� s zYaccProduction.__getslice__c C s t | j�S r )r" rA r; r r r �__len__� s zYaccProduction.__len__c C s t | j| dd�S )N�linenor ��getattrrA rL r r r rU s zYaccProduction.linenoc C s || j | _d S r )rA rU )r rM rU r r r � set_lineno s zYaccProduction.set_linenoc C s, t | j| dd�}t | j| d|�}||fS )NrU r � endlinenorV )r rM � startlineZendliner r r �linespan s zYaccProduction.linespanc C s t | j| dd�S )N�lexposr rV rL r r r r\ s zYaccProduction.lexposc C s || j | _d S r )rA r\ )r rM r\ r r r � set_lexpos s zYaccProduction.set_lexposc C s, t | j| dd�}t | j| d|�}||fS )Nr\ r � endlexposrV )r rM �startpos�endposr r r �lexspan s zYaccProduction.lexspanc C s t �d S r )� SyntaxErrorr; r r r r s zYaccProduction.error)N)r r r r rN rP rS rT rU rX r[ r\ r] ra r r r r r r@ � s r@ c @ s\ e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zdd d�Zddd�Z ddd�Z ddd�Z d S )�LRParserc C s0 |j | _|j| _|j| _|| _| �� d| _d S �NT) �lr_productions� productions� lr_action�action�lr_goto�gotor6 �set_defaulted_states�errorok)r ZlrtabZerrorfr r r r s zLRParser.__init__c C s d| _ d S rd )rl r; r r r r0 ( s zLRParser.errokc C s@ | j d d �= | jd d �= t� }d|_| j�|� | j �d� d S )N�$endr )� statestack�symstackr9 r$ �append)r �symr r r r2 + s zLRParser.restartc C sP i | _ | j�� D ]:\}}t|�� �}t|�dkr|d dk r|d | j |< qd S �N� r )�defaulted_statesrh �items�list�valuesr" )r �state�actionsZrulesr r r rk ; s z LRParser.set_defaulted_statesc C s i | _ d S r )rt r; r r r �disable_defaulted_statesB s z!LRParser.disable_defaulted_statesNFc C sZ |st r.t|t�r ttj�}| �|||||�S |rD| �|||||�S | �|||||�S d S r ) � yaccdevelrK �intr �sys�stderr� parsedebug�parseopt�parseopt_notrack)r �inputrC r �tracking� tokenfuncr r r �parseE s zLRParser.parsec C s� d }g }| j }| j} | j} | j} td �} d} |�d� |sLddlm} |j}|| _| | _ |d urj|� |� |d u rz|j }n|}|| _ g }|| _ g }|| _ || _d }|�d� t� }d|_|�|� d}|�d� |�d|� || v�r(|�s|s�|� }n|�� }|�st� }d|_|j}|| �|�}n| | }|�d|| � |�d d d �d d � |D �dd � �t|�f �� � |d u�r�|dk�r�|�|� |}|�d|� |�|� d }| r�| d8 } q�|dk �rD| | }|j}|j}t� }||_d |_|�r<|�d|jdd�dd � || d � D �� d | |d| | � n |�d|jg | |d | � |�r�|| d d � }||d< |�r�|d }|j|_|j |_ |d }t |d|j�|_ t |d|j �|_ || _ zd|| d �= || _!|�"| � || d �= |�dt#| d �� |�|� | |d | }|�|� W q� t$�y� |�|� |�%|dd� � |�� |d }d|_d|_|}t&} d| _'Y q�0 q�n�|�r�|j|_|j |_ |g}|| _ zL|| _!|�"| � |�dt#| d �� |�|� | |d | }|�|� W q� t$�y@ |�|� |�� |d }d|_d|_|}t&} d| _'Y q�0 q�|dk�r�|d } t | dd �} |�dt#| �� |�d � | S |d u �r�|�(d d d �d d � |D �dd � �t|�f �� � | dk�s�| j'�r�t&} d| _'|}|jdk�r�d }| j)�r6|�rt*|d ��s||_|| _!t+| j)|| �} | j'�r�| }d }q�n`|�r�t*|d ��rP|j} nd} | �rrt,j-�.d!| |jf � nt,j-�.d"|j � nt,j-�.d#� d S nt&} t|�dk�r�|jdk�r�d }d }d}|d d �= q�|jdk�r�d S |jdk�r�|d }|jdk�r*|�r$t |d |j�|_ t |d$|j �|_ d }q�t� }d|_t*|d ��rP|j |_|_ t*|d$��rj|j |_ |_ ||_|�|� |}q�|�� }|�r�|j|_|j |_ |�� |d }q�t/d%��q�d S )&Nr zPLY: PARSE DEBUG STARTrs ��lexrm � z State : %sz#Defaulted state %s: Reduce using %dz Stack : %sz%s . %s� c S s g | ] }|j �qS r r: �rH �xxr r r rI � rJ z'LRParser.parsedebug.<locals>.<listcomp>z Action : Shift and goto state %sz3Action : Reduce rule [%s] with %s and goto state %d�[�,c S s g | ]}t |j��qS r )r+ rF )rH Z_vr r r rI � rJ �]���rY r^ z Result : %sr FrF zDone : Returning %szPLY: PARSE DEBUG ENDz Error : %sc S s g | ] }|j �qS r r: r� r r r rI D rJ rC rU �(yacc: Syntax error at line %d, token=%s � yacc: Syntax error, token=%s� yacc: Parse error in input. EOF r\ � yacc: internal parser error!!! )0rh rj rf rt r@ r r� r� rC r7 r� r4 rn ro rB rp r9 r$ r �pop�get�joinr> �lstripr r" rF rU r\ rW rY r^ rA rx �callabler) rb �extend� error_countrl r r6 �hasattrr8 r} r~ r � RuntimeError� r r� rC r r� r� � lookahead�lookaheadstackry rj �prodrt �pslice� errorcountr� � get_tokenrn ro �errtokenrq rx �ltype�t�p�pname�plen�targ�t1rM r( �tokrU r r r r ^ s� *� $� � *� zLRParser.parsedebugc C sj d }g }| j }| j} | j} | j} td �} d} |sBddlm} |j}|| _| | _|d ur`|� |� |d u rp|j }n|}|| _ g }|| _ g }|| _ || _ d }|�d� t� }d|_|�|� d}|| v�r|s�|s�|� }n|�� }|s�t� }d|_|j}|| �|�}n| | }|d u�r`|dk�rJ|�|� |}|�|� d }| r�| d8 } q�|dk �r>| | }|j}|j}t� }||_d |_|�r�|| d d � }||d< |�r�|d }|j|_|j|_|d }t|d|j�|_t|d|j�|_|| _zP|| d �= || _ |� | � || d �= |�|� | |d | }|�|� W q� t �y� |�|� |� |dd� � |�� |d }d|_d|_|}t } d | _!Y q�0 q�n�|�r�|j|_|j|_|g}|| _z8|| _ |� | � |�|� | |d | }|�|� W q� t �y: |�|� |�� |d }d|_d|_|}t } d | _!Y q�0 q�|dk�r`|d } t| d d �} | S |d u �r\| dk�s|| j!�rDt } d | _!|}|jdk�r�d }| j"�r�|�r�t#|d ��s�||_|| _ t$| j"|| �} | j!�rB| }d }q�n`|�r2t#|d ��r�|j} nd} | �r t%j&�'d | |jf � nt%j&�'d|j � nt%j&�'d� d S nt } t|�dk�rz|jdk�rzd }d }d}|d d �= q�|jdk�r�d S |jdk�r,|d }|jdk�r�|�r�t|d |j�|_t|d|j�|_d }q�t� }d|_t#|d ��r�|j |_|_t#|d��r|j |_|_||_|�|� |}q�|�� }|�rJ|j|_|j|_|�� |d }q�t(d��q�d S )Nr rs r� rm r� rY r^ r FrF rC rU r� r� r� r\ r� ))rh rj rf rt r@ r� r� rC r7 r� r4 rn ro rB rp r9 r$ r� r� r r" rF rU r\ rW rY r^ rA rx r� rb r� r� rl r6 r� r8 r} r~ r r� r� r r r r� � sV zLRParser.parseoptc C s� d }g }| j }| j} | j} | j} td �} d} |sBddlm} |j}|| _| | _|d ur`|� |� |d u rp|j }n|}|| _ g }|| _ g }|| _ || _ d }|�d� t� }d|_|�|� d}|| v�r|s�|s�|� }n|�� }|s�t� }d|_|j}|| �|�}n| | }|d u�r|dk�rJ|�|� |}|�|� d }| r�| d8 } q�|dk �r�| | }|j}|j}t� }||_d |_|�rR|| d d � }||d< || _zP|| d �= || _|�| � || d �= |�|� | |d | }|�|� W q� t�yL |�|� |�|dd� � |�� |d }d|_d|_|}t} d| _ Y q�0 q�n�|g}|| _z8|| _|�| � |�|� | |d | }|�|� W q� t�y� |�|� |�� |d }d|_d|_|}t} d| _ Y q�0 q�|dk�r|d }t |dd �} | S |d u �r�| dk�s | j �r�t} d| _ |}|jdk�r>d }| j �r�|�r^t |d ��s^||_|| _t | j || �} | j �r�| }d }q�n`|�r�t |d ��r�|j!} nd} | �r�t"j#�$d | |jf � nt"j#�$d |j � nt"j#�$d � d S nt} t|�dk�r |jdk�r d }d }d}|d d �= q�|jdk�r.d S |jdk�r�|d }|jdk�rTd }q�t� }d|_t |d ��rz|j! |_!|_%t |d��r�|j& |_&|_'||_|�|� |}q�|�� }|�� |d }q�t(d��q�d S )Nr rs r� rm r� r FrF rC rU r� r� r� r\ r� ))rh rj rf rt r@ r� r� rC r7 r� r4 rn ro rB rp r9 r$ r� r� r r" rF rA rx r� rb r� r� rl rW r6 r� r8 rU r} r~ r rY r\ r^ r� ) r r� rC r r� r� r� r� ry rj r� rt r� r� r� r� rn ro r� rq rx r� r� r� r� r� r� rM r( r� rU r r r r� � s6 zLRParser.parseopt_notrack)NNFFN)NNFFN)NNFFN)NNFFN) r r r r r0 r2 rk rz r� r r� r� r r r r rc s ] 4rc z^[a-zA-Z0-9_-]+$c @ sR e Zd ZdZddd�Zdd� Zd d � Zd d � Zd d� Zdd� Z dd� Z dd� Z dS )� Productionr ��rightr Nr� c C s� || _ t|�| _|| _|| _d | _|| _|| _|| _t | j�| _ g | _ | jD ]}|| j vrL| j � |� qLg | _ d | _ | jr�d| j d�| j�f | _n d| j | _d S �N�%s -> %sr� z %s -> <empty>)r �tupler� �number�funcr� �file�line�precr" �usymsrp �lr_items�lr_nextr� r> ) r r� r r� � precedencer� r� r� rD r r r r ! s$ zProduction.__init__c C s | j S r r= r; r r r r< ? s zProduction.__str__c C s dt | � d S )Nz Production(�)r= r; r r r r? B s zProduction.__repr__c C s t | j�S r )r" r� r; r r r rT E s zProduction.__len__c C s dS �Nrs r r; r r r � __nonzero__H s zProduction.__nonzero__c C s | j | S r )r� �r �indexr r r rN K s zProduction.__getitem__c C s� |t | j�krd S t| |�}z| j|j|d |_W n ttfyR g |_Y n0 z|j|d |_W n ty� d |_Y n0 |S r� )r" r� �LRItem� Prodnames�lr_after� IndexError�KeyError� lr_before)r rM r� r r r �lr_itemO s zProduction.lr_itemc C s | j r|| j | _d S r �r� r� �r �pdictr r r �bind_ s zProduction.bind)r� Nr� r ) r r r �reducedr r< r? rT r� rN r� r� r r r r r� s r� c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S ) �MiniProductionc C s. || _ || _|| _d | _|| _|| _|| _d S r )r r" r� r� r� r� r> )r r> r r" r� r� r� r r r r h s zMiniProduction.__init__c C s | j S r r= r; r r r r< q s zMiniProduction.__str__c C s d| j S )NzMiniProduction(%s)r= r; r r r r? t s zMiniProduction.__repr__c C s | j r|| j | _d S r r� r� r r r r� x s zMiniProduction.bindN)r r r r r< r? r� r r r r r� g s r� c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )r� c C sZ |j | _ t|j�| _|j| _|| _i | _| j�|d� t| j�| _t| j�| _|j | _ d S )N�.) r rv r� r� �lr_index� lookaheads�insertr� r" r� )r r� rM r r r r � s zLRItem.__init__c C s, | j r d| jd�| j �f }n d| j }|S r� )r� r r� )r rD r r r r< � s zLRItem.__str__c C s dt | � d S )NzLRItem(r� r= r; r r r r? � s zLRItem.__repr__N)r r r r r< r? r r r r r� � s r� c C s6 t | �d }|dkr2| | |v r(| | S |d8 }q d S rr )r" )Zsymbols� terminalsrQ r r r �rightmost_terminal� s r� c @ s e Zd ZdS )� GrammarErrorNr r r r r r� � s r� c @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd$d d �Zd%dd�Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zd d � Zd d � Zd&d d!�Zd"d#� Zd S )'�Grammarc C sb d g| _ i | _i | _i | _|D ]}g | j|< q g | jd< i | _i | _i | _i | _t� | _ d | _ d S �Nr ) � Productionsr� �Prodmap� Terminals� Nonterminals�First�Follow� Precedence�set�UsedPrecedence�Start)r r� �termr r r r � s zGrammar.__init__c C s t | j�S r )r" r� r; r r r rT � s zGrammar.__len__c C s | j | S r )r� r� r r r rN � s zGrammar.__getitem__c C sL | j d gksJ d��|| jv r*td| ��|dvr:td��||f| j|< d S )Nz2Must call set_precedence() before add_production()z,Precedence already specified for terminal %r)�leftr� �nonassocz:Associativity must be one of 'left','right', or 'nonassoc')r� r� r� )r r� �assoc�levelr r r �set_precedence� s zGrammar.set_precedenceNr� r c C s� || j v r td|||f ��|dkr6td|||f ��t�|�sRtd|||f ��t|�D ]�\}}|d dv r�zLt|�}t|�dkr�td||||f ��|| j vr�g | j |< |||< W qZW n ty� Y n0 t�|�sZ|d krZtd ||||f ��qZd |v �r�|d d k�r td ||f ��|d d k�r<td||f ��|d } | j� | �} | �sjtd||| f ��n | j � | � |d d �= nt || j �} | j� | d�} d||f } | | j v �r�| j | } td||| f d| j| jf ��t| j�} || jv�r g | j|< |D ]J}|| j v �r&| j | �| � n&|| jv�r<g | j|< | j| �| � �qt| ||| |||�}| j�|� || j | < z| j| �|� W n t�y� |g| j|< Y n0 d S )Nz7%s:%d: Illegal rule name %r. Already defined as a tokenr z5%s:%d: Illegal rule name %r. error is a reserved wordz%s:%d: Illegal rule name %rr z'"rs zA%s:%d: Literal token %s in rule %r may only be a single characterz%precz!%s:%d: Illegal name %r in rule %rr� z+%s:%d: Syntax error. Nothing follows %%prec���zH%s:%d: Syntax error. %%prec can only appear at the end of a grammar rulez/%s:%d: Nothing known about the precedence of %rr� r� z%s:%d: Duplicate rule %s. z Previous definition at %s:%d)r� r� �_is_identifier�match� enumerate�evalr" rb r� r� r� �addr� r� r� r� r� r� rp r� r� r� )r �prodname�symsr� r� r� rM rD �cZprecnameZprodprec�map�mZpnumberr� r� r r r �add_production sv � � � zGrammar.add_productionc C sT |s| j d j}|| jvr&td| ��tdd|g�| j d< | j| �d� || _d S )Nrs zstart symbol %s undefinedr �S')r� r r� r� r� rp r� )r �startr r r � set_startc s zGrammar.set_startc s> � ��fdd�� t � �� �jd jd � �fdd��jD �S )Nc sB | �v r d S �� | � �j�| g �D ]}|jD ] }� |� q.q$d S r )r� r� r� r� )rD r� r& ��mark_reachable_from� reachabler r r r� v s z5Grammar.find_unreachable.<locals>.mark_reachable_fromr c s g | ]}|� vr|�qS r r rG )r� r r rI � rJ z,Grammar.find_unreachable.<locals>.<listcomp>)r� r� r� r� r; r r� r �find_unreachables s zGrammar.find_unreachablec C s� i }| j D ] }d||< q d|d< | jD ] }d||< q&d}| j�� D ]N\}}|D ]@}|jD ]}|| sXd} qrqXd}|rN|| s�d||< d} qBqNqB|s4q�q4g } |�� D ]4\}} | s�|| jvr�|| j vr�|dkr�q�| �|� q�| S )NTrm Fr )r� r� r� ru r� rp ) r Z terminatesr� rM � some_change�plr� rD Z p_terminates�infiniter� r r r �infinite_cycles� s8 zGrammar.infinite_cyclesc C sP g }| j D ]@}|sq |jD ].}|| jvr|| jvr|dkr|�||f� qq |S r� )r� r� r� r� rp )r r( r� rD r r r �undefined_symbols� s zGrammar.undefined_symbolsc C s2 g }| j �� D ] \}}|dkr|s|�|� q|S r� )r� ru rp )r Z unused_tokrD rO r r r �unused_terminals� s zGrammar.unused_terminalsc C s8 g }| j �� D ]$\}}|s| j| d }|�|� q|S �Nr )r� ru r� rp )r Z unused_prodrD rO r� r r r � unused_rules� s zGrammar.unused_rulesc C s@ g }| j D ]0}|| jv s || jv s |�|| j | d f� q |S r )r� r� r� rp )r ZunusedZtermnamer r r �unused_precedence� s zGrammar.unused_precedencec C sZ g }|D ]B}d}| j | D ]$}|dkr,d}q||vr|�|� q|rFq qVq|�d� |S )NF�<empty>T)r� rp )r Zbetar( �xZx_produces_emptyr r r r �_first s zGrammar._firstc C s� | j r | j S | jD ]}|g| j |< qdg| j d< | jD ]}g | j |< q6d}| jD ]H}| j| D ]8}| �|j�D ]&}|| j | vrn| j | �|� d}qnq^qP|sFq�qF| j S )Nrm FT)r� r� r� r� r r� rp )r r� rM r� r� r r r r � compute_first. s" zGrammar.compute_firstc C s< | j r | j S | js| �� | jD ]}g | j |< q |s@| jd j}dg| j |< d}| jdd � D ]�}t|j�D ]�\}}|| jv rl| �|j|d d � �}d}|D ]:} | dkr�| | j | vr�| j | � | � d}| dkr�d}q�|s�|t |j�d krl| j |j D ]*} | | j | v� r�| j | � | � d}� q�qlq^|sL�q6qL| j S )Nrs rm Fr T) r� r� r r� r� r r� r� r rp r" ) r r� �k�didaddr� rQ �BZfstZhasemptyr r r r �compute_followS s: zGrammar.compute_followc C s� | j D ]�}|}d}g }|t|�kr(d }npt||�}z| j|j|d |_W n ttfyh g |_Y n0 z|j|d |_W n ty� d |_Y n0 ||_ |s�q�|� |� |}|d7 }q||_ qd S �Nr rs ) r� r" r� r� r� r� r� r� r� r� rp r� )r r� ZlastlrirQ r� Zlrir r r � build_lritems� s, zGrammar.build_lritems)Nr� r )N)N)r r r r rT rN r� r� r� r� r� r� r� r r r r r r r r r r r� � s $ T @#% ;r� c @ s e Zd ZdS )� VersionErrorNr r r r r r � s r c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S ) �LRTablec C s d | _ d | _d | _d | _d S r )rg ri re � lr_methodr; r r r r � s zLRTable.__init__c C sz t |tj�r|}ntd| � tj| }|jtkr:td��|j | _ |j | _ g | _ |jD ]}| j �t|� � qV|j| _|jS )N� import %s�&yacc table file version is out of date)rK �types� ModuleType�execr} �modulesZ _tabversion�__tabversion__r Z _lr_actionrg Z_lr_gotori re Z_lr_productionsrp r� Z _lr_methodr Z _lr_signature)r �moduler r� r r r � read_table� s zLRTable.read_tablec C s� z dd l }W n ty& dd l}Y n0 tj�|�s8t�t|d�}|�|�}|tkr\t d��|�|�| _ |�|�}|�|�| _ |�|�| _ |�|�}g | _ |D ]}| j �t|� � q�|�� |S )Nr �rbr )�cPickle� ImportError�pickle�os�path�exists�open�loadr r r rg ri re rp r� �close)r �filenamer Zin_fZ tabversion� signaturerf r� r r r � read_pickle� s( zLRTable.read_picklec C s | j D ]}|�|� qd S r )re r� )r r� r� r r r �bind_callables� s zLRTable.bind_callablesN)r r r r r r% r& r r r r r � s r c C sL i }| D ] }d||< qg }i }| D ]$}|| dkr"t ||||| ||� q"|S r )�traverse)�X�R�FP�Nr rB �Fr r r �digraph s r- c C s� |� | � t|�}||| < || �|| < || �}|D ]f} || dkrVt| ||||||� t|| || �|| < |�| g �D ] } | || vrx|| � | � qxq2|| |kr�t||d < || ||d < |�� } | | kr�t||d < || ||d < |�� } q�d S )Nr r� )rp r" r' �minr� �MAXINTr� ) r r+ rB r, r( r) r* �d�rel�y�a�elementr r r r' s( r' c @ s e Zd ZdS )� LALRErrorNr r r r r r5 + s r5 c @ s� e Zd Zd$dd�Zdd� Zdd� Zd d � Zd d � Zd d� Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd � Zd d � Zd%d d!�Zd&d"d#�ZdS )'�LRGeneratedTabler Nc C s� |dvrt d| ��|| _|| _|s*t� }|| _i | _i | _|j| _i | _ i | _ d| _ d| _ d| _ g | _g | _g | _| j�� | j�� | j�� | �� d S )N)ZSLRr zUnsupported method %sr )r5 �grammarr r �logrg ri r� re � lr_goto_cache� lr0_cidhash� _add_countZ sr_conflictZ rr_conflict� conflicts� sr_conflicts� rr_conflictsr r r �lr_parse_table)r r7 �methodr8 r r r r 6 s, zLRGeneratedTable.__init__c C sn | j d7 _ |d d � }d}|rjd}|D ]<}|jD ]0}t|dd�| j krLq4|�|j� | j |_d}q4q*q |S )Nrs TF� lr0_addedr )r; r� rW rp r� rA )r �I�Jr rR r r r r � lr0_closure[ s z LRGeneratedTable.lr0_closurec C s� | j �t|�|f�}|r |S | j �|�}|s:i }|| j |< g }|D ]H}|j}|rB|j|krB|�t|��}|s|i }||t|�< |�|� |}qB|�d�}|s�|r�| �|�}||d< n||d< || j t|�|f< |S )Nrm )r9 r� r% r� r� rp rD ) r rB r �grD Zgsr� rM �s1r r r �lr0_gotou s2 zLRGeneratedTable.lr0_gotoc C s� | � | jjd jg�g}d}|D ]}|| jt|�< |d7 }q d}|t|�k r�|| }|d7 }i }|D ]}|jD ] }d ||< qnqd|D ]@}| �||�}|r�t|�| jv r�q�t|�| jt|�< |� |� q�q@|S r ) rD r7 r� r� r: r% r" r� rG rp ) r �CrQ rB Zasyms�iirD r rE r r r � lr0_items� s( zLRGeneratedTable.lr0_itemsc C sx t � }d}| jjdd � D ]@}|jdkr6|�|j� q|jD ]}||vr< qq<|�|j� qt|�|krjqtt|�}q |S r )r� r7 r� r" r� r r� )r �nullableZ num_nullabler� r� r r r � compute_nullable_nonterminals� s z.LRGeneratedTable.compute_nullable_nonterminalsc C sj g }t |�D ]X\}}|D ]J}|j|jd k r||j|jd f}|d | jjv r||vr|�|� qq |S r� )r� r� r" r� r7 r� rp )r rH �transZstatenorx r� r� r r r � find_nonterminal_transitions� s z-LRGeneratedTable.find_nonterminal_transitionsc C s� |\}}g }| � || |�}|D ]B}|j|jd k r |j|jd } | | jjv r | |vr |�| � q |dkr�|| jjd jd kr�|�d� |S )Nrs r rm )rG r� r" r� r7 r� rp r� ) r rH rM rK rx r+ �termsrE r� r3 r r r � dr_relation s z LRGeneratedTable.dr_relationc C sr g }|\}}| � || |�}| j�t|�d�}|D ]:} | j| jd k r2| j| jd } | |v r2|�|| f� q2|S )Nr� rs )rG r: r� r% r� r" r� rp ) r rH rM �emptyr1 rx r+ rE rR r� r3 r r r �reads_relation s z LRGeneratedTable.reads_relationc C s� i }i }i }|D ] }d||< q|D �]�\}} g } g } || D �],} | j | krNq<| j} |}| | jd k r�| d } | j| }||f|v r�| d }|| jk r�| j| | jjv r�q�| j| |vr�q�|d }q�| �||f� | �|| |�}| j� t |�d�}qX|| D ]j}|j | j k�rq�|j| jk�r"q�d}||jk �rZ|j| | j|d k�rNq�|d }�q&| �||f� q�q<| D ]*}||v�r�g ||< || �|| f� �qp| ||| f< q"||fS )Nrs r� r ) r r� r" r� r7 r� rp rG r: r� r% )r rH rM rK ZlookdictZ includedictZdtransr� rx r+ ZlookbZincludesr� r� rR ZlirE r& rQ r r r �compute_lookback_includesD sX z*LRGeneratedTable.compute_lookback_includesc s0 � ��fdd�}� ��fdd�}t |||�}|S )Nc s �� � | ��S r )rP �r �rH rK r r r �<lambda>� rJ z4LRGeneratedTable.compute_read_sets.<locals>.<lambda>c s �� � | ��S r )rR rT rU r r rV � rJ �r- )r rH �ntransrK r* r) r, r rU r �compute_read_sets� s z"LRGeneratedTable.compute_read_setsc s( �fdd�}� fdd�}t |||�}|S )Nc s � | S r r rT )�readsetsr r rV � rJ z6LRGeneratedTable.compute_follow_sets.<locals>.<lambda>c s � � | g �S r )r� rT )�inclsetsr r rV � rJ rW )r rX rZ r[ r* r) r, r )r[ rZ r �compute_follow_sets� s z$LRGeneratedTable.compute_follow_setsc C sl |� � D ]^\}}|D ]P\}}||jvr0g |j|< |�|g �}|D ]"}||j| vr@|j| �|� q@qqd S r )ru r� r� rp ) r Z lookbacksZ followsetrM Zlbrx r� r r3 r r r �add_lookaheads� s z LRGeneratedTable.add_lookaheadsc C sP | � � }| �|�}| �|||�}| �|||�\}}| �|||�}| �||� d S r )rL rN rY rS r\ r] )r rH rK rM rZ ZlookdZincludedZ followsetsr r r �add_lalr_lookaheads� s z$LRGeneratedTable.add_lalr_lookaheadsc $ C s | j j}| j j}| j}| j}| j}i }|�d| j� | �� }| jdkrP| � |� d}|D �]�} g } i } i } i } |�d� |�d|� |�d� | D ]}|�d|j |� q�|�d� | D �]�}|j |j d k�r|j dkr�d| d < || d < �q�| jdk�r|j| }n| j j|j }|D �]�}| �||d |j |f f� | �|�}|d u�r�|dk�r*|�|d �\}}||j j\}}||k �s�||k�r�|d k�r�|j | |< || |< |�s�|�s�|�d |� | j�||df� ||j jd7 _nB||k�r|dk�rd | |< n$|�s�|�d|� | j�||df� n�|dk �r�|| }||j }|j|jk�r�|j | |< || |< || }}||j jd7 _||j jd8 _n || }}| j�|||f� |�d|| | j | | � n td| ��n(|j | |< || |< ||j jd7 _�qq�|j }|j|d }|| j jv r�| �| |�}| j�t |�d�} | dkr�| �||d| f� | �|�}|d u�r�|dk�r�|| k�r�td| ��n�|dk �r�|�|d �\}}|| | j j\}}||k�s�||k�r<|dk�r<|| | j jd8 _| | |< || |< |�s�|�d|� | j�||df� nH||k�rZ|dk�rZd | |< n*|�s�|�s�|�d |� | j�||df� n td| ��q�| | |< || |< q�i } | D ]>\}}} || v �r�|| | u �r�|�d|| � d| || f< �q�|�d� d} | D ]P\}}} || v �r || | u�r || f| v�r |� d|| � d} d| || f< �q | �rb|� d� i } | D ]*}!|!j D ] }"|"| j j v �rtd | |"< �qt�qj| D ]D}#| �| |#�}| j�t |�d�} | dk�r�| | |#< |�d|#| � �q�| ||< | ||< | ||< |d7 }qXd S )NzParsing method: %sr r r� zstate %dz (%d) %srs r� rm zreduce using rule %d (%s)r� r� z3 ! shift/reduce conflict for %s resolved as reduce�reducer� z2 ! shift/reduce conflict for %s resolved as shift�shiftz= ! reduce/reduce conflict for %s resolved using rule %d (%s)z Unknown conflict in state %dr� zshift and go to state %dz Shift/shift conflict in state %dr� z %-15s %sz ! %-15s [ %s ]z" %-30s shift and go to state %d) r7 r� r� ri rg r8 r r rJ r^ r� r" r� r r� r� rp r� r� r= r� r� r> r5 r� r� rG r: r% r r� r� )$r r� r� rj rh r8 ZactionprH �strB ZactlistZ st_actionZ st_actionpZst_gotor� Zlaheadsr3 r& ZsprecZslevelZrprecZrlevelZoldp�ppZchosenpZrejectprQ rE rR Z _actprintr� Znot_usedZnkeysrI rD rM r r r r? � s � z LRGeneratedTable.lr_parse_tabler� c C s� t |tj�rtd��|�d�d }tj�||�d }�z8t|d�}|� dtj� |�t | j |f � d}|�r`i }| j �� D ]T\} } | �� D ]B\} } |�| �} | s�g g f} | || < | d �| � | d �| � q�qz|� d � |�� D ]f\}} |� d | � | d D ]} |� d | � �q |� d � | d D ]} |� d | � �q(|� d � q�|� d� |� d� nF|� d� | j �� D ]&\}} |� d|d |d | f � �qt|� d� |�r�i }| j�� D ]Z\} } | �� D ]F\} } |�| �} | �s�g g f} | || < | d �| � | d �| � �qʐq�|� d� |�� D ]h\}} |� d | � | d D ]} |� d | � �qF|� d � | d D ]} |� d | � �qn|� d � �q(|� d� |� d� nF|� d� | j�� D ]&\}} |� d|d |d | f � �q�|� d� |� d� | jD ]Z}|j�r:|� d|j|j|j|jtj� |j�|jf � n |� dt|�|j|jf � �q�|� d� |�� W n( t�y� } z� W Y d }~n d }~0 0 d S )Nz"Won't overwrite existing tabmoduler� r� z.py�wz� # %s # This file is automatically generated. Do not edit. # pylint: disable=W,C,R _tabversion = %r _lr_method = %r _lr_signature = %r rs r z _lr_action_items = {z%r:([z%r,z],[z]),z} z� _lr_action = {} for _k, _v in _lr_action_items.items(): for _x,_y in zip(_v[0],_v[1]): if not _x in _lr_action: _lr_action[_x] = {} _lr_action[_x][_k] = _y del _lr_action_items z _lr_action = { z (%r,%r):%r,z _lr_goto_items = {z� _lr_goto = {} for _k, _v in _lr_goto_items.items(): for _x, _y in zip(_v[0], _v[1]): if not _x in _lr_goto: _lr_goto[_x] = {} _lr_goto[_x][_k] = _y del _lr_goto_items z _lr_goto = { z_lr_productions = [ z (%r,%r,%d,%r,%r,%d), z (%r,%r,%d,None,None,None), z] )rK r r �IOError�splitr r r� r r �basenamer r rg ru r� rp ri re r� r> r r" r� r� r" )r � tabmodule� outputdirr$ Zbasemodulenamer# r Zsmallerru rD Zndr rO rQ r r� �er r r � write_table� s� � � z LRGeneratedTable.write_tablec C s z dd l }W n ty& dd l}Y n0 t|d���}|�t|t� |�| j|t� |�||t� |�| j|t� |�| j |t� g }| j D ]T}|j r�|� |j |j|j|j tj�|j�|jf� q�|� t |�|j|jd d d f� q�|�||t� W d � n1 �s0 Y d S )Nr �wb)r r r r �dumpr �pickle_protocolr rg ri re r� rp r> r r" r r rf r� r� )r r# r$ r ZoutfZoutpr� r r r � pickle_table" s , z LRGeneratedTable.pickle_table)r N)r� r� )r� )r r r r rD rG rJ rL rN rP rR rS rY r\ r] r^ r? rj rn r r r r r6 5 s" %#8 +P B {r6 c C s0 t �| �}|j�� }|j|jkr,|�|j� |S r )r} � _getframe� f_globals�copy�f_locals�update)Zlevelsr Zldictr r r �get_caller_module_dictE s rt c C s� g }| � � }d }|}|D ]�}|d7 }|�� }|s2qz�|d dkrf|sTtd||f ��|} |dd � } n@|d } | }|dd � } |d } | dkr�| dkr�td||f ��|�||| | f� W q ty� � Y q ty� td |||�� f ��Y q0 q|S ) Nrs r �|z%s:%d: Misplaced '|'� �:z::=z!%s:%d: Syntax error. Expected ':'z %s:%d: Syntax error in rule %r)� splitlinesre rb rp � Exception�strip) �docr� r� r7 ZpstringsZlastpZdlineZpsr� r� r� Zassignr r r � parse_grammarQ s6 r| c @ s� e Zd Zd dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zd d � Zd d � ZdS )!� ParserReflectNc C sL || _ d | _d | _d | _t� | _g | _d| _|d u rBtt j �| _ n|| _ d S )NF) r� r� � error_func�tokensr� r r7 r r r} r~ r8 )r r� r8 r r r r { s zParserReflect.__init__c C s, | � � | �� | �� | �� | �� d S r )� get_start�get_error_func� get_tokens�get_precedence�get_pfunctionsr; r r r �get_all� s zParserReflect.get_allc C s6 | � � | �� | �� | �� | �� | �� | jS r )�validate_start�validate_error_func�validate_tokens�validate_precedence�validate_pfunctions�validate_modulesr r; r r r � validate_all� s zParserReflect.validate_allc C s� g }zr| j r|�| j � | jr:|�d�dd� | jD ��� | jrR|�d�| j�� | jD ]}|d rX|�|d � qXW n ttfy� Y n0 d�|�S )Nr� c S s g | ]}d � |��qS )r� )r� )rH r� r r r rI � rJ z+ParserReflect.signature.<locals>.<listcomp>r� r )r� rp r� r� r �pfuncs� TypeError� ValueError)r �partsr r r r r$ � s zParserReflect.signaturec C s� t �d�}| jD ]�}zt�|�\}}W n ty< Y qY n0 i }t|�D ]^\}}|d7 }|�|�}|rJ|�d�}|� |�} | s�|||< qJt� |�} | j � d| ||| � qJqd S )Nz \s*def\s+(p_[a-zA-Z_0-9]*)\(rs z;%s:%d: Function %s redefined. Previously defined on line %d) �re�compiler �inspectZgetsourcelinesrd r� r� �groupr� � getsourcefiler8 r ) r Zfrer �linesZlinenZ counthashr� r� r �prevr# r r r r� � s& �z ParserReflect.validate_modulesc C s | j �d�| _d S )Nr� )r� r� r� r; r r r r� � s zParserReflect.get_startc C s& | j d ur"t| j t�s"| j�d� d S )Nz'start' must be a string)r� rK � string_typesr8 r r; r r r r� � s z ParserReflect.validate_startc C s | j �d�| _d S )N�p_error)r� r� r~ r; r r r r� � s z ParserReflect.get_error_funcc C s� | j r�t| j tj�rd}n*t| j tj�r.d}n| j�d� d| _d S | j jj}| j jj }t � | j �}| j � |� | j jj| }|dkr�| j�d||� d| _d S )Nr rs z2'p_error' defined, but is not a function or methodTz$%s:%d: p_error() requires 1 argument)r~ rK r � FunctionType� MethodTyper8 r �__code__�co_firstlineno� co_filenamer� � getmoduler r� � co_argcount)r ZismethodZelineZefiler Zargcountr r r r� � s z!ParserReflect.validate_error_funcc C sr | j �d�}|s&| j�d� d| _d S t|ttf�sJ| j�d� d| _d S |sd| j�d� d| _d S t|�| _d S )Nr zNo token list is definedTz tokens must be a list or tupleztokens is empty) r� r� r8 r rK rv r� �sortedr )r r r r r r� � s zParserReflect.get_tokensc C sV d| j v r | j�d� d| _d S t� }| j D ]$}||v rF| j�d|� |�|� q,d S )Nr z.Illegal token name 'error'. Is a reserved wordTzToken %r multiply defined)r r8 r r� r r� )r r� rM r r r r� s z ParserReflect.validate_tokensc C s | j �d�| _d S )Nr� )r� r� r� r; r r r r� s z ParserReflect.get_precedencec C s g }| j �rt| j ttf�s2| j�d� d| _d S t| j �D ]�\}}t|ttf�sj| j�d� d| _ d S t|�dk r�| j�d|� d| _ d S |d }t|t�s�| j�d� d| _ d S |dd � D ]<}t|t�s�| j�d � d| _ d S |� |||d f� q�q<|| _ d S ) Nz"precedence must be a list or tupleTzBad precedence tablerv z?Malformed precedence entry %s. Must be (assoc, term, ..., term)r z)precedence associativity must be a stringrs z precedence items must be strings) r� rK rv r� r8 r r� r" r� rp �preclist)r r� r� r� r� r� r r r r� s6 z!ParserReflect.validate_precedencec C s� g }| j �� D ]\\}}|�d�r|dkr*qt|tjtjf�rt|d|jj �}t � |�}|� ||||j f� q|jdd� d� || _d S )N�p_r� r� c S s | d t | d �| d | d fS )Nr rs rv r r= )Z p_functionr r r rV F s �z.ParserReflect.get_pfunctions.<locals>.<lambda>)�key)r� ru � startswithrK r r� r� rW r� r� r� r� rp �__doc__�sortr� )r Z p_functionsr �itemr� r r r r r� 9 s z ParserReflect.get_pfunctionsc C sN g }t | j�dkr(| j�d� d| _d S | jD �]\}}}}t�|�}| j| }t|tj �rbd}nd}|j j |kr�| j�d|||j � d| _q.|j j |k r�| j�d|||j � d| _q.|j s�| j�d|||j � q.z(t|||�} | D ]} |�|| f� q�W n< t�y6 } z"| j�t| �� d| _W Y d } ~ n d } ~ 0 0 | j�|� q.| j�� D ]�\} } | �d ��r|t| tjtj f��r|�qP| �d ��r��qP| �d ��r�| d k�r�| j�d | � t| tj��r�| j j dk�s�t| tj ��rP| jj j dk�rP| j �rPz8| j �d �}|d dk�r(| j�d| j j| j j| � W n t �y> Y n0 �qP|| _ d S )Nr z+no rules of the form p_rulename are definedTrv rs z%%s:%d: Rule %r has too many argumentsz#%s:%d: Rule %r requires an argumentzA%s:%d: No documentation string specified in function %r (ignored)r� Zt_r� z %r not defined as a functionr� rw z9%s:%d: Possible grammar rule %r defined without p_ prefix) r" r� r8 r r� r� r� rK r r� r� r� r r� r r| rp rb r> r r� ru r� r� �__func__re r� r� r� r7 )r r7 r� r r r{ r� r� ZreqargsZparsed_grE ri rM rO r r r r� N sf � � � � z!ParserReflect.validate_pfunctions)N)r r r r r� r� r$ r� r� r� r� r� r� r� r� r� r� r� r r r r r} z s r} c < s� |d u r t }| rd}| d u r&ttj�} � r�� fdd�t� �D �} t| �}d|vrdtj|d j|d< d|vr�d|v r�ttj|d d�r�tj|d j |d< nt d�}| d u �r t |t j �r�|j}nLd|vr�|d }n:|�d�}d�|d d � �}td | � ttj| dd �}tj�|�} |�d�}|�rNt |t��rNd|v�rN|d | }|d u�r`||d < t|| d �}|�� |j�r�td��|�� }z�t � }| �r�|� | �}n |� |�}|�s�||k�rz&|� |j � t!||j"�}|j#a#|W W S t$�y } z| �%d|� W Y d }~n d }~0 0 W nF t&�yP } z| �%t|�� W Y d }~n d }~0 t'�yb Y n0 | d u �r�|�r�z tt(tj�| |�d��} W n> t)�y� } z$| �%d||f � t*� } W Y d }~n d }~0 0 nt*� } | �+dt,� d}|�-� �r�td��|j"�s | �%d� t.|j/�}|j0D ]R\}} } z|�1|| | � W n2 t2�yj } z| �%d|� W Y d }~n d }~0 0 �q |j3D ]d\} } | \} }!}"}#z|�4|"|#| | |!� W n6 t2�y� } z | �d|� d}W Y d }~n d }~0 0 �qvz&|d u �r�|�5|j6� n |�5|� W n8 t2�y: } z | �t|�� d}W Y d }~n d }~0 0 |�rJtd��|�7� }$|$D ]"\}%}&| �d|&j8|&j9|%� d}�qV|�:� }'|'�r�| �+d � | �+d� | �+d � |'D ] }| �%d|� | �+d|� �q�|�r| �+d � | �+d� | �+d � t;|j<�D ]\}(})| �+d |(|)� �q�|�=� }*|*D ] }&| �%d |&j8|&j9|&j>� �q t?|'�d k�rT| �%d � t?|'�d k�rr| �%d t?|'�� t?|*�d k�r�| �%d!� t?|*�d k�r�| �%d"t?|*�� |�rx| �+d � | �+d#� | �+d � t@|jA�}+|+�B� |+D ]*}| �+d$|d%�d&d� |jA| D ��� �q�| �+d � | �+d'� | �+d � t@|jC�},|,�B� |,D ]*}-| �+d$|-d%�d(d� |jC|- D ��� �qB| �+d � |�r�|�D� }.|.D ]}/| �%d)|/� �q�|�E� }0|0D ]}1| �d*|1� d}�q�|�F� }2|2D ] \}} | �d+| |� d}�q�|�r�td��|�r | �Gd,| � tH|| | �}|�r�t?|jI�}3|3d k�r>| �%d-� n|3d k�rT| �%d.|3� t?|jJ�}4|4d k�rt| �%d/� n|4d k�r�| �%d0|4� |�r�|jI�s�|jJ�r�| �%d � | �%d1� | �%d � |jID ] \}5}6}7| �%d2|6|5|7� �q�tK� }8|jJD ]x\}5}9}:|5tL|9�tL|:�f|8v �r�q�| �%d3|5|9� | �%d4|:|5� | �%d3|5|9� | �%d4|:|5� |8�M|5tL|9�tL|:�f� �q�g };|jJD ]@\}5}9}:|:jN�sr|:|;v�rr| �%d5|:� | �%d5|:� |;�O|:� �qr|� rz&|�P|| |� |tjv �r�tj|= W n8 t)� y } z | �%d6||f � W Y d }~n d }~0 0 | � rjz|�Q| |� W n8 t)� yh } z | �%d6| |f � W Y d }~n d }~0 0 |� |j � t!||j"�}|j#a#|S )7Nr c s g | ]}|t � |�f�qS r )rW )rH r �r r r rI � rJ zyacc.<locals>.<listcomp>�__file__r � __package__rv r� r� r r� r� )r8 zUnable to build parserz.There was a problem loading the table file: %rrc zCouldn't open %r. %sz5Created by PLY version %s (http://www.dabeaz.com/ply)Fz no p_error() function is definedz%sTz;%s:%d: Symbol %r used, but not defined as a token or a rulezUnused terminals:z Token %r defined, but not usedz %sr� z Rule %-5d %sz$%s:%d: Rule %r defined, but not usedrs zThere is 1 unused tokenzThere are %d unused tokenszThere is 1 unused rulezThere are %d unused rulesz'Terminals, with rules where they appearz %-20s : %sr� c S s g | ] }t |��qS r r= rG r r r rI M rJ z*Nonterminals, with rules where they appearc S s g | ] }t |��qS r r= rG r r r rI U rJ zSymbol %r is unreachablez)Infinite recursion detected for symbol %rz0Precedence rule %r defined for unknown symbol %rzGenerating %s tablesz1 shift/reduce conflictz%d shift/reduce conflictsz1 reduce/reduce conflictz%d reduce/reduce conflictsz Conflicts:z7shift/reduce conflict for %s in state %d resolved as %sz;reduce/reduce conflict in state %d resolved using rule (%s)z rejected rule (%s) in state %dzRule (%s) is never reducedzCouldn't create %r. %s)R� tab_moduler r} r~ �dir�dictr r� r� r� rt rK r r re r� r rW r r �dirnamer� r> r} r� r r r$ r r% r r& r� rc r~ r� ry r r r r rd r r � __version__r� r� r r� r� r� r7 r� r� r� r� r� r� r� r� r� r r r" rv r� r� r� r� r� r r r6 r= r> r� r% r� r� rp rj rn )<r@ r r rg r� Zcheck_recursion�optimizeZ write_tablesZ debugfilerh ZdebuglogZerrorlogZ picklefileZ_itemsr� Zsrcfiler� Zpkgname�pkgZpinfor$ ZlrZread_signaturer7 ri �errorsr7 r� r� r� �funcnameZgramr� r� r� r� r� rq r� r� rM r� r rO ZnontermsZnontermZ unreachable�ur� �infZ unused_precZnum_srZnum_rrrx r� Z resolutionZalready_reportedZruleZrejectedZ warned_neverr r� r �yacc� s� &" & ( ( (( r� );r� r r} Zos.pathr r� r, r� r Z yaccdebugZ debug_filer� Z default_lrr� r{ r# rm � version_infoZ basestringr� r> �maxsizer/ �objectr r ry r r) r+ r/ r3 r1 r. r0 r2 r4 r8 r9 r@ rc r� r� r� r� r� r� r� r� r r r- r' r5 r6 rt r| r} r� r r r r �<module>> s� 7 m H. rT ) � __pycache__/audit.cpython-39.opt-1.pyc 0000644 00000041554 15025012421 0013453 0 ustar 00 a z f�U � @ s� d dl Z d dlZddlmZ ddlmZ ddlmZ dd� Zdd � Zd d � ZG d d � d �Z G dd� de �Z G dd� de �Z d dl m Z i ZG dd� de �ZG dd� de �ZG dd� de �ZG dd� de �ZG dd� d�ZG d d � d �ZG d d � d �ZdS ) � N� )� refpolicy)�access)�utilc C s� ddl } ddl}tdd�}t|�� �� d �}|j |�|�� | �}|�d|�}|�d|�}| j ddd d ||g| j d �� � d }t j r�t �|�}|S ) � Obtain all of the avc and policy load messages from the audit log. This function uses ausearch and requires that the current process have sufficient rights to run ausearch. Returns: string contain all of the audit messages returned by ausearch. r Nz /proc/uptime�rz%xz%X�/sbin/ausearch�-m�5AVC,USER_AVC,MAC_POLICY_LOAD,DAEMON_START,SELINUX_ERRz-ts��stdout)� subprocess�time�open�float�read�split�close� localtime�strftime�Popen�PIPE� communicater �PY3� decode_input)r r �fdZoff�sZbootdateZboottime�output� r �2/usr/lib/python3.9/site-packages/sepolgen/audit.py�get_audit_boot_msgs s �� r c C s8 ddl } | jg d�| jd��� d }tjr4t�|�}|S )r r N)r r r r �r r r r r r r �r r r r r �get_audit_msgs2 s �� r# c C s6 ddl } | jdg| jd��� d }tjr2t�|�}|S )z�Obtain all of the avc and policy load messages from /bin/dmesg. Returns: string contain all of the audit messages returned by dmesg. r Nz /bin/dmesgr r! r" r r r �get_dmesg_msgsA s �� r$ c @ s e Zd ZdZdd� Zdd� ZdS )� AuditMessagez�Base class for all objects representing audit messages. AuditMessage is a base class for all audit messages and only provides storage for the raw message (as a string) and a parsing function that does nothing. c C s || _ d| _d S �N� )�message�header��selfr( r r r �__init__W s zAuditMessage.__init__c C s^ |D ]T}|� d�}t|�dkr<|dd� dkr|| _ dS q|d dkr|d | _ dS qdS ) z�Parse a string that has been split into records by space into an audit message. This method should be overridden by subclasses. Error reporting should be done by raise ValueError exceptions. �=� N� zaudit(r �msgr )r �lenr) �r+ �recsr0 �fieldsr r r �from_split_string[ s z AuditMessage.from_split_stringN��__name__� __module__� __qualname__�__doc__r, r5 r r r r r% P s r% c @ s e Zd ZdZdd� ZdS )�InvalidMessagez�Class representing invalid audit messages. This is used to differentiate between audit messages that aren't recognized (that should return None from the audit message parser) and a message that is recognized but is malformed in some way. c C s t �| |� d S �N�r% r, r* r r r r, v s zInvalidMessage.__init__N�r7 r8 r9 r: r, r r r r r; p s r; c @ s e Zd ZdZdd� Zdd� ZdS )� PathMessagez!Class representing a path messagec C s t �| |� d| _d S r& )r% r, �pathr* r r r r, { s zPathMessage.__init__c C sV t �| |� |D ]@}|�d�}t|�dkr,q|d dkr|d dd� | _ d S qd S )Nr- r. r r@ r ���)r% r5 r r1 r@ r2 r r r r5 s z PathMessage.from_split_stringNr6 r r r r r? y s r? c @ s0 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd S ) � AVCMessagea� AVC message representing an access denial or granted message. This is a very basic class and does not represent all possible fields in an avc message. Currently the fields are: scontext - context for the source (process) that generated the message tcontext - context for the target tclass - object class for the target (only one) comm - the process name exe - the on-disc binary path - the path of the target access - list of accesses that were allowed or denied denial - boolean indicating whether this was a denial (True) or granted (False) message. ioctlcmd - ioctl 'request' parameter An example audit message generated from the audit daemon looks like (line breaks added): 'type=AVC msg=audit(1155568085.407:10877): avc: denied { search } for pid=677 comm="python" name="modules" dev=dm-0 ino=13716388 scontext=user_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=dir' An example audit message stored in syslog (not processed by the audit daemon - line breaks added): 'Sep 12 08:26:43 dhcp83-5 kernel: audit(1158064002.046:4): avc: denied { read } for pid=2 496 comm="bluez-pin" name=".gdm1K3IFT" dev=dm-0 ino=3601333 scontext=user_u:system_r:bluetooth_helper_t:s0-s0:c0 tcontext=system_u:object_r:xdm_tmp_t:s0 tclass=file c C s\ t �| |� t�� | _t�� | _d| _d| _d| _d| _ d| _ g | _ d| _ d | _ tj| _d S )Nr' T)r% r, r �SecurityContext�scontext�tcontext�tclass�comm�exer@ �name�accesses�denial�ioctlcmd� audit2why�TERULE�typer* r r r r, � s zAVCMessage.__init__c C sx d}|}|t |�d kr&td| j ��|t |�k r^|| dkrDd}q^| j�|| � |d }q&|sptd| j ��|d S )NFr �#AVC message in invalid format [%s] �}T)r1 � ValueErrorr( rJ �append)r+ r3 �startZ found_close�ir r r Z__parse_access� s zAVCMessage.__parse_accessc C s� t �| |� d}d}d}d}tt|��D �]R}|| dkrR| �||d �}d}q(n|| dkrdd| _|| �d�}t|�dkr�q(|d d kr�t�|d �| _ d}q(|d d kr�t�|d �| _ d}q(|d d kr�|d | _ d}q(|d d k�r|d dd � | _ q(|d dk�r$|d dd � | _ q(|d dk�rF|d dd � | _q(|d dkr(zt|d d�| _W q( t�yz Y q(0 q(|�r�|�r�|�r�|�s�td| j ��| �� d S )NF�{r TZgrantedr- r. r rD rE rF rG rA rH rI rL � rP )r% r5 �ranger1 �_AVCMessage__parse_accessrK r r rC rD rE rF rG rH rI �intrL rR r( �analyze)r+ r3 Z found_srcZ found_tgtZ found_classZ found_accessrU r4 r r r r5 � sL z AVCMessage.from_split_stringc C s� | j �� }| j�� }t| j�}g | _||| j|ft�� v rXt||| j|f \| _ | _�n�t � ||| j| j�\| _ | _| j t j kr�t j | _ | j t jkr�td| ��| j t jkr�td| ��| j t jkr�td| j ��| j t jkr�tdd�| j� ��| j t jk�rtd��| j t jk�r�| jg| _| jj| j jk�rR| j�d| jj d| j j f� | jj| j jk�r�| j jdk�r�| j�d | jj d | j j f� | jj| j jk�r�| j�d | jj d | j j f� | j | jft||| j|f< d S ) NzInvalid Target Context %s zInvalid Source Context %s zInvalid Type Class %s zInvalid permission %s � z&Error during access vector computationz user (%s)Zobject_rz role (%s)z level (%s))rE Z to_stringrD �tuplerJ �datarF �avcdict�keysrO rM r[ ZNOPOLICYrN ZBADTCONrR ZBADSCONZBADPERM�joinZ BADCOMPUTEZ CONSTRAINT�userrS �role�level)r+ rE rD Z access_tupler r r r[ � s8 zAVCMessage.analyzeN)r7 r8 r9 r: r, rY r5 r[ r r r r rB � s -rB c @ s e Zd ZdZdd� ZdS )�PolicyLoadMessagez6Audit message indicating that the policy was reloaded.c C s t �| |� d S r< r= r* r r r r, s zPolicyLoadMessage.__init__Nr> r r r r re s re c @ s e Zd ZdZdd� Zdd� ZdS )�DaemonStartMessagez3Audit message indicating that a daemon was started.c C s t �| |� d| _d S �NF)r% r, �auditdr* r r r r, % s zDaemonStartMessage.__init__c C s t �| |� d|v rd| _d S )Nrh T)r% r5 rh �r+ r3 r r r r5 ) s z$DaemonStartMessage.from_split_stringNr6 r r r r rf # s rf c @ s( e Zd ZdZdd� Zdd� Zdd� ZdS ) �ComputeSidMessagea� Audit message indicating that a sid was not valid. Compute sid messages are generated on attempting to create a security context that is not valid. Security contexts are invalid if the role is not authorized for the user or the type is not authorized for the role. This class does not store all of the fields from the compute sid message - just the type and role. c C s4 t �| |� t�� | _t�� | _t�� | _d| _d S r& )r% r, r rC �invalid_contextrD rE rF r* r r r r, 9 s zComputeSidMessage.__init__c C s� t �| |� t|�dk r td��z\t�|d �| _t�|d �d�d �| _t�|d �d�d �| _ |d �d�d | _ W n td��Y n0 d S ) N� z;Split string does not represent a valid compute sid message� � r- r � � ) r% r5 r1 rR r rC rk r rD rE rF ri r r r r5 @ s z#ComputeSidMessage.from_split_stringc C s d| j | jf S )Nzrole %s types %s; )rc rO �r+ r r r r L s zComputeSidMessage.outputN)r7 r8 r9 r: r, r5 r r r r r rj / s rj c @ s^ e Zd ZdZddd�Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z ddd�Z ddd�Z dS )� AuditParsera� Parser for audit messages. This class parses audit messages and stores them according to their message type. This is not a general purpose audit message parser - it only extracts selinux related messages. Each audit messages are stored in one of four lists: avc_msgs - avc denial or granted messages. Messages are stored in AVCMessage objects. comput_sid_messages - invalid sid messages. Messages are stored in ComputSidMessage objects. invalid_msgs - selinux related messages that are not valid. Messages are stored in InvalidMessageObjects. policy_load_messages - policy load messages. Messages are stored in PolicyLoadMessage objects. These lists will be reset when a policy load message is seen if AuditParser.last_load_only is set to true. It is assumed that messages are fed to the parser in chronological order - time stamps are not parsed. Fc C s | � � || _d S r< )�_AuditParser__initialize�last_load_only)r+ rt r r r r, g s zAuditParser.__init__c C s. g | _ g | _g | _g | _g | _i | _d| _d S rg )�avc_msgs�compute_sid_msgs� invalid_msgs�policy_load_msgs� path_msgs� by_header�check_input_filerq r r r Z __initializek s zAuditParser.__initializec C s� dd� |� � D �}|D ]�}d}|dks6|dks6|dkrDt|�}d}n^|dkrZt|�}d}nH|d ksj|d krxt|�}d}n*|d kr�t|�}d}n|d kr�tt�}d}|rd| _z|�|� W n t y� t |�}Y n0 | S qd S ) Nc S s g | ]}|� d ��qS )u )�strip)�.0�xr r r � <listcomp>� � z,AuditParser.__parse_line.<locals>.<listcomp>Fzavc:z message=avc:z msg='avc:Tzsecurity_compute_sid:ztype=MAC_POLICY_LOADz type=1403z type=AVC_PATHztype=DAEMON_START) r rB rj re r? rf �listr{ r5 rR r; )r+ �lineZrecrU �foundr0 r r r Z __parse_line� s4 zAuditParser.__parse_linec C s� | � |�}|d u rd S t|t�r0| jr�| �� n�t|t�r\|jrN| jrN| �� | j�|� n^t|t �rt| j �|� nFt|t �r�| j �|� n.t|t �r�| j�|� nt|t�r�| j�|� |jdkr�|j| jv r�| j|j �|� n|g| j|j< d S r& )�_AuditParser__parse_line� isinstancere rt rs rf rh rx rS rB ru rj rv r; rw r? ry r) rz )r+ r� r0 r r r Z__parse� s, zAuditParser.__parsec C sl | j �� D ]\}g }d }|D ](}t|t�r.|}qt|t�r|�|� qt|�dkr |r |D ] }|j|_qXq d S )Nr )rz �valuesr� r? rB rS r1 r@ )r+ �value�avcr@ r0 �ar r r Z__post_process� s zAuditParser.__post_processc C sH |� � }|r | �|� |� � }q| js<tj�d� t�d� | �� dS )zpParse the contents of a file object. This method can be called multiple times (along with parse_string).zNothing to do r N)�readline�_AuditParser__parser{ �sys�stderr�write�exit�_AuditParser__post_process)r+ �inputr� r r r � parse_file� s zAuditParser.parse_filec C s* |� d�}|D ]}| �|� q| �� dS )z�Parse a string containing audit messages - messages should be separated by new lines. This method can be called multiple times (along with parse_file).� N)r r� r� )r+ r� �lines�lr r r � parse_string� s zAuditParser.parse_stringNc C s: t �� }| jD ]&}|r |�|�r|�|jj|jj� q|S )ao Return RoleAllowSet statements matching the specified filter Filter out types that match the filer, or all roles Params: role_filter - [optional] Filter object used to filter the output. Returns: Access vector set representing the denied access in the audit logs parsed by this object. )r Z RoleTypeSetrv �filter�addrk rc rO )r+ Z role_filterZ role_types�csr r r �to_role� s zAuditParser.to_roleTc C s� t �� }| jD ]�}|jdkr"|r"q|r0|�|�rt �|jj|jj|j g|j �}|j |_ |j|_|j r�t �� }|�|j � ||jd< |j||d� q|S )a� Convert the audit logs access into a an access vector set. Convert the audit logs into an access vector set, optionally filtering the restults with the passed in filter object. Filter objects are object instances with a .filter method that takes and access vector and returns True if the message should be included in the final output and False otherwise. Params: avc_filter - [optional] Filter object used to filter the output. Returns: Access vector set representing the denied access in the audit logs parsed by this object. TZioctl)Z audit_msg)r ZAccessVectorSetru rK r� Z AccessVectorrD rO rE rF rJ r^ rL r ZXpermSetr� ZxpermsZadd_av)r+ Z avc_filterZ only_denialsZav_setr� �avZ xperm_setr r r � to_access� s$ �� zAuditParser.to_access)F)N)NT) r7 r8 r9 r: r, rs r� r� r� r� r� r� r� r r r r rr Q s $% rr c @ s e Zd Zdd� Zdd� ZdS )� AVCTypeFilterc C s t �|�| _d S r< ��re�compile�regex�r+ r� r r r r, % s zAVCTypeFilter.__init__c C s, | j �|jj�rdS | j �|jj�r(dS dS �NTF)r� �matchrD rO rE �r+ r� r r r r� ( s zAVCTypeFilter.filterN�r7 r8 r9 r, r� r r r r r� $ s r� c @ s e Zd Zdd� Zdd� ZdS )�ComputeSidTypeFilterc C s t �|�| _d S r< r� r� r r r r, 0 s z ComputeSidTypeFilter.__init__c C s@ | j �|jj�rdS | j �|jj�r(dS | j �|jj�r<dS dS r� )r� r� rk rO rD rE r� r r r r� 3 s zComputeSidTypeFilter.filterNr� r r r r r� / s r� )r� r� r' r r r r r# r$ r% r; r? Zselinux.audit2whyrM r_ rB re rf rj rr r� r� r r r r �<module> s* " T __pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000000220 15025012421 0014065 0 ustar 00 a z f � @ s d S )N� r r r �5/usr/lib/python3.9/site-packages/sepolgen/__init__.py�<module> � __pycache__/objectmodel.cpython-39.pyc 0000644 00000007603 15025012421 0013672 0 ustar 00 a z fw � @ sb d Z g d�ZdZdZdZeeB Zeeeed�Zedededed iZG d d � d �ZG d d � d �Z dS )z� This module provides knowledge object classes and permissions. It should be used to keep this knowledge from leaking into the more generic parts of the policy generation. ) Zsocket�fdZprocess�fileZlnk_fileZ fifo_fileZdbusZ capabilityZunix_stream_socket� � � )�n�r�w�br r r r c @ s e Zd ZdZdd� Zdd� ZdS )�PermMapa A mapping between a permission and its information flow properties. PermMap represents the information flow properties of a single permission including the direction (read, write, etc.) and an abstract representation of the bandwidth of the flow (weight). c C s || _ || _|| _d S �N)�perm�dir�weight)�selfr r r � r �8/usr/lib/python3.9/site-packages/sepolgen/objectmodel.py�__init__T s zPermMap.__init__c C s d| j t| j | jf S )Nz'<sepolgen.objectmodel.PermMap %s %s %d>)r � dir_to_strr r �r r r r �__repr__Y s �zPermMap.__repr__N)�__name__� __module__� __qualname__�__doc__r r r r r r r M s r c @ s@ e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dS )� PermMappingsz�The information flow properties of a set of object classes and permissions. PermMappings maps one or more classes and permissions to their PermMap objects describing their information flow characteristics. c C s i | _ d| _t| _d S )N� )�classes�default_weight� FLOW_BOTH� default_dirr r r r r d s zPermMappings.__init__c C s� d}|D ]�}|� � }t|�dkst|�dks|d dkr:q|d dkrv|d }|| jv r`td��i | j|< | j| }qt|�dkr�td��|du r�td ��t|d t|d t|d ��}|||j< qdS ) zsRead the permission mappings from a file. This reads the format used by Apol in the setools suite. Nr r �#�classzduplicate class in perm map� z!error in object class permissionszpermission outside of classr )�split�lenr � ValueErrorr � str_to_dir�intr )r r Zcur�line�fields�c�pmr r r � from_filei s" $ zPermMappings.from_filec C s | j | | S )z�Get the permission map for the object permission. Returns: PermMap representing the permission Raises: KeyError if the object or permission is not defined )r )r �objr r r r �get� s zPermMappings.getc C s: z| j | | }W n" ty4 t|| j| j� Y S 0 |S )a Get the permission map for the object permission or a default. getdefault is the same as get except that a default PermMap is returned if the object class or permission is not defined. The default is FLOW_BOTH with a weight of 5. )r �KeyErrorr r r )r r- r r+ r r r � getdefault� s zPermMappings.getdefaultc C s( t }|D ]}| �||�}||jB }q|S r )� FLOW_NONEr0 r )r r- �permsr r r+ r r r �getdefault_direction� s z!PermMappings.getdefault_directionc C s( d}|D ]}| � ||�}||j7 }q|S )Nr )r0 r )r r- r2 �totalr r+ r r r �getdefault_distance� s z PermMappings.getdefault_distanceN) r r r r r r, r. r0 r3 r5 r r r r r ^ s r N) r Zimplicitly_typed_objectsr1 Z FLOW_READZ FLOW_WRITEr r& r r r r r r r �<module> s __pycache__/lex.cpython-39.opt-1.pyc 0000644 00000051601 15025012421 0013127 0 ustar 00 a z f�� � @ s: d Z dZddlZddlZddlZddlZddlZddlZzejej fZ W n e yb e e fZ Y n0 e�d�ZG dd� de�ZG dd� de�ZG d d � d e�ZG d d � d e�ZG d d� d�Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Z G dd � d e�Z ddd d d e ej �d dddf d d �Z d%d!d"�Z!d#d$� Z"e"Z#dS )&z3.11z3.10� Nz^[a-zA-Z0-9_]+$c @ s e Zd Zdd� ZdS )�LexErrorc C s |f| _ || _d S �N)�args�text)�self�message�s� r �0/usr/lib/python3.9/site-packages/sepolgen/lex.py�__init__: s zLexError.__init__N)�__name__� __module__� __qualname__r r r r r r 9 s r c @ s e Zd Zdd� Zdd� ZdS )�LexTokenc C s d| j | j| j| jf S )NzLexToken(%s,%r,%d,%d))�type�value�lineno�lexpos�r r r r �__str__A s zLexToken.__str__c C s t | �S r )�strr r r r �__repr__D s zLexToken.__repr__N)r r r r r r r r r r @ s r c @ s4 e Zd Zdd� Zdd� Zdd� Zdd� ZeZeZd S ) � PlyLoggerc C s || _ d S r ��f)r r r r r r L s zPlyLogger.__init__c O s | j �|| d � d S )N� �r �write�r �msgr �kwargsr r r �criticalO s zPlyLogger.criticalc O s | j �d|| d � d S )Nz WARNING: r r r r r r �warningR s zPlyLogger.warningc O s | j �d|| d � d S )NzERROR: r r r r r r �errorU s zPlyLogger.errorN) r r r r r! r" r# �info�debugr r r r r K s r c @ s e Zd Zdd� Zdd� ZdS )� NullLoggerc C s | S r r )r �namer r r �__getattribute__^ s zNullLogger.__getattribute__c O s | S r r )r r r r r r �__call__a s zNullLogger.__call__N)r r r r( r) r r r r r& ] s r& c @ s| e Zd Zdd� Zd dd�Zd dd�Zd d � Zd d � Zd d� Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd � ZeZdS ) �Lexerc C s� d | _ d | _i | _i | _i | _d| _g | _d | _i | _i | _ i | _ d| _ d | _ d| _ d| _d | _d | _d | _d| _d| _d | _d| _d| _d S )N�INITIALr � � F)�lexre� lexretext� lexstatere�lexstateretext�lexstaterenames�lexstate� lexstatestack� lexstateinfo�lexstateignore�lexstateerrorf� lexstateeoff� lexreflags�lexdatar �lexlen� lexerrorf�lexeoff� lextokens� lexignore� lexliterals� lexmoduler � lexoptimizer r r r r t s. zLexer.__init__Nc C s� t � | �}|r�i }| j�� D ]t\}}g }|D ]L\}}g } |D ]:} | rL| d sX| �| � q<| �t|| d j�| d f� q<q,|�|| f� |||< q ||_i |_| j�� D ]\}} t|| j�|j|< q�||_|S �Nr r- )�copyr0 �items�append�getattrr r7 rA ) r �object�cZnewtab�keyZritemZnewreZcreZfindexZ newfindexr �efr r r �clone� s( " z Lexer.cloner, c C s� t |tj�rtd��|�d�d }tj�||�d }t|d����}|� d|t f � |� dt t � � |� dt t t| j��� � |� d t t| j�� � |� d t | j� � |� d t | j� � i }| j�� D ]P\}}g } t|| j| | j| �D ]"\\} } } } | �| t| | �f� q�| ||< q�|� d t |� � |� d t | j� � i }| j �� D ] \}}|�rj|j nd ||< �qV|� dt |� � i }| j �� D ] \}}|�r�|j nd ||< �q�|� dt |� � W d � n1 �s�0 Y d S )Nz&Won't overwrite existing lextab module�.���z.py�wzJ# %s.py. This file automatically created by PLY (version %s). Don't edit! z_tabversion = %s z_lextokens = set(%s) z_lexreflags = %s z_lexliterals = %s z_lexstateinfo = %s z_lexstatere = %s z_lexstateignore = %s z_lexstateerrorf = %s z_lexstateeoff = %s ) � isinstance�types� ModuleType�IOError�split�os�path�join�openr � __version__�repr�__tabversion__�tuple�sortedr> �intr9 r@ r5 r0 rE �zipr1 r2 rF �_funcs_to_namesr6 r7 r r8 )r �lextab� outputdirZ basetabmodule�filenameZtfZtabre� statename�lre�titem�pat�funcZretext�renamesZtaberrrK Ztabeofr r r �writetab� s6 & zLexer.writetabc C sB t |tj�r|}ntd| � tj| }t|dd�tkr@td��|j | _ |j | _ |j | _| j t| j�B | _|j| _|j| _i | _i | _|j�� D ]P\}}g }g }|D ]&\}} |�t�||j �t | |�f� q�|| j|< || j|< q�i | _ |j �� D ]\}} || | j |< q�i | _ |j �� D ]\}} || | j |< �q| �!d� d S )N� import %sZ _tabversionz0.0zInconsistent PLY versionr+ )"rP rQ rR �exec�sys�modulesrG r[ � ImportErrorZ _lextokensr> Z _lexreflagsr9 Z _lexliteralsr@ �set� lextokens_allZ _lexstateinfor5 Z_lexstateignorer6 r0 r1 Z _lexstatererE rF �re�compile�_names_to_funcsr7 Z_lexstateerrorfr8 Z _lexstateeoff�begin) r Ztabfile�fdictra rd re rf Ztxtitemrg Z func_namerK r r r �readtab� s8 z Lexer.readtabc C s8 |d d� }t |t�s td��|| _d| _t|�| _d S )Nr- zExpected a stringr )rP � StringTypes� ValueErrorr: r �lenr; )r r rI r r r �input� s z Lexer.inputc C sd || j vrtd��| j | | _| j| | _| j�|d�| _| j�|d �| _ | j �|d �| _ || _ d S )NzUndefined stater, ) r0 ry r. r1 r/ r6 �getr? r7 r< r8 r= r3 �r �stater r r ru s z Lexer.beginc C s | j �| j� | �|� d S r )r4 rF r3 ru r} r r r � push_state s zLexer.push_statec C s | � | j�� � d S r )ru r4 �popr r r r � pop_state s zLexer.pop_statec C s | j S r )r3 r r r r � current_state! s zLexer.current_statec C s | j |7 _ d S r )r )r �nr r r �skip' s z Lexer.skipc C s~ | j }| j}| j}| j}||k �r|| |v r8|d7 }q| jD ]�\}}|�||�}|sXq>t� }|�� |_| j |_ ||_ |j } || \} |_ | s�|j r�|� � | _ | S |� � } q|� � }| |_ || _|| _ | |�} | s�| j }| j} q| j�s(| j | jv�r(td| jj| jj| j| j f ||d � ��| S || | jv �rtt� }|| |_| j |_ |j|_ ||_ |d | _ |S | j�r�t� }| j|d � |_| j |_ d|_ | |_ ||_ || _ | �|�} || j k�r�td|| ||d � ��| j }| �s�q| S || _ td|| |f ||d � ��q| j�r\t� }d|_ d|_| j |_ ||_ | |_ || _ | �|�} | S |d | _ | jd u �rztd��d S ) Nr- z4%s:%d: Rule '%s' returned an unknown token type '%s'r# z&Scanning error. Illegal character '%s'z"Illegal character '%s' at index %d�eofr, z"No input string given with input())r r; r? r: r. �matchr �groupr r � lastindexr �end�lexerZlexmatchrB rq r �__code__� co_filename�co_firstlinenor r@ r< r= � RuntimeError) r r r; r? r: r. � lexindexfunc�m�tok�irh Znewtokr r r �token1 s� � � z Lexer.tokenc C s | S r r r r r r �__iter__� s zLexer.__iter__c C s | � � }|d u rt�|S r )r� � StopIteration)r �tr r r �next� s z Lexer.next)N)r, )r r r r rL rj rw r{ ru r r� r� r� r� r� r� �__next__r r r r r* s s %( nr* c C s t | d| j�S )N�regex)rG �__doc__)rh r r r � _get_regex� s r� c C s0 t �| �}|j�� }|j|jkr,|�|j� |S r )rm � _getframe� f_globalsrD �f_locals�update)Zlevelsr �ldictr r r �get_caller_module_dict� s r� c C sF g }t | |�D ]2\}}|r6|d r6|�||d f� q|�|� q|S rC )r_ rF )Zfunclist�namelist�resultr r' r r r r` � s r` c C sD g }| D ]6}|r4|d r4|� ||d |d f� q|� |� q|S rC )rF )r� rv r� r� r r r rt � s rt c C sd | sg S d� | �}z�t�||�}d gt|j�� �d }|d d � }|j�� D ]z\}} |�|d �} t| �t j t j fv r�| || f|| < ||| < qN| d urN||| < |� d�dkr�d|| < qNd || f|| < qN||fg|g|gfW S t �y^ tt| �d �} | dk�r d} t| d | � |||�\} } }t| | d � |||�\}}}| | | | || f Y S 0 d S )N�|r- �ignore_r )NN� )rW rr rs �max� groupindex�valuesrE r| r rQ � FunctionType� MethodType�find� Exceptionr^ rz �_form_master_re)Zrelist�reflagsr� �toknamesr� r. r� Z lexindexnamesr r� Zhandler� Zllistre ZlnamesZrlistZrreZrnamesr r r r� � s2 r� c C s� | � d�}t|dd � d�D ] \}}||vr |dkr q:q |dkrTt|d|� �}nd}d|v rht|�}d�||d � �}||fS )N�_r- �ANY)r+ )rT � enumerater\ rW )r �names�partsr� �part�statesZ tokennamer r r � _statetoken s r� c @ sf e Zd Zddd�Zdd� Zdd� Zd d � Zd d � Zd d� Zdd� Z dd� Z dd� Z dd� Z dd� Z dS )� LexerReflectNr c C sL || _ d | _g | _|| _ddi| _t� | _d| _|d u rBtt j �n|| _ d S )Nr+ � inclusiveF) r� Z error_func�tokensr� � stateinforp rn r# r rm �stderr�log)r r� r� r� r r r r . s zLexerReflect.__init__c C s$ | � � | �� | �� | �� d S r )� get_tokens� get_literals� get_states� get_rulesr r r r �get_all9 s zLexerReflect.get_allc C s | � � | �� | �� | jS r )�validate_tokens�validate_literals�validate_rulesr# r r r r � validate_all@ s zLexerReflect.validate_allc C sp | j �dd �}|s(| j�d� d| _d S t|ttf�sL| j�d� d| _d S |sf| j�d� d| _d S || _d S )Nr� zNo token list is definedTz tokens must be a list or tupleztokens is empty)r� r| r� r# rP �listr\ r� )r r� r r r r� G s zLexerReflect.get_tokensc C sP i }| j D ]@}t�|�s,| j�d|� d| _||v rB| j�d|� d||< q d S )NzBad token name '%s'TzToken '%s' multiply definedr- )r� �_is_identifierr� r� r# r" )r Z terminalsr� r r r r� [ s z LexerReflect.validate_tokensc C s | j �dd�| _| js d| _d S )N�literalsr, )r� r| r� r r r r r� f s zLexerReflect.get_literalsc C sh z>| j D ]2}t|t�r"t|�dkr| j�dt|�� d| _qW n$ tyb | j�d� d| _Y n0 d S )Nr- z.Invalid literal %s. Must be a single characterTzIInvalid literals specification. literals must be a sequence of characters)r� rP rx rz r� r# rZ � TypeError)r rI r r r r� l s z LexerReflect.validate_literalsc C s� | j �dd �| _| jr�t| jttf�s:| j�d� d| _n�| jD ]�}t|t�rZt|�dkrt| j�dt |�� d| _q@|\}}t|t �s�| j�dt |�� d| _q@|dks�|dks�| j�d |� d| _q@|| j v r�| j�d |� d| _q@|| j |< q@d S ) Nr� z)states must be defined as a tuple or listTr� zMInvalid state specifier %s. Must be a tuple (statename,'exclusive|inclusive')z State name %s must be a stringr� � exclusivez:State type for state %s must be 'inclusive' or 'exclusive'zState '%s' already defined) r� r| r� rP r\ r� r� r# rz rZ rx r� )r r r' Z statetyper r r r� w s0 zLexerReflect.get_statesc C s, dd� | j D �}i | _i | _i | _i | _i | _i | _| jD ]}g | j|< g | j|< q:t|�dkrv| j � d� d| _ d S |D �]d}| j | }t || j�\}}|| j|< t |d��rD|dkr�|D ]}|| j|< q�nt|dkr�|D ]}|| j|< q�nV|d k�r"|j j}|j j}| j � d |||j� d| _ n |D ]}| j| �||f� �q&qzt|t��r�|d k�r�|D ]}|| j|< �q^d |v �r�| j �d |� n@|dk�r�| j � d |� d| _ n |D ]}| j| �||f� �q�qz| j � d|� d| _ qz| j�� D ]}|jdd� d� �q�| j�� D ]}|jdd� dd� �qd S )Nc S s g | ]}|d d� dkr|�qS )Nr� Zt_r )�.0r r r r � <listcomp>� � z*LexerReflect.get_rules.<locals>.<listcomp>r z+No rules of the form t_rulename are definedTr) r# r� �ignorez,%s:%d: Rule '%s' must be defined as a string�\z#%s contains a literal backslash '\'�'Rule '%s' must be defined as a functionz&%s not defined as a function or stringc S s | d j jS �Nr- )r� r� ��xr r r �<lambda>� r� z(LexerReflect.get_rules.<locals>.<lambda>)rJ c S s t | d �S r� )rz r� r r r r� � r� )rJ �reverse)r� r� �funcsym�strsymr� �errorf�eoffr� rz r� r# r� �hasattrr� r� r� r rF rP rx r" r� �sort) r Ztsymbolsr r r� r� �tokname�line�filer r r r� � sb zLexerReflect.get_rulesc C s~ | j D �]X}| j| D �]n\}}|jj}|jj}t�|�}| j�|� | j | }t |t j �rbd}nd}|jj } | |kr�| j�d|||j� d| _q| |k r�| j�d|||j� d| _qt|�s�| j�d|||j� d| _qzDt�d|t|�f | j�} | �d��r | j�d |||j� d| _W q tj�y� } zJ| j�d |||j| � d t|�v �rj| j�d |||j� d| _W Y d } ~ qd } ~ 0 0 q| j| D ]�\} } | j | }|d k�r�| j�d| � d| _�q�|| jv�r�|�d�dk �r�| j�d| |� d| _�q�z:t�d| | f | j�} | �d��r4| j�d| � d| _W nV tj�y� } z:| j�d| | � d | v �rr| j�d| � d| _W Y d } ~ n d } ~ 0 0 �q�| j| �s�| j| �s�| j�d|� d| _| j�|d �}|r|}|jj}|jj}t�|�}| j�|� t |t j ��rd}nd}|jj } | |k�r>| j�d|||j� d| _| |k r| j�d|||j� d| _q| jD ]}| �|� �qhd S )Nr� r- z'%s:%d: Rule '%s' has too many argumentsTz%%s:%d: Rule '%s' requires an argumentz2%s:%d: No regular expression defined for rule '%s'� (?P<%s>%s)r, z<%s:%d: Regular expression for rule '%s' matches empty stringz3%s:%d: Invalid regular expression for rule '%s'. %s�#z6%s:%d. Make sure '#' in rule '%s' is escaped with '\#'r# r� r� r z-Rule '%s' defined for an unspecified token %sz5Regular expression for rule '%s' matches empty stringz,Invalid regular expression for rule '%s'. %sz/Make sure '#' in rule '%s' is escaped with '\#'z No rules defined for state '%s') r� r� r� r� r� �inspectZ getmodulern �addr� rP rQ r� � co_argcountr� r# r r� rr rs r� r� r� r� r� r� r| �validate_module)r r~ �fnamer r� r� �moduler� Zreqargs�nargsrI �er' �rZefuncr r r r� � s� zLexerReflect.validate_rulesc C s� zt �|�\}}W n ty& Y d S 0 t�d�}t�d�}i }|d7 }|D ]n}|�|�}|sh|�|�}|r�|�d�} |�| �} | s�||| < n$t �|�} | j � d| || | � d| _ |d7 }qLd S )Nz \s*def\s+(t_[a-zA-Z_0-9]*)\(z\s*(t_[a-zA-Z_0-9]*)\s*=r- z7%s:%d: Rule %s redefined. Previously defined on line %dT) r� ZgetsourcelinesrS rr rs r� r� r| Z getsourcefiler� r# ) r r� �linesZlinenZfreZsreZ counthashr� r� r' �prevrc r r r r� ? s* z LexerReflect.validate_module)Nr )r r r r r� r� r� r� r� r� r� r� r� r� r r r r r� - s Bgr� Fra c # sv |d u r d}d } ddi} t � } || _| d u r6ttj�} |rL|d u rLttj�}|rT|� � r�� fdd�t� �D �} t| �} d| vr�tj| d j| d< nt d�} | � d �}|r�t |t �r�d |vr�|d | }t | | |d �}|�� |s�|�� r�td ��|�r6|�r6z"| �|| � | ja| ja| a| W S t�y4 Y n0 |�rf|�d |j� |�d|j� |�d|j� t� | _|jD ]}| j� |� �qtt |jt t f��r�t |jd �� � |j�| _!n|j| _!| jt| j!�B | _"|j} i }| D ]�}g }|j#| D ]:\}}|�$d|t%|�f � |�r�|�d|t%|�|� �q�|j&| D ]2\}}|�$d||f � |�r6|�d|||� �q6|||< �q�|�r�|�d� |D ]h}t'|| || |j(�\}}}|| j)|< || j*|< || j+|< |�r�t,|�D ]\}} |�d||| � �qԐq�| �-� D ]`\}} |dk�r�| dk�r�| j)| �.| j)d � | j*| �.| j*d � | j+| �.| j+d � �q�| | _/| j)d | _0| j*d | _1|| _2|j3| _4| j4� dd�| _5|j6| _7|j6� dd �| _8| j8�s�| �9d� |j:| _;|j:� dd �| _<| �-� D ]�\} } | dk�r0| |j6v�r| �9d| � | |j3v�rz| j5�rz| �9d| � nJ| dk�r�| |j6v�rZ|j6� dd �|j6| < | |j3v�r�|j3� dd�|j3| < �q�| ja| ja| a|�rr|�rr|d u �rt |t=j>��r�|j} nNd |v�r�| d } n:|�?d �} d � | d d� �}!t@d|! � tAtj|! dd�} tBjC�D| �}z$| �E||� |tjv �r6tj|= W n8 tF�yp }" z | �9d ||"f � W Y d }"~"n d }"~"0 0 | S ) Nra r+ r� c s g | ]}|t � |�f�qS r )rG )r� �k�r� r r r� y r� zlex.<locals>.<listcomp>�__file__r r� � __package__rM )r� r� zCan't build lexerzlex: tokens = %rzlex: literals = %rzlex: states = %rr r� z(lex: Adding rule %s -> '%s' (state '%s')z#lex: ==== MASTER REGEXS FOLLOW ====z"lex: state '%s' : regex[%d] = '%s'r, zNo t_error rule is definedr� z1No error rule is defined for exclusive state '%s'z2No ignore rule is defined for exclusive state '%s'rN rk z#Couldn't write lextab module %r. %s)Gr* rB r rm r� �dir�dictrn r� r� r| rP r r� r� r� � SyntaxErrorrw r� r{ r� ro r$ r� r� r� rp r> r� r� r\ r rW r@ rq r� rF r� r� r� r� r0 r1 r2 r� rE �extendr5 r. r/ r9 r� r6 r? r� r7 r< r" r� r8 r= rQ rR rT rl rG rU rV �dirnamerj rS )#r� rH r% �optimizera r� Znowarnrb ZdebuglogZerrorlogr� r� ZlexobjZ_items�pkgZlinfor� Zregexsr~ Z regex_listr� r r' r� r. Zre_textZre_namesr� r �styper Zsrcfiler� Zpkgnamer� r r� r �lex^ s� (r� c C s� |sTz&t jd }t|�}|�� }|�� W n( tyR t j�d� t j�� }Y n0 | r`| j }nt }||� | rx| j }nt }|� }|s�q�t j�d|j |j |j |jf � q|d S )Nr- z/Reading from standard input (type EOF to end): z(%s,%r,%d,%d) )rm �argvrX �read�close� IndexError�stdoutr �stdinr{ r� r r r r )r� �datarc r Z_inputZ_tokenr� r r r �runmain s( r c s � fdd�}|S )Nc s t � d�rt� �| _n� | _| S )Nr) )r� r� r� r �r� r r � set_regexA s zTOKEN.<locals>.set_regexr )r� r r r r �TOKEN@ s r )NN)$rY r[ rr rm rQ rD rU r� Z StringTypeZ UnicodeTyperx �AttributeErrorr �bytesrs r� r� r rH r r r& r* r� r� r` rt r� r� r� r^ �VERBOSEr� r r �Tokenr r r r �<module>" sF F ( 3 � A " __pycache__/policygen.cpython-39.opt-1.pyc 0000644 00000031127 15025012421 0014331 0 ustar 00 a z f�; � @ s� d Z ddlZddlZddlmZ z ddlT W n Y n0 ddlmZ ddlmZ ddlm Z ddlm Z dd lm Z dd lm Z dZ dZd ZG d d � d �Zdefdd�Zdd� ZG dd� d�Zdd� ZdS )z> classes and algorithms for the generation of SELinux policy. � N)�*� )� refpolicy)� objectmodel)�access)� interfaces)�matching)�util� c @ s� e Zd ZdZd dd�Zd dd�Zd!dd �Zefd d �Zd d � Z dd� Z dd� Z d"dd�Z dd� Z dd� Zdd� Zdd � Zd d � ZdS )#�PolicyGeneratora� Generate a reference policy module from access vectors. PolicyGenerator generates a new reference policy module or updates an existing module based on requested access in the form of access vectors. It generates allow rules and optionally module require statements, reference policy interfaces, and extended permission access vector rules. By default only allow rules are generated. The methods .set_gen_refpol, .set_gen_requires and .set_gen_xperms turns on interface generation, requires generation, and xperms rules generation respectively. PolicyGenerator can also optionally add comments explaining why a particular access was allowed based on the audit messages that generated the access. The access vectors passed in must have the .audit_msgs field set correctly and .explain set to SHORT|LONG_EXPLANATION to enable this feature. The module created by PolicyGenerator can be passed to output.ModuleWriter to output a text representation. Nc C s> d| _ t| _d| _|r || _n t�� | _d| _d| _d| _ dS )z�Initialize a PolicyGenerator with an optional existing module. If the module parameter is not None then access will be added to the passed in module. Otherwise a new reference policy module will be created. NF) �ifgen�NO_EXPLANATION�explain� gen_requires�moduler ZModule� dontaudit�xperms�domains)�selfr � r �6/usr/lib/python3.9/site-packages/sepolgen/policygen.py�__init__E s zPolicyGenerator.__init__c C s* |rt ||�| _d| _nd| _| �� dS )a? Set whether reference policy interfaces are generated. To turn on interface generation pass in an interface set to use for interface generation. To turn off interface generation pass in None. If interface generation is enabled requires generation will also be enabled. TN)�InterfaceGeneratorr r �"_PolicyGenerator__set_module_style)r Zif_set� perm_mapsr r r �set_gen_refpolY s z PolicyGenerator.set_gen_refpolTc C s || _ dS )a& Set whether module requires are generated. Passing in true will turn on requires generation and False will disable generation. If requires generation is disabled interface generation will also be disabled and can only be re-enabled via .set_gen_refpol. N)r )r �statusr r r �set_gen_requiresk s z PolicyGenerator.set_gen_requiresc C s || _ dS )z)Set whether access is explained. N)r )r r r r r �set_gen_explainu s z PolicyGenerator.set_gen_explainc C s || _ d S �N)r )r r r r r �set_gen_dontauditz s z!PolicyGenerator.set_gen_dontauditc C s || _ dS )zSSet whether extended permission access vector rules are generated. N)r )r r r r r �set_gen_xperms} s z PolicyGenerator.set_gen_xpermsc C s* | j r d}nd}| j�� D ] }||_qd S )NTF)r r �module_declarationsr )r r �modr r r Z__set_module_style� s z"PolicyGenerator.__set_module_style�1.0c C sX d}| j �� D ]}|}q|s4t�� }| j j�d|� ||_||_| jrNd|_nd|_dS )z?Set the name of the module and optionally the version. Nr TF) r r" r ZModuleDeclaration�children�insert�name�versionr )r r' r( �mr# r r r �set_module_name� s z PolicyGenerator.set_module_namec C s | j rt | j� | jS r )r r )r r r r � get_module� s zPolicyGenerator.get_modulec C sn t �|�}| jr|j|_d|_| jr>tt �t || jd���|_|j t j krl| jd7 _|j rl| jd7 _|j t jkr�| jd7 _|j t jkr�t|j�dkr�| jdd�d d � |jD �� 7 _n | jd |jd d 7 _|j t jk�rL| jd 7 _| jd7 _| jd|jd 7 _|jdd� D ]}| jd| 7 _�q2�z |j t jk�rLd|jv �rLd|jv �s�d|jv �rL| j�s�ttdd�d d | _g }dd � tt gt|jt |jt |ji�D �D ] }|| jv�r�|� |� �q�t|�dk�r | jd|j|jd�|�f 7 _n0t|�dk�rL| jd|j|jd�|�f 7 _W n Y n0 | j j � |� dS )z Add access vector rule. � )� verbosityz0 #!!!! This avc is allowed in the current policyzN #!!!! This av rule may have been overridden by an extended permission av rulez: #!!!! This avc has a dontaudit rule in the current policyr zH #!!!! This avc can be allowed using one of the these booleans: # %sz, c S s g | ] }|d �qS )r r ��.0�xr r r � <listcomp>� � z1PolicyGenerator.__add_av_rule.<locals>.<listcomp>z5 #!!!! This avc can be allowed using the boolean '%s'r z� #!!!! This avc is a constraint violation. You would need to modify the attributes of either the source or target types to allow this access.z #Constraint rule: z # Nz? # Possible cause is the source %s and target %s are different.�write�dir�open�domain)r' �typesc S s g | ] }|t �qS r )ZTCONTEXTr. r r r r1 � r2 zL #!!!! The source type '%s' can write to a '%s' of the following type: # %s zM #!!!! The source type '%s' can write to a '%s' of the following types: # %s )!r ZAVRuler Z DONTAUDIT� rule_type�commentr �str�Comment�explain_access�type� audit2whyZALLOWr ZBOOLEAN�len�data�joinZ CONSTRAINTZTERULE�perms� obj_classr ZseinfoZ ATTRIBUTEZsesearchZSCONTEXT�src_typeZCLASSZPERMS�appendr r% )r �avZrule�reasonr7 �ir r r Z __add_av_rule� sV & ���, $&z PolicyGenerator.__add_av_rulec C s< |j �� D ],}t�||�}| jr(|j|_| jj� |� q dS )z5Add extended permission access vector rules. N) r �keysr Z AVExtRuler ZDONTAUDITXPERMr8 r r% rE )r rF �opZextruler r r Z__add_ext_av_rules� s z"PolicyGenerator.__add_ext_av_rulesc C s\ | j r*| j �|| j�\}}| jj�|� n|}|D ]$}| �|� | jr2|jr2| �|� q2dS )zJAdd the access from the access vector set to this module. N) r �genr r r% �extend� _PolicyGenerator__add_av_ruler �"_PolicyGenerator__add_ext_av_rules)r Zav_setZ raw_allow�ifcallsrF r r r � add_access� s zPolicyGenerator.add_accessc C s |D ]}| j j�|� qd S r )r r% rE )r Z role_type_set� role_typer r r �add_role_types� s z PolicyGenerator.add_role_types)N)NN)T)r$ )�__name__� __module__� __qualname__�__doc__r r r �SHORT_EXPLANATIONr r r! r r* r+ rM rN rP rR r r r r r - s 5 r c s g �� �fdd�}|t kr�| jD ]�}��d|j � ��dt|j�t|j�f � ��d|jt� |j �f � ��d|j |j |j f � ��tjd|j d d d d d �� q |� nb|�r��d | j| j| j| j�� f � t| j�dk�r| jd }��d|j |j |j f � |� �S )a� Explain why a policy statement was generated. Return a string containing a text explanation of why a policy statement was generated. The string is commented and wrapped and can be directly inserted into a policy. Params: av - access vector representing the access. Should have .audit_msgs set appropriately. verbosity - the amount of explanation provided. Should be set to NO_EXPLANATION, SHORT_EXPLANATION, or LONG_EXPLANATION. Returns: list of strings - strings explaining the access or an empty string if verbosity=NO_EXPLANATION or there is not sufficient information to provide an explanation. c sJ � sd S �� d� � �� D ]*} t| j� j�}�� d|�� | jf � qd S )Nz Interface options:z %s # [%d])rE �all�call_interface� interfacerF Z to_stringZdist)�match�ifcall��ml�sr r �explain_interfaces s z*explain_access.<locals>.explain_interfacesz %sz scontext="%s" tcontext="%s"z class="%s" perms="%s"z comm="%s" exe="%s" path="%s"z message="�"�P z z )�initial_indent�subsequent_indentz) src="%s" tgt="%s" class="%s", perms="%s"r z comm="%s" exe="%s" path="%s")�LONG_EXPLANATIONZ audit_msgsrE �headerr: ZscontextZtcontextZtclassr Zlist_to_space_strZaccessesZcommZexe�pathrL �textwrap�wrap�messagerD �tgt_typerC rB Z to_space_strr? )rF r^ r- r` �msgr r] r r< � s2 ��� � r< c C s� g }g }|� | j�� � |jdd� dd� t�� }| j|_tt |��D ]r}|| j tj krj|j � |j� qF|| j tjkr�|j � |j� qF|| j tjkr�|j � |j� qFt|| j � qF|S )Nc S s | j S r ��num�Zparamr r r �<lambda>9 r2 z call_interface.<locals>.<lambda>T��key�reverse)rL �params�values�sortr Z InterfaceCallr' Zifname�ranger? r= �SRC_TYPE�argsrE rD �TGT_TYPErk � OBJ_CLASSrC �print)rZ rF rt ry r\ rH r r r rY 4 s rY c @ s. e Zd Zd dd�Zdd� Zdd� Zdd � ZdS ) r Nc C s& || _ | �|� t�|�| _g | _d S r )�ifs�hack_check_ifsr Z AccessMatcher�matcher�calls)r r} r r r r r N s zInterfaceGenerator.__init__c C s� |j �� D ]|}g }|�|j�� � |jdd� dd� tt|��D ]D}|d || jkr`d|_ q || j t j t j t j fvr@d|_ q q@q d S )Nc S s | j S r rm ro r r r rp \ r2 z3InterfaceGenerator.hack_check_ifs.<locals>.<lambda>Trq r F)r ru rL rt rv rw r? rn Zenabledr= r rx rz r{ )r r} r0 rt rH r r r r~ T s �z!InterfaceGenerator.hack_check_ifsc C s� | � |�}g }| jD ]>}t|�� j|j�}|rDt�t|j||��|_ |� ||f� qg }|D ]L\}}d} |D ],} | � |�rl| j r�|j r�| j � |j � d} ql| s\|� |� q\||fS )NFT) r[ r� rY ZbestrZ rF r r; r< r9 rE �matches�merge) r �avsr- �raw_avrO r^ r\ �dr} �foundZo_ifcallr r r rK k s$ zInterfaceGenerator.genc C sL g }|D ]>}t �� }| j�| j||� t|�r<| j�|� q|�|� q|S r )r Z MatchListr Z search_ifsr} r? r� rE )r r� r� rF Zansr r r r[ � s zInterfaceGenerator.match)N)rS rT rU r r~ rK r[ r r r r r M s r c C s" dd� }| � � D ] }||� qdS )z*Add require statements to the module. c S s� t �� }| �� D ]:}|j�|j� |j�|j� |jD ]}|�||j � q6q| � � D ] }|j D ]}|j� |� q^qT| � � D ] }|j� |j� |j�|j� qz|j�d� | j�d|� d S )Nr r )r ZRequireZavrulesr7 �updateZ src_typesZ tgt_typesZ obj_classesZ add_obj_classrB Zinterface_callsry �addZ role_typesZrolesZrole�discardr% r& )�node�rZavrule�objr\ �argrQ r r r �collect_requires� s z&gen_requires.<locals>.collect_requiresN)Znodes)r r� r� r r r r � s r )rV � itertoolsrh Zselinux.audit2whyr> Zsetoolsr, r r r r r r r rW re r r< rY r r r r r r �<module> s, Q7B refpolicy.py 0000644 00000076651 15025012421 0007121 0 ustar 00 # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> # # Copyright (C) 2006 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; version 2 only # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # import string import selinux # OVERVIEW # # This file contains objects and functions used to represent the reference # policy (including the headers, M4 macros, and policy language statements). # # This representation is very different from the semantic representation # used in libsepol. Instead, it is a more typical abstract representation # used by the first stage of compilers. It is basically a parse tree. # # This choice is intentional as it allows us to handle the unprocessed # M4 statements - including the $1 style arguments - and to more easily generate # the data structures that we need for policy generation. # # Constants for referring to fields SRC_TYPE = 0 TGT_TYPE = 1 OBJ_CLASS = 2 PERMS = 3 ROLE = 4 DEST_TYPE = 5 # String representations of the above constants field_to_str = ["source", "target", "object", "permission", "role", "destination" ] str_to_field = { "source" : SRC_TYPE, "target" : TGT_TYPE, "object" : OBJ_CLASS, "permission" : PERMS, "role" : ROLE, "destination" : DEST_TYPE } # Base Classes class PolicyBase: def __init__(self, parent=None): self.parent = None self.comment = None class Node(PolicyBase): """Base class objects produced from parsing the reference policy. The Node class is used as the base class for any non-leaf object produced by parsing the reference policy. This object should contain a reference to its parent (or None for a top-level object) and 0 or more children. The general idea here is to have a very simple tree structure. Children are not separated out by type. Instead the tree structure represents fairly closely the real structure of the policy statements. The object should be iterable - by default over all children but subclasses are free to provide additional iterators over a subset of their childre (see Interface for example). """ def __init__(self, parent=None): PolicyBase.__init__(self, parent) self.children = [] def __iter__(self): return iter(self.children) # Not all of the iterators will return something on all Nodes, but # they won't explode either. Putting them here is just easier. # Top level nodes def nodes(self): return filter(lambda x: isinstance(x, Node), walktree(self)) def modules(self): return filter(lambda x: isinstance(x, Module), walktree(self)) def interfaces(self): return filter(lambda x: isinstance(x, Interface), walktree(self)) def templates(self): return filter(lambda x: isinstance(x, Template), walktree(self)) def support_macros(self): return filter(lambda x: isinstance(x, SupportMacros), walktree(self)) # Common policy statements def module_declarations(self): return filter(lambda x: isinstance(x, ModuleDeclaration), walktree(self)) def interface_calls(self): return filter(lambda x: isinstance(x, InterfaceCall), walktree(self)) def avrules(self): return filter(lambda x: isinstance(x, AVRule), walktree(self)) def avextrules(self): return filter(lambda x: isinstance(x, AVExtRule), walktree(self)) def typerules(self): return filter(lambda x: isinstance(x, TypeRule), walktree(self)) def typebounds(self): return filter(lambda x: isinstance(x, TypeBound), walktree(self)) def typeattributes(self): """Iterate over all of the TypeAttribute children of this Interface.""" return filter(lambda x: isinstance(x, TypeAttribute), walktree(self)) def roleattributes(self): """Iterate over all of the RoleAttribute children of this Interface.""" return filter(lambda x: isinstance(x, RoleAttribute), walktree(self)) def requires(self): return filter(lambda x: isinstance(x, Require), walktree(self)) def roles(self): return filter(lambda x: isinstance(x, Role), walktree(self)) def role_allows(self): return filter(lambda x: isinstance(x, RoleAllow), walktree(self)) def role_types(self): return filter(lambda x: isinstance(x, RoleType), walktree(self)) def __str__(self): if self.comment: return str(self.comment) + "\n" + self.to_string() else: return self.to_string() def __repr__(self): return "<%s(%s)>" % (self.__class__.__name__, self.to_string()) def to_string(self): return "" class Leaf(PolicyBase): def __init__(self, parent=None): PolicyBase.__init__(self, parent) def __str__(self): if self.comment: return str(self.comment) + "\n" + self.to_string() else: return self.to_string() def __repr__(self): return "<%s(%s)>" % (self.__class__.__name__, self.to_string()) def to_string(self): return "" # Utility functions def walktree(node, depthfirst=True, showdepth=False, type=None): """Iterate over a Node and its Children. The walktree function iterates over a tree containing Nodes and leaf objects. The iteration can perform a depth first or a breadth first traversal of the tree (controlled by the depthfirst parameter. The passed in node will be returned. This function will only work correctly for trees - arbitrary graphs will likely cause infinite looping. """ # We control depth first / versus breadth first by # how we pop items off of the node stack. if depthfirst: index = -1 else: index = 0 stack = [(node, 0)] while len(stack) > 0: cur, depth = stack.pop(index) if showdepth: yield cur, depth else: yield cur # If the node is not a Node instance it must # be a leaf - so no need to add it to the stack if isinstance(cur, Node): items = [] i = len(cur.children) - 1 while i >= 0: if type is None or isinstance(cur.children[i], type): items.append((cur.children[i], depth + 1)) i -= 1 stack.extend(items) def walknode(node, type=None): """Iterate over the direct children of a Node. The walktree function iterates over the children of a Node. Unlike walktree it does note return the passed in node or the children of any Node objects (that is, it does not go beyond the current level in the tree). """ for x in node: if type is None or isinstance(x, type): yield x def list_to_space_str(s, cont=('{', '}')): """Convert a set (or any sequence type) into a string representation formatted to match SELinux space separated list conventions. For example the list ['read', 'write'] would be converted into: '{ read write }' """ l = len(s) str = "" if l < 1: raise ValueError("cannot convert 0 len set to string") str = " ".join(s) if l == 1: return str else: return cont[0] + " " + str + " " + cont[1] def list_to_comma_str(s): l = len(s) if l < 1: raise ValueError("cannot convert 0 len set to comma string") return ", ".join(s) # Basic SELinux types class IdSet(set): def __init__(self, list=None): if list: set.__init__(self, list) else: set.__init__(self) self.compliment = False def to_space_str(self): return list_to_space_str(sorted(self)) def to_comma_str(self): return list_to_comma_str(sorted(self)) class SecurityContext(Leaf): """An SELinux security context with optional MCS / MLS fields.""" def __init__(self, context=None, parent=None): """Create a SecurityContext object, optionally from a string. Parameters: [context] - string representing a security context. Same format as a string passed to the from_string method. """ Leaf.__init__(self, parent) self.user = "" self.role = "" self.type = "" self.level = None if context is not None: self.from_string(context) def from_string(self, context): """Parse a string representing a context into a SecurityContext. The string should be in the standard format - e.g., 'user:role:type:level'. Raises ValueError if the string is not parsable as a security context. """ # try to translate the context string to raw form raw = selinux.selinux_trans_to_raw_context(context) if raw[0] == 0: context = raw[1] fields = context.split(":") if len(fields) < 3: raise ValueError("context string [%s] not in a valid format" % context) self.user = fields[0] self.role = fields[1] self.type = fields[2] if len(fields) > 3: # FUTURE - normalize level fields to allow more comparisons to succeed. self.level = ':'.join(fields[3:]) else: self.level = None def __eq__(self, other): """Compare two SecurityContext objects - all fields must be exactly the the same for the comparison to work. It is possible for the level fields to be semantically the same yet syntactically different - in this case this function will return false. """ return self.user == other.user and \ self.role == other.role and \ self.type == other.type and \ self.level == other.level def to_string(self, default_level=None): """Return a string representing this security context. By default, the string will contiain a MCS / MLS level potentially from the default which is passed in if none was set. Arguments: default_level - the default level to use if self.level is an empty string. Returns: A string represening the security context in the form 'user:role:type:level'. """ fields = [self.user, self.role, self.type] if self.level is None: if default_level is None: if selinux.is_selinux_mls_enabled() == 1: fields.append("s0") else: fields.append(default_level) else: fields.append(self.level) return ":".join(fields) class ObjectClass(Leaf): """SELinux object class and permissions. This class is a basic representation of an SELinux object class - it does not represent separate common permissions - just the union of the common and class specific permissions. It is meant to be convenient for policy generation. """ def __init__(self, name="", parent=None): Leaf.__init__(self, parent) self.name = name self.perms = IdSet() class XpermSet(): """Extended permission set. This class represents one or more extended permissions represented by numeric values or ranges of values. The .complement attribute is used to specify all permission except those specified. Two xperm set can be merged using the .extend() method. """ def __init__(self, complement=False): self.complement = complement self.ranges = [] def __normalize_ranges(self): """Ensure that ranges are not overlapping. """ self.ranges.sort() i = 0 while i < len(self.ranges): while i + 1 < len(self.ranges): if self.ranges[i + 1][0] <= self.ranges[i][1] + 1: self.ranges[i] = (self.ranges[i][0], max(self.ranges[i][1], self.ranges[i + 1][1])) del self.ranges[i + 1] else: break i += 1 def extend(self, s): """Add ranges from an xperm set """ self.ranges.extend(s.ranges) self.__normalize_ranges() def add(self, minimum, maximum=None): """Add value of range of values to the xperm set. """ if maximum is None: maximum = minimum self.ranges.append((minimum, maximum)) self.__normalize_ranges() def to_string(self): if not self.ranges: return "" compl = "~ " if self.complement else "" # print single value without braces if len(self.ranges) == 1 and self.ranges[0][0] == self.ranges[0][1]: return compl + hex(self.ranges[0][0]) vals = map(lambda x: hex(x[0]) if x[0] == x[1] else "%s-%s" % (hex(x[0]), hex(x[1]), ), self.ranges) return "%s{ %s }" % (compl, " ".join(vals)) # Basic statements class TypeAttribute(Leaf): """SElinux typeattribute statement. This class represents a typeattribute statement. """ def __init__(self, parent=None): Leaf.__init__(self, parent) self.type = "" self.attributes = IdSet() def to_string(self): return "typeattribute %s %s;" % (self.type, self.attributes.to_comma_str()) class RoleAttribute(Leaf): """SElinux roleattribute statement. This class represents a roleattribute statement. """ def __init__(self, parent=None): Leaf.__init__(self, parent) self.role = "" self.roleattributes = IdSet() def to_string(self): return "roleattribute %s %s;" % (self.role, self.roleattributes.to_comma_str()) class Role(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.role = "" self.types = IdSet() def to_string(self): s = "" for t in self.types: s += "role %s types %s;\n" % (self.role, t) return s class Type(Leaf): def __init__(self, name="", parent=None): Leaf.__init__(self, parent) self.name = name self.attributes = IdSet() self.aliases = IdSet() def to_string(self): s = "type %s" % self.name if len(self.aliases) > 0: s = s + "alias %s" % self.aliases.to_space_str() if len(self.attributes) > 0: s = s + ", %s" % self.attributes.to_comma_str() return s + ";" class TypeAlias(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.type = "" self.aliases = IdSet() def to_string(self): return "typealias %s alias %s;" % (self.type, self.aliases.to_space_str()) class Attribute(Leaf): def __init__(self, name="", parent=None): Leaf.__init__(self, parent) self.name = name def to_string(self): return "attribute %s;" % self.name class Attribute_Role(Leaf): def __init__(self, name="", parent=None): Leaf.__init__(self, parent) self.name = name def to_string(self): return "attribute_role %s;" % self.name # Classes representing rules class AVRule(Leaf): """SELinux access vector (AV) rule. The AVRule class represents all varieties of AV rules including allow, dontaudit, and auditallow (indicated by the flags self.ALLOW, self.DONTAUDIT, and self.AUDITALLOW respectively). The source and target types, object classes, and perms are all represented by sets containing strings. Sets are used to make it simple to add strings repeatedly while avoiding duplicates. No checking is done to make certain that the symbols are valid or consistent (e.g., perms that don't match the object classes). It is even possible to put invalid types like '$1' into the rules to allow storage of the reference policy interfaces. """ ALLOW = 0 DONTAUDIT = 1 AUDITALLOW = 2 NEVERALLOW = 3 def __init__(self, av=None, parent=None): Leaf.__init__(self, parent) self.src_types = IdSet() self.tgt_types = IdSet() self.obj_classes = IdSet() self.perms = IdSet() self.rule_type = self.ALLOW if av: self.from_av(av) def __rule_type_str(self): if self.rule_type == self.ALLOW: return "allow" elif self.rule_type == self.DONTAUDIT: return "dontaudit" elif self.rule_type == self.AUDITALLOW: return "auditallow" elif self.rule_type == self.NEVERALLOW: return "neverallow" def from_av(self, av): """Add the access from an access vector to this allow rule. """ self.src_types.add(av.src_type) if av.src_type == av.tgt_type: self.tgt_types.add("self") else: self.tgt_types.add(av.tgt_type) self.obj_classes.add(av.obj_class) self.perms.update(av.perms) def to_string(self): """Return a string representation of the rule that is a valid policy language representation (assuming that the types, object class, etc. are valie). """ return "%s %s %s:%s %s;" % (self.__rule_type_str(), self.src_types.to_space_str(), self.tgt_types.to_space_str(), self.obj_classes.to_space_str(), self.perms.to_space_str()) class AVExtRule(Leaf): """Extended permission access vector rule. The AVExtRule class represents allowxperm, dontauditxperm, auditallowxperm, and neverallowxperm rules. The source and target types, and object classes are represented by sets containing strings. The operation is a single string, e.g. 'ioctl'. Extended permissions are represented by an XpermSet. """ ALLOWXPERM = 0 DONTAUDITXPERM = 1 AUDITALLOWXPERM = 2 NEVERALLOWXPERM = 3 def __init__(self, av=None, op=None, parent=None): Leaf.__init__(self, parent) self.src_types = IdSet() self.tgt_types = IdSet() self.obj_classes = IdSet() self.rule_type = self.ALLOWXPERM self.xperms = XpermSet() self.operation = op if av: self.from_av(av, op) def __rule_type_str(self): if self.rule_type == self.ALLOWXPERM: return "allowxperm" elif self.rule_type == self.DONTAUDITXPERM: return "dontauditxperm" elif self.rule_type == self.AUDITALLOWXPERM: return "auditallowxperm" elif self.rule_type == self.NEVERALLOWXPERM: return "neverallowxperm" def from_av(self, av, op): self.src_types.add(av.src_type) if av.src_type == av.tgt_type: self.tgt_types.add("self") else: self.tgt_types.add(av.tgt_type) self.obj_classes.add(av.obj_class) self.operation = op self.xperms = av.xperms[op] def to_string(self): """Return a string representation of the rule that is a valid policy language representation (assuming that the types, object class, etc. are valid). """ return "%s %s %s:%s %s %s;" % (self.__rule_type_str(), self.src_types.to_space_str(), self.tgt_types.to_space_str(), self.obj_classes.to_space_str(), self.operation, self.xperms.to_string()) class TypeRule(Leaf): """SELinux type rules. This class is very similar to the AVRule class, but is for representing the type rules (type_trans, type_change, and type_member). The major difference is the lack of perms and only and sing destination type. """ TYPE_TRANSITION = 0 TYPE_CHANGE = 1 TYPE_MEMBER = 2 def __init__(self, parent=None): Leaf.__init__(self, parent) self.src_types = IdSet() self.tgt_types = IdSet() self.obj_classes = IdSet() self.dest_type = "" self.rule_type = self.TYPE_TRANSITION def __rule_type_str(self): if self.rule_type == self.TYPE_TRANSITION: return "type_transition" elif self.rule_type == self.TYPE_CHANGE: return "type_change" else: return "type_member" def to_string(self): return "%s %s %s:%s %s;" % (self.__rule_type_str(), self.src_types.to_space_str(), self.tgt_types.to_space_str(), self.obj_classes.to_space_str(), self.dest_type) class TypeBound(Leaf): """SElinux typebound statement. This class represents a typebound statement. """ def __init__(self, parent=None): Leaf.__init__(self, parent) self.type = "" self.tgt_types = IdSet() def to_string(self): return "typebounds %s %s;" % (self.type, self.tgt_types.to_comma_str()) class RoleAllow(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.src_roles = IdSet() self.tgt_roles = IdSet() def to_string(self): return "allow %s %s;" % (self.src_roles.to_comma_str(), self.tgt_roles.to_comma_str()) class RoleType(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.role = "" self.types = IdSet() def to_string(self): s = "" for t in self.types: s += "role %s types %s;\n" % (self.role, t) return s class ModuleDeclaration(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.name = "" self.version = "" self.refpolicy = False def to_string(self): if self.refpolicy: return "policy_module(%s, %s)" % (self.name, self.version) else: return "module %s %s;" % (self.name, self.version) class Conditional(Node): def __init__(self, parent=None): Node.__init__(self, parent) self.cond_expr = [] def to_string(self): return "[If %s]" % list_to_space_str(self.cond_expr, cont=("", "")) class Bool(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.name = "" self.state = False def to_string(self): s = "bool %s " % self.name if s.state: return s + "true" else: return s + "false" class InitialSid(Leaf): def __init(self, parent=None): Leaf.__init__(self, parent) self.name = "" self.context = None def to_string(self): return "sid %s %s" % (self.name, str(self.context)) class GenfsCon(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.filesystem = "" self.path = "" self.context = None def to_string(self): return "genfscon %s %s %s" % (self.filesystem, self.path, str(self.context)) class FilesystemUse(Leaf): XATTR = 1 TRANS = 2 TASK = 3 def __init__(self, parent=None): Leaf.__init__(self, parent) self.type = self.XATTR self.filesystem = "" self.context = None def to_string(self): s = "" if self.type == self.XATTR: s = "fs_use_xattr " elif self.type == self.TRANS: s = "fs_use_trans " elif self.type == self.TASK: s = "fs_use_task " return "%s %s %s;" % (s, self.filesystem, str(self.context)) class PortCon(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.port_type = "" self.port_number = "" self.context = None def to_string(self): return "portcon %s %s %s" % (self.port_type, self.port_number, str(self.context)) class NodeCon(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.start = "" self.end = "" self.context = None def to_string(self): return "nodecon %s %s %s" % (self.start, self.end, str(self.context)) class NetifCon(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.interface = "" self.interface_context = None self.packet_context = None def to_string(self): return "netifcon %s %s %s" % (self.interface, str(self.interface_context), str(self.packet_context)) class PirqCon(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.pirq_number = "" self.context = None def to_string(self): return "pirqcon %s %s" % (self.pirq_number, str(self.context)) class IomemCon(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.device_mem = "" self.context = None def to_string(self): return "iomemcon %s %s" % (self.device_mem, str(self.context)) class IoportCon(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.ioport = "" self.context = None def to_string(self): return "ioportcon %s %s" % (self.ioport, str(self.context)) class PciDeviceCon(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.device = "" self.context = None def to_string(self): return "pcidevicecon %s %s" % (self.device, str(self.context)) class DeviceTreeCon(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.path = "" self.context = None def to_string(self): return "devicetreecon %s %s" % (self.path, str(self.context)) # Reference policy specific types def print_tree(head): for node, depth in walktree(head, showdepth=True): s = "" for i in range(depth): s = s + "\t" print(s + str(node)) class Headers(Node): def __init__(self, parent=None): Node.__init__(self, parent) def to_string(self): return "[Headers]" class Module(Node): def __init__(self, parent=None): Node.__init__(self, parent) def to_string(self): return "" class Interface(Node): """A reference policy interface definition. This class represents a reference policy interface definition. """ def __init__(self, name="", parent=None): Node.__init__(self, parent) self.name = name def to_string(self): return "[Interface name: %s]" % self.name class TunablePolicy(Node): def __init__(self, parent=None): Node.__init__(self, parent) self.cond_expr = [] def to_string(self): return "[Tunable Policy %s]" % list_to_space_str(self.cond_expr, cont=("", "")) class Template(Node): def __init__(self, name="", parent=None): Node.__init__(self, parent) self.name = name def to_string(self): return "[Template name: %s]" % self.name class IfDef(Node): def __init__(self, name="", parent=None): Node.__init__(self, parent) self.name = name def to_string(self): return "[Ifdef name: %s]" % self.name class InterfaceCall(Leaf): def __init__(self, ifname="", parent=None): Leaf.__init__(self, parent) self.ifname = ifname self.args = [] self.comments = [] def matches(self, other): if self.ifname != other.ifname: return False if len(self.args) != len(other.args): return False for a,b in zip(self.args, other.args): if a != b: return False return True def to_string(self): s = "%s(" % self.ifname i = 0 for a in self.args: if isinstance(a, list): str = list_to_space_str(a) else: str = a if i != 0: s = s + ", %s" % str else: s = s + str i += 1 return s + ")" class OptionalPolicy(Node): def __init__(self, parent=None): Node.__init__(self, parent) def to_string(self): return "[Optional Policy]" class SupportMacros(Node): def __init__(self, parent=None): Node.__init__(self, parent) self.map = None def to_string(self): return "[Support Macros]" def __expand_perm(self, perm): # Recursive expansion - the assumption is that these # are ordered correctly so that no macro is used before # it is defined s = set() if perm in self.map: for p in self.by_name(perm): s.update(self.__expand_perm(p)) else: s.add(perm) return s def __gen_map(self): self.map = {} for x in self: exp_perms = set() for perm in x.perms: exp_perms.update(self.__expand_perm(perm)) self.map[x.name] = exp_perms def by_name(self, name): if not self.map: self.__gen_map() return self.map[name] def has_key(self, name): if not self.map: self.__gen_map() return name in self.map class Require(Leaf): def __init__(self, parent=None): Leaf.__init__(self, parent) self.types = IdSet() self.obj_classes = { } self.roles = IdSet() self.data = IdSet() self.users = IdSet() def add_obj_class(self, obj_class, perms): p = self.obj_classes.setdefault(obj_class, IdSet()) p.update(perms) def to_string(self): s = [] s.append("require {") for type in self.types: s.append("\ttype %s;" % type) for obj_class, perms in self.obj_classes.items(): s.append("\tclass %s %s;" % (obj_class, perms.to_space_str())) for role in self.roles: s.append("\trole %s;" % role) for bool in self.data: s.append("\tbool %s;" % bool) for user in self.users: s.append("\tuser %s;" % user) s.append("}") # Handle empty requires if len(s) == 2: return "" return "\n".join(s) class ObjPermSet: def __init__(self, name): self.name = name self.perms = set() def to_string(self): return "define(`%s', `%s')" % (self.name, self.perms.to_space_str()) class ClassMap: def __init__(self, obj_class, perms): self.obj_class = obj_class self.perms = perms def to_string(self): return self.obj_class + ": " + self.perms class Comment: def __init__(self, l=None): if l: self.lines = l else: self.lines = [] def to_string(self): # If there are no lines, treat this as a spacer between # policy statements and return a new line. if len(self.lines) == 0: return "" else: out = [] for line in self.lines: out.append("#" + line) return "\n".join(out) def merge(self, other): if len(other.lines): for line in other.lines: if line != "": self.lines.append(line) def __str__(self): return self.to_string() util.py 0000644 00000012552 15025012421 0006070 0 ustar 00 # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> # # Copyright (C) 2006 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; version 2 only # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # import locale import sys PY3 = sys.version_info[0] == 3 if PY3: bytes_type=bytes string_type=str else: bytes_type=str string_type=unicode class ConsoleProgressBar: def __init__(self, out, steps=100, indicator='#'): self.blocks = 0 self.current = 0 self.steps = steps self.indicator = indicator self.out = out self.done = False def start(self, message=None): self.done = False if message: self.out.write('\n%s:\n' % message) self.out.write('%--10---20---30---40---50---60---70---80---90--100\n') def step(self, n=1): self.current += n old = self.blocks self.blocks = int(round(self.current / float(self.steps) * 100) / 2) if self.blocks > 50: self.blocks = 50 new = self.blocks - old self.out.write(self.indicator * new) self.out.flush() if self.blocks == 50 and not self.done: self.done = True self.out.write("\n") def set_to_list(s): l = [] l.extend(s) return l def first(s, sorted=False): """ Return the first element of a set. It sometimes useful to return the first element from a set but, because sets are not indexable, this is rather hard. This function will return the first element from a set. If sorted is True, then the set will first be sorted (making this an expensive operation). Otherwise a random element will be returned (as sets are not ordered). """ if not len(s): raise IndexError("empty container") if sorted: l = set_to_list(s) l.sort() return l[0] else: for x in s: return x def encode_input(text): """Encode given text via preferred system encoding""" # locale will often find out the correct encoding encoding = locale.getpreferredencoding() try: encoded_text = text.encode(encoding) except UnicodeError: # if it fails to find correct encoding then ascii is used # which may lead to UnicodeError if `text` contains non ascii signs # utf-8 is our guess to fix the situation encoded_text = text.encode('utf-8') return encoded_text def decode_input(text): """Decode given text via preferred system encoding""" # locale will often find out the correct encoding encoding = locale.getpreferredencoding() try: decoded_text = text.decode(encoding) except UnicodeError: # if it fails to find correct encoding then ascii is used # which may lead to UnicodeError if `text` contains non ascii signs # utf-8 is our guess to fix the situation decoded_text = text.decode('utf-8') return decoded_text class Comparison(): """Class used when implementing rich comparison. Inherit from this class if you want to have a rich comparison within the class, afterwards implement _compare function within your class.""" def _compare(self, other, method): return NotImplemented def __eq__(self, other): return self._compare(other, lambda a, b: a == b) def __lt__(self, other): return self._compare(other, lambda a, b: a < b) def __le__(self, other): return self._compare(other, lambda a, b: a <= b) def __ge__(self, other): return self._compare(other, lambda a, b: a >= b) def __gt__(self, other): return self._compare(other, lambda a, b: a > b) def __ne__(self, other): return self._compare(other, lambda a, b: a != b) if sys.version_info < (2,7): # cmp_to_key function is missing in python2.6 def cmp_to_key(mycmp): 'Convert a cmp= function into a key= function' class K: def __init__(self, obj, *args): self.obj = obj def __lt__(self, other): return mycmp(self.obj, other.obj) < 0 def __gt__(self, other): return mycmp(self.obj, other.obj) > 0 def __eq__(self, other): return mycmp(self.obj, other.obj) == 0 def __le__(self, other): return mycmp(self.obj, other.obj) <= 0 def __ge__(self, other): return mycmp(self.obj, other.obj) >= 0 def __ne__(self, other): return mycmp(self.obj, other.obj) != 0 return K else: from functools import cmp_to_key def cmp(first, second): return (first > second) - (second > first) if __name__ == "__main__": import time p = ConsoleProgressBar(sys.stdout, steps=999) p.start("computing pi") for i in range(999): p.step() time.sleep(0.001) audit.py 0000644 00000052734 15025012421 0006227 0 ustar 00 # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> # # Copyright (C) 2006 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; version 2 only # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # import re import sys from . import refpolicy from . import access from . import util # Convenience functions def get_audit_boot_msgs(): """Obtain all of the avc and policy load messages from the audit log. This function uses ausearch and requires that the current process have sufficient rights to run ausearch. Returns: string contain all of the audit messages returned by ausearch. """ import subprocess import time fd=open("/proc/uptime", "r") off=float(fd.read().split()[0]) fd.close s = time.localtime(time.time() - off) bootdate = time.strftime("%x", s) boottime = time.strftime("%X", s) output = subprocess.Popen(["/sbin/ausearch", "-m", "AVC,USER_AVC,MAC_POLICY_LOAD,DAEMON_START,SELINUX_ERR", "-ts", bootdate, boottime], stdout=subprocess.PIPE).communicate()[0] if util.PY3: output = util.decode_input(output) return output def get_audit_msgs(): """Obtain all of the avc and policy load messages from the audit log. This function uses ausearch and requires that the current process have sufficient rights to run ausearch. Returns: string contain all of the audit messages returned by ausearch. """ import subprocess output = subprocess.Popen(["/sbin/ausearch", "-m", "AVC,USER_AVC,MAC_POLICY_LOAD,DAEMON_START,SELINUX_ERR"], stdout=subprocess.PIPE).communicate()[0] if util.PY3: output = util.decode_input(output) return output def get_dmesg_msgs(): """Obtain all of the avc and policy load messages from /bin/dmesg. Returns: string contain all of the audit messages returned by dmesg. """ import subprocess output = subprocess.Popen(["/bin/dmesg"], stdout=subprocess.PIPE).communicate()[0] if util.PY3: output = util.decode_input(output) return output # Classes representing audit messages class AuditMessage: """Base class for all objects representing audit messages. AuditMessage is a base class for all audit messages and only provides storage for the raw message (as a string) and a parsing function that does nothing. """ def __init__(self, message): self.message = message self.header = "" def from_split_string(self, recs): """Parse a string that has been split into records by space into an audit message. This method should be overridden by subclasses. Error reporting should be done by raise ValueError exceptions. """ for msg in recs: fields = msg.split("=") if len(fields) != 2: if msg[:6] == "audit(": self.header = msg return else: continue if fields[0] == "msg": self.header = fields[1] return class InvalidMessage(AuditMessage): """Class representing invalid audit messages. This is used to differentiate between audit messages that aren't recognized (that should return None from the audit message parser) and a message that is recognized but is malformed in some way. """ def __init__(self, message): AuditMessage.__init__(self, message) class PathMessage(AuditMessage): """Class representing a path message""" def __init__(self, message): AuditMessage.__init__(self, message) self.path = "" def from_split_string(self, recs): AuditMessage.from_split_string(self, recs) for msg in recs: fields = msg.split("=") if len(fields) != 2: continue if fields[0] == "path": self.path = fields[1][1:-1] return import selinux.audit2why as audit2why avcdict = {} class AVCMessage(AuditMessage): """AVC message representing an access denial or granted message. This is a very basic class and does not represent all possible fields in an avc message. Currently the fields are: scontext - context for the source (process) that generated the message tcontext - context for the target tclass - object class for the target (only one) comm - the process name exe - the on-disc binary path - the path of the target access - list of accesses that were allowed or denied denial - boolean indicating whether this was a denial (True) or granted (False) message. ioctlcmd - ioctl 'request' parameter An example audit message generated from the audit daemon looks like (line breaks added): 'type=AVC msg=audit(1155568085.407:10877): avc: denied { search } for pid=677 comm="python" name="modules" dev=dm-0 ino=13716388 scontext=user_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=dir' An example audit message stored in syslog (not processed by the audit daemon - line breaks added): 'Sep 12 08:26:43 dhcp83-5 kernel: audit(1158064002.046:4): avc: denied { read } for pid=2 496 comm="bluez-pin" name=".gdm1K3IFT" dev=dm-0 ino=3601333 scontext=user_u:system_r:bluetooth_helper_t:s0-s0:c0 tcontext=system_u:object_r:xdm_tmp_t:s0 tclass=file """ def __init__(self, message): AuditMessage.__init__(self, message) self.scontext = refpolicy.SecurityContext() self.tcontext = refpolicy.SecurityContext() self.tclass = "" self.comm = "" self.exe = "" self.path = "" self.name = "" self.accesses = [] self.denial = True self.ioctlcmd = None self.type = audit2why.TERULE def __parse_access(self, recs, start): # This is kind of sucky - the access that is in a space separated # list like '{ read write }'. This doesn't fit particularly well with splitting # the string on spaces. This function takes the list of recs and a starting # position one beyond the open brace. It then adds the accesses until it finds # the close brace or the end of the list (which is an error if reached without # seeing a close brace). found_close = False i = start if i == (len(recs) - 1): raise ValueError("AVC message in invalid format [%s]\n" % self.message) while i < len(recs): if recs[i] == "}": found_close = True break self.accesses.append(recs[i]) i = i + 1 if not found_close: raise ValueError("AVC message in invalid format [%s]\n" % self.message) return i + 1 def from_split_string(self, recs): AuditMessage.from_split_string(self, recs) # FUTURE - fully parse avc messages and store all possible fields # Required fields found_src = False found_tgt = False found_class = False found_access = False for i in range(len(recs)): if recs[i] == "{": i = self.__parse_access(recs, i + 1) found_access = True continue elif recs[i] == "granted": self.denial = False fields = recs[i].split("=") if len(fields) != 2: continue if fields[0] == "scontext": self.scontext = refpolicy.SecurityContext(fields[1]) found_src = True elif fields[0] == "tcontext": self.tcontext = refpolicy.SecurityContext(fields[1]) found_tgt = True elif fields[0] == "tclass": self.tclass = fields[1] found_class = True elif fields[0] == "comm": self.comm = fields[1][1:-1] elif fields[0] == "exe": self.exe = fields[1][1:-1] elif fields[0] == "name": self.name = fields[1][1:-1] elif fields[0] == "ioctlcmd": try: self.ioctlcmd = int(fields[1], 16) except ValueError: pass if not found_src or not found_tgt or not found_class or not found_access: raise ValueError("AVC message in invalid format [%s]\n" % self.message) self.analyze() def analyze(self): tcontext = self.tcontext.to_string() scontext = self.scontext.to_string() access_tuple = tuple( self.accesses) self.data = [] if (scontext, tcontext, self.tclass, access_tuple) in avcdict.keys(): self.type, self.data = avcdict[(scontext, tcontext, self.tclass, access_tuple)] else: self.type, self.data = audit2why.analyze(scontext, tcontext, self.tclass, self.accesses) if self.type == audit2why.NOPOLICY: self.type = audit2why.TERULE if self.type == audit2why.BADTCON: raise ValueError("Invalid Target Context %s\n" % tcontext) if self.type == audit2why.BADSCON: raise ValueError("Invalid Source Context %s\n" % scontext) if self.type == audit2why.BADSCON: raise ValueError("Invalid Type Class %s\n" % self.tclass) if self.type == audit2why.BADPERM: raise ValueError("Invalid permission %s\n" % " ".join(self.accesses)) if self.type == audit2why.BADCOMPUTE: raise ValueError("Error during access vector computation") if self.type == audit2why.CONSTRAINT: self.data = [ self.data ] if self.scontext.user != self.tcontext.user: self.data.append(("user (%s)" % self.scontext.user, 'user (%s)' % self.tcontext.user)) if self.scontext.role != self.tcontext.role and self.tcontext.role != "object_r": self.data.append(("role (%s)" % self.scontext.role, 'role (%s)' % self.tcontext.role)) if self.scontext.level != self.tcontext.level: self.data.append(("level (%s)" % self.scontext.level, 'level (%s)' % self.tcontext.level)) avcdict[(scontext, tcontext, self.tclass, access_tuple)] = (self.type, self.data) class PolicyLoadMessage(AuditMessage): """Audit message indicating that the policy was reloaded.""" def __init__(self, message): AuditMessage.__init__(self, message) class DaemonStartMessage(AuditMessage): """Audit message indicating that a daemon was started.""" def __init__(self, message): AuditMessage.__init__(self, message) self.auditd = False def from_split_string(self, recs): AuditMessage.from_split_string(self, recs) if "auditd" in recs: self.auditd = True class ComputeSidMessage(AuditMessage): """Audit message indicating that a sid was not valid. Compute sid messages are generated on attempting to create a security context that is not valid. Security contexts are invalid if the role is not authorized for the user or the type is not authorized for the role. This class does not store all of the fields from the compute sid message - just the type and role. """ def __init__(self, message): AuditMessage.__init__(self, message) self.invalid_context = refpolicy.SecurityContext() self.scontext = refpolicy.SecurityContext() self.tcontext = refpolicy.SecurityContext() self.tclass = "" def from_split_string(self, recs): AuditMessage.from_split_string(self, recs) if len(recs) < 10: raise ValueError("Split string does not represent a valid compute sid message") try: self.invalid_context = refpolicy.SecurityContext(recs[5]) self.scontext = refpolicy.SecurityContext(recs[7].split("=")[1]) self.tcontext = refpolicy.SecurityContext(recs[8].split("=")[1]) self.tclass = recs[9].split("=")[1] except: raise ValueError("Split string does not represent a valid compute sid message") def output(self): return "role %s types %s;\n" % (self.role, self.type) # Parser for audit messages class AuditParser: """Parser for audit messages. This class parses audit messages and stores them according to their message type. This is not a general purpose audit message parser - it only extracts selinux related messages. Each audit messages are stored in one of four lists: avc_msgs - avc denial or granted messages. Messages are stored in AVCMessage objects. comput_sid_messages - invalid sid messages. Messages are stored in ComputSidMessage objects. invalid_msgs - selinux related messages that are not valid. Messages are stored in InvalidMessageObjects. policy_load_messages - policy load messages. Messages are stored in PolicyLoadMessage objects. These lists will be reset when a policy load message is seen if AuditParser.last_load_only is set to true. It is assumed that messages are fed to the parser in chronological order - time stamps are not parsed. """ def __init__(self, last_load_only=False): self.__initialize() self.last_load_only = last_load_only def __initialize(self): self.avc_msgs = [] self.compute_sid_msgs = [] self.invalid_msgs = [] self.policy_load_msgs = [] self.path_msgs = [] self.by_header = { } self.check_input_file = False # Low-level parsing function - tries to determine if this audit # message is an SELinux related message and then parses it into # the appropriate AuditMessage subclass. This function deliberately # does not impose policy (e.g., on policy load message) or store # messages to make as simple and reusable as possible. # # Return values: # None - no recognized audit message found in this line # # InvalidMessage - a recognized but invalid message was found. # # AuditMessage (or subclass) - object representing a parsed # and valid audit message. def __parse_line(self, line): # strip("\x1c\x1d\x1e\x85") is only needed for python2 # since str.split() in python3 already does this rec = [x.strip("\x1c\x1d\x1e\x85") for x in line.split()] for i in rec: found = False if i == "avc:" or i == "message=avc:" or i == "msg='avc:": msg = AVCMessage(line) found = True elif i == "security_compute_sid:": msg = ComputeSidMessage(line) found = True elif i == "type=MAC_POLICY_LOAD" or i == "type=1403": msg = PolicyLoadMessage(line) found = True elif i == "type=AVC_PATH": msg = PathMessage(line) found = True elif i == "type=DAEMON_START": msg = DaemonStartMessage(list) found = True if found: self.check_input_file = True try: msg.from_split_string(rec) except ValueError: msg = InvalidMessage(line) return msg return None # Higher-level parse function - take a line, parse it into an # AuditMessage object, and store it in the appropriate list. # This function will optionally reset all of the lists when # it sees a load policy message depending on the value of # self.last_load_only. def __parse(self, line): msg = self.__parse_line(line) if msg is None: return # Append to the correct list if isinstance(msg, PolicyLoadMessage): if self.last_load_only: self.__initialize() elif isinstance(msg, DaemonStartMessage): # We initialize every time the auditd is started. This # is less than ideal, but unfortunately it is the only # way to catch reboots since the initial policy load # by init is not stored in the audit log. if msg.auditd and self.last_load_only: self.__initialize() self.policy_load_msgs.append(msg) elif isinstance(msg, AVCMessage): self.avc_msgs.append(msg) elif isinstance(msg, ComputeSidMessage): self.compute_sid_msgs.append(msg) elif isinstance(msg, InvalidMessage): self.invalid_msgs.append(msg) elif isinstance(msg, PathMessage): self.path_msgs.append(msg) # Group by audit header if msg.header != "": if msg.header in self.by_header: self.by_header[msg.header].append(msg) else: self.by_header[msg.header] = [msg] # Post processing will add additional information from AVC messages # from related messages - only works on messages generated by # the audit system. def __post_process(self): for value in self.by_header.values(): avc = [] path = None for msg in value: if isinstance(msg, PathMessage): path = msg elif isinstance(msg, AVCMessage): avc.append(msg) if len(avc) > 0 and path: for a in avc: a.path = path.path def parse_file(self, input): """Parse the contents of a file object. This method can be called multiple times (along with parse_string).""" line = input.readline() while line: self.__parse(line) line = input.readline() if not self.check_input_file: sys.stderr.write("Nothing to do\n") sys.exit(0) self.__post_process() def parse_string(self, input): """Parse a string containing audit messages - messages should be separated by new lines. This method can be called multiple times (along with parse_file).""" lines = input.split('\n') for l in lines: self.__parse(l) self.__post_process() def to_role(self, role_filter=None): """Return RoleAllowSet statements matching the specified filter Filter out types that match the filer, or all roles Params: role_filter - [optional] Filter object used to filter the output. Returns: Access vector set representing the denied access in the audit logs parsed by this object. """ role_types = access.RoleTypeSet() for cs in self.compute_sid_msgs: if not role_filter or role_filter.filter(cs): role_types.add(cs.invalid_context.role, cs.invalid_context.type) return role_types def to_access(self, avc_filter=None, only_denials=True): """Convert the audit logs access into a an access vector set. Convert the audit logs into an access vector set, optionally filtering the restults with the passed in filter object. Filter objects are object instances with a .filter method that takes and access vector and returns True if the message should be included in the final output and False otherwise. Params: avc_filter - [optional] Filter object used to filter the output. Returns: Access vector set representing the denied access in the audit logs parsed by this object. """ av_set = access.AccessVectorSet() for avc in self.avc_msgs: if avc.denial != True and only_denials: continue if not avc_filter or avc_filter.filter(avc): av = access.AccessVector([avc.scontext.type, avc.tcontext.type, avc.tclass] + avc.accesses) av.data = avc.data av.type = avc.type if avc.ioctlcmd: xperm_set = refpolicy.XpermSet() xperm_set.add(avc.ioctlcmd) av.xperms["ioctl"] = xperm_set av_set.add_av(av, audit_msg=avc) return av_set class AVCTypeFilter: def __init__(self, regex): self.regex = re.compile(regex) def filter(self, avc): if self.regex.match(avc.scontext.type): return True if self.regex.match(avc.tcontext.type): return True return False class ComputeSidTypeFilter: def __init__(self, regex): self.regex = re.compile(regex) def filter(self, avc): if self.regex.match(avc.invalid_context.type): return True if self.regex.match(avc.scontext.type): return True if self.regex.match(avc.tcontext.type): return True return False output.py 0000644 00000012054 15025012421 0006450 0 ustar 00 # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> # # Copyright (C) 2006 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; version 2 only # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # """ Classes and functions for the output of reference policy modules. This module takes a refpolicy.Module object and formats it for output using the ModuleWriter object. By separating the output in this way the other parts of Madison can focus solely on generating policy. This keeps the semantic / syntactic issues cleanly separated from the formatting issues. """ from . import refpolicy from . import util if util.PY3: from .util import cmp class ModuleWriter: def __init__(self): self.fd = None self.module = None self.sort = True self.requires = True def write(self, module, fd): self.module = module if self.sort: sort_filter(self.module) # FIXME - make this handle nesting for node, depth in refpolicy.walktree(self.module, showdepth=True): fd.write("%s\n" % str(node)) # Helper functions for sort_filter - this is all done old school # C style rather than with polymorphic methods because this sorting # is specific to output. It is not necessarily the comparison you # want generally. # Compare two IdSets - we could probably do something clever # with different here, but this works. def id_set_cmp(x, y): xl = util.set_to_list(x) xl.sort() yl = util.set_to_list(y) yl.sort() if len(xl) != len(yl): return cmp(xl[0], yl[0]) for v in zip(xl, yl): if v[0] != v[1]: return cmp(v[0], v[1]) return 0 # Compare two avrules def avrule_cmp(a, b): ret = id_set_cmp(a.src_types, b.src_types) if ret != 0: return ret ret = id_set_cmp(a.tgt_types, b.tgt_types) if ret != 0: return ret ret = id_set_cmp(a.obj_classes, b.obj_classes) if ret != 0: return ret # At this point, who cares - just return something return 0 # Compare two interface calls def ifcall_cmp(a, b): if a.args[0] != b.args[0]: return cmp(a.args[0], b.args[0]) return cmp(a.ifname, b.ifname) # Compare an two avrules or interface calls def rule_cmp(a, b): if isinstance(a, refpolicy.InterfaceCall): if isinstance(b, refpolicy.InterfaceCall): return ifcall_cmp(a, b) else: return id_set_cmp([a.args[0]], b.src_types) else: if isinstance(b, refpolicy.AVRule) or isinstance(b, refpolicy.AVExtRule): return avrule_cmp(a,b) else: return id_set_cmp(a.src_types, [b.args[0]]) def role_type_cmp(a, b): return cmp(a.role, b.role) def sort_filter(module): """Sort and group the output for readability. """ def sort_node(node): c = [] # Module statement for mod in node.module_declarations(): c.append(mod) c.append(refpolicy.Comment()) # Requires for require in node.requires(): c.append(require) c.append(refpolicy.Comment()) # Rules # # We are going to group output by source type (which # we assume is the first argument for interfaces). rules = [] rules.extend(node.avrules()) rules.extend(node.avextrules()) rules.extend(node.interface_calls()) rules.sort(key=util.cmp_to_key(rule_cmp)) cur = None sep_rules = [] for rule in rules: if isinstance(rule, refpolicy.InterfaceCall): x = rule.args[0] else: x = util.first(rule.src_types) if cur != x: if cur: sep_rules.append(refpolicy.Comment()) cur = x comment = refpolicy.Comment() comment.lines.append("============= %s ==============" % cur) sep_rules.append(comment) sep_rules.append(rule) c.extend(sep_rules) ras = [] ras.extend(node.role_types()) ras.sort(key=util.cmp_to_key(role_type_cmp)) if len(ras): comment = refpolicy.Comment() comment.lines.append("============= ROLES ==============") c.append(comment) c.extend(ras) # Everything else for child in node.children: if child not in c: c.append(child) node.children = c for node in module.nodes(): sort_node(node) yacc.py 0000644 00000414144 15025012421 0006035 0 ustar 00 # ----------------------------------------------------------------------------- # ply: yacc.py # # Copyright (C) 2001-2018 # David M. Beazley (Dabeaz LLC) # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are # met: # # * Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # * Neither the name of the David Beazley or Dabeaz LLC may be used to # endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR # A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT # OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, # DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # ----------------------------------------------------------------------------- # # This implements an LR parser that is constructed from grammar rules defined # as Python functions. The grammar is specified by supplying the BNF inside # Python documentation strings. The inspiration for this technique was borrowed # from John Aycock's Spark parsing system. PLY might be viewed as cross between # Spark and the GNU bison utility. # # The current implementation is only somewhat object-oriented. The # LR parser itself is defined in terms of an object (which allows multiple # parsers to co-exist). However, most of the variables used during table # construction are defined in terms of global variables. Users shouldn't # notice unless they are trying to define multiple parsers at the same # time using threads (in which case they should have their head examined). # # This implementation supports both SLR and LALR(1) parsing. LALR(1) # support was originally implemented by Elias Ioup (ezioup@alumni.uchicago.edu), # using the algorithm found in Aho, Sethi, and Ullman "Compilers: Principles, # Techniques, and Tools" (The Dragon Book). LALR(1) has since been replaced # by the more efficient DeRemer and Pennello algorithm. # # :::::::: WARNING ::::::: # # Construction of LR parsing tables is fairly complicated and expensive. # To make this module run fast, a *LOT* of work has been put into # optimization---often at the expensive of readability and what might # consider to be good Python "coding style." Modify the code at your # own risk! # ---------------------------------------------------------------------------- import re import types import sys import os.path import inspect import warnings __version__ = '3.11' __tabversion__ = '3.10' #----------------------------------------------------------------------------- # === User configurable parameters === # # Change these to modify the default behavior of yacc (if you wish) #----------------------------------------------------------------------------- yaccdebug = True # Debugging mode. If set, yacc generates a # a 'parser.out' file in the current directory debug_file = 'parser.out' # Default name of the debugging file tab_module = 'parsetab' # Default name of the table module default_lr = 'LALR' # Default LR table generation method error_count = 3 # Number of symbols that must be shifted to leave recovery mode yaccdevel = False # Set to True if developing yacc. This turns off optimized # implementations of certain functions. resultlimit = 40 # Size limit of results when running in debug mode. pickle_protocol = 0 # Protocol to use when writing pickle files # String type-checking compatibility if sys.version_info[0] < 3: string_types = basestring else: string_types = str MAXINT = sys.maxsize # This object is a stand-in for a logging object created by the # logging module. PLY will use this by default to create things # such as the parser.out file. If a user wants more detailed # information, they can create their own logging object and pass # it into PLY. class PlyLogger(object): def __init__(self, f): self.f = f def debug(self, msg, *args, **kwargs): self.f.write((msg % args) + '\n') info = debug def warning(self, msg, *args, **kwargs): self.f.write('WARNING: ' + (msg % args) + '\n') def error(self, msg, *args, **kwargs): self.f.write('ERROR: ' + (msg % args) + '\n') critical = debug # Null logger is used when no output is generated. Does nothing. class NullLogger(object): def __getattribute__(self, name): return self def __call__(self, *args, **kwargs): return self # Exception raised for yacc-related errors class YaccError(Exception): pass # Format the result message that the parser produces when running in debug mode. def format_result(r): repr_str = repr(r) if '\n' in repr_str: repr_str = repr(repr_str) if len(repr_str) > resultlimit: repr_str = repr_str[:resultlimit] + ' ...' result = '<%s @ 0x%x> (%s)' % (type(r).__name__, id(r), repr_str) return result # Format stack entries when the parser is running in debug mode def format_stack_entry(r): repr_str = repr(r) if '\n' in repr_str: repr_str = repr(repr_str) if len(repr_str) < 16: return repr_str else: return '<%s @ 0x%x>' % (type(r).__name__, id(r)) # Panic mode error recovery support. This feature is being reworked--much of the # code here is to offer a deprecation/backwards compatible transition _errok = None _token = None _restart = None _warnmsg = '''PLY: Don't use global functions errok(), token(), and restart() in p_error(). Instead, invoke the methods on the associated parser instance: def p_error(p): ... # Use parser.errok(), parser.token(), parser.restart() ... parser = yacc.yacc() ''' def errok(): warnings.warn(_warnmsg) return _errok() def restart(): warnings.warn(_warnmsg) return _restart() def token(): warnings.warn(_warnmsg) return _token() # Utility function to call the p_error() function with some deprecation hacks def call_errorfunc(errorfunc, token, parser): global _errok, _token, _restart _errok = parser.errok _token = parser.token _restart = parser.restart r = errorfunc(token) try: del _errok, _token, _restart except NameError: pass return r #----------------------------------------------------------------------------- # === LR Parsing Engine === # # The following classes are used for the LR parser itself. These are not # used during table construction and are independent of the actual LR # table generation algorithm #----------------------------------------------------------------------------- # This class is used to hold non-terminal grammar symbols during parsing. # It normally has the following attributes set: # .type = Grammar symbol type # .value = Symbol value # .lineno = Starting line number # .endlineno = Ending line number (optional, set automatically) # .lexpos = Starting lex position # .endlexpos = Ending lex position (optional, set automatically) class YaccSymbol: def __str__(self): return self.type def __repr__(self): return str(self) # This class is a wrapper around the objects actually passed to each # grammar rule. Index lookup and assignment actually assign the # .value attribute of the underlying YaccSymbol object. # The lineno() method returns the line number of a given # item (or 0 if not defined). The linespan() method returns # a tuple of (startline,endline) representing the range of lines # for a symbol. The lexspan() method returns a tuple (lexpos,endlexpos) # representing the range of positional information for a symbol. class YaccProduction: def __init__(self, s, stack=None): self.slice = s self.stack = stack self.lexer = None self.parser = None def __getitem__(self, n): if isinstance(n, slice): return [s.value for s in self.slice[n]] elif n >= 0: return self.slice[n].value else: return self.stack[n].value def __setitem__(self, n, v): self.slice[n].value = v def __getslice__(self, i, j): return [s.value for s in self.slice[i:j]] def __len__(self): return len(self.slice) def lineno(self, n): return getattr(self.slice[n], 'lineno', 0) def set_lineno(self, n, lineno): self.slice[n].lineno = lineno def linespan(self, n): startline = getattr(self.slice[n], 'lineno', 0) endline = getattr(self.slice[n], 'endlineno', startline) return startline, endline def lexpos(self, n): return getattr(self.slice[n], 'lexpos', 0) def set_lexpos(self, n, lexpos): self.slice[n].lexpos = lexpos def lexspan(self, n): startpos = getattr(self.slice[n], 'lexpos', 0) endpos = getattr(self.slice[n], 'endlexpos', startpos) return startpos, endpos def error(self): raise SyntaxError # ----------------------------------------------------------------------------- # == LRParser == # # The LR Parsing engine. # ----------------------------------------------------------------------------- class LRParser: def __init__(self, lrtab, errorf): self.productions = lrtab.lr_productions self.action = lrtab.lr_action self.goto = lrtab.lr_goto self.errorfunc = errorf self.set_defaulted_states() self.errorok = True def errok(self): self.errorok = True def restart(self): del self.statestack[:] del self.symstack[:] sym = YaccSymbol() sym.type = '$end' self.symstack.append(sym) self.statestack.append(0) # Defaulted state support. # This method identifies parser states where there is only one possible reduction action. # For such states, the parser can make a choose to make a rule reduction without consuming # the next look-ahead token. This delayed invocation of the tokenizer can be useful in # certain kinds of advanced parsing situations where the lexer and parser interact with # each other or change states (i.e., manipulation of scope, lexer states, etc.). # # See: http://www.gnu.org/software/bison/manual/html_node/Default-Reductions.html#Default-Reductions def set_defaulted_states(self): self.defaulted_states = {} for state, actions in self.action.items(): rules = list(actions.values()) if len(rules) == 1 and rules[0] < 0: self.defaulted_states[state] = rules[0] def disable_defaulted_states(self): self.defaulted_states = {} def parse(self, input=None, lexer=None, debug=False, tracking=False, tokenfunc=None): if debug or yaccdevel: if isinstance(debug, int): debug = PlyLogger(sys.stderr) return self.parsedebug(input, lexer, debug, tracking, tokenfunc) elif tracking: return self.parseopt(input, lexer, debug, tracking, tokenfunc) else: return self.parseopt_notrack(input, lexer, debug, tracking, tokenfunc) # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # parsedebug(). # # This is the debugging enabled version of parse(). All changes made to the # parsing engine should be made here. Optimized versions of this function # are automatically created by the ply/ygen.py script. This script cuts out # sections enclosed in markers such as this: # # #--! DEBUG # statements # #--! DEBUG # # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! def parsedebug(self, input=None, lexer=None, debug=False, tracking=False, tokenfunc=None): #--! parsedebug-start lookahead = None # Current lookahead symbol lookaheadstack = [] # Stack of lookahead symbols actions = self.action # Local reference to action table (to avoid lookup on self.) goto = self.goto # Local reference to goto table (to avoid lookup on self.) prod = self.productions # Local reference to production list (to avoid lookup on self.) defaulted_states = self.defaulted_states # Local reference to defaulted states pslice = YaccProduction(None) # Production object passed to grammar rules errorcount = 0 # Used during error recovery #--! DEBUG debug.info('PLY: PARSE DEBUG START') #--! DEBUG # If no lexer was given, we will try to use the lex module if not lexer: from . import lex lexer = lex.lexer # Set up the lexer and parser objects on pslice pslice.lexer = lexer pslice.parser = self # If input was supplied, pass to lexer if input is not None: lexer.input(input) if tokenfunc is None: # Tokenize function get_token = lexer.token else: get_token = tokenfunc # Set the parser() token method (sometimes used in error recovery) self.token = get_token # Set up the state and symbol stacks statestack = [] # Stack of parsing states self.statestack = statestack symstack = [] # Stack of grammar symbols self.symstack = symstack pslice.stack = symstack # Put in the production errtoken = None # Err token # The start state is assumed to be (0,$end) statestack.append(0) sym = YaccSymbol() sym.type = '$end' symstack.append(sym) state = 0 while True: # Get the next symbol on the input. If a lookahead symbol # is already set, we just use that. Otherwise, we'll pull # the next token off of the lookaheadstack or from the lexer #--! DEBUG debug.debug('') debug.debug('State : %s', state) #--! DEBUG if state not in defaulted_states: if not lookahead: if not lookaheadstack: lookahead = get_token() # Get the next token else: lookahead = lookaheadstack.pop() if not lookahead: lookahead = YaccSymbol() lookahead.type = '$end' # Check the action table ltype = lookahead.type t = actions[state].get(ltype) else: t = defaulted_states[state] #--! DEBUG debug.debug('Defaulted state %s: Reduce using %d', state, -t) #--! DEBUG #--! DEBUG debug.debug('Stack : %s', ('%s . %s' % (' '.join([xx.type for xx in symstack][1:]), str(lookahead))).lstrip()) #--! DEBUG if t is not None: if t > 0: # shift a symbol on the stack statestack.append(t) state = t #--! DEBUG debug.debug('Action : Shift and goto state %s', t) #--! DEBUG symstack.append(lookahead) lookahead = None # Decrease error count on successful shift if errorcount: errorcount -= 1 continue if t < 0: # reduce a symbol on the stack, emit a production p = prod[-t] pname = p.name plen = p.len # Get production function sym = YaccSymbol() sym.type = pname # Production name sym.value = None #--! DEBUG if plen: debug.info('Action : Reduce rule [%s] with %s and goto state %d', p.str, '['+','.join([format_stack_entry(_v.value) for _v in symstack[-plen:]])+']', goto[statestack[-1-plen]][pname]) else: debug.info('Action : Reduce rule [%s] with %s and goto state %d', p.str, [], goto[statestack[-1]][pname]) #--! DEBUG if plen: targ = symstack[-plen-1:] targ[0] = sym #--! TRACKING if tracking: t1 = targ[1] sym.lineno = t1.lineno sym.lexpos = t1.lexpos t1 = targ[-1] sym.endlineno = getattr(t1, 'endlineno', t1.lineno) sym.endlexpos = getattr(t1, 'endlexpos', t1.lexpos) #--! TRACKING # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # The code enclosed in this section is duplicated # below as a performance optimization. Make sure # changes get made in both locations. pslice.slice = targ try: # Call the grammar rule with our special slice object del symstack[-plen:] self.state = state p.callable(pslice) del statestack[-plen:] #--! DEBUG debug.info('Result : %s', format_result(pslice[0])) #--! DEBUG symstack.append(sym) state = goto[statestack[-1]][pname] statestack.append(state) except SyntaxError: # If an error was set. Enter error recovery state lookaheadstack.append(lookahead) # Save the current lookahead token symstack.extend(targ[1:-1]) # Put the production slice back on the stack statestack.pop() # Pop back one state (before the reduce) state = statestack[-1] sym.type = 'error' sym.value = 'error' lookahead = sym errorcount = error_count self.errorok = False continue # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! else: #--! TRACKING if tracking: sym.lineno = lexer.lineno sym.lexpos = lexer.lexpos #--! TRACKING targ = [sym] # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # The code enclosed in this section is duplicated # above as a performance optimization. Make sure # changes get made in both locations. pslice.slice = targ try: # Call the grammar rule with our special slice object self.state = state p.callable(pslice) #--! DEBUG debug.info('Result : %s', format_result(pslice[0])) #--! DEBUG symstack.append(sym) state = goto[statestack[-1]][pname] statestack.append(state) except SyntaxError: # If an error was set. Enter error recovery state lookaheadstack.append(lookahead) # Save the current lookahead token statestack.pop() # Pop back one state (before the reduce) state = statestack[-1] sym.type = 'error' sym.value = 'error' lookahead = sym errorcount = error_count self.errorok = False continue # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! if t == 0: n = symstack[-1] result = getattr(n, 'value', None) #--! DEBUG debug.info('Done : Returning %s', format_result(result)) debug.info('PLY: PARSE DEBUG END') #--! DEBUG return result if t is None: #--! DEBUG debug.error('Error : %s', ('%s . %s' % (' '.join([xx.type for xx in symstack][1:]), str(lookahead))).lstrip()) #--! DEBUG # We have some kind of parsing error here. To handle # this, we are going to push the current token onto # the tokenstack and replace it with an 'error' token. # If there are any synchronization rules, they may # catch it. # # In addition to pushing the error token, we call call # the user defined p_error() function if this is the # first syntax error. This function is only called if # errorcount == 0. if errorcount == 0 or self.errorok: errorcount = error_count self.errorok = False errtoken = lookahead if errtoken.type == '$end': errtoken = None # End of file! if self.errorfunc: if errtoken and not hasattr(errtoken, 'lexer'): errtoken.lexer = lexer self.state = state tok = call_errorfunc(self.errorfunc, errtoken, self) if self.errorok: # User must have done some kind of panic # mode recovery on their own. The # returned token is the next lookahead lookahead = tok errtoken = None continue else: if errtoken: if hasattr(errtoken, 'lineno'): lineno = lookahead.lineno else: lineno = 0 if lineno: sys.stderr.write('yacc: Syntax error at line %d, token=%s\n' % (lineno, errtoken.type)) else: sys.stderr.write('yacc: Syntax error, token=%s' % errtoken.type) else: sys.stderr.write('yacc: Parse error in input. EOF\n') return else: errorcount = error_count # case 1: the statestack only has 1 entry on it. If we're in this state, the # entire parse has been rolled back and we're completely hosed. The token is # discarded and we just keep going. if len(statestack) <= 1 and lookahead.type != '$end': lookahead = None errtoken = None state = 0 # Nuke the pushback stack del lookaheadstack[:] continue # case 2: the statestack has a couple of entries on it, but we're # at the end of the file. nuke the top entry and generate an error token # Start nuking entries on the stack if lookahead.type == '$end': # Whoa. We're really hosed here. Bail out return if lookahead.type != 'error': sym = symstack[-1] if sym.type == 'error': # Hmmm. Error is on top of stack, we'll just nuke input # symbol and continue #--! TRACKING if tracking: sym.endlineno = getattr(lookahead, 'lineno', sym.lineno) sym.endlexpos = getattr(lookahead, 'lexpos', sym.lexpos) #--! TRACKING lookahead = None continue # Create the error symbol for the first time and make it the new lookahead symbol t = YaccSymbol() t.type = 'error' if hasattr(lookahead, 'lineno'): t.lineno = t.endlineno = lookahead.lineno if hasattr(lookahead, 'lexpos'): t.lexpos = t.endlexpos = lookahead.lexpos t.value = lookahead lookaheadstack.append(lookahead) lookahead = t else: sym = symstack.pop() #--! TRACKING if tracking: lookahead.lineno = sym.lineno lookahead.lexpos = sym.lexpos #--! TRACKING statestack.pop() state = statestack[-1] continue # Call an error function here raise RuntimeError('yacc: internal parser error!!!\n') #--! parsedebug-end # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # parseopt(). # # Optimized version of parse() method. DO NOT EDIT THIS CODE DIRECTLY! # This code is automatically generated by the ply/ygen.py script. Make # changes to the parsedebug() method instead. # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! def parseopt(self, input=None, lexer=None, debug=False, tracking=False, tokenfunc=None): #--! parseopt-start lookahead = None # Current lookahead symbol lookaheadstack = [] # Stack of lookahead symbols actions = self.action # Local reference to action table (to avoid lookup on self.) goto = self.goto # Local reference to goto table (to avoid lookup on self.) prod = self.productions # Local reference to production list (to avoid lookup on self.) defaulted_states = self.defaulted_states # Local reference to defaulted states pslice = YaccProduction(None) # Production object passed to grammar rules errorcount = 0 # Used during error recovery # If no lexer was given, we will try to use the lex module if not lexer: from . import lex lexer = lex.lexer # Set up the lexer and parser objects on pslice pslice.lexer = lexer pslice.parser = self # If input was supplied, pass to lexer if input is not None: lexer.input(input) if tokenfunc is None: # Tokenize function get_token = lexer.token else: get_token = tokenfunc # Set the parser() token method (sometimes used in error recovery) self.token = get_token # Set up the state and symbol stacks statestack = [] # Stack of parsing states self.statestack = statestack symstack = [] # Stack of grammar symbols self.symstack = symstack pslice.stack = symstack # Put in the production errtoken = None # Err token # The start state is assumed to be (0,$end) statestack.append(0) sym = YaccSymbol() sym.type = '$end' symstack.append(sym) state = 0 while True: # Get the next symbol on the input. If a lookahead symbol # is already set, we just use that. Otherwise, we'll pull # the next token off of the lookaheadstack or from the lexer if state not in defaulted_states: if not lookahead: if not lookaheadstack: lookahead = get_token() # Get the next token else: lookahead = lookaheadstack.pop() if not lookahead: lookahead = YaccSymbol() lookahead.type = '$end' # Check the action table ltype = lookahead.type t = actions[state].get(ltype) else: t = defaulted_states[state] if t is not None: if t > 0: # shift a symbol on the stack statestack.append(t) state = t symstack.append(lookahead) lookahead = None # Decrease error count on successful shift if errorcount: errorcount -= 1 continue if t < 0: # reduce a symbol on the stack, emit a production p = prod[-t] pname = p.name plen = p.len # Get production function sym = YaccSymbol() sym.type = pname # Production name sym.value = None if plen: targ = symstack[-plen-1:] targ[0] = sym #--! TRACKING if tracking: t1 = targ[1] sym.lineno = t1.lineno sym.lexpos = t1.lexpos t1 = targ[-1] sym.endlineno = getattr(t1, 'endlineno', t1.lineno) sym.endlexpos = getattr(t1, 'endlexpos', t1.lexpos) #--! TRACKING # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # The code enclosed in this section is duplicated # below as a performance optimization. Make sure # changes get made in both locations. pslice.slice = targ try: # Call the grammar rule with our special slice object del symstack[-plen:] self.state = state p.callable(pslice) del statestack[-plen:] symstack.append(sym) state = goto[statestack[-1]][pname] statestack.append(state) except SyntaxError: # If an error was set. Enter error recovery state lookaheadstack.append(lookahead) # Save the current lookahead token symstack.extend(targ[1:-1]) # Put the production slice back on the stack statestack.pop() # Pop back one state (before the reduce) state = statestack[-1] sym.type = 'error' sym.value = 'error' lookahead = sym errorcount = error_count self.errorok = False continue # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! else: #--! TRACKING if tracking: sym.lineno = lexer.lineno sym.lexpos = lexer.lexpos #--! TRACKING targ = [sym] # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # The code enclosed in this section is duplicated # above as a performance optimization. Make sure # changes get made in both locations. pslice.slice = targ try: # Call the grammar rule with our special slice object self.state = state p.callable(pslice) symstack.append(sym) state = goto[statestack[-1]][pname] statestack.append(state) except SyntaxError: # If an error was set. Enter error recovery state lookaheadstack.append(lookahead) # Save the current lookahead token statestack.pop() # Pop back one state (before the reduce) state = statestack[-1] sym.type = 'error' sym.value = 'error' lookahead = sym errorcount = error_count self.errorok = False continue # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! if t == 0: n = symstack[-1] result = getattr(n, 'value', None) return result if t is None: # We have some kind of parsing error here. To handle # this, we are going to push the current token onto # the tokenstack and replace it with an 'error' token. # If there are any synchronization rules, they may # catch it. # # In addition to pushing the error token, we call call # the user defined p_error() function if this is the # first syntax error. This function is only called if # errorcount == 0. if errorcount == 0 or self.errorok: errorcount = error_count self.errorok = False errtoken = lookahead if errtoken.type == '$end': errtoken = None # End of file! if self.errorfunc: if errtoken and not hasattr(errtoken, 'lexer'): errtoken.lexer = lexer self.state = state tok = call_errorfunc(self.errorfunc, errtoken, self) if self.errorok: # User must have done some kind of panic # mode recovery on their own. The # returned token is the next lookahead lookahead = tok errtoken = None continue else: if errtoken: if hasattr(errtoken, 'lineno'): lineno = lookahead.lineno else: lineno = 0 if lineno: sys.stderr.write('yacc: Syntax error at line %d, token=%s\n' % (lineno, errtoken.type)) else: sys.stderr.write('yacc: Syntax error, token=%s' % errtoken.type) else: sys.stderr.write('yacc: Parse error in input. EOF\n') return else: errorcount = error_count # case 1: the statestack only has 1 entry on it. If we're in this state, the # entire parse has been rolled back and we're completely hosed. The token is # discarded and we just keep going. if len(statestack) <= 1 and lookahead.type != '$end': lookahead = None errtoken = None state = 0 # Nuke the pushback stack del lookaheadstack[:] continue # case 2: the statestack has a couple of entries on it, but we're # at the end of the file. nuke the top entry and generate an error token # Start nuking entries on the stack if lookahead.type == '$end': # Whoa. We're really hosed here. Bail out return if lookahead.type != 'error': sym = symstack[-1] if sym.type == 'error': # Hmmm. Error is on top of stack, we'll just nuke input # symbol and continue #--! TRACKING if tracking: sym.endlineno = getattr(lookahead, 'lineno', sym.lineno) sym.endlexpos = getattr(lookahead, 'lexpos', sym.lexpos) #--! TRACKING lookahead = None continue # Create the error symbol for the first time and make it the new lookahead symbol t = YaccSymbol() t.type = 'error' if hasattr(lookahead, 'lineno'): t.lineno = t.endlineno = lookahead.lineno if hasattr(lookahead, 'lexpos'): t.lexpos = t.endlexpos = lookahead.lexpos t.value = lookahead lookaheadstack.append(lookahead) lookahead = t else: sym = symstack.pop() #--! TRACKING if tracking: lookahead.lineno = sym.lineno lookahead.lexpos = sym.lexpos #--! TRACKING statestack.pop() state = statestack[-1] continue # Call an error function here raise RuntimeError('yacc: internal parser error!!!\n') #--! parseopt-end # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # parseopt_notrack(). # # Optimized version of parseopt() with line number tracking removed. # DO NOT EDIT THIS CODE DIRECTLY. This code is automatically generated # by the ply/ygen.py script. Make changes to the parsedebug() method instead. # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! def parseopt_notrack(self, input=None, lexer=None, debug=False, tracking=False, tokenfunc=None): #--! parseopt-notrack-start lookahead = None # Current lookahead symbol lookaheadstack = [] # Stack of lookahead symbols actions = self.action # Local reference to action table (to avoid lookup on self.) goto = self.goto # Local reference to goto table (to avoid lookup on self.) prod = self.productions # Local reference to production list (to avoid lookup on self.) defaulted_states = self.defaulted_states # Local reference to defaulted states pslice = YaccProduction(None) # Production object passed to grammar rules errorcount = 0 # Used during error recovery # If no lexer was given, we will try to use the lex module if not lexer: from . import lex lexer = lex.lexer # Set up the lexer and parser objects on pslice pslice.lexer = lexer pslice.parser = self # If input was supplied, pass to lexer if input is not None: lexer.input(input) if tokenfunc is None: # Tokenize function get_token = lexer.token else: get_token = tokenfunc # Set the parser() token method (sometimes used in error recovery) self.token = get_token # Set up the state and symbol stacks statestack = [] # Stack of parsing states self.statestack = statestack symstack = [] # Stack of grammar symbols self.symstack = symstack pslice.stack = symstack # Put in the production errtoken = None # Err token # The start state is assumed to be (0,$end) statestack.append(0) sym = YaccSymbol() sym.type = '$end' symstack.append(sym) state = 0 while True: # Get the next symbol on the input. If a lookahead symbol # is already set, we just use that. Otherwise, we'll pull # the next token off of the lookaheadstack or from the lexer if state not in defaulted_states: if not lookahead: if not lookaheadstack: lookahead = get_token() # Get the next token else: lookahead = lookaheadstack.pop() if not lookahead: lookahead = YaccSymbol() lookahead.type = '$end' # Check the action table ltype = lookahead.type t = actions[state].get(ltype) else: t = defaulted_states[state] if t is not None: if t > 0: # shift a symbol on the stack statestack.append(t) state = t symstack.append(lookahead) lookahead = None # Decrease error count on successful shift if errorcount: errorcount -= 1 continue if t < 0: # reduce a symbol on the stack, emit a production p = prod[-t] pname = p.name plen = p.len # Get production function sym = YaccSymbol() sym.type = pname # Production name sym.value = None if plen: targ = symstack[-plen-1:] targ[0] = sym # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # The code enclosed in this section is duplicated # below as a performance optimization. Make sure # changes get made in both locations. pslice.slice = targ try: # Call the grammar rule with our special slice object del symstack[-plen:] self.state = state p.callable(pslice) del statestack[-plen:] symstack.append(sym) state = goto[statestack[-1]][pname] statestack.append(state) except SyntaxError: # If an error was set. Enter error recovery state lookaheadstack.append(lookahead) # Save the current lookahead token symstack.extend(targ[1:-1]) # Put the production slice back on the stack statestack.pop() # Pop back one state (before the reduce) state = statestack[-1] sym.type = 'error' sym.value = 'error' lookahead = sym errorcount = error_count self.errorok = False continue # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! else: targ = [sym] # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # The code enclosed in this section is duplicated # above as a performance optimization. Make sure # changes get made in both locations. pslice.slice = targ try: # Call the grammar rule with our special slice object self.state = state p.callable(pslice) symstack.append(sym) state = goto[statestack[-1]][pname] statestack.append(state) except SyntaxError: # If an error was set. Enter error recovery state lookaheadstack.append(lookahead) # Save the current lookahead token statestack.pop() # Pop back one state (before the reduce) state = statestack[-1] sym.type = 'error' sym.value = 'error' lookahead = sym errorcount = error_count self.errorok = False continue # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! if t == 0: n = symstack[-1] result = getattr(n, 'value', None) return result if t is None: # We have some kind of parsing error here. To handle # this, we are going to push the current token onto # the tokenstack and replace it with an 'error' token. # If there are any synchronization rules, they may # catch it. # # In addition to pushing the error token, we call call # the user defined p_error() function if this is the # first syntax error. This function is only called if # errorcount == 0. if errorcount == 0 or self.errorok: errorcount = error_count self.errorok = False errtoken = lookahead if errtoken.type == '$end': errtoken = None # End of file! if self.errorfunc: if errtoken and not hasattr(errtoken, 'lexer'): errtoken.lexer = lexer self.state = state tok = call_errorfunc(self.errorfunc, errtoken, self) if self.errorok: # User must have done some kind of panic # mode recovery on their own. The # returned token is the next lookahead lookahead = tok errtoken = None continue else: if errtoken: if hasattr(errtoken, 'lineno'): lineno = lookahead.lineno else: lineno = 0 if lineno: sys.stderr.write('yacc: Syntax error at line %d, token=%s\n' % (lineno, errtoken.type)) else: sys.stderr.write('yacc: Syntax error, token=%s' % errtoken.type) else: sys.stderr.write('yacc: Parse error in input. EOF\n') return else: errorcount = error_count # case 1: the statestack only has 1 entry on it. If we're in this state, the # entire parse has been rolled back and we're completely hosed. The token is # discarded and we just keep going. if len(statestack) <= 1 and lookahead.type != '$end': lookahead = None errtoken = None state = 0 # Nuke the pushback stack del lookaheadstack[:] continue # case 2: the statestack has a couple of entries on it, but we're # at the end of the file. nuke the top entry and generate an error token # Start nuking entries on the stack if lookahead.type == '$end': # Whoa. We're really hosed here. Bail out return if lookahead.type != 'error': sym = symstack[-1] if sym.type == 'error': # Hmmm. Error is on top of stack, we'll just nuke input # symbol and continue lookahead = None continue # Create the error symbol for the first time and make it the new lookahead symbol t = YaccSymbol() t.type = 'error' if hasattr(lookahead, 'lineno'): t.lineno = t.endlineno = lookahead.lineno if hasattr(lookahead, 'lexpos'): t.lexpos = t.endlexpos = lookahead.lexpos t.value = lookahead lookaheadstack.append(lookahead) lookahead = t else: sym = symstack.pop() statestack.pop() state = statestack[-1] continue # Call an error function here raise RuntimeError('yacc: internal parser error!!!\n') #--! parseopt-notrack-end # ----------------------------------------------------------------------------- # === Grammar Representation === # # The following functions, classes, and variables are used to represent and # manipulate the rules that make up a grammar. # ----------------------------------------------------------------------------- # regex matching identifiers _is_identifier = re.compile(r'^[a-zA-Z0-9_-]+$') # ----------------------------------------------------------------------------- # class Production: # # This class stores the raw information about a single production or grammar rule. # A grammar rule refers to a specification such as this: # # expr : expr PLUS term # # Here are the basic attributes defined on all productions # # name - Name of the production. For example 'expr' # prod - A list of symbols on the right side ['expr','PLUS','term'] # prec - Production precedence level # number - Production number. # func - Function that executes on reduce # file - File where production function is defined # lineno - Line number where production function is defined # # The following attributes are defined or optional. # # len - Length of the production (number of symbols on right hand side) # usyms - Set of unique symbols found in the production # ----------------------------------------------------------------------------- class Production(object): reduced = 0 def __init__(self, number, name, prod, precedence=('right', 0), func=None, file='', line=0): self.name = name self.prod = tuple(prod) self.number = number self.func = func self.callable = None self.file = file self.line = line self.prec = precedence # Internal settings used during table construction self.len = len(self.prod) # Length of the production # Create a list of unique production symbols used in the production self.usyms = [] for s in self.prod: if s not in self.usyms: self.usyms.append(s) # List of all LR items for the production self.lr_items = [] self.lr_next = None # Create a string representation if self.prod: self.str = '%s -> %s' % (self.name, ' '.join(self.prod)) else: self.str = '%s -> <empty>' % self.name def __str__(self): return self.str def __repr__(self): return 'Production(' + str(self) + ')' def __len__(self): return len(self.prod) def __nonzero__(self): return 1 def __getitem__(self, index): return self.prod[index] # Return the nth lr_item from the production (or None if at the end) def lr_item(self, n): if n > len(self.prod): return None p = LRItem(self, n) # Precompute the list of productions immediately following. try: p.lr_after = self.Prodnames[p.prod[n+1]] except (IndexError, KeyError): p.lr_after = [] try: p.lr_before = p.prod[n-1] except IndexError: p.lr_before = None return p # Bind the production function name to a callable def bind(self, pdict): if self.func: self.callable = pdict[self.func] # This class serves as a minimal standin for Production objects when # reading table data from files. It only contains information # actually used by the LR parsing engine, plus some additional # debugging information. class MiniProduction(object): def __init__(self, str, name, len, func, file, line): self.name = name self.len = len self.func = func self.callable = None self.file = file self.line = line self.str = str def __str__(self): return self.str def __repr__(self): return 'MiniProduction(%s)' % self.str # Bind the production function name to a callable def bind(self, pdict): if self.func: self.callable = pdict[self.func] # ----------------------------------------------------------------------------- # class LRItem # # This class represents a specific stage of parsing a production rule. For # example: # # expr : expr . PLUS term # # In the above, the "." represents the current location of the parse. Here # basic attributes: # # name - Name of the production. For example 'expr' # prod - A list of symbols on the right side ['expr','.', 'PLUS','term'] # number - Production number. # # lr_next Next LR item. Example, if we are ' expr -> expr . PLUS term' # then lr_next refers to 'expr -> expr PLUS . term' # lr_index - LR item index (location of the ".") in the prod list. # lookaheads - LALR lookahead symbols for this item # len - Length of the production (number of symbols on right hand side) # lr_after - List of all productions that immediately follow # lr_before - Grammar symbol immediately before # ----------------------------------------------------------------------------- class LRItem(object): def __init__(self, p, n): self.name = p.name self.prod = list(p.prod) self.number = p.number self.lr_index = n self.lookaheads = {} self.prod.insert(n, '.') self.prod = tuple(self.prod) self.len = len(self.prod) self.usyms = p.usyms def __str__(self): if self.prod: s = '%s -> %s' % (self.name, ' '.join(self.prod)) else: s = '%s -> <empty>' % self.name return s def __repr__(self): return 'LRItem(' + str(self) + ')' # ----------------------------------------------------------------------------- # rightmost_terminal() # # Return the rightmost terminal from a list of symbols. Used in add_production() # ----------------------------------------------------------------------------- def rightmost_terminal(symbols, terminals): i = len(symbols) - 1 while i >= 0: if symbols[i] in terminals: return symbols[i] i -= 1 return None # ----------------------------------------------------------------------------- # === GRAMMAR CLASS === # # The following class represents the contents of the specified grammar along # with various computed properties such as first sets, follow sets, LR items, etc. # This data is used for critical parts of the table generation process later. # ----------------------------------------------------------------------------- class GrammarError(YaccError): pass class Grammar(object): def __init__(self, terminals): self.Productions = [None] # A list of all of the productions. The first # entry is always reserved for the purpose of # building an augmented grammar self.Prodnames = {} # A dictionary mapping the names of nonterminals to a list of all # productions of that nonterminal. self.Prodmap = {} # A dictionary that is only used to detect duplicate # productions. self.Terminals = {} # A dictionary mapping the names of terminal symbols to a # list of the rules where they are used. for term in terminals: self.Terminals[term] = [] self.Terminals['error'] = [] self.Nonterminals = {} # A dictionary mapping names of nonterminals to a list # of rule numbers where they are used. self.First = {} # A dictionary of precomputed FIRST(x) symbols self.Follow = {} # A dictionary of precomputed FOLLOW(x) symbols self.Precedence = {} # Precedence rules for each terminal. Contains tuples of the # form ('right',level) or ('nonassoc', level) or ('left',level) self.UsedPrecedence = set() # Precedence rules that were actually used by the grammar. # This is only used to provide error checking and to generate # a warning about unused precedence rules. self.Start = None # Starting symbol for the grammar def __len__(self): return len(self.Productions) def __getitem__(self, index): return self.Productions[index] # ----------------------------------------------------------------------------- # set_precedence() # # Sets the precedence for a given terminal. assoc is the associativity such as # 'left','right', or 'nonassoc'. level is a numeric level. # # ----------------------------------------------------------------------------- def set_precedence(self, term, assoc, level): assert self.Productions == [None], 'Must call set_precedence() before add_production()' if term in self.Precedence: raise GrammarError('Precedence already specified for terminal %r' % term) if assoc not in ['left', 'right', 'nonassoc']: raise GrammarError("Associativity must be one of 'left','right', or 'nonassoc'") self.Precedence[term] = (assoc, level) # ----------------------------------------------------------------------------- # add_production() # # Given an action function, this function assembles a production rule and # computes its precedence level. # # The production rule is supplied as a list of symbols. For example, # a rule such as 'expr : expr PLUS term' has a production name of 'expr' and # symbols ['expr','PLUS','term']. # # Precedence is determined by the precedence of the right-most non-terminal # or the precedence of a terminal specified by %prec. # # A variety of error checks are performed to make sure production symbols # are valid and that %prec is used correctly. # ----------------------------------------------------------------------------- def add_production(self, prodname, syms, func=None, file='', line=0): if prodname in self.Terminals: raise GrammarError('%s:%d: Illegal rule name %r. Already defined as a token' % (file, line, prodname)) if prodname == 'error': raise GrammarError('%s:%d: Illegal rule name %r. error is a reserved word' % (file, line, prodname)) if not _is_identifier.match(prodname): raise GrammarError('%s:%d: Illegal rule name %r' % (file, line, prodname)) # Look for literal tokens for n, s in enumerate(syms): if s[0] in "'\"": try: c = eval(s) if (len(c) > 1): raise GrammarError('%s:%d: Literal token %s in rule %r may only be a single character' % (file, line, s, prodname)) if c not in self.Terminals: self.Terminals[c] = [] syms[n] = c continue except SyntaxError: pass if not _is_identifier.match(s) and s != '%prec': raise GrammarError('%s:%d: Illegal name %r in rule %r' % (file, line, s, prodname)) # Determine the precedence level if '%prec' in syms: if syms[-1] == '%prec': raise GrammarError('%s:%d: Syntax error. Nothing follows %%prec' % (file, line)) if syms[-2] != '%prec': raise GrammarError('%s:%d: Syntax error. %%prec can only appear at the end of a grammar rule' % (file, line)) precname = syms[-1] prodprec = self.Precedence.get(precname) if not prodprec: raise GrammarError('%s:%d: Nothing known about the precedence of %r' % (file, line, precname)) else: self.UsedPrecedence.add(precname) del syms[-2:] # Drop %prec from the rule else: # If no %prec, precedence is determined by the rightmost terminal symbol precname = rightmost_terminal(syms, self.Terminals) prodprec = self.Precedence.get(precname, ('right', 0)) # See if the rule is already in the rulemap map = '%s -> %s' % (prodname, syms) if map in self.Prodmap: m = self.Prodmap[map] raise GrammarError('%s:%d: Duplicate rule %s. ' % (file, line, m) + 'Previous definition at %s:%d' % (m.file, m.line)) # From this point on, everything is valid. Create a new Production instance pnumber = len(self.Productions) if prodname not in self.Nonterminals: self.Nonterminals[prodname] = [] # Add the production number to Terminals and Nonterminals for t in syms: if t in self.Terminals: self.Terminals[t].append(pnumber) else: if t not in self.Nonterminals: self.Nonterminals[t] = [] self.Nonterminals[t].append(pnumber) # Create a production and add it to the list of productions p = Production(pnumber, prodname, syms, prodprec, func, file, line) self.Productions.append(p) self.Prodmap[map] = p # Add to the global productions list try: self.Prodnames[prodname].append(p) except KeyError: self.Prodnames[prodname] = [p] # ----------------------------------------------------------------------------- # set_start() # # Sets the starting symbol and creates the augmented grammar. Production # rule 0 is S' -> start where start is the start symbol. # ----------------------------------------------------------------------------- def set_start(self, start=None): if not start: start = self.Productions[1].name if start not in self.Nonterminals: raise GrammarError('start symbol %s undefined' % start) self.Productions[0] = Production(0, "S'", [start]) self.Nonterminals[start].append(0) self.Start = start # ----------------------------------------------------------------------------- # find_unreachable() # # Find all of the nonterminal symbols that can't be reached from the starting # symbol. Returns a list of nonterminals that can't be reached. # ----------------------------------------------------------------------------- def find_unreachable(self): # Mark all symbols that are reachable from a symbol s def mark_reachable_from(s): if s in reachable: return reachable.add(s) for p in self.Prodnames.get(s, []): for r in p.prod: mark_reachable_from(r) reachable = set() mark_reachable_from(self.Productions[0].prod[0]) return [s for s in self.Nonterminals if s not in reachable] # ----------------------------------------------------------------------------- # infinite_cycles() # # This function looks at the various parsing rules and tries to detect # infinite recursion cycles (grammar rules where there is no possible way # to derive a string of only terminals). # ----------------------------------------------------------------------------- def infinite_cycles(self): terminates = {} # Terminals: for t in self.Terminals: terminates[t] = True terminates['$end'] = True # Nonterminals: # Initialize to false: for n in self.Nonterminals: terminates[n] = False # Then propagate termination until no change: while True: some_change = False for (n, pl) in self.Prodnames.items(): # Nonterminal n terminates iff any of its productions terminates. for p in pl: # Production p terminates iff all of its rhs symbols terminate. for s in p.prod: if not terminates[s]: # The symbol s does not terminate, # so production p does not terminate. p_terminates = False break else: # didn't break from the loop, # so every symbol s terminates # so production p terminates. p_terminates = True if p_terminates: # symbol n terminates! if not terminates[n]: terminates[n] = True some_change = True # Don't need to consider any more productions for this n. break if not some_change: break infinite = [] for (s, term) in terminates.items(): if not term: if s not in self.Prodnames and s not in self.Terminals and s != 'error': # s is used-but-not-defined, and we've already warned of that, # so it would be overkill to say that it's also non-terminating. pass else: infinite.append(s) return infinite # ----------------------------------------------------------------------------- # undefined_symbols() # # Find all symbols that were used the grammar, but not defined as tokens or # grammar rules. Returns a list of tuples (sym, prod) where sym in the symbol # and prod is the production where the symbol was used. # ----------------------------------------------------------------------------- def undefined_symbols(self): result = [] for p in self.Productions: if not p: continue for s in p.prod: if s not in self.Prodnames and s not in self.Terminals and s != 'error': result.append((s, p)) return result # ----------------------------------------------------------------------------- # unused_terminals() # # Find all terminals that were defined, but not used by the grammar. Returns # a list of all symbols. # ----------------------------------------------------------------------------- def unused_terminals(self): unused_tok = [] for s, v in self.Terminals.items(): if s != 'error' and not v: unused_tok.append(s) return unused_tok # ------------------------------------------------------------------------------ # unused_rules() # # Find all grammar rules that were defined, but not used (maybe not reachable) # Returns a list of productions. # ------------------------------------------------------------------------------ def unused_rules(self): unused_prod = [] for s, v in self.Nonterminals.items(): if not v: p = self.Prodnames[s][0] unused_prod.append(p) return unused_prod # ----------------------------------------------------------------------------- # unused_precedence() # # Returns a list of tuples (term,precedence) corresponding to precedence # rules that were never used by the grammar. term is the name of the terminal # on which precedence was applied and precedence is a string such as 'left' or # 'right' corresponding to the type of precedence. # ----------------------------------------------------------------------------- def unused_precedence(self): unused = [] for termname in self.Precedence: if not (termname in self.Terminals or termname in self.UsedPrecedence): unused.append((termname, self.Precedence[termname][0])) return unused # ------------------------------------------------------------------------- # _first() # # Compute the value of FIRST1(beta) where beta is a tuple of symbols. # # During execution of compute_first1, the result may be incomplete. # Afterward (e.g., when called from compute_follow()), it will be complete. # ------------------------------------------------------------------------- def _first(self, beta): # We are computing First(x1,x2,x3,...,xn) result = [] for x in beta: x_produces_empty = False # Add all the non-<empty> symbols of First[x] to the result. for f in self.First[x]: if f == '<empty>': x_produces_empty = True else: if f not in result: result.append(f) if x_produces_empty: # We have to consider the next x in beta, # i.e. stay in the loop. pass else: # We don't have to consider any further symbols in beta. break else: # There was no 'break' from the loop, # so x_produces_empty was true for all x in beta, # so beta produces empty as well. result.append('<empty>') return result # ------------------------------------------------------------------------- # compute_first() # # Compute the value of FIRST1(X) for all symbols # ------------------------------------------------------------------------- def compute_first(self): if self.First: return self.First # Terminals: for t in self.Terminals: self.First[t] = [t] self.First['$end'] = ['$end'] # Nonterminals: # Initialize to the empty set: for n in self.Nonterminals: self.First[n] = [] # Then propagate symbols until no change: while True: some_change = False for n in self.Nonterminals: for p in self.Prodnames[n]: for f in self._first(p.prod): if f not in self.First[n]: self.First[n].append(f) some_change = True if not some_change: break return self.First # --------------------------------------------------------------------- # compute_follow() # # Computes all of the follow sets for every non-terminal symbol. The # follow set is the set of all symbols that might follow a given # non-terminal. See the Dragon book, 2nd Ed. p. 189. # --------------------------------------------------------------------- def compute_follow(self, start=None): # If already computed, return the result if self.Follow: return self.Follow # If first sets not computed yet, do that first. if not self.First: self.compute_first() # Add '$end' to the follow list of the start symbol for k in self.Nonterminals: self.Follow[k] = [] if not start: start = self.Productions[1].name self.Follow[start] = ['$end'] while True: didadd = False for p in self.Productions[1:]: # Here is the production set for i, B in enumerate(p.prod): if B in self.Nonterminals: # Okay. We got a non-terminal in a production fst = self._first(p.prod[i+1:]) hasempty = False for f in fst: if f != '<empty>' and f not in self.Follow[B]: self.Follow[B].append(f) didadd = True if f == '<empty>': hasempty = True if hasempty or i == (len(p.prod)-1): # Add elements of follow(a) to follow(b) for f in self.Follow[p.name]: if f not in self.Follow[B]: self.Follow[B].append(f) didadd = True if not didadd: break return self.Follow # ----------------------------------------------------------------------------- # build_lritems() # # This function walks the list of productions and builds a complete set of the # LR items. The LR items are stored in two ways: First, they are uniquely # numbered and placed in the list _lritems. Second, a linked list of LR items # is built for each production. For example: # # E -> E PLUS E # # Creates the list # # [E -> . E PLUS E, E -> E . PLUS E, E -> E PLUS . E, E -> E PLUS E . ] # ----------------------------------------------------------------------------- def build_lritems(self): for p in self.Productions: lastlri = p i = 0 lr_items = [] while True: if i > len(p): lri = None else: lri = LRItem(p, i) # Precompute the list of productions immediately following try: lri.lr_after = self.Prodnames[lri.prod[i+1]] except (IndexError, KeyError): lri.lr_after = [] try: lri.lr_before = lri.prod[i-1] except IndexError: lri.lr_before = None lastlri.lr_next = lri if not lri: break lr_items.append(lri) lastlri = lri i += 1 p.lr_items = lr_items # ----------------------------------------------------------------------------- # == Class LRTable == # # This basic class represents a basic table of LR parsing information. # Methods for generating the tables are not defined here. They are defined # in the derived class LRGeneratedTable. # ----------------------------------------------------------------------------- class VersionError(YaccError): pass class LRTable(object): def __init__(self): self.lr_action = None self.lr_goto = None self.lr_productions = None self.lr_method = None def read_table(self, module): if isinstance(module, types.ModuleType): parsetab = module else: exec('import %s' % module) parsetab = sys.modules[module] if parsetab._tabversion != __tabversion__: raise VersionError('yacc table file version is out of date') self.lr_action = parsetab._lr_action self.lr_goto = parsetab._lr_goto self.lr_productions = [] for p in parsetab._lr_productions: self.lr_productions.append(MiniProduction(*p)) self.lr_method = parsetab._lr_method return parsetab._lr_signature def read_pickle(self, filename): try: import cPickle as pickle except ImportError: import pickle if not os.path.exists(filename): raise ImportError in_f = open(filename, 'rb') tabversion = pickle.load(in_f) if tabversion != __tabversion__: raise VersionError('yacc table file version is out of date') self.lr_method = pickle.load(in_f) signature = pickle.load(in_f) self.lr_action = pickle.load(in_f) self.lr_goto = pickle.load(in_f) productions = pickle.load(in_f) self.lr_productions = [] for p in productions: self.lr_productions.append(MiniProduction(*p)) in_f.close() return signature # Bind all production function names to callable objects in pdict def bind_callables(self, pdict): for p in self.lr_productions: p.bind(pdict) # ----------------------------------------------------------------------------- # === LR Generator === # # The following classes and functions are used to generate LR parsing tables on # a grammar. # ----------------------------------------------------------------------------- # ----------------------------------------------------------------------------- # digraph() # traverse() # # The following two functions are used to compute set valued functions # of the form: # # F(x) = F'(x) U U{F(y) | x R y} # # This is used to compute the values of Read() sets as well as FOLLOW sets # in LALR(1) generation. # # Inputs: X - An input set # R - A relation # FP - Set-valued function # ------------------------------------------------------------------------------ def digraph(X, R, FP): N = {} for x in X: N[x] = 0 stack = [] F = {} for x in X: if N[x] == 0: traverse(x, N, stack, F, X, R, FP) return F def traverse(x, N, stack, F, X, R, FP): stack.append(x) d = len(stack) N[x] = d F[x] = FP(x) # F(X) <- F'(x) rel = R(x) # Get y's related to x for y in rel: if N[y] == 0: traverse(y, N, stack, F, X, R, FP) N[x] = min(N[x], N[y]) for a in F.get(y, []): if a not in F[x]: F[x].append(a) if N[x] == d: N[stack[-1]] = MAXINT F[stack[-1]] = F[x] element = stack.pop() while element != x: N[stack[-1]] = MAXINT F[stack[-1]] = F[x] element = stack.pop() class LALRError(YaccError): pass # ----------------------------------------------------------------------------- # == LRGeneratedTable == # # This class implements the LR table generation algorithm. There are no # public methods except for write() # ----------------------------------------------------------------------------- class LRGeneratedTable(LRTable): def __init__(self, grammar, method='LALR', log=None): if method not in ['SLR', 'LALR']: raise LALRError('Unsupported method %s' % method) self.grammar = grammar self.lr_method = method # Set up the logger if not log: log = NullLogger() self.log = log # Internal attributes self.lr_action = {} # Action table self.lr_goto = {} # Goto table self.lr_productions = grammar.Productions # Copy of grammar Production array self.lr_goto_cache = {} # Cache of computed gotos self.lr0_cidhash = {} # Cache of closures self._add_count = 0 # Internal counter used to detect cycles # Diagonistic information filled in by the table generator self.sr_conflict = 0 self.rr_conflict = 0 self.conflicts = [] # List of conflicts self.sr_conflicts = [] self.rr_conflicts = [] # Build the tables self.grammar.build_lritems() self.grammar.compute_first() self.grammar.compute_follow() self.lr_parse_table() # Compute the LR(0) closure operation on I, where I is a set of LR(0) items. def lr0_closure(self, I): self._add_count += 1 # Add everything in I to J J = I[:] didadd = True while didadd: didadd = False for j in J: for x in j.lr_after: if getattr(x, 'lr0_added', 0) == self._add_count: continue # Add B --> .G to J J.append(x.lr_next) x.lr0_added = self._add_count didadd = True return J # Compute the LR(0) goto function goto(I,X) where I is a set # of LR(0) items and X is a grammar symbol. This function is written # in a way that guarantees uniqueness of the generated goto sets # (i.e. the same goto set will never be returned as two different Python # objects). With uniqueness, we can later do fast set comparisons using # id(obj) instead of element-wise comparison. def lr0_goto(self, I, x): # First we look for a previously cached entry g = self.lr_goto_cache.get((id(I), x)) if g: return g # Now we generate the goto set in a way that guarantees uniqueness # of the result s = self.lr_goto_cache.get(x) if not s: s = {} self.lr_goto_cache[x] = s gs = [] for p in I: n = p.lr_next if n and n.lr_before == x: s1 = s.get(id(n)) if not s1: s1 = {} s[id(n)] = s1 gs.append(n) s = s1 g = s.get('$end') if not g: if gs: g = self.lr0_closure(gs) s['$end'] = g else: s['$end'] = gs self.lr_goto_cache[(id(I), x)] = g return g # Compute the LR(0) sets of item function def lr0_items(self): C = [self.lr0_closure([self.grammar.Productions[0].lr_next])] i = 0 for I in C: self.lr0_cidhash[id(I)] = i i += 1 # Loop over the items in C and each grammar symbols i = 0 while i < len(C): I = C[i] i += 1 # Collect all of the symbols that could possibly be in the goto(I,X) sets asyms = {} for ii in I: for s in ii.usyms: asyms[s] = None for x in asyms: g = self.lr0_goto(I, x) if not g or id(g) in self.lr0_cidhash: continue self.lr0_cidhash[id(g)] = len(C) C.append(g) return C # ----------------------------------------------------------------------------- # ==== LALR(1) Parsing ==== # # LALR(1) parsing is almost exactly the same as SLR except that instead of # relying upon Follow() sets when performing reductions, a more selective # lookahead set that incorporates the state of the LR(0) machine is utilized. # Thus, we mainly just have to focus on calculating the lookahead sets. # # The method used here is due to DeRemer and Pennelo (1982). # # DeRemer, F. L., and T. J. Pennelo: "Efficient Computation of LALR(1) # Lookahead Sets", ACM Transactions on Programming Languages and Systems, # Vol. 4, No. 4, Oct. 1982, pp. 615-649 # # Further details can also be found in: # # J. Tremblay and P. Sorenson, "The Theory and Practice of Compiler Writing", # McGraw-Hill Book Company, (1985). # # ----------------------------------------------------------------------------- # ----------------------------------------------------------------------------- # compute_nullable_nonterminals() # # Creates a dictionary containing all of the non-terminals that might produce # an empty production. # ----------------------------------------------------------------------------- def compute_nullable_nonterminals(self): nullable = set() num_nullable = 0 while True: for p in self.grammar.Productions[1:]: if p.len == 0: nullable.add(p.name) continue for t in p.prod: if t not in nullable: break else: nullable.add(p.name) if len(nullable) == num_nullable: break num_nullable = len(nullable) return nullable # ----------------------------------------------------------------------------- # find_nonterminal_trans(C) # # Given a set of LR(0) items, this functions finds all of the non-terminal # transitions. These are transitions in which a dot appears immediately before # a non-terminal. Returns a list of tuples of the form (state,N) where state # is the state number and N is the nonterminal symbol. # # The input C is the set of LR(0) items. # ----------------------------------------------------------------------------- def find_nonterminal_transitions(self, C): trans = [] for stateno, state in enumerate(C): for p in state: if p.lr_index < p.len - 1: t = (stateno, p.prod[p.lr_index+1]) if t[1] in self.grammar.Nonterminals: if t not in trans: trans.append(t) return trans # ----------------------------------------------------------------------------- # dr_relation() # # Computes the DR(p,A) relationships for non-terminal transitions. The input # is a tuple (state,N) where state is a number and N is a nonterminal symbol. # # Returns a list of terminals. # ----------------------------------------------------------------------------- def dr_relation(self, C, trans, nullable): state, N = trans terms = [] g = self.lr0_goto(C[state], N) for p in g: if p.lr_index < p.len - 1: a = p.prod[p.lr_index+1] if a in self.grammar.Terminals: if a not in terms: terms.append(a) # This extra bit is to handle the start state if state == 0 and N == self.grammar.Productions[0].prod[0]: terms.append('$end') return terms # ----------------------------------------------------------------------------- # reads_relation() # # Computes the READS() relation (p,A) READS (t,C). # ----------------------------------------------------------------------------- def reads_relation(self, C, trans, empty): # Look for empty transitions rel = [] state, N = trans g = self.lr0_goto(C[state], N) j = self.lr0_cidhash.get(id(g), -1) for p in g: if p.lr_index < p.len - 1: a = p.prod[p.lr_index + 1] if a in empty: rel.append((j, a)) return rel # ----------------------------------------------------------------------------- # compute_lookback_includes() # # Determines the lookback and includes relations # # LOOKBACK: # # This relation is determined by running the LR(0) state machine forward. # For example, starting with a production "N : . A B C", we run it forward # to obtain "N : A B C ." We then build a relationship between this final # state and the starting state. These relationships are stored in a dictionary # lookdict. # # INCLUDES: # # Computes the INCLUDE() relation (p,A) INCLUDES (p',B). # # This relation is used to determine non-terminal transitions that occur # inside of other non-terminal transition states. (p,A) INCLUDES (p', B) # if the following holds: # # B -> LAT, where T -> epsilon and p' -L-> p # # L is essentially a prefix (which may be empty), T is a suffix that must be # able to derive an empty string. State p' must lead to state p with the string L. # # ----------------------------------------------------------------------------- def compute_lookback_includes(self, C, trans, nullable): lookdict = {} # Dictionary of lookback relations includedict = {} # Dictionary of include relations # Make a dictionary of non-terminal transitions dtrans = {} for t in trans: dtrans[t] = 1 # Loop over all transitions and compute lookbacks and includes for state, N in trans: lookb = [] includes = [] for p in C[state]: if p.name != N: continue # Okay, we have a name match. We now follow the production all the way # through the state machine until we get the . on the right hand side lr_index = p.lr_index j = state while lr_index < p.len - 1: lr_index = lr_index + 1 t = p.prod[lr_index] # Check to see if this symbol and state are a non-terminal transition if (j, t) in dtrans: # Yes. Okay, there is some chance that this is an includes relation # the only way to know for certain is whether the rest of the # production derives empty li = lr_index + 1 while li < p.len: if p.prod[li] in self.grammar.Terminals: break # No forget it if p.prod[li] not in nullable: break li = li + 1 else: # Appears to be a relation between (j,t) and (state,N) includes.append((j, t)) g = self.lr0_goto(C[j], t) # Go to next set j = self.lr0_cidhash.get(id(g), -1) # Go to next state # When we get here, j is the final state, now we have to locate the production for r in C[j]: if r.name != p.name: continue if r.len != p.len: continue i = 0 # This look is comparing a production ". A B C" with "A B C ." while i < r.lr_index: if r.prod[i] != p.prod[i+1]: break i = i + 1 else: lookb.append((j, r)) for i in includes: if i not in includedict: includedict[i] = [] includedict[i].append((state, N)) lookdict[(state, N)] = lookb return lookdict, includedict # ----------------------------------------------------------------------------- # compute_read_sets() # # Given a set of LR(0) items, this function computes the read sets. # # Inputs: C = Set of LR(0) items # ntrans = Set of nonterminal transitions # nullable = Set of empty transitions # # Returns a set containing the read sets # ----------------------------------------------------------------------------- def compute_read_sets(self, C, ntrans, nullable): FP = lambda x: self.dr_relation(C, x, nullable) R = lambda x: self.reads_relation(C, x, nullable) F = digraph(ntrans, R, FP) return F # ----------------------------------------------------------------------------- # compute_follow_sets() # # Given a set of LR(0) items, a set of non-terminal transitions, a readset, # and an include set, this function computes the follow sets # # Follow(p,A) = Read(p,A) U U {Follow(p',B) | (p,A) INCLUDES (p',B)} # # Inputs: # ntrans = Set of nonterminal transitions # readsets = Readset (previously computed) # inclsets = Include sets (previously computed) # # Returns a set containing the follow sets # ----------------------------------------------------------------------------- def compute_follow_sets(self, ntrans, readsets, inclsets): FP = lambda x: readsets[x] R = lambda x: inclsets.get(x, []) F = digraph(ntrans, R, FP) return F # ----------------------------------------------------------------------------- # add_lookaheads() # # Attaches the lookahead symbols to grammar rules. # # Inputs: lookbacks - Set of lookback relations # followset - Computed follow set # # This function directly attaches the lookaheads to productions contained # in the lookbacks set # ----------------------------------------------------------------------------- def add_lookaheads(self, lookbacks, followset): for trans, lb in lookbacks.items(): # Loop over productions in lookback for state, p in lb: if state not in p.lookaheads: p.lookaheads[state] = [] f = followset.get(trans, []) for a in f: if a not in p.lookaheads[state]: p.lookaheads[state].append(a) # ----------------------------------------------------------------------------- # add_lalr_lookaheads() # # This function does all of the work of adding lookahead information for use # with LALR parsing # ----------------------------------------------------------------------------- def add_lalr_lookaheads(self, C): # Determine all of the nullable nonterminals nullable = self.compute_nullable_nonterminals() # Find all non-terminal transitions trans = self.find_nonterminal_transitions(C) # Compute read sets readsets = self.compute_read_sets(C, trans, nullable) # Compute lookback/includes relations lookd, included = self.compute_lookback_includes(C, trans, nullable) # Compute LALR FOLLOW sets followsets = self.compute_follow_sets(trans, readsets, included) # Add all of the lookaheads self.add_lookaheads(lookd, followsets) # ----------------------------------------------------------------------------- # lr_parse_table() # # This function constructs the parse tables for SLR or LALR # ----------------------------------------------------------------------------- def lr_parse_table(self): Productions = self.grammar.Productions Precedence = self.grammar.Precedence goto = self.lr_goto # Goto array action = self.lr_action # Action array log = self.log # Logger for output actionp = {} # Action production array (temporary) log.info('Parsing method: %s', self.lr_method) # Step 1: Construct C = { I0, I1, ... IN}, collection of LR(0) items # This determines the number of states C = self.lr0_items() if self.lr_method == 'LALR': self.add_lalr_lookaheads(C) # Build the parser table, state by state st = 0 for I in C: # Loop over each production in I actlist = [] # List of actions st_action = {} st_actionp = {} st_goto = {} log.info('') log.info('state %d', st) log.info('') for p in I: log.info(' (%d) %s', p.number, p) log.info('') for p in I: if p.len == p.lr_index + 1: if p.name == "S'": # Start symbol. Accept! st_action['$end'] = 0 st_actionp['$end'] = p else: # We are at the end of a production. Reduce! if self.lr_method == 'LALR': laheads = p.lookaheads[st] else: laheads = self.grammar.Follow[p.name] for a in laheads: actlist.append((a, p, 'reduce using rule %d (%s)' % (p.number, p))) r = st_action.get(a) if r is not None: # Whoa. Have a shift/reduce or reduce/reduce conflict if r > 0: # Need to decide on shift or reduce here # By default we favor shifting. Need to add # some precedence rules here. # Shift precedence comes from the token sprec, slevel = Precedence.get(a, ('right', 0)) # Reduce precedence comes from rule being reduced (p) rprec, rlevel = Productions[p.number].prec if (slevel < rlevel) or ((slevel == rlevel) and (rprec == 'left')): # We really need to reduce here. st_action[a] = -p.number st_actionp[a] = p if not slevel and not rlevel: log.info(' ! shift/reduce conflict for %s resolved as reduce', a) self.sr_conflicts.append((st, a, 'reduce')) Productions[p.number].reduced += 1 elif (slevel == rlevel) and (rprec == 'nonassoc'): st_action[a] = None else: # Hmmm. Guess we'll keep the shift if not rlevel: log.info(' ! shift/reduce conflict for %s resolved as shift', a) self.sr_conflicts.append((st, a, 'shift')) elif r < 0: # Reduce/reduce conflict. In this case, we favor the rule # that was defined first in the grammar file oldp = Productions[-r] pp = Productions[p.number] if oldp.line > pp.line: st_action[a] = -p.number st_actionp[a] = p chosenp, rejectp = pp, oldp Productions[p.number].reduced += 1 Productions[oldp.number].reduced -= 1 else: chosenp, rejectp = oldp, pp self.rr_conflicts.append((st, chosenp, rejectp)) log.info(' ! reduce/reduce conflict for %s resolved using rule %d (%s)', a, st_actionp[a].number, st_actionp[a]) else: raise LALRError('Unknown conflict in state %d' % st) else: st_action[a] = -p.number st_actionp[a] = p Productions[p.number].reduced += 1 else: i = p.lr_index a = p.prod[i+1] # Get symbol right after the "." if a in self.grammar.Terminals: g = self.lr0_goto(I, a) j = self.lr0_cidhash.get(id(g), -1) if j >= 0: # We are in a shift state actlist.append((a, p, 'shift and go to state %d' % j)) r = st_action.get(a) if r is not None: # Whoa have a shift/reduce or shift/shift conflict if r > 0: if r != j: raise LALRError('Shift/shift conflict in state %d' % st) elif r < 0: # Do a precedence check. # - if precedence of reduce rule is higher, we reduce. # - if precedence of reduce is same and left assoc, we reduce. # - otherwise we shift # Shift precedence comes from the token sprec, slevel = Precedence.get(a, ('right', 0)) # Reduce precedence comes from the rule that could have been reduced rprec, rlevel = Productions[st_actionp[a].number].prec if (slevel > rlevel) or ((slevel == rlevel) and (rprec == 'right')): # We decide to shift here... highest precedence to shift Productions[st_actionp[a].number].reduced -= 1 st_action[a] = j st_actionp[a] = p if not rlevel: log.info(' ! shift/reduce conflict for %s resolved as shift', a) self.sr_conflicts.append((st, a, 'shift')) elif (slevel == rlevel) and (rprec == 'nonassoc'): st_action[a] = None else: # Hmmm. Guess we'll keep the reduce if not slevel and not rlevel: log.info(' ! shift/reduce conflict for %s resolved as reduce', a) self.sr_conflicts.append((st, a, 'reduce')) else: raise LALRError('Unknown conflict in state %d' % st) else: st_action[a] = j st_actionp[a] = p # Print the actions associated with each terminal _actprint = {} for a, p, m in actlist: if a in st_action: if p is st_actionp[a]: log.info(' %-15s %s', a, m) _actprint[(a, m)] = 1 log.info('') # Print the actions that were not used. (debugging) not_used = 0 for a, p, m in actlist: if a in st_action: if p is not st_actionp[a]: if not (a, m) in _actprint: log.debug(' ! %-15s [ %s ]', a, m) not_used = 1 _actprint[(a, m)] = 1 if not_used: log.debug('') # Construct the goto table for this state nkeys = {} for ii in I: for s in ii.usyms: if s in self.grammar.Nonterminals: nkeys[s] = None for n in nkeys: g = self.lr0_goto(I, n) j = self.lr0_cidhash.get(id(g), -1) if j >= 0: st_goto[n] = j log.info(' %-30s shift and go to state %d', n, j) action[st] = st_action actionp[st] = st_actionp goto[st] = st_goto st += 1 # ----------------------------------------------------------------------------- # write() # # This function writes the LR parsing tables to a file # ----------------------------------------------------------------------------- def write_table(self, tabmodule, outputdir='', signature=''): if isinstance(tabmodule, types.ModuleType): raise IOError("Won't overwrite existing tabmodule") basemodulename = tabmodule.split('.')[-1] filename = os.path.join(outputdir, basemodulename) + '.py' try: f = open(filename, 'w') f.write(''' # %s # This file is automatically generated. Do not edit. # pylint: disable=W,C,R _tabversion = %r _lr_method = %r _lr_signature = %r ''' % (os.path.basename(filename), __tabversion__, self.lr_method, signature)) # Change smaller to 0 to go back to original tables smaller = 1 # Factor out names to try and make smaller if smaller: items = {} for s, nd in self.lr_action.items(): for name, v in nd.items(): i = items.get(name) if not i: i = ([], []) items[name] = i i[0].append(s) i[1].append(v) f.write('\n_lr_action_items = {') for k, v in items.items(): f.write('%r:([' % k) for i in v[0]: f.write('%r,' % i) f.write('],[') for i in v[1]: f.write('%r,' % i) f.write(']),') f.write('}\n') f.write(''' _lr_action = {} for _k, _v in _lr_action_items.items(): for _x,_y in zip(_v[0],_v[1]): if not _x in _lr_action: _lr_action[_x] = {} _lr_action[_x][_k] = _y del _lr_action_items ''') else: f.write('\n_lr_action = { ') for k, v in self.lr_action.items(): f.write('(%r,%r):%r,' % (k[0], k[1], v)) f.write('}\n') if smaller: # Factor out names to try and make smaller items = {} for s, nd in self.lr_goto.items(): for name, v in nd.items(): i = items.get(name) if not i: i = ([], []) items[name] = i i[0].append(s) i[1].append(v) f.write('\n_lr_goto_items = {') for k, v in items.items(): f.write('%r:([' % k) for i in v[0]: f.write('%r,' % i) f.write('],[') for i in v[1]: f.write('%r,' % i) f.write(']),') f.write('}\n') f.write(''' _lr_goto = {} for _k, _v in _lr_goto_items.items(): for _x, _y in zip(_v[0], _v[1]): if not _x in _lr_goto: _lr_goto[_x] = {} _lr_goto[_x][_k] = _y del _lr_goto_items ''') else: f.write('\n_lr_goto = { ') for k, v in self.lr_goto.items(): f.write('(%r,%r):%r,' % (k[0], k[1], v)) f.write('}\n') # Write production table f.write('_lr_productions = [\n') for p in self.lr_productions: if p.func: f.write(' (%r,%r,%d,%r,%r,%d),\n' % (p.str, p.name, p.len, p.func, os.path.basename(p.file), p.line)) else: f.write(' (%r,%r,%d,None,None,None),\n' % (str(p), p.name, p.len)) f.write(']\n') f.close() except IOError as e: raise # ----------------------------------------------------------------------------- # pickle_table() # # This function pickles the LR parsing tables to a supplied file object # ----------------------------------------------------------------------------- def pickle_table(self, filename, signature=''): try: import cPickle as pickle except ImportError: import pickle with open(filename, 'wb') as outf: pickle.dump(__tabversion__, outf, pickle_protocol) pickle.dump(self.lr_method, outf, pickle_protocol) pickle.dump(signature, outf, pickle_protocol) pickle.dump(self.lr_action, outf, pickle_protocol) pickle.dump(self.lr_goto, outf, pickle_protocol) outp = [] for p in self.lr_productions: if p.func: outp.append((p.str, p.name, p.len, p.func, os.path.basename(p.file), p.line)) else: outp.append((str(p), p.name, p.len, None, None, None)) pickle.dump(outp, outf, pickle_protocol) # ----------------------------------------------------------------------------- # === INTROSPECTION === # # The following functions and classes are used to implement the PLY # introspection features followed by the yacc() function itself. # ----------------------------------------------------------------------------- # ----------------------------------------------------------------------------- # get_caller_module_dict() # # This function returns a dictionary containing all of the symbols defined within # a caller further down the call stack. This is used to get the environment # associated with the yacc() call if none was provided. # ----------------------------------------------------------------------------- def get_caller_module_dict(levels): f = sys._getframe(levels) ldict = f.f_globals.copy() if f.f_globals != f.f_locals: ldict.update(f.f_locals) return ldict # ----------------------------------------------------------------------------- # parse_grammar() # # This takes a raw grammar rule string and parses it into production data # ----------------------------------------------------------------------------- def parse_grammar(doc, file, line): grammar = [] # Split the doc string into lines pstrings = doc.splitlines() lastp = None dline = line for ps in pstrings: dline += 1 p = ps.split() if not p: continue try: if p[0] == '|': # This is a continuation of a previous rule if not lastp: raise SyntaxError("%s:%d: Misplaced '|'" % (file, dline)) prodname = lastp syms = p[1:] else: prodname = p[0] lastp = prodname syms = p[2:] assign = p[1] if assign != ':' and assign != '::=': raise SyntaxError("%s:%d: Syntax error. Expected ':'" % (file, dline)) grammar.append((file, dline, prodname, syms)) except SyntaxError: raise except Exception: raise SyntaxError('%s:%d: Syntax error in rule %r' % (file, dline, ps.strip())) return grammar # ----------------------------------------------------------------------------- # ParserReflect() # # This class represents information extracted for building a parser including # start symbol, error function, tokens, precedence list, action functions, # etc. # ----------------------------------------------------------------------------- class ParserReflect(object): def __init__(self, pdict, log=None): self.pdict = pdict self.start = None self.error_func = None self.tokens = None self.modules = set() self.grammar = [] self.error = False if log is None: self.log = PlyLogger(sys.stderr) else: self.log = log # Get all of the basic information def get_all(self): self.get_start() self.get_error_func() self.get_tokens() self.get_precedence() self.get_pfunctions() # Validate all of the information def validate_all(self): self.validate_start() self.validate_error_func() self.validate_tokens() self.validate_precedence() self.validate_pfunctions() self.validate_modules() return self.error # Compute a signature over the grammar def signature(self): parts = [] try: if self.start: parts.append(self.start) if self.prec: parts.append(''.join([''.join(p) for p in self.prec])) if self.tokens: parts.append(' '.join(self.tokens)) for f in self.pfuncs: if f[3]: parts.append(f[3]) except (TypeError, ValueError): pass return ''.join(parts) # ----------------------------------------------------------------------------- # validate_modules() # # This method checks to see if there are duplicated p_rulename() functions # in the parser module file. Without this function, it is really easy for # users to make mistakes by cutting and pasting code fragments (and it's a real # bugger to try and figure out why the resulting parser doesn't work). Therefore, # we just do a little regular expression pattern matching of def statements # to try and detect duplicates. # ----------------------------------------------------------------------------- def validate_modules(self): # Match def p_funcname( fre = re.compile(r'\s*def\s+(p_[a-zA-Z_0-9]*)\(') for module in self.modules: try: lines, linen = inspect.getsourcelines(module) except IOError: continue counthash = {} for linen, line in enumerate(lines): linen += 1 m = fre.match(line) if m: name = m.group(1) prev = counthash.get(name) if not prev: counthash[name] = linen else: filename = inspect.getsourcefile(module) self.log.warning('%s:%d: Function %s redefined. Previously defined on line %d', filename, linen, name, prev) # Get the start symbol def get_start(self): self.start = self.pdict.get('start') # Validate the start symbol def validate_start(self): if self.start is not None: if not isinstance(self.start, string_types): self.log.error("'start' must be a string") # Look for error handler def get_error_func(self): self.error_func = self.pdict.get('p_error') # Validate the error function def validate_error_func(self): if self.error_func: if isinstance(self.error_func, types.FunctionType): ismethod = 0 elif isinstance(self.error_func, types.MethodType): ismethod = 1 else: self.log.error("'p_error' defined, but is not a function or method") self.error = True return eline = self.error_func.__code__.co_firstlineno efile = self.error_func.__code__.co_filename module = inspect.getmodule(self.error_func) self.modules.add(module) argcount = self.error_func.__code__.co_argcount - ismethod if argcount != 1: self.log.error('%s:%d: p_error() requires 1 argument', efile, eline) self.error = True # Get the tokens map def get_tokens(self): tokens = self.pdict.get('tokens') if not tokens: self.log.error('No token list is defined') self.error = True return if not isinstance(tokens, (list, tuple)): self.log.error('tokens must be a list or tuple') self.error = True return if not tokens: self.log.error('tokens is empty') self.error = True return self.tokens = sorted(tokens) # Validate the tokens def validate_tokens(self): # Validate the tokens. if 'error' in self.tokens: self.log.error("Illegal token name 'error'. Is a reserved word") self.error = True return terminals = set() for n in self.tokens: if n in terminals: self.log.warning('Token %r multiply defined', n) terminals.add(n) # Get the precedence map (if any) def get_precedence(self): self.prec = self.pdict.get('precedence') # Validate and parse the precedence map def validate_precedence(self): preclist = [] if self.prec: if not isinstance(self.prec, (list, tuple)): self.log.error('precedence must be a list or tuple') self.error = True return for level, p in enumerate(self.prec): if not isinstance(p, (list, tuple)): self.log.error('Bad precedence table') self.error = True return if len(p) < 2: self.log.error('Malformed precedence entry %s. Must be (assoc, term, ..., term)', p) self.error = True return assoc = p[0] if not isinstance(assoc, string_types): self.log.error('precedence associativity must be a string') self.error = True return for term in p[1:]: if not isinstance(term, string_types): self.log.error('precedence items must be strings') self.error = True return preclist.append((term, assoc, level+1)) self.preclist = preclist # Get all p_functions from the grammar def get_pfunctions(self): p_functions = [] for name, item in self.pdict.items(): if not name.startswith('p_') or name == 'p_error': continue if isinstance(item, (types.FunctionType, types.MethodType)): line = getattr(item, 'co_firstlineno', item.__code__.co_firstlineno) module = inspect.getmodule(item) p_functions.append((line, module, name, item.__doc__)) # Sort all of the actions by line number; make sure to stringify # modules to make them sortable, since `line` may not uniquely sort all # p functions p_functions.sort(key=lambda p_function: ( p_function[0], str(p_function[1]), p_function[2], p_function[3])) self.pfuncs = p_functions # Validate all of the p_functions def validate_pfunctions(self): grammar = [] # Check for non-empty symbols if len(self.pfuncs) == 0: self.log.error('no rules of the form p_rulename are defined') self.error = True return for line, module, name, doc in self.pfuncs: file = inspect.getsourcefile(module) func = self.pdict[name] if isinstance(func, types.MethodType): reqargs = 2 else: reqargs = 1 if func.__code__.co_argcount > reqargs: self.log.error('%s:%d: Rule %r has too many arguments', file, line, func.__name__) self.error = True elif func.__code__.co_argcount < reqargs: self.log.error('%s:%d: Rule %r requires an argument', file, line, func.__name__) self.error = True elif not func.__doc__: self.log.warning('%s:%d: No documentation string specified in function %r (ignored)', file, line, func.__name__) else: try: parsed_g = parse_grammar(doc, file, line) for g in parsed_g: grammar.append((name, g)) except SyntaxError as e: self.log.error(str(e)) self.error = True # Looks like a valid grammar rule # Mark the file in which defined. self.modules.add(module) # Secondary validation step that looks for p_ definitions that are not functions # or functions that look like they might be grammar rules. for n, v in self.pdict.items(): if n.startswith('p_') and isinstance(v, (types.FunctionType, types.MethodType)): continue if n.startswith('t_'): continue if n.startswith('p_') and n != 'p_error': self.log.warning('%r not defined as a function', n) if ((isinstance(v, types.FunctionType) and v.__code__.co_argcount == 1) or (isinstance(v, types.MethodType) and v.__func__.__code__.co_argcount == 2)): if v.__doc__: try: doc = v.__doc__.split(' ') if doc[1] == ':': self.log.warning('%s:%d: Possible grammar rule %r defined without p_ prefix', v.__code__.co_filename, v.__code__.co_firstlineno, n) except IndexError: pass self.grammar = grammar # ----------------------------------------------------------------------------- # yacc(module) # # Build a parser # ----------------------------------------------------------------------------- def yacc(method='LALR', debug=yaccdebug, module=None, tabmodule=tab_module, start=None, check_recursion=True, optimize=False, write_tables=True, debugfile=debug_file, outputdir=None, debuglog=None, errorlog=None, picklefile=None): if tabmodule is None: tabmodule = tab_module # Reference to the parsing method of the last built parser global parse # If pickling is enabled, table files are not created if picklefile: write_tables = 0 if errorlog is None: errorlog = PlyLogger(sys.stderr) # Get the module dictionary used for the parser if module: _items = [(k, getattr(module, k)) for k in dir(module)] pdict = dict(_items) # If no __file__ or __package__ attributes are available, try to obtain them # from the __module__ instead if '__file__' not in pdict: pdict['__file__'] = sys.modules[pdict['__module__']].__file__ if '__package__' not in pdict and '__module__' in pdict: if hasattr(sys.modules[pdict['__module__']], '__package__'): pdict['__package__'] = sys.modules[pdict['__module__']].__package__ else: pdict = get_caller_module_dict(2) if outputdir is None: # If no output directory is set, the location of the output files # is determined according to the following rules: # - If tabmodule specifies a package, files go into that package directory # - Otherwise, files go in the same directory as the specifying module if isinstance(tabmodule, types.ModuleType): srcfile = tabmodule.__file__ else: if '.' not in tabmodule: srcfile = pdict['__file__'] else: parts = tabmodule.split('.') pkgname = '.'.join(parts[:-1]) exec('import %s' % pkgname) srcfile = getattr(sys.modules[pkgname], '__file__', '') outputdir = os.path.dirname(srcfile) # Determine if the module is package of a package or not. # If so, fix the tabmodule setting so that tables load correctly pkg = pdict.get('__package__') if pkg and isinstance(tabmodule, str): if '.' not in tabmodule: tabmodule = pkg + '.' + tabmodule # Set start symbol if it's specified directly using an argument if start is not None: pdict['start'] = start # Collect parser information from the dictionary pinfo = ParserReflect(pdict, log=errorlog) pinfo.get_all() if pinfo.error: raise YaccError('Unable to build parser') # Check signature against table files (if any) signature = pinfo.signature() # Read the tables try: lr = LRTable() if picklefile: read_signature = lr.read_pickle(picklefile) else: read_signature = lr.read_table(tabmodule) if optimize or (read_signature == signature): try: lr.bind_callables(pinfo.pdict) parser = LRParser(lr, pinfo.error_func) parse = parser.parse return parser except Exception as e: errorlog.warning('There was a problem loading the table file: %r', e) except VersionError as e: errorlog.warning(str(e)) except ImportError: pass if debuglog is None: if debug: try: debuglog = PlyLogger(open(os.path.join(outputdir, debugfile), 'w')) except IOError as e: errorlog.warning("Couldn't open %r. %s" % (debugfile, e)) debuglog = NullLogger() else: debuglog = NullLogger() debuglog.info('Created by PLY version %s (http://www.dabeaz.com/ply)', __version__) errors = False # Validate the parser information if pinfo.validate_all(): raise YaccError('Unable to build parser') if not pinfo.error_func: errorlog.warning('no p_error() function is defined') # Create a grammar object grammar = Grammar(pinfo.tokens) # Set precedence level for terminals for term, assoc, level in pinfo.preclist: try: grammar.set_precedence(term, assoc, level) except GrammarError as e: errorlog.warning('%s', e) # Add productions to the grammar for funcname, gram in pinfo.grammar: file, line, prodname, syms = gram try: grammar.add_production(prodname, syms, funcname, file, line) except GrammarError as e: errorlog.error('%s', e) errors = True # Set the grammar start symbols try: if start is None: grammar.set_start(pinfo.start) else: grammar.set_start(start) except GrammarError as e: errorlog.error(str(e)) errors = True if errors: raise YaccError('Unable to build parser') # Verify the grammar structure undefined_symbols = grammar.undefined_symbols() for sym, prod in undefined_symbols: errorlog.error('%s:%d: Symbol %r used, but not defined as a token or a rule', prod.file, prod.line, sym) errors = True unused_terminals = grammar.unused_terminals() if unused_terminals: debuglog.info('') debuglog.info('Unused terminals:') debuglog.info('') for term in unused_terminals: errorlog.warning('Token %r defined, but not used', term) debuglog.info(' %s', term) # Print out all productions to the debug log if debug: debuglog.info('') debuglog.info('Grammar') debuglog.info('') for n, p in enumerate(grammar.Productions): debuglog.info('Rule %-5d %s', n, p) # Find unused non-terminals unused_rules = grammar.unused_rules() for prod in unused_rules: errorlog.warning('%s:%d: Rule %r defined, but not used', prod.file, prod.line, prod.name) if len(unused_terminals) == 1: errorlog.warning('There is 1 unused token') if len(unused_terminals) > 1: errorlog.warning('There are %d unused tokens', len(unused_terminals)) if len(unused_rules) == 1: errorlog.warning('There is 1 unused rule') if len(unused_rules) > 1: errorlog.warning('There are %d unused rules', len(unused_rules)) if debug: debuglog.info('') debuglog.info('Terminals, with rules where they appear') debuglog.info('') terms = list(grammar.Terminals) terms.sort() for term in terms: debuglog.info('%-20s : %s', term, ' '.join([str(s) for s in grammar.Terminals[term]])) debuglog.info('') debuglog.info('Nonterminals, with rules where they appear') debuglog.info('') nonterms = list(grammar.Nonterminals) nonterms.sort() for nonterm in nonterms: debuglog.info('%-20s : %s', nonterm, ' '.join([str(s) for s in grammar.Nonterminals[nonterm]])) debuglog.info('') if check_recursion: unreachable = grammar.find_unreachable() for u in unreachable: errorlog.warning('Symbol %r is unreachable', u) infinite = grammar.infinite_cycles() for inf in infinite: errorlog.error('Infinite recursion detected for symbol %r', inf) errors = True unused_prec = grammar.unused_precedence() for term, assoc in unused_prec: errorlog.error('Precedence rule %r defined for unknown symbol %r', assoc, term) errors = True if errors: raise YaccError('Unable to build parser') # Run the LRGeneratedTable on the grammar if debug: errorlog.debug('Generating %s tables', method) lr = LRGeneratedTable(grammar, method, debuglog) if debug: num_sr = len(lr.sr_conflicts) # Report shift/reduce and reduce/reduce conflicts if num_sr == 1: errorlog.warning('1 shift/reduce conflict') elif num_sr > 1: errorlog.warning('%d shift/reduce conflicts', num_sr) num_rr = len(lr.rr_conflicts) if num_rr == 1: errorlog.warning('1 reduce/reduce conflict') elif num_rr > 1: errorlog.warning('%d reduce/reduce conflicts', num_rr) # Write out conflicts to the output file if debug and (lr.sr_conflicts or lr.rr_conflicts): debuglog.warning('') debuglog.warning('Conflicts:') debuglog.warning('') for state, tok, resolution in lr.sr_conflicts: debuglog.warning('shift/reduce conflict for %s in state %d resolved as %s', tok, state, resolution) already_reported = set() for state, rule, rejected in lr.rr_conflicts: if (state, id(rule), id(rejected)) in already_reported: continue debuglog.warning('reduce/reduce conflict in state %d resolved using rule (%s)', state, rule) debuglog.warning('rejected rule (%s) in state %d', rejected, state) errorlog.warning('reduce/reduce conflict in state %d resolved using rule (%s)', state, rule) errorlog.warning('rejected rule (%s) in state %d', rejected, state) already_reported.add((state, id(rule), id(rejected))) warned_never = [] for state, rule, rejected in lr.rr_conflicts: if not rejected.reduced and (rejected not in warned_never): debuglog.warning('Rule (%s) is never reduced', rejected) errorlog.warning('Rule (%s) is never reduced', rejected) warned_never.append(rejected) # Write the table file if requested if write_tables: try: lr.write_table(tabmodule, outputdir, signature) if tabmodule in sys.modules: del sys.modules[tabmodule] except IOError as e: errorlog.warning("Couldn't create %r. %s" % (tabmodule, e)) # Write a pickled version of the tables if picklefile: try: lr.pickle_table(picklefile, signature) except IOError as e: errorlog.warning("Couldn't create %r. %s" % (picklefile, e)) # Build the parser lr.bind_callables(pinfo.pdict) parser = LRParser(lr, pinfo.error_func) parse = parser.parse return parser access.py 0000644 00000027312 15025012421 0006354 0 ustar 00 # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> # # Copyright (C) 2006 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; version 2 only # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # """ Classes representing basic access. SELinux - at the most basic level - represents access as the 4-tuple subject (type or context), target (type or context), object class, permission. The policy language elaborates this basic access to facilitate more concise rules (e.g., allow rules can have multiple source or target types - see refpolicy for more information). This module has objects for representing the most basic access (AccessVector) and sets of that access (AccessVectorSet). These objects are used in Madison in a variety of ways, but they are the fundamental representation of access. """ from . import refpolicy from . import util from selinux import audit2why def is_idparam(id): """Determine if an id is a parameter in the form $N, where N is an integer. Returns: True if the id is a parameter False if the id is not a parameter """ if len(id) > 1 and id[0] == '$': try: int(id[1:]) except ValueError: return False return True else: return False class AccessVector(util.Comparison): """ An access vector is the basic unit of access in SELinux. Access vectors are the most basic representation of access within SELinux. It represents the access a source type has to a target type in terms of an object class and a set of permissions. Access vectors are distinct from AVRules in that they can only store a single source type, target type, and object class. The simplicity of AccessVectors makes them useful for storing access in a form that is easy to search and compare. The source, target, and object are stored as string. No checking done to verify that the strings are valid SELinux identifiers. Identifiers in the form $N (where N is an integer) are reserved as interface parameters and are treated as wild cards in many circumstances. Properties: .src_type - The source type allowed access. [String or None] .tgt_type - The target type to which access is allowed. [String or None] .obj_class - The object class to which access is allowed. [String or None] .perms - The permissions allowed to the object class. [IdSet] .audit_msgs - The audit messages that generated this access vector [List of strings] .xperms - Extended permissions attached to the AV. [Dictionary {operation: xperm set}] """ def __init__(self, init_list=None): if init_list: self.from_list(init_list) else: self.src_type = None self.tgt_type = None self.obj_class = None self.perms = refpolicy.IdSet() self.audit_msgs = [] self.type = audit2why.TERULE self.data = [] self.xperms = {} # when implementing __eq__ also __hash__ is needed on py2 # if object is muttable __hash__ should be None self.__hash__ = None # The direction of the information flow represented by this # access vector - used for matching self.info_flow_dir = None def from_list(self, list): """Initialize an access vector from a list. Initialize an access vector from a list treating the list as positional arguments - i.e., 0 = src_type, 1 = tgt_type, etc. All of the list elements 3 and greater are treated as perms. For example, the list ['foo_t', 'bar_t', 'file', 'read', 'write'] would create an access vector list with the source type 'foo_t', target type 'bar_t', object class 'file', and permissions 'read' and 'write'. This format is useful for very simple storage to strings or disc (see to_list) and for initializing access vectors. """ if len(list) < 4: raise ValueError("List must contain at least four elements %s" % str(list)) self.src_type = list[0] self.tgt_type = list[1] self.obj_class = list[2] self.perms = refpolicy.IdSet(list[3:]) def to_list(self): """ Convert an access vector to a list. Convert an access vector to a list treating the list as positional values. See from_list for more information on how an access vector is represented in a list. """ l = [self.src_type, self.tgt_type, self.obj_class] l.extend(sorted(self.perms)) return l def merge(self, av): """Add permissions and extended permissions from AV""" self.perms.update(av.perms) for op in av.xperms: if op not in self.xperms: self.xperms[op] = refpolicy.XpermSet() self.xperms[op].extend(av.xperms[op]) def __str__(self): return self.to_string() def to_string(self): return "allow %s %s:%s %s;" % (self.src_type, self.tgt_type, self.obj_class, self.perms.to_space_str()) def _compare(self, other, method): try: x = list(self.perms) a = (self.src_type, self.tgt_type, self.obj_class, x) y = list(other.perms) x.sort() y.sort() b = (other.src_type, other.tgt_type, other.obj_class, y) return method(a, b) except (AttributeError, TypeError): # trying to compare to foreign type return NotImplemented def avrule_to_access_vectors(avrule): """Convert an avrule into a list of access vectors. AccessVectors and AVRules are similarly, but differ in that an AVRule can more than one source type, target type, and object class. This function expands a single avrule into a list of one or more AccessVectors representing the access defined in the AVRule. """ if isinstance(avrule, AccessVector): return [avrule] a = [] for src_type in avrule.src_types: for tgt_type in avrule.tgt_types: for obj_class in avrule.obj_classes: access = AccessVector() access.src_type = src_type access.tgt_type = tgt_type access.obj_class = obj_class access.perms = avrule.perms.copy() a.append(access) return a class AccessVectorSet: """A non-overlapping set of access vectors. An AccessVectorSet is designed to store one or more access vectors that are non-overlapping. Access can be added to the set incrementally and access vectors will be added or merged as necessary. For example, adding the following access vectors using add_av: allow $1 etc_t : read; allow $1 etc_t : write; allow $1 var_log_t : read; Would result in an access vector set with the access vectors: allow $1 etc_t : { read write}; allow $1 var_log_t : read; """ def __init__(self): """Initialize an access vector set. """ self.src = {} # The information flow direction of this access vector # set - see objectmodel.py for more information. This # stored here to speed up searching - see matching.py. self.info_dir = None def __iter__(self): """Iterate over all of the unique access vectors in the set.""" for tgts in self.src.values(): for objs in tgts.values(): for av in objs.values(): yield av def __len__(self): """Return the number of unique access vectors in the set. Because of the internal representation of the access vector set, __len__ is not a constant time operation. Worst case is O(N) where N is the number of unique access vectors, but the common case is probably better. """ l = 0 for tgts in self.src.values(): for objs in tgts.values(): l += len(objs) return l def to_list(self): """Return the unique access vectors in the set as a list. The format of the returned list is a set of nested lists, each access vector represented by a list. This format is designed to be simply serializable to a file. For example, consider an access vector set with the following access vectors: allow $1 user_t : file read; allow $1 etc_t : file { read write}; to_list would return the following: [[$1, user_t, file, read] [$1, etc_t, file, read, write]] See AccessVector.to_list for more information. """ l = [] for av in self: l.append(av.to_list()) return l def from_list(self, l): """Add access vectors stored in a list. See to list for more information on the list format that this method accepts. This will add all of the access from the list. Any existing access vectors in the set will be retained. """ for av in l: self.add_av(AccessVector(av)) def add(self, src_type, tgt_type, obj_class, perms, audit_msg=None, avc_type=audit2why.TERULE, data=[]): """Add an access vector to the set. """ av = AccessVector() av.src_type = src_type av.tgt_type = tgt_type av.obj_class = obj_class av.perms = perms av.data = data av.type = avc_type self.add_av(av, audit_msg) def add_av(self, av, audit_msg=None): """Add an access vector to the set.""" tgt = self.src.setdefault(av.src_type, { }) cls = tgt.setdefault(av.tgt_type, { }) if (av.obj_class, av.type) in cls: cls[av.obj_class, av.type].merge(av) else: cls[av.obj_class, av.type] = av if audit_msg: cls[av.obj_class, av.type].audit_msgs.append(audit_msg) def avs_extract_types(avs): types = refpolicy.IdSet() for av in avs: types.add(av.src_type) types.add(av.tgt_type) return types def avs_extract_obj_perms(avs): perms = { } for av in avs: if av.obj_class in perms: s = perms[av.obj_class] else: s = refpolicy.IdSet() perms[av.obj_class] = s s.update(av.perms) return perms class RoleTypeSet: """A non-overlapping set of role type statements. This class allows the incremental addition of role type statements and maintains a non-overlapping list of statements. """ def __init__(self): """Initialize an access vector set.""" self.role_types = {} def __iter__(self): """Iterate over all of the unique role allows statements in the set.""" for role_type in self.role_types.values(): yield role_type def __len__(self): """Return the unique number of role allow statements.""" return len(self.role_types.keys()) def add(self, role, type): if role in self.role_types: role_type = self.role_types[role] else: role_type = refpolicy.RoleType() role_type.role = role self.role_types[role] = role_type role_type.types.add(type) policygen.py 0000644 00000035767 15025012421 0007121 0 ustar 00 # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> # # Copyright (C) 2006 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; version 2 only # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # """ classes and algorithms for the generation of SELinux policy. """ import itertools import textwrap import selinux.audit2why as audit2why try: from setools import * except: pass from . import refpolicy from . import objectmodel from . import access from . import interfaces from . import matching from . import util # Constants for the level of explanation from the generation # routines NO_EXPLANATION = 0 SHORT_EXPLANATION = 1 LONG_EXPLANATION = 2 class PolicyGenerator: """Generate a reference policy module from access vectors. PolicyGenerator generates a new reference policy module or updates an existing module based on requested access in the form of access vectors. It generates allow rules and optionally module require statements, reference policy interfaces, and extended permission access vector rules. By default only allow rules are generated. The methods .set_gen_refpol, .set_gen_requires and .set_gen_xperms turns on interface generation, requires generation, and xperms rules generation respectively. PolicyGenerator can also optionally add comments explaining why a particular access was allowed based on the audit messages that generated the access. The access vectors passed in must have the .audit_msgs field set correctly and .explain set to SHORT|LONG_EXPLANATION to enable this feature. The module created by PolicyGenerator can be passed to output.ModuleWriter to output a text representation. """ def __init__(self, module=None): """Initialize a PolicyGenerator with an optional existing module. If the module parameter is not None then access will be added to the passed in module. Otherwise a new reference policy module will be created. """ self.ifgen = None self.explain = NO_EXPLANATION self.gen_requires = False if module: self.module = module else: self.module = refpolicy.Module() self.dontaudit = False self.xperms = False self.domains = None def set_gen_refpol(self, if_set=None, perm_maps=None): """Set whether reference policy interfaces are generated. To turn on interface generation pass in an interface set to use for interface generation. To turn off interface generation pass in None. If interface generation is enabled requires generation will also be enabled. """ if if_set: self.ifgen = InterfaceGenerator(if_set, perm_maps) self.gen_requires = True else: self.ifgen = None self.__set_module_style() def set_gen_requires(self, status=True): """Set whether module requires are generated. Passing in true will turn on requires generation and False will disable generation. If requires generation is disabled interface generation will also be disabled and can only be re-enabled via .set_gen_refpol. """ self.gen_requires = status def set_gen_explain(self, explain=SHORT_EXPLANATION): """Set whether access is explained. """ self.explain = explain def set_gen_dontaudit(self, dontaudit): self.dontaudit = dontaudit def set_gen_xperms(self, xperms): """Set whether extended permission access vector rules are generated. """ self.xperms = xperms def __set_module_style(self): if self.ifgen: refpolicy = True else: refpolicy = False for mod in self.module.module_declarations(): mod.refpolicy = refpolicy def set_module_name(self, name, version="1.0"): """Set the name of the module and optionally the version. """ # find an existing module declaration m = None for mod in self.module.module_declarations(): m = mod if not m: m = refpolicy.ModuleDeclaration() self.module.children.insert(0, m) m.name = name m.version = version if self.ifgen: m.refpolicy = True else: m.refpolicy = False def get_module(self): # Generate the requires if self.gen_requires: gen_requires(self.module) """Return the generated module""" return self.module def __add_av_rule(self, av): """Add access vector rule. """ rule = refpolicy.AVRule(av) if self.dontaudit: rule.rule_type = rule.DONTAUDIT rule.comment = "" if self.explain: rule.comment = str(refpolicy.Comment(explain_access(av, verbosity=self.explain))) if av.type == audit2why.ALLOW: rule.comment += "\n#!!!! This avc is allowed in the current policy" if av.xperms: rule.comment += "\n#!!!! This av rule may have been overridden by an extended permission av rule" if av.type == audit2why.DONTAUDIT: rule.comment += "\n#!!!! This avc has a dontaudit rule in the current policy" if av.type == audit2why.BOOLEAN: if len(av.data) > 1: rule.comment += "\n#!!!! This avc can be allowed using one of the these booleans:\n# %s" % ", ".join([x[0] for x in av.data]) else: rule.comment += "\n#!!!! This avc can be allowed using the boolean '%s'" % av.data[0][0] if av.type == audit2why.CONSTRAINT: rule.comment += "\n#!!!! This avc is a constraint violation. You would need to modify the attributes of either the source or target types to allow this access." rule.comment += "\n#Constraint rule: " rule.comment += "\n#\t" + av.data[0] for reason in av.data[1:]: rule.comment += "\n#\tPossible cause is the source %s and target %s are different." % reason try: if ( av.type == audit2why.TERULE and "write" in av.perms and ( "dir" in av.obj_class or "open" in av.perms )): if not self.domains: self.domains = seinfo(ATTRIBUTE, name="domain")[0]["types"] types=[] for i in [x[TCONTEXT] for x in sesearch([ALLOW], {SCONTEXT: av.src_type, CLASS: av.obj_class, PERMS: av.perms})]: if i not in self.domains: types.append(i) if len(types) == 1: rule.comment += "\n#!!!! The source type '%s' can write to a '%s' of the following type:\n# %s\n" % ( av.src_type, av.obj_class, ", ".join(types)) elif len(types) >= 1: rule.comment += "\n#!!!! The source type '%s' can write to a '%s' of the following types:\n# %s\n" % ( av.src_type, av.obj_class, ", ".join(types)) except: pass self.module.children.append(rule) def __add_ext_av_rules(self, av): """Add extended permission access vector rules. """ for op in av.xperms.keys(): extrule = refpolicy.AVExtRule(av, op) if self.dontaudit: extrule.rule_type = extrule.DONTAUDITXPERM self.module.children.append(extrule) def add_access(self, av_set): """Add the access from the access vector set to this module. """ # Use the interface generator to split the access # into raw allow rules and interfaces. After this # a will contain a list of access that should be # used as raw allow rules and the interfaces will # be added to the module. if self.ifgen: raw_allow, ifcalls = self.ifgen.gen(av_set, self.explain) self.module.children.extend(ifcalls) else: raw_allow = av_set # Generate the raw allow rules from the filtered list for av in raw_allow: self.__add_av_rule(av) if self.xperms and av.xperms: self.__add_ext_av_rules(av) def add_role_types(self, role_type_set): for role_type in role_type_set: self.module.children.append(role_type) def explain_access(av, ml=None, verbosity=SHORT_EXPLANATION): """Explain why a policy statement was generated. Return a string containing a text explanation of why a policy statement was generated. The string is commented and wrapped and can be directly inserted into a policy. Params: av - access vector representing the access. Should have .audit_msgs set appropriately. verbosity - the amount of explanation provided. Should be set to NO_EXPLANATION, SHORT_EXPLANATION, or LONG_EXPLANATION. Returns: list of strings - strings explaining the access or an empty string if verbosity=NO_EXPLANATION or there is not sufficient information to provide an explanation. """ s = [] def explain_interfaces(): if not ml: return s.append(" Interface options:") for match in ml.all(): ifcall = call_interface(match.interface, ml.av) s.append(' %s # [%d]' % (ifcall.to_string(), match.dist)) # Format the raw audit data to explain why the # access was requested - either long or short. if verbosity == LONG_EXPLANATION: for msg in av.audit_msgs: s.append(' %s' % msg.header) s.append(' scontext="%s" tcontext="%s"' % (str(msg.scontext), str(msg.tcontext))) s.append(' class="%s" perms="%s"' % (msg.tclass, refpolicy.list_to_space_str(msg.accesses))) s.append(' comm="%s" exe="%s" path="%s"' % (msg.comm, msg.exe, msg.path)) s.extend(textwrap.wrap('message="' + msg.message + '"', 80, initial_indent=" ", subsequent_indent=" ")) explain_interfaces() elif verbosity: s.append(' src="%s" tgt="%s" class="%s", perms="%s"' % (av.src_type, av.tgt_type, av.obj_class, av.perms.to_space_str())) # For the short display we are only going to use the additional information # from the first audit message. For the vast majority of cases this info # will always be the same anyway. if len(av.audit_msgs) > 0: msg = av.audit_msgs[0] s.append(' comm="%s" exe="%s" path="%s"' % (msg.comm, msg.exe, msg.path)) explain_interfaces() return s def call_interface(interface, av): params = [] args = [] params.extend(interface.params.values()) params.sort(key=lambda param: param.num, reverse=True) ifcall = refpolicy.InterfaceCall() ifcall.ifname = interface.name for i in range(len(params)): if params[i].type == refpolicy.SRC_TYPE: ifcall.args.append(av.src_type) elif params[i].type == refpolicy.TGT_TYPE: ifcall.args.append(av.tgt_type) elif params[i].type == refpolicy.OBJ_CLASS: ifcall.args.append(av.obj_class) else: print(params[i].type) assert 0 assert len(ifcall.args) > 0 return ifcall class InterfaceGenerator: def __init__(self, ifs, perm_maps=None): self.ifs = ifs self.hack_check_ifs(ifs) self.matcher = matching.AccessMatcher(perm_maps) self.calls = [] def hack_check_ifs(self, ifs): # FIXME: Disable interfaces we can't call - this is a hack. # Because we don't handle roles, multiple parameters, etc., # etc., we must make certain we can actually use a returned # interface. for x in ifs.interfaces.values(): params = [] params.extend(x.params.values()) params.sort(key=lambda param: param.num, reverse=True) for i in range(len(params)): # Check that the parameter position matches # the number (e.g., $1 is the first arg). This # will fail if the parser missed something. if (i + 1) != params[i].num: x.enabled = False break # Check that we can handle the param type (currently excludes # roles. if params[i].type not in [refpolicy.SRC_TYPE, refpolicy.TGT_TYPE, refpolicy.OBJ_CLASS]: x.enabled = False break def gen(self, avs, verbosity): raw_av = self.match(avs) ifcalls = [] for ml in self.calls: ifcall = call_interface(ml.best().interface, ml.av) if verbosity: ifcall.comment = refpolicy.Comment(explain_access(ml.av, ml, verbosity)) ifcalls.append((ifcall, ml)) d = [] for ifcall, ifs in ifcalls: found = False for o_ifcall in d: if o_ifcall.matches(ifcall): if o_ifcall.comment and ifcall.comment: o_ifcall.comment.merge(ifcall.comment) found = True if not found: d.append(ifcall) return (raw_av, d) def match(self, avs): raw_av = [] for av in avs: ans = matching.MatchList() self.matcher.search_ifs(self.ifs, av, ans) if len(ans): self.calls.append(ans) else: raw_av.append(av) return raw_av def gen_requires(module): """Add require statements to the module. """ def collect_requires(node): r = refpolicy.Require() for avrule in node.avrules(): r.types.update(avrule.src_types) r.types.update(avrule.tgt_types) for obj in avrule.obj_classes: r.add_obj_class(obj, avrule.perms) for ifcall in node.interface_calls(): for arg in ifcall.args: # FIXME - handle non-type arguments when we # can actually figure those out. r.types.add(arg) for role_type in node.role_types(): r.roles.add(role_type.role) r.types.update(role_type.types) r.types.discard("self") node.children.insert(0, r) # FUTURE - this is untested on modules with any sort of # nesting for node in module.nodes(): collect_requires(node) module.py 0000644 00000016166 15025012421 0006405 0 ustar 00 # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> # # Copyright (C) 2006 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; version 2 only # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # """ Utilities for dealing with the compilation of modules and creation of module tress. """ import re import tempfile try: from subprocess import getstatusoutput except ImportError: from commands import getstatusoutput import os import os.path import shutil import selinux from . import defaults def is_valid_name(modname): """Check that a module name is valid. """ m = re.findall(r"[^a-zA-Z0-9_\-\.]", modname) if len(m) == 0 and modname[0].isalpha(): return True else: return False class ModuleTree: def __init__(self, modname): self.modname = modname self.dirname = None def dir_name(self): return self.dirname def te_name(self): return self.dirname + "/" + self.modname + ".te" def fc_name(self): return self.dirname + "/" + self.modname + ".fc" def if_name(self): return self.dirname + "/" + self.modname + ".if" def package_name(self): return self.dirname + "/" + self.modname + ".pp" def makefile_name(self): return self.dirname + "/Makefile" def create(self, parent_dirname, makefile_include=None): self.dirname = parent_dirname + "/" + self.modname os.mkdir(self.dirname) fd = open(self.makefile_name(), "w") if makefile_include: fd.write("include " + makefile_include) else: fd.write("include " + defaults.refpolicy_makefile()) fd.close() # Create empty files for the standard refpolicy # module files open(self.te_name(), "w").close() open(self.fc_name(), "w").close() open(self.if_name(), "w").close() def modname_from_sourcename(sourcename): return os.path.splitext(os.path.split(sourcename)[1])[0] class ModuleCompiler: """ModuleCompiler eases running of the module compiler. The ModuleCompiler class encapsulates running the commandline module compiler (checkmodule) and module packager (semodule_package). You are likely interested in the create_module_package method. Several options are controlled via parameters (only effects the non-refpol builds): .mls [boolean] Generate an MLS module (by passed -M to checkmodule). True to generate an MLS module, false otherwise. .module [boolean] Generate a module instead of a base module. True to generate a module, false to generate a base. .checkmodule [string] Fully qualified path to the module compiler. Default is /usr/bin/checkmodule. .semodule_package [string] Fully qualified path to the module packager. Defaults to /usr/bin/semodule_package. .output [file object] File object used to write verbose output of the compililation and packaging process. """ def __init__(self, output=None): """Create a ModuleCompiler instance, optionally with an output file object for verbose output of the compilation process. """ self.mls = selinux.is_selinux_mls_enabled() self.module = True self.checkmodule = "/usr/bin/checkmodule" self.semodule_package = "/usr/bin/semodule_package" self.output = output self.last_output = "" self.refpol_makefile = defaults.refpolicy_makefile() self.make = "/usr/bin/make" def o(self, str): if self.output: self.output.write(str + "\n") self.last_output = str def run(self, command): self.o(command) rc, output = getstatusoutput(command) self.o(output) return rc def gen_filenames(self, sourcename): """Generate the module and policy package filenames from a source file name. The source file must be in the form of "foo.te". This will generate "foo.mod" and "foo.pp". Returns a tuple with (modname, policypackage). """ splitname = sourcename.split(".") if len(splitname) < 2: raise RuntimeError("invalid sourcefile name %s (must end in .te)", sourcename) # Handle other periods in the filename correctly basename = ".".join(splitname[0:-1]) modname = basename + ".mod" packagename = basename + ".pp" return (modname, packagename) def create_module_package(self, sourcename, refpolicy=True): """Create a module package saved in a packagename from a sourcename. The create_module_package creates a module package saved in a file named sourcename (.pp is the standard extension) from a source file (.te is the standard extension). The source file should contain SELinux policy statements appropriate for a base or non-base module (depending on the setting of .module). Only file names are accepted, not open file objects or descriptors because the command line SELinux tools are used. On error a RuntimeError will be raised with a descriptive error message. """ if refpolicy: self.refpol_build(sourcename) else: modname, packagename = self.gen_filenames(sourcename) self.compile(sourcename, modname) self.package(modname, packagename) os.unlink(modname) def refpol_build(self, sourcename): # Compile command = self.make + " -f " + self.refpol_makefile rc = self.run(command) # Raise an error if the process failed if rc != 0: raise RuntimeError("compilation failed:\n%s" % self.last_output) def compile(self, sourcename, modname): s = [self.checkmodule] if self.mls: s.append("-M") if self.module: s.append("-m") s.append("-o") s.append(modname) s.append(sourcename) rc = self.run(" ".join(s)) if rc != 0: raise RuntimeError("compilation failed:\n%s" % self.last_output) def package(self, modname, packagename): s = [self.semodule_package] s.append("-o") s.append(packagename) s.append("-m") s.append(modname) rc = self.run(" ".join(s)) if rc != 0: raise RuntimeError("packaging failed [%s]" % self.last_output) classperms.py 0000644 00000005402 15025012421 0007263 0 ustar 00 # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> # # Copyright (C) 2006 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; version 2 only # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # import sys tokens = ('DEFINE', 'NAME', 'TICK', 'SQUOTE', 'OBRACE', 'CBRACE', 'SEMI', 'OPAREN', 'CPAREN', 'COMMA') reserved = { 'define' : 'DEFINE' } t_TICK = r'\`' t_SQUOTE = r'\'' t_OBRACE = r'\{' t_CBRACE = r'\}' t_SEMI = r'\;' t_OPAREN = r'\(' t_CPAREN = r'\)' t_COMMA = r'\,' t_ignore = " \t\n" def t_NAME(t): r'[a-zA-Z_][a-zA-Z0-9_]*' t.type = reserved.get(t.value,'NAME') return t def t_error(t): print("Illegal character '%s'" % t.value[0]) t.skip(1) from . import lex lex.lex() def p_statements(p): '''statements : define_stmt | define_stmt statements ''' if len(p) == 2: p[0] = [p[1]] else: p[0] = [p[1]] + [p[2]] def p_define_stmt(p): # This sucks - corresponds to 'define(`foo',`{ read write }') '''define_stmt : DEFINE OPAREN TICK NAME SQUOTE COMMA TICK list SQUOTE CPAREN ''' p[0] = [p[4], p[8]] def p_list(p): '''list : NAME | OBRACE names CBRACE ''' if p[1] == "{": p[0] = p[2] else: p[0] = [p[1]] def p_names(p): '''names : NAME | NAME names ''' if len(p) == 2: p[0] = [p[1]] else: p[0] = [p[1]] + p[2] def p_error(p): print("Syntax error on line %d %s [type=%s]" % (p.lineno, p.value, p.type)) from . import yacc yacc.yacc() f = open("all_perms.spt") txt = f.read() f.close() #lex.input(txt) #while 1: # tok = lex.token() # if not tok: # break # print tok test = "define(`foo',`{ read write append }')" test2 = """define(`all_filesystem_perms',`{ mount remount unmount getattr relabelfrom relabelto transition associate quotamod quotaget }') define(`all_security_perms',`{ compute_av compute_create compute_member check_context load_policy compute_relabel compute_user setenforce setbool setsecparam setcheckreqprot }') """ result = yacc.parse(txt) print(result) lex.py 0000644 00000123631 15025012421 0005704 0 ustar 00 # ----------------------------------------------------------------------------- # ply: lex.py # # Copyright (C) 2001-2018 # David M. Beazley (Dabeaz LLC) # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are # met: # # * Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # * Neither the name of the David Beazley or Dabeaz LLC may be used to # endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR # A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT # OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, # DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # ----------------------------------------------------------------------------- __version__ = '3.11' __tabversion__ = '3.10' import re import sys import types import copy import os import inspect # This tuple contains known string types try: # Python 2.6 StringTypes = (types.StringType, types.UnicodeType) except AttributeError: # Python 3.0 StringTypes = (str, bytes) # This regular expression is used to match valid token names _is_identifier = re.compile(r'^[a-zA-Z0-9_]+$') # Exception thrown when invalid token encountered and no default error # handler is defined. class LexError(Exception): def __init__(self, message, s): self.args = (message,) self.text = s # Token class. This class is used to represent the tokens produced. class LexToken(object): def __str__(self): return 'LexToken(%s,%r,%d,%d)' % (self.type, self.value, self.lineno, self.lexpos) def __repr__(self): return str(self) # This object is a stand-in for a logging object created by the # logging module. class PlyLogger(object): def __init__(self, f): self.f = f def critical(self, msg, *args, **kwargs): self.f.write((msg % args) + '\n') def warning(self, msg, *args, **kwargs): self.f.write('WARNING: ' + (msg % args) + '\n') def error(self, msg, *args, **kwargs): self.f.write('ERROR: ' + (msg % args) + '\n') info = critical debug = critical # Null logger is used when no output is generated. Does nothing. class NullLogger(object): def __getattribute__(self, name): return self def __call__(self, *args, **kwargs): return self # ----------------------------------------------------------------------------- # === Lexing Engine === # # The following Lexer class implements the lexer runtime. There are only # a few public methods and attributes: # # input() - Store a new string in the lexer # token() - Get the next token # clone() - Clone the lexer # # lineno - Current line number # lexpos - Current position in the input string # ----------------------------------------------------------------------------- class Lexer: def __init__(self): self.lexre = None # Master regular expression. This is a list of # tuples (re, findex) where re is a compiled # regular expression and findex is a list # mapping regex group numbers to rules self.lexretext = None # Current regular expression strings self.lexstatere = {} # Dictionary mapping lexer states to master regexs self.lexstateretext = {} # Dictionary mapping lexer states to regex strings self.lexstaterenames = {} # Dictionary mapping lexer states to symbol names self.lexstate = 'INITIAL' # Current lexer state self.lexstatestack = [] # Stack of lexer states self.lexstateinfo = None # State information self.lexstateignore = {} # Dictionary of ignored characters for each state self.lexstateerrorf = {} # Dictionary of error functions for each state self.lexstateeoff = {} # Dictionary of eof functions for each state self.lexreflags = 0 # Optional re compile flags self.lexdata = None # Actual input data (as a string) self.lexpos = 0 # Current position in input text self.lexlen = 0 # Length of the input text self.lexerrorf = None # Error rule (if any) self.lexeoff = None # EOF rule (if any) self.lextokens = None # List of valid tokens self.lexignore = '' # Ignored characters self.lexliterals = '' # Literal characters that can be passed through self.lexmodule = None # Module self.lineno = 1 # Current line number self.lexoptimize = False # Optimized mode def clone(self, object=None): c = copy.copy(self) # If the object parameter has been supplied, it means we are attaching the # lexer to a new object. In this case, we have to rebind all methods in # the lexstatere and lexstateerrorf tables. if object: newtab = {} for key, ritem in self.lexstatere.items(): newre = [] for cre, findex in ritem: newfindex = [] for f in findex: if not f or not f[0]: newfindex.append(f) continue newfindex.append((getattr(object, f[0].__name__), f[1])) newre.append((cre, newfindex)) newtab[key] = newre c.lexstatere = newtab c.lexstateerrorf = {} for key, ef in self.lexstateerrorf.items(): c.lexstateerrorf[key] = getattr(object, ef.__name__) c.lexmodule = object return c # ------------------------------------------------------------ # writetab() - Write lexer information to a table file # ------------------------------------------------------------ def writetab(self, lextab, outputdir=''): if isinstance(lextab, types.ModuleType): raise IOError("Won't overwrite existing lextab module") basetabmodule = lextab.split('.')[-1] filename = os.path.join(outputdir, basetabmodule) + '.py' with open(filename, 'w') as tf: tf.write('# %s.py. This file automatically created by PLY (version %s). Don\'t edit!\n' % (basetabmodule, __version__)) tf.write('_tabversion = %s\n' % repr(__tabversion__)) tf.write('_lextokens = set(%s)\n' % repr(tuple(sorted(self.lextokens)))) tf.write('_lexreflags = %s\n' % repr(int(self.lexreflags))) tf.write('_lexliterals = %s\n' % repr(self.lexliterals)) tf.write('_lexstateinfo = %s\n' % repr(self.lexstateinfo)) # Rewrite the lexstatere table, replacing function objects with function names tabre = {} for statename, lre in self.lexstatere.items(): titem = [] for (pat, func), retext, renames in zip(lre, self.lexstateretext[statename], self.lexstaterenames[statename]): titem.append((retext, _funcs_to_names(func, renames))) tabre[statename] = titem tf.write('_lexstatere = %s\n' % repr(tabre)) tf.write('_lexstateignore = %s\n' % repr(self.lexstateignore)) taberr = {} for statename, ef in self.lexstateerrorf.items(): taberr[statename] = ef.__name__ if ef else None tf.write('_lexstateerrorf = %s\n' % repr(taberr)) tabeof = {} for statename, ef in self.lexstateeoff.items(): tabeof[statename] = ef.__name__ if ef else None tf.write('_lexstateeoff = %s\n' % repr(tabeof)) # ------------------------------------------------------------ # readtab() - Read lexer information from a tab file # ------------------------------------------------------------ def readtab(self, tabfile, fdict): if isinstance(tabfile, types.ModuleType): lextab = tabfile else: exec('import %s' % tabfile) lextab = sys.modules[tabfile] if getattr(lextab, '_tabversion', '0.0') != __tabversion__: raise ImportError('Inconsistent PLY version') self.lextokens = lextab._lextokens self.lexreflags = lextab._lexreflags self.lexliterals = lextab._lexliterals self.lextokens_all = self.lextokens | set(self.lexliterals) self.lexstateinfo = lextab._lexstateinfo self.lexstateignore = lextab._lexstateignore self.lexstatere = {} self.lexstateretext = {} for statename, lre in lextab._lexstatere.items(): titem = [] txtitem = [] for pat, func_name in lre: titem.append((re.compile(pat, lextab._lexreflags), _names_to_funcs(func_name, fdict))) self.lexstatere[statename] = titem self.lexstateretext[statename] = txtitem self.lexstateerrorf = {} for statename, ef in lextab._lexstateerrorf.items(): self.lexstateerrorf[statename] = fdict[ef] self.lexstateeoff = {} for statename, ef in lextab._lexstateeoff.items(): self.lexstateeoff[statename] = fdict[ef] self.begin('INITIAL') # ------------------------------------------------------------ # input() - Push a new string into the lexer # ------------------------------------------------------------ def input(self, s): # Pull off the first character to see if s looks like a string c = s[:1] if not isinstance(c, StringTypes): raise ValueError('Expected a string') self.lexdata = s self.lexpos = 0 self.lexlen = len(s) # ------------------------------------------------------------ # begin() - Changes the lexing state # ------------------------------------------------------------ def begin(self, state): if state not in self.lexstatere: raise ValueError('Undefined state') self.lexre = self.lexstatere[state] self.lexretext = self.lexstateretext[state] self.lexignore = self.lexstateignore.get(state, '') self.lexerrorf = self.lexstateerrorf.get(state, None) self.lexeoff = self.lexstateeoff.get(state, None) self.lexstate = state # ------------------------------------------------------------ # push_state() - Changes the lexing state and saves old on stack # ------------------------------------------------------------ def push_state(self, state): self.lexstatestack.append(self.lexstate) self.begin(state) # ------------------------------------------------------------ # pop_state() - Restores the previous state # ------------------------------------------------------------ def pop_state(self): self.begin(self.lexstatestack.pop()) # ------------------------------------------------------------ # current_state() - Returns the current lexing state # ------------------------------------------------------------ def current_state(self): return self.lexstate # ------------------------------------------------------------ # skip() - Skip ahead n characters # ------------------------------------------------------------ def skip(self, n): self.lexpos += n # ------------------------------------------------------------ # opttoken() - Return the next token from the Lexer # # Note: This function has been carefully implemented to be as fast # as possible. Don't make changes unless you really know what # you are doing # ------------------------------------------------------------ def token(self): # Make local copies of frequently referenced attributes lexpos = self.lexpos lexlen = self.lexlen lexignore = self.lexignore lexdata = self.lexdata while lexpos < lexlen: # This code provides some short-circuit code for whitespace, tabs, and other ignored characters if lexdata[lexpos] in lexignore: lexpos += 1 continue # Look for a regular expression match for lexre, lexindexfunc in self.lexre: m = lexre.match(lexdata, lexpos) if not m: continue # Create a token for return tok = LexToken() tok.value = m.group() tok.lineno = self.lineno tok.lexpos = lexpos i = m.lastindex func, tok.type = lexindexfunc[i] if not func: # If no token type was set, it's an ignored token if tok.type: self.lexpos = m.end() return tok else: lexpos = m.end() break lexpos = m.end() # If token is processed by a function, call it tok.lexer = self # Set additional attributes useful in token rules self.lexmatch = m self.lexpos = lexpos newtok = func(tok) # Every function must return a token, if nothing, we just move to next token if not newtok: lexpos = self.lexpos # This is here in case user has updated lexpos. lexignore = self.lexignore # This is here in case there was a state change break # Verify type of the token. If not in the token map, raise an error if not self.lexoptimize: if newtok.type not in self.lextokens_all: raise LexError("%s:%d: Rule '%s' returned an unknown token type '%s'" % ( func.__code__.co_filename, func.__code__.co_firstlineno, func.__name__, newtok.type), lexdata[lexpos:]) return newtok else: # No match, see if in literals if lexdata[lexpos] in self.lexliterals: tok = LexToken() tok.value = lexdata[lexpos] tok.lineno = self.lineno tok.type = tok.value tok.lexpos = lexpos self.lexpos = lexpos + 1 return tok # No match. Call t_error() if defined. if self.lexerrorf: tok = LexToken() tok.value = self.lexdata[lexpos:] tok.lineno = self.lineno tok.type = 'error' tok.lexer = self tok.lexpos = lexpos self.lexpos = lexpos newtok = self.lexerrorf(tok) if lexpos == self.lexpos: # Error method didn't change text position at all. This is an error. raise LexError("Scanning error. Illegal character '%s'" % (lexdata[lexpos]), lexdata[lexpos:]) lexpos = self.lexpos if not newtok: continue return newtok self.lexpos = lexpos raise LexError("Illegal character '%s' at index %d" % (lexdata[lexpos], lexpos), lexdata[lexpos:]) if self.lexeoff: tok = LexToken() tok.type = 'eof' tok.value = '' tok.lineno = self.lineno tok.lexpos = lexpos tok.lexer = self self.lexpos = lexpos newtok = self.lexeoff(tok) return newtok self.lexpos = lexpos + 1 if self.lexdata is None: raise RuntimeError('No input string given with input()') return None # Iterator interface def __iter__(self): return self def next(self): t = self.token() if t is None: raise StopIteration return t __next__ = next # ----------------------------------------------------------------------------- # ==== Lex Builder === # # The functions and classes below are used to collect lexing information # and build a Lexer object from it. # ----------------------------------------------------------------------------- # ----------------------------------------------------------------------------- # _get_regex(func) # # Returns the regular expression assigned to a function either as a doc string # or as a .regex attribute attached by the @TOKEN decorator. # ----------------------------------------------------------------------------- def _get_regex(func): return getattr(func, 'regex', func.__doc__) # ----------------------------------------------------------------------------- # get_caller_module_dict() # # This function returns a dictionary containing all of the symbols defined within # a caller further down the call stack. This is used to get the environment # associated with the yacc() call if none was provided. # ----------------------------------------------------------------------------- def get_caller_module_dict(levels): f = sys._getframe(levels) ldict = f.f_globals.copy() if f.f_globals != f.f_locals: ldict.update(f.f_locals) return ldict # ----------------------------------------------------------------------------- # _funcs_to_names() # # Given a list of regular expression functions, this converts it to a list # suitable for output to a table file # ----------------------------------------------------------------------------- def _funcs_to_names(funclist, namelist): result = [] for f, name in zip(funclist, namelist): if f and f[0]: result.append((name, f[1])) else: result.append(f) return result # ----------------------------------------------------------------------------- # _names_to_funcs() # # Given a list of regular expression function names, this converts it back to # functions. # ----------------------------------------------------------------------------- def _names_to_funcs(namelist, fdict): result = [] for n in namelist: if n and n[0]: result.append((fdict[n[0]], n[1])) else: result.append(n) return result # ----------------------------------------------------------------------------- # _form_master_re() # # This function takes a list of all of the regex components and attempts to # form the master regular expression. Given limitations in the Python re # module, it may be necessary to break the master regex into separate expressions. # ----------------------------------------------------------------------------- def _form_master_re(relist, reflags, ldict, toknames): if not relist: return [] regex = '|'.join(relist) try: lexre = re.compile(regex, reflags) # Build the index to function map for the matching engine lexindexfunc = [None] * (max(lexre.groupindex.values()) + 1) lexindexnames = lexindexfunc[:] for f, i in lexre.groupindex.items(): handle = ldict.get(f, None) if type(handle) in (types.FunctionType, types.MethodType): lexindexfunc[i] = (handle, toknames[f]) lexindexnames[i] = f elif handle is not None: lexindexnames[i] = f if f.find('ignore_') > 0: lexindexfunc[i] = (None, None) else: lexindexfunc[i] = (None, toknames[f]) return [(lexre, lexindexfunc)], [regex], [lexindexnames] except Exception: m = int(len(relist)/2) if m == 0: m = 1 llist, lre, lnames = _form_master_re(relist[:m], reflags, ldict, toknames) rlist, rre, rnames = _form_master_re(relist[m:], reflags, ldict, toknames) return (llist+rlist), (lre+rre), (lnames+rnames) # ----------------------------------------------------------------------------- # def _statetoken(s,names) # # Given a declaration name s of the form "t_" and a dictionary whose keys are # state names, this function returns a tuple (states,tokenname) where states # is a tuple of state names and tokenname is the name of the token. For example, # calling this with s = "t_foo_bar_SPAM" might return (('foo','bar'),'SPAM') # ----------------------------------------------------------------------------- def _statetoken(s, names): parts = s.split('_') for i, part in enumerate(parts[1:], 1): if part not in names and part != 'ANY': break if i > 1: states = tuple(parts[1:i]) else: states = ('INITIAL',) if 'ANY' in states: states = tuple(names) tokenname = '_'.join(parts[i:]) return (states, tokenname) # ----------------------------------------------------------------------------- # LexerReflect() # # This class represents information needed to build a lexer as extracted from a # user's input file. # ----------------------------------------------------------------------------- class LexerReflect(object): def __init__(self, ldict, log=None, reflags=0): self.ldict = ldict self.error_func = None self.tokens = [] self.reflags = reflags self.stateinfo = {'INITIAL': 'inclusive'} self.modules = set() self.error = False self.log = PlyLogger(sys.stderr) if log is None else log # Get all of the basic information def get_all(self): self.get_tokens() self.get_literals() self.get_states() self.get_rules() # Validate all of the information def validate_all(self): self.validate_tokens() self.validate_literals() self.validate_rules() return self.error # Get the tokens map def get_tokens(self): tokens = self.ldict.get('tokens', None) if not tokens: self.log.error('No token list is defined') self.error = True return if not isinstance(tokens, (list, tuple)): self.log.error('tokens must be a list or tuple') self.error = True return if not tokens: self.log.error('tokens is empty') self.error = True return self.tokens = tokens # Validate the tokens def validate_tokens(self): terminals = {} for n in self.tokens: if not _is_identifier.match(n): self.log.error("Bad token name '%s'", n) self.error = True if n in terminals: self.log.warning("Token '%s' multiply defined", n) terminals[n] = 1 # Get the literals specifier def get_literals(self): self.literals = self.ldict.get('literals', '') if not self.literals: self.literals = '' # Validate literals def validate_literals(self): try: for c in self.literals: if not isinstance(c, StringTypes) or len(c) > 1: self.log.error('Invalid literal %s. Must be a single character', repr(c)) self.error = True except TypeError: self.log.error('Invalid literals specification. literals must be a sequence of characters') self.error = True def get_states(self): self.states = self.ldict.get('states', None) # Build statemap if self.states: if not isinstance(self.states, (tuple, list)): self.log.error('states must be defined as a tuple or list') self.error = True else: for s in self.states: if not isinstance(s, tuple) or len(s) != 2: self.log.error("Invalid state specifier %s. Must be a tuple (statename,'exclusive|inclusive')", repr(s)) self.error = True continue name, statetype = s if not isinstance(name, StringTypes): self.log.error('State name %s must be a string', repr(name)) self.error = True continue if not (statetype == 'inclusive' or statetype == 'exclusive'): self.log.error("State type for state %s must be 'inclusive' or 'exclusive'", name) self.error = True continue if name in self.stateinfo: self.log.error("State '%s' already defined", name) self.error = True continue self.stateinfo[name] = statetype # Get all of the symbols with a t_ prefix and sort them into various # categories (functions, strings, error functions, and ignore characters) def get_rules(self): tsymbols = [f for f in self.ldict if f[:2] == 't_'] # Now build up a list of functions and a list of strings self.toknames = {} # Mapping of symbols to token names self.funcsym = {} # Symbols defined as functions self.strsym = {} # Symbols defined as strings self.ignore = {} # Ignore strings by state self.errorf = {} # Error functions by state self.eoff = {} # EOF functions by state for s in self.stateinfo: self.funcsym[s] = [] self.strsym[s] = [] if len(tsymbols) == 0: self.log.error('No rules of the form t_rulename are defined') self.error = True return for f in tsymbols: t = self.ldict[f] states, tokname = _statetoken(f, self.stateinfo) self.toknames[f] = tokname if hasattr(t, '__call__'): if tokname == 'error': for s in states: self.errorf[s] = t elif tokname == 'eof': for s in states: self.eoff[s] = t elif tokname == 'ignore': line = t.__code__.co_firstlineno file = t.__code__.co_filename self.log.error("%s:%d: Rule '%s' must be defined as a string", file, line, t.__name__) self.error = True else: for s in states: self.funcsym[s].append((f, t)) elif isinstance(t, StringTypes): if tokname == 'ignore': for s in states: self.ignore[s] = t if '\\' in t: self.log.warning("%s contains a literal backslash '\\'", f) elif tokname == 'error': self.log.error("Rule '%s' must be defined as a function", f) self.error = True else: for s in states: self.strsym[s].append((f, t)) else: self.log.error('%s not defined as a function or string', f) self.error = True # Sort the functions by line number for f in self.funcsym.values(): f.sort(key=lambda x: x[1].__code__.co_firstlineno) # Sort the strings by regular expression length for s in self.strsym.values(): s.sort(key=lambda x: len(x[1]), reverse=True) # Validate all of the t_rules collected def validate_rules(self): for state in self.stateinfo: # Validate all rules defined by functions for fname, f in self.funcsym[state]: line = f.__code__.co_firstlineno file = f.__code__.co_filename module = inspect.getmodule(f) self.modules.add(module) tokname = self.toknames[fname] if isinstance(f, types.MethodType): reqargs = 2 else: reqargs = 1 nargs = f.__code__.co_argcount if nargs > reqargs: self.log.error("%s:%d: Rule '%s' has too many arguments", file, line, f.__name__) self.error = True continue if nargs < reqargs: self.log.error("%s:%d: Rule '%s' requires an argument", file, line, f.__name__) self.error = True continue if not _get_regex(f): self.log.error("%s:%d: No regular expression defined for rule '%s'", file, line, f.__name__) self.error = True continue try: c = re.compile('(?P<%s>%s)' % (fname, _get_regex(f)), self.reflags) if c.match(''): self.log.error("%s:%d: Regular expression for rule '%s' matches empty string", file, line, f.__name__) self.error = True except re.error as e: self.log.error("%s:%d: Invalid regular expression for rule '%s'. %s", file, line, f.__name__, e) if '#' in _get_regex(f): self.log.error("%s:%d. Make sure '#' in rule '%s' is escaped with '\\#'", file, line, f.__name__) self.error = True # Validate all rules defined by strings for name, r in self.strsym[state]: tokname = self.toknames[name] if tokname == 'error': self.log.error("Rule '%s' must be defined as a function", name) self.error = True continue if tokname not in self.tokens and tokname.find('ignore_') < 0: self.log.error("Rule '%s' defined for an unspecified token %s", name, tokname) self.error = True continue try: c = re.compile('(?P<%s>%s)' % (name, r), self.reflags) if (c.match('')): self.log.error("Regular expression for rule '%s' matches empty string", name) self.error = True except re.error as e: self.log.error("Invalid regular expression for rule '%s'. %s", name, e) if '#' in r: self.log.error("Make sure '#' in rule '%s' is escaped with '\\#'", name) self.error = True if not self.funcsym[state] and not self.strsym[state]: self.log.error("No rules defined for state '%s'", state) self.error = True # Validate the error function efunc = self.errorf.get(state, None) if efunc: f = efunc line = f.__code__.co_firstlineno file = f.__code__.co_filename module = inspect.getmodule(f) self.modules.add(module) if isinstance(f, types.MethodType): reqargs = 2 else: reqargs = 1 nargs = f.__code__.co_argcount if nargs > reqargs: self.log.error("%s:%d: Rule '%s' has too many arguments", file, line, f.__name__) self.error = True if nargs < reqargs: self.log.error("%s:%d: Rule '%s' requires an argument", file, line, f.__name__) self.error = True for module in self.modules: self.validate_module(module) # ----------------------------------------------------------------------------- # validate_module() # # This checks to see if there are duplicated t_rulename() functions or strings # in the parser input file. This is done using a simple regular expression # match on each line in the source code of the given module. # ----------------------------------------------------------------------------- def validate_module(self, module): try: lines, linen = inspect.getsourcelines(module) except IOError: return fre = re.compile(r'\s*def\s+(t_[a-zA-Z_0-9]*)\(') sre = re.compile(r'\s*(t_[a-zA-Z_0-9]*)\s*=') counthash = {} linen += 1 for line in lines: m = fre.match(line) if not m: m = sre.match(line) if m: name = m.group(1) prev = counthash.get(name) if not prev: counthash[name] = linen else: filename = inspect.getsourcefile(module) self.log.error('%s:%d: Rule %s redefined. Previously defined on line %d', filename, linen, name, prev) self.error = True linen += 1 # ----------------------------------------------------------------------------- # lex(module) # # Build all of the regular expression rules from definitions in the supplied module # ----------------------------------------------------------------------------- def lex(module=None, object=None, debug=False, optimize=False, lextab='lextab', reflags=int(re.VERBOSE), nowarn=False, outputdir=None, debuglog=None, errorlog=None): if lextab is None: lextab = 'lextab' global lexer ldict = None stateinfo = {'INITIAL': 'inclusive'} lexobj = Lexer() lexobj.lexoptimize = optimize global token, input if errorlog is None: errorlog = PlyLogger(sys.stderr) if debug: if debuglog is None: debuglog = PlyLogger(sys.stderr) # Get the module dictionary used for the lexer if object: module = object # Get the module dictionary used for the parser if module: _items = [(k, getattr(module, k)) for k in dir(module)] ldict = dict(_items) # If no __file__ attribute is available, try to obtain it from the __module__ instead if '__file__' not in ldict: ldict['__file__'] = sys.modules[ldict['__module__']].__file__ else: ldict = get_caller_module_dict(2) # Determine if the module is package of a package or not. # If so, fix the tabmodule setting so that tables load correctly pkg = ldict.get('__package__') if pkg and isinstance(lextab, str): if '.' not in lextab: lextab = pkg + '.' + lextab # Collect parser information from the dictionary linfo = LexerReflect(ldict, log=errorlog, reflags=reflags) linfo.get_all() if not optimize: if linfo.validate_all(): raise SyntaxError("Can't build lexer") if optimize and lextab: try: lexobj.readtab(lextab, ldict) token = lexobj.token input = lexobj.input lexer = lexobj return lexobj except ImportError: pass # Dump some basic debugging information if debug: debuglog.info('lex: tokens = %r', linfo.tokens) debuglog.info('lex: literals = %r', linfo.literals) debuglog.info('lex: states = %r', linfo.stateinfo) # Build a dictionary of valid token names lexobj.lextokens = set() for n in linfo.tokens: lexobj.lextokens.add(n) # Get literals specification if isinstance(linfo.literals, (list, tuple)): lexobj.lexliterals = type(linfo.literals[0])().join(linfo.literals) else: lexobj.lexliterals = linfo.literals lexobj.lextokens_all = lexobj.lextokens | set(lexobj.lexliterals) # Get the stateinfo dictionary stateinfo = linfo.stateinfo regexs = {} # Build the master regular expressions for state in stateinfo: regex_list = [] # Add rules defined by functions first for fname, f in linfo.funcsym[state]: regex_list.append('(?P<%s>%s)' % (fname, _get_regex(f))) if debug: debuglog.info("lex: Adding rule %s -> '%s' (state '%s')", fname, _get_regex(f), state) # Now add all of the simple rules for name, r in linfo.strsym[state]: regex_list.append('(?P<%s>%s)' % (name, r)) if debug: debuglog.info("lex: Adding rule %s -> '%s' (state '%s')", name, r, state) regexs[state] = regex_list # Build the master regular expressions if debug: debuglog.info('lex: ==== MASTER REGEXS FOLLOW ====') for state in regexs: lexre, re_text, re_names = _form_master_re(regexs[state], reflags, ldict, linfo.toknames) lexobj.lexstatere[state] = lexre lexobj.lexstateretext[state] = re_text lexobj.lexstaterenames[state] = re_names if debug: for i, text in enumerate(re_text): debuglog.info("lex: state '%s' : regex[%d] = '%s'", state, i, text) # For inclusive states, we need to add the regular expressions from the INITIAL state for state, stype in stateinfo.items(): if state != 'INITIAL' and stype == 'inclusive': lexobj.lexstatere[state].extend(lexobj.lexstatere['INITIAL']) lexobj.lexstateretext[state].extend(lexobj.lexstateretext['INITIAL']) lexobj.lexstaterenames[state].extend(lexobj.lexstaterenames['INITIAL']) lexobj.lexstateinfo = stateinfo lexobj.lexre = lexobj.lexstatere['INITIAL'] lexobj.lexretext = lexobj.lexstateretext['INITIAL'] lexobj.lexreflags = reflags # Set up ignore variables lexobj.lexstateignore = linfo.ignore lexobj.lexignore = lexobj.lexstateignore.get('INITIAL', '') # Set up error functions lexobj.lexstateerrorf = linfo.errorf lexobj.lexerrorf = linfo.errorf.get('INITIAL', None) if not lexobj.lexerrorf: errorlog.warning('No t_error rule is defined') # Set up eof functions lexobj.lexstateeoff = linfo.eoff lexobj.lexeoff = linfo.eoff.get('INITIAL', None) # Check state information for ignore and error rules for s, stype in stateinfo.items(): if stype == 'exclusive': if s not in linfo.errorf: errorlog.warning("No error rule is defined for exclusive state '%s'", s) if s not in linfo.ignore and lexobj.lexignore: errorlog.warning("No ignore rule is defined for exclusive state '%s'", s) elif stype == 'inclusive': if s not in linfo.errorf: linfo.errorf[s] = linfo.errorf.get('INITIAL', None) if s not in linfo.ignore: linfo.ignore[s] = linfo.ignore.get('INITIAL', '') # Create global versions of the token() and input() functions token = lexobj.token input = lexobj.input lexer = lexobj # If in optimize mode, we write the lextab if lextab and optimize: if outputdir is None: # If no output directory is set, the location of the output files # is determined according to the following rules: # - If lextab specifies a package, files go into that package directory # - Otherwise, files go in the same directory as the specifying module if isinstance(lextab, types.ModuleType): srcfile = lextab.__file__ else: if '.' not in lextab: srcfile = ldict['__file__'] else: parts = lextab.split('.') pkgname = '.'.join(parts[:-1]) exec('import %s' % pkgname) srcfile = getattr(sys.modules[pkgname], '__file__', '') outputdir = os.path.dirname(srcfile) try: lexobj.writetab(lextab, outputdir) if lextab in sys.modules: del sys.modules[lextab] except IOError as e: errorlog.warning("Couldn't write lextab module %r. %s" % (lextab, e)) return lexobj # ----------------------------------------------------------------------------- # runmain() # # This runs the lexer as a main program # ----------------------------------------------------------------------------- def runmain(lexer=None, data=None): if not data: try: filename = sys.argv[1] f = open(filename) data = f.read() f.close() except IndexError: sys.stdout.write('Reading from standard input (type EOF to end):\n') data = sys.stdin.read() if lexer: _input = lexer.input else: _input = input _input(data) if lexer: _token = lexer.token else: _token = token while True: tok = _token() if not tok: break sys.stdout.write('(%s,%r,%d,%d)\n' % (tok.type, tok.value, tok.lineno, tok.lexpos)) # ----------------------------------------------------------------------------- # @TOKEN(regex) # # This decorator function can be used to set the regex expression on a function # when its docstring might need to be set in an alternative way # ----------------------------------------------------------------------------- def TOKEN(r): def set_regex(f): if hasattr(r, '__call__'): f.regex = _get_regex(r) else: f.regex = r return f return set_regex # Alternative spelling of the TOKEN decorator Token = TOKEN refparser.py 0000644 00000075145 15025012421 0007113 0 ustar 00 # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> # # Copyright (C) 2006-2007 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; version 2 only # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # # OVERVIEW # # # This is a parser for the refpolicy policy "language" - i.e., the # normal SELinux policy language plus the refpolicy style M4 macro # constructs on top of that base language. This parser is primarily # aimed at parsing the policy headers in order to create an abstract # policy representation suitable for generating policy. # # Both the lexer and parser are included in this file. The are implemented # using the Ply library (included with sepolgen). import sys import os import re import traceback from . import access from . import defaults from . import lex from . import refpolicy from . import yacc # ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: # # lexer # # ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: tokens = ( # basic tokens, punctuation 'TICK', 'SQUOTE', 'OBRACE', 'CBRACE', 'SEMI', 'COLON', 'OPAREN', 'CPAREN', 'COMMA', 'MINUS', 'TILDE', 'ASTERISK', 'AMP', 'BAR', 'EXPL', 'EQUAL', 'FILENAME', 'IDENTIFIER', 'NUMBER', 'PATH', 'IPV6_ADDR', # reserved words # module 'MODULE', 'POLICY_MODULE', 'REQUIRE', # flask 'SID', 'GENFSCON', 'FS_USE_XATTR', 'FS_USE_TRANS', 'FS_USE_TASK', 'PORTCON', 'NODECON', 'NETIFCON', 'PIRQCON', 'IOMEMCON', 'IOPORTCON', 'PCIDEVICECON', 'DEVICETREECON', # object classes 'CLASS', # types and attributes 'TYPEATTRIBUTE', 'ROLEATTRIBUTE', 'TYPE', 'ATTRIBUTE', 'ATTRIBUTE_ROLE', 'ALIAS', 'TYPEALIAS', # conditional policy 'BOOL', 'TRUE', 'FALSE', 'IF', 'ELSE', # users and roles 'ROLE', 'TYPES', # rules 'ALLOW', 'DONTAUDIT', 'AUDITALLOW', 'NEVERALLOW', 'PERMISSIVE', 'TYPEBOUNDS', 'TYPE_TRANSITION', 'TYPE_CHANGE', 'TYPE_MEMBER', 'RANGE_TRANSITION', 'ROLE_TRANSITION', # refpolicy keywords 'OPT_POLICY', 'INTERFACE', 'TUNABLE_POLICY', 'GEN_REQ', 'TEMPLATE', 'GEN_CONTEXT', 'GEN_TUNABLE', # m4 'IFELSE', 'IFDEF', 'IFNDEF', 'DEFINE' ) # All reserved keywords - see t_IDENTIFIER for how these are matched in # the lexer. reserved = { # module 'module' : 'MODULE', 'policy_module' : 'POLICY_MODULE', 'require' : 'REQUIRE', # flask 'sid' : 'SID', 'genfscon' : 'GENFSCON', 'fs_use_xattr' : 'FS_USE_XATTR', 'fs_use_trans' : 'FS_USE_TRANS', 'fs_use_task' : 'FS_USE_TASK', 'portcon' : 'PORTCON', 'nodecon' : 'NODECON', 'netifcon' : 'NETIFCON', 'pirqcon' : 'PIRQCON', 'iomemcon' : 'IOMEMCON', 'ioportcon' : 'IOPORTCON', 'pcidevicecon' : 'PCIDEVICECON', 'devicetreecon' : 'DEVICETREECON', # object classes 'class' : 'CLASS', # types and attributes 'typeattribute' : 'TYPEATTRIBUTE', 'roleattribute' : 'ROLEATTRIBUTE', 'type' : 'TYPE', 'attribute' : 'ATTRIBUTE', 'attribute_role' : 'ATTRIBUTE_ROLE', 'alias' : 'ALIAS', 'typealias' : 'TYPEALIAS', # conditional policy 'bool' : 'BOOL', 'true' : 'TRUE', 'false' : 'FALSE', 'if' : 'IF', 'else' : 'ELSE', # users and roles 'role' : 'ROLE', 'types' : 'TYPES', # rules 'allow' : 'ALLOW', 'dontaudit' : 'DONTAUDIT', 'auditallow' : 'AUDITALLOW', 'neverallow' : 'NEVERALLOW', 'permissive' : 'PERMISSIVE', 'typebounds' : 'TYPEBOUNDS', 'type_transition' : 'TYPE_TRANSITION', 'type_change' : 'TYPE_CHANGE', 'type_member' : 'TYPE_MEMBER', 'range_transition' : 'RANGE_TRANSITION', 'role_transition' : 'ROLE_TRANSITION', # refpolicy keywords 'optional_policy' : 'OPT_POLICY', 'interface' : 'INTERFACE', 'tunable_policy' : 'TUNABLE_POLICY', 'gen_require' : 'GEN_REQ', 'template' : 'TEMPLATE', 'gen_context' : 'GEN_CONTEXT', 'gen_tunable' : 'GEN_TUNABLE', # M4 'ifelse' : 'IFELSE', 'ifndef' : 'IFNDEF', 'ifdef' : 'IFDEF', 'define' : 'DEFINE' } # The ply lexer allows definition of tokens in 2 ways: regular expressions # or functions. # Simple regex tokens t_TICK = r'\`' t_SQUOTE = r'\'' t_OBRACE = r'\{' t_CBRACE = r'\}' # This will handle spurious extra ';' via the + t_SEMI = r'\;+' t_COLON = r'\:' t_OPAREN = r'\(' t_CPAREN = r'\)' t_COMMA = r'\,' t_MINUS = r'\-' t_TILDE = r'\~' t_ASTERISK = r'\*' t_AMP = r'\&' t_BAR = r'\|' t_EXPL = r'\!' t_EQUAL = r'\=' t_NUMBER = r'[0-9\.]+' t_PATH = r'/[a-zA-Z0-9)_\.\*/\$]*' #t_IPV6_ADDR = r'[a-fA-F0-9]{0,4}:[a-fA-F0-9]{0,4}:([a-fA-F0-9]{0,4}:)*' # Ignore whitespace - this is a special token for ply that more efficiently # ignores uninteresting tokens. t_ignore = " \t" # More complex tokens def t_IPV6_ADDR(t): r'[a-fA-F0-9]{0,4}:[a-fA-F0-9]{0,4}:([a-fA-F0-9]|:)*' # This is a function simply to force it sooner into # the regex list return t def t_m4comment(t): r'dnl.*\n' # Ignore all comments t.lexer.lineno += 1 def t_refpolicywarn1(t): r'define.*refpolicywarn\(.*\n' # Ignore refpolicywarn statements - they sometimes # contain text that we can't parse. t.skip(1) def t_refpolicywarn(t): r'refpolicywarn\(.*\n' # Ignore refpolicywarn statements - they sometimes # contain text that we can't parse. t.lexer.lineno += 1 def t_IDENTIFIER(t): r'[a-zA-Z_\$][a-zA-Z0-9_\-\+\.\$\*~]*' # Handle any keywords t.type = reserved.get(t.value,'IDENTIFIER') return t def t_FILENAME(t): r'\"[a-zA-Z0-9_\-\+\.\$\*~ :\[\]]+\"' # Handle any keywords t.type = reserved.get(t.value,'FILENAME') return t def t_comment(t): r'\#.*\n' # Ignore all comments t.lexer.lineno += 1 def t_error(t): print("Illegal character '%s'" % t.value[0]) t.skip(1) def t_newline(t): r'\n+' t.lexer.lineno += len(t.value) # ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: # # Parser # # ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: # Global data used during parsing - making it global is easier than # passing the state through the parsing functions. # m is the top-level data structure (stands for modules). m = None # error is either None (indicating no error) or a string error message. error = None parse_file = "" # spt is the support macros (e.g., obj/perm sets) - it is an instance of # refpolicy.SupportMacros and should always be present during parsing # though it may not contain any macros. spt = None success = True # utilities def collect(stmts, parent, val=None): if stmts is None: return for s in stmts: if s is None: continue s.parent = parent if val is not None: parent.children.insert(0, (val, s)) else: parent.children.insert(0, s) def expand(ids, s): for id in ids: if spt.has_key(id): # noqa s.update(spt.by_name(id)) else: s.add(id) # Top-level non-terminal def p_statements(p): '''statements : statement | statements statement | empty ''' if len(p) == 2 and p[1]: m.children.append(p[1]) elif len(p) > 2 and p[2]: m.children.append(p[2]) def p_statement(p): '''statement : interface | template | obj_perm_set | policy | policy_module_stmt | module_stmt ''' p[0] = p[1] def p_empty(p): 'empty :' pass # # Reference policy language constructs # # This is for the policy module statement (e.g., policy_module(foo,1.2.0)). # We have a separate terminal for either the basic language module statement # and interface calls to make it easier to identifier. def p_policy_module_stmt(p): 'policy_module_stmt : POLICY_MODULE OPAREN IDENTIFIER COMMA NUMBER CPAREN' m = refpolicy.ModuleDeclaration() m.name = p[3] m.version = p[5] m.refpolicy = True p[0] = m def p_interface(p): '''interface : INTERFACE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN ''' x = refpolicy.Interface(p[4]) collect(p[8], x) p[0] = x def p_template(p): '''template : TEMPLATE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN | DEFINE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN ''' x = refpolicy.Template(p[4]) collect(p[8], x) p[0] = x def p_define(p): '''define : DEFINE OPAREN TICK IDENTIFIER SQUOTE CPAREN''' # This is for defining single M4 values (to be used later in ifdef statements). # Example: define(`sulogin_no_pam'). We don't currently do anything with these # but we should in the future when we correctly resolve ifdef statements. p[0] = None def p_interface_stmts(p): '''interface_stmts : policy | interface_stmts policy | empty ''' if len(p) == 2 and p[1]: p[0] = p[1] elif len(p) > 2: if not p[1]: if p[2]: p[0] = p[2] elif not p[2]: p[0] = p[1] else: p[0] = p[1] + p[2] def p_optional_policy(p): '''optional_policy : OPT_POLICY OPAREN TICK interface_stmts SQUOTE CPAREN | OPT_POLICY OPAREN TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN ''' o = refpolicy.OptionalPolicy() collect(p[4], o, val=True) if len(p) > 7: collect(p[8], o, val=False) p[0] = [o] def p_tunable_policy(p): '''tunable_policy : TUNABLE_POLICY OPAREN TICK cond_expr SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN | TUNABLE_POLICY OPAREN TICK cond_expr SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN ''' x = refpolicy.TunablePolicy() x.cond_expr = p[4] collect(p[8], x, val=True) if len(p) > 11: collect(p[12], x, val=False) p[0] = [x] def p_ifelse(p): '''ifelse : IFELSE OPAREN TICK IDENTIFIER SQUOTE COMMA COMMA TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi | IFELSE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi | IFELSE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi ''' # x = refpolicy.IfDef(p[4]) # v = True # collect(p[8], x, val=v) # if len(p) > 12: # collect(p[12], x, val=False) # p[0] = [x] pass def p_ifdef(p): '''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi ''' x = refpolicy.IfDef(p[4]) if p[1] == 'ifdef': v = True else: v = False collect(p[8], x, val=v) if len(p) > 12: collect(p[12], x, val=False) p[0] = [x] def p_interface_call(p): '''interface_call : IDENTIFIER OPAREN interface_call_param_list CPAREN | IDENTIFIER OPAREN CPAREN | IDENTIFIER OPAREN interface_call_param_list CPAREN SEMI''' # Allow spurious semi-colons at the end of interface calls i = refpolicy.InterfaceCall(ifname=p[1]) if len(p) > 4: i.args.extend(p[3]) p[0] = i def p_interface_call_param(p): '''interface_call_param : IDENTIFIER | IDENTIFIER MINUS IDENTIFIER | nested_id_set | TRUE | FALSE | FILENAME ''' # Intentionally let single identifiers pass through # List means set, non-list identifier if len(p) == 2: p[0] = p[1] else: p[0] = [p[1], "-" + p[3]] def p_interface_call_param_list(p): '''interface_call_param_list : interface_call_param | interface_call_param_list COMMA interface_call_param ''' if len(p) == 2: p[0] = [p[1]] else: p[0] = p[1] + [p[3]] def p_obj_perm_set(p): 'obj_perm_set : DEFINE OPAREN TICK IDENTIFIER SQUOTE COMMA TICK names SQUOTE CPAREN' s = refpolicy.ObjPermSet(p[4]) s.perms = p[8] p[0] = s # # Basic SELinux policy language # def p_policy(p): '''policy : policy_stmt | optional_policy | tunable_policy | ifdef | ifelse | conditional ''' p[0] = p[1] def p_policy_stmt(p): '''policy_stmt : gen_require | avrule_def | typerule_def | typebound_def | typeattribute_def | roleattribute_def | interface_call | role_def | role_allow | permissive | type_def | typealias_def | attribute_def | attribute_role_def | range_transition_def | role_transition_def | bool | gen_tunable | define | initial_sid | genfscon | fs_use | portcon | nodecon | netifcon | pirqcon | iomemcon | ioportcon | pcidevicecon | devicetreecon ''' if p[1]: p[0] = [p[1]] def p_module_stmt(p): 'module_stmt : MODULE IDENTIFIER NUMBER SEMI' m = refpolicy.ModuleDeclaration() m.name = p[2] m.version = p[3] m.refpolicy = False p[0] = m def p_gen_require(p): '''gen_require : GEN_REQ OPAREN TICK requires SQUOTE CPAREN | REQUIRE OBRACE requires CBRACE''' # We ignore the require statements - they are redundant data from our point-of-view. # Checkmodule will verify them later anyway so we just assume that they match what # is in the rest of the interface. pass def p_requires(p): '''requires : require | requires require | ifdef | requires ifdef ''' pass def p_require(p): '''require : TYPE comma_list SEMI | ROLE comma_list SEMI | ATTRIBUTE comma_list SEMI | ATTRIBUTE_ROLE comma_list SEMI | CLASS comma_list SEMI | BOOL comma_list SEMI ''' pass def p_security_context(p): '''security_context : IDENTIFIER COLON IDENTIFIER COLON IDENTIFIER | IDENTIFIER COLON IDENTIFIER COLON IDENTIFIER COLON mls_range_def''' # This will likely need some updates to handle complex levels s = refpolicy.SecurityContext() s.user = p[1] s.role = p[3] s.type = p[5] if len(p) > 6: s.level = p[7] p[0] = s def p_gen_context(p): '''gen_context : GEN_CONTEXT OPAREN security_context COMMA mls_range_def CPAREN ''' # We actually store gen_context statements in a SecurityContext # object - it knows how to output either a bare context or a # gen_context statement. s = p[3] s.level = p[5] p[0] = s def p_context(p): '''context : security_context | gen_context ''' p[0] = p[1] def p_initial_sid(p): '''initial_sid : SID IDENTIFIER context''' s = refpolicy.InitialSid() s.name = p[2] s.context = p[3] p[0] = s def p_genfscon(p): '''genfscon : GENFSCON IDENTIFIER PATH context''' g = refpolicy.GenfsCon() g.filesystem = p[2] g.path = p[3] g.context = p[4] p[0] = g def p_fs_use(p): '''fs_use : FS_USE_XATTR IDENTIFIER context SEMI | FS_USE_TASK IDENTIFIER context SEMI | FS_USE_TRANS IDENTIFIER context SEMI ''' f = refpolicy.FilesystemUse() if p[1] == "fs_use_xattr": f.type = refpolicy.FilesystemUse.XATTR elif p[1] == "fs_use_task": f.type = refpolicy.FilesystemUse.TASK elif p[1] == "fs_use_trans": f.type = refpolicy.FilesystemUse.TRANS f.filesystem = p[2] f.context = p[3] p[0] = f def p_portcon(p): '''portcon : PORTCON IDENTIFIER NUMBER context | PORTCON IDENTIFIER NUMBER MINUS NUMBER context''' c = refpolicy.PortCon() c.port_type = p[2] if len(p) == 5: c.port_number = p[3] c.context = p[4] else: c.port_number = p[3] + "-" + p[4] c.context = p[5] p[0] = c def p_nodecon(p): '''nodecon : NODECON NUMBER NUMBER context | NODECON IPV6_ADDR IPV6_ADDR context ''' n = refpolicy.NodeCon() n.start = p[2] n.end = p[3] n.context = p[4] p[0] = n def p_netifcon(p): 'netifcon : NETIFCON IDENTIFIER context context' n = refpolicy.NetifCon() n.interface = p[2] n.interface_context = p[3] n.packet_context = p[4] p[0] = n def p_pirqcon(p): 'pirqcon : PIRQCON NUMBER context' c = refpolicy.PirqCon() c.pirq_number = p[2] c.context = p[3] p[0] = c def p_iomemcon(p): '''iomemcon : IOMEMCON NUMBER context | IOMEMCON NUMBER MINUS NUMBER context''' c = refpolicy.IomemCon() if len(p) == 4: c.device_mem = p[2] c.context = p[3] else: c.device_mem = p[2] + "-" + p[3] c.context = p[4] p[0] = c def p_ioportcon(p): '''ioportcon : IOPORTCON NUMBER context | IOPORTCON NUMBER MINUS NUMBER context''' c = refpolicy.IoportCon() if len(p) == 4: c.ioport = p[2] c.context = p[3] else: c.ioport = p[2] + "-" + p[3] c.context = p[4] p[0] = c def p_pcidevicecon(p): 'pcidevicecon : PCIDEVICECON NUMBER context' c = refpolicy.PciDeviceCon() c.device = p[2] c.context = p[3] p[0] = c def p_devicetreecon(p): 'devicetreecon : DEVICETREECON NUMBER context' c = refpolicy.DevicetTeeCon() c.path = p[2] c.context = p[3] p[0] = c def p_mls_range_def(p): '''mls_range_def : mls_level_def MINUS mls_level_def | mls_level_def ''' p[0] = p[1] if len(p) > 2: p[0] = p[0] + "-" + p[3] def p_mls_level_def(p): '''mls_level_def : IDENTIFIER COLON comma_list | IDENTIFIER ''' p[0] = p[1] if len(p) > 2: p[0] = p[0] + ":" + ",".join(p[3]) def p_type_def(p): '''type_def : TYPE IDENTIFIER COMMA comma_list SEMI | TYPE IDENTIFIER SEMI | TYPE IDENTIFIER ALIAS names SEMI | TYPE IDENTIFIER ALIAS names COMMA comma_list SEMI ''' t = refpolicy.Type(p[2]) if len(p) == 6: if p[3] == ',': t.attributes.update(p[4]) else: t.aliases = p[4] elif len(p) > 4: t.aliases = p[4] if len(p) == 8: t.attributes.update(p[6]) p[0] = t def p_attribute_def(p): 'attribute_def : ATTRIBUTE IDENTIFIER SEMI' a = refpolicy.Attribute(p[2]) p[0] = a def p_attribute_role_def(p): 'attribute_role_def : ATTRIBUTE_ROLE IDENTIFIER SEMI' a = refpolicy.Attribute_Role(p[2]) p[0] = a def p_typealias_def(p): 'typealias_def : TYPEALIAS IDENTIFIER ALIAS names SEMI' t = refpolicy.TypeAlias() t.type = p[2] t.aliases = p[4] p[0] = t def p_role_def(p): '''role_def : ROLE IDENTIFIER TYPES comma_list SEMI | ROLE IDENTIFIER SEMI''' r = refpolicy.Role() r.role = p[2] if len(p) > 4: r.types.update(p[4]) p[0] = r def p_role_allow(p): 'role_allow : ALLOW names names SEMI' r = refpolicy.RoleAllow() r.src_roles = p[2] r.tgt_roles = p[3] p[0] = r def p_permissive(p): 'permissive : PERMISSIVE names SEMI' pass def p_avrule_def(p): '''avrule_def : ALLOW names names COLON names names SEMI | DONTAUDIT names names COLON names names SEMI | AUDITALLOW names names COLON names names SEMI | NEVERALLOW names names COLON names names SEMI ''' a = refpolicy.AVRule() if p[1] == 'dontaudit': a.rule_type = refpolicy.AVRule.DONTAUDIT elif p[1] == 'auditallow': a.rule_type = refpolicy.AVRule.AUDITALLOW elif p[1] == 'neverallow': a.rule_type = refpolicy.AVRule.NEVERALLOW a.src_types = p[2] a.tgt_types = p[3] a.obj_classes = p[5] a.perms = p[6] p[0] = a def p_typerule_def(p): '''typerule_def : TYPE_TRANSITION names names COLON names IDENTIFIER SEMI | TYPE_TRANSITION names names COLON names IDENTIFIER FILENAME SEMI | TYPE_TRANSITION names names COLON names IDENTIFIER IDENTIFIER SEMI | TYPE_CHANGE names names COLON names IDENTIFIER SEMI | TYPE_MEMBER names names COLON names IDENTIFIER SEMI ''' t = refpolicy.TypeRule() if p[1] == 'type_change': t.rule_type = refpolicy.TypeRule.TYPE_CHANGE elif p[1] == 'type_member': t.rule_type = refpolicy.TypeRule.TYPE_MEMBER t.src_types = p[2] t.tgt_types = p[3] t.obj_classes = p[5] t.dest_type = p[6] t.file_name = p[7] p[0] = t def p_typebound_def(p): '''typebound_def : TYPEBOUNDS IDENTIFIER comma_list SEMI''' t = refpolicy.TypeBound() t.type = p[2] t.tgt_types.update(p[3]) p[0] = t def p_bool(p): '''bool : BOOL IDENTIFIER TRUE SEMI | BOOL IDENTIFIER FALSE SEMI''' b = refpolicy.Bool() b.name = p[2] if p[3] == "true": b.state = True else: b.state = False p[0] = b def p_gen_tunable(p): '''gen_tunable : GEN_TUNABLE OPAREN TICK IDENTIFIER SQUOTE COMMA TRUE CPAREN | GEN_TUNABLE OPAREN TICK IDENTIFIER SQUOTE COMMA FALSE CPAREN''' b = refpolicy.Bool() b.name = p[4] if p[7] == "true": b.state = True else: b.state = False p[0] = b def p_conditional(p): ''' conditional : IF OPAREN cond_expr CPAREN OBRACE interface_stmts CBRACE | IF OPAREN cond_expr CPAREN OBRACE interface_stmts CBRACE ELSE OBRACE interface_stmts CBRACE ''' c = refpolicy.Conditional() c.cond_expr = p[3] collect(p[6], c, val=True) if len(p) > 8: collect(p[10], c, val=False) p[0] = [c] def p_typeattribute_def(p): '''typeattribute_def : TYPEATTRIBUTE IDENTIFIER comma_list SEMI''' t = refpolicy.TypeAttribute() t.type = p[2] t.attributes.update(p[3]) p[0] = t def p_roleattribute_def(p): '''roleattribute_def : ROLEATTRIBUTE IDENTIFIER comma_list SEMI''' t = refpolicy.RoleAttribute() t.role = p[2] t.roleattributes.update(p[3]) p[0] = t def p_range_transition_def(p): '''range_transition_def : RANGE_TRANSITION names names COLON names mls_range_def SEMI | RANGE_TRANSITION names names names SEMI''' pass def p_role_transition_def(p): '''role_transition_def : ROLE_TRANSITION names names names SEMI''' pass def p_cond_expr(p): '''cond_expr : IDENTIFIER | EXPL cond_expr | cond_expr AMP AMP cond_expr | cond_expr BAR BAR cond_expr | cond_expr EQUAL EQUAL cond_expr | cond_expr EXPL EQUAL cond_expr ''' l = len(p) if l == 2: p[0] = [p[1]] elif l == 3: p[0] = [p[1]] + p[2] else: p[0] = p[1] + [p[2] + p[3]] + p[4] # # Basic terminals # # Identifiers and lists of identifiers. These must # be handled somewhat gracefully. Names returns an IdSet and care must # be taken that this is _assigned_ to an object to correctly update # all of the flags (as opposed to using update). The other terminals # return list - this is to preserve ordering if it is important for # parsing (for example, interface_call must retain the ordering). Other # times the list should be used to update an IdSet. def p_names(p): '''names : identifier | nested_id_set | asterisk | TILDE identifier | TILDE nested_id_set | IDENTIFIER MINUS IDENTIFIER ''' s = refpolicy.IdSet() if len(p) < 3: expand(p[1], s) elif len(p) == 3: expand(p[2], s) s.compliment = True else: expand([p[1]]) s.add("-" + p[3]) p[0] = s def p_identifier(p): 'identifier : IDENTIFIER' p[0] = [p[1]] def p_asterisk(p): 'asterisk : ASTERISK' p[0] = [p[1]] def p_nested_id_set(p): '''nested_id_set : OBRACE nested_id_list CBRACE ''' p[0] = p[2] def p_nested_id_list(p): '''nested_id_list : nested_id_element | nested_id_list nested_id_element ''' if len(p) == 2: p[0] = p[1] else: p[0] = p[1] + p[2] def p_nested_id_element(p): '''nested_id_element : identifier | MINUS IDENTIFIER | nested_id_set ''' if len(p) == 2: p[0] = p[1] else: # For now just leave the '-' str = "-" + p[2] p[0] = [str] def p_comma_list(p): '''comma_list : nested_id_list | comma_list COMMA nested_id_list ''' if len(p) > 2: p[1] = p[1] + p[3] p[0] = p[1] def p_optional_semi(p): '''optional_semi : SEMI | empty''' pass # # Interface to the parser # def p_error(tok): global error, parse_file, success, parser error = "%s: Syntax error on line %d %s [type=%s]" % (parse_file, tok.lineno, tok.value, tok.type) print(error) success = False def prep_spt(spt): if not spt: return { } map = {} for x in spt: map[x.name] = x parser = None lexer = None def create_globals(module, support, debug): global parser, lexer, m, spt if not parser: lexer = lex.lex() parser = yacc.yacc(method="LALR", debug=debug, write_tables=0) if module is not None: m = module else: m = refpolicy.Module() if not support: spt = refpolicy.SupportMacros() else: spt = support def parse(text, module=None, support=None, debug=False): create_globals(module, support, debug) global error, parser, lexer, success lexer.lineno = 1 success = True try: parser.parse(text, debug=debug, lexer=lexer) except Exception as e: parser = None lexer = None error = "internal parser error: %s" % str(e) + "\n" + traceback.format_exc() if not success: # force the parser and lexer to be rebuilt - we have some problems otherwise parser = None msg = 'could not parse text: "%s"' % error raise ValueError(msg) return m def list_headers(root): modules = [] support_macros = None for dirpath, dirnames, filenames in os.walk(root): for name in filenames: modname = os.path.splitext(name) filename = os.path.join(dirpath, name) if modname[1] == '.spt': if name == "obj_perm_sets.spt": support_macros = filename elif len(re.findall("patterns", modname[0])): modules.append((modname[0], filename)) elif modname[1] == '.if': modules.append((modname[0], filename)) return (modules, support_macros) def parse_headers(root, output=None, expand=True, debug=False): from . import util headers = refpolicy.Headers() modules = [] support_macros = None if os.path.isfile(root): name = os.path.split(root)[1] if name == '': raise ValueError("Invalid file name %s" % root) modname = os.path.splitext(name) modules.append((modname[0], root)) all_modules, support_macros = list_headers(defaults.headers()) else: modules, support_macros = list_headers(root) if expand and not support_macros: raise ValueError("could not find support macros (obj_perm_sets.spt)") def o(msg): if output: output.write(msg) def parse_file(f, module, spt=None): global parse_file if debug: o("parsing file %s\n" % f) try: fd = open(f) txt = fd.read() fd.close() parse_file = f parse(txt, module, spt, debug) except IOError as e: return except ValueError as e: raise ValueError("error parsing file %s: %s" % (f, str(e))) spt = None if support_macros: o("Parsing support macros (%s): " % support_macros) spt = refpolicy.SupportMacros() parse_file(support_macros, spt) headers.children.append(spt) # FIXME: Total hack - add in can_exec rather than parse the insanity # of misc_macros. We are just going to pretend that this is an interface # to make the expansion work correctly. can_exec = refpolicy.Interface("can_exec") av = access.AccessVector(["$1","$2","file","execute_no_trans","open", "read", "getattr","lock","execute","ioctl"]) can_exec.children.append(refpolicy.AVRule(av)) headers.children.append(can_exec) o("done.\n") if output and not debug: status = util.ConsoleProgressBar(sys.stdout, steps=len(modules)) status.start("Parsing interface files") failures = [] for x in modules: m = refpolicy.Module() m.name = x[0] try: if expand: parse_file(x[1], m, spt) else: parse_file(x[1], m) except ValueError as e: o(str(e) + "\n") failures.append(x[1]) continue headers.children.append(m) if output and not debug: status.step() if len(failures): o("failed to parse some headers: %s\n" % ", ".join(failures)) return headers defaults.py 0000644 00000005525 15025012421 0006724 0 ustar 00 # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> # # Copyright (C) 2006 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; version 2 only # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # import os import re # Select the correct location for the development files based on a # path variable (optionally read from a configuration file) class PathChooser(object): def __init__(self, pathname): self.config = dict() if not os.path.exists(pathname): self.config_pathname = "(defaults)" self.config["SELINUX_DEVEL_PATH"] = "/usr/share/selinux/default:/usr/share/selinux/mls:/usr/share/selinux/devel" return self.config_pathname = pathname ignore = re.compile(r"^\s*(?:#.+)?$") consider = re.compile(r"^\s*(\w+)\s*=\s*(.+?)\s*$") with open(pathname, "r") as fd: for lineno, line in enumerate(fd): if ignore.match(line): continue mo = consider.match(line) if not mo: raise ValueError("%s:%d: line is not in key = value format" % (pathname, lineno+1)) self.config[mo.group(1)] = mo.group(2) # We're only exporting one useful function, so why not be a function def __call__(self, testfilename, pathset="SELINUX_DEVEL_PATH"): paths = self.config.get(pathset, None) if paths is None: raise ValueError("%s was not in %s" % (pathset, self.config_pathname)) paths = paths.split(":") for p in paths: target = os.path.join(p, testfilename) if os.path.exists(target): return target return os.path.join(paths[0], testfilename) """ Various default settings, including file and directory locations. """ def data_dir(): return "/var/lib/sepolgen" def perm_map(): return data_dir() + "/perm_map" def interface_info(): return data_dir() + "/interface_info" def attribute_info(): return data_dir() + "/attribute_info" def refpolicy_makefile(): chooser = PathChooser("/etc/selinux/sepolgen.conf") result = chooser("Makefile") if not os.path.exists(result): result = chooser("include/Makefile") return result def headers(): chooser = PathChooser("/etc/selinux/sepolgen.conf") return chooser("include") interfaces.py 0000644 00000040120 15025012421 0007226 0 ustar 00 # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> # # Copyright (C) 2006 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; version 2 only # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # """ Classes for representing and manipulating interfaces. """ import copy import itertools from . import access from . import refpolicy from . import objectmodel from . import matching from .sepolgeni18n import _ class Param: """ Object representing a parameter for an interface. """ def __init__(self): self.__name = "" self.type = refpolicy.SRC_TYPE self.obj_classes = refpolicy.IdSet() self.required = True def set_name(self, name): if not access.is_idparam(name): raise ValueError("Name [%s] is not a param" % name) self.__name = name def get_name(self): return self.__name name = property(get_name, set_name) num = property(fget=lambda self: int(self.name[1:])) def __repr__(self): return "<sepolgen.policygen.Param instance [%s, %s, %s]>" % \ (self.name, refpolicy.field_to_str[self.type], " ".join(self.obj_classes)) # Helper for extract perms def __param_insert(name, type, av, params): ret = 0 if name in params: p = params[name] # The entries are identical - we're done if type == p.type: return # Handle implicitly typed objects (like process) if (type == refpolicy.SRC_TYPE or type == refpolicy.TGT_TYPE) and \ (p.type == refpolicy.TGT_TYPE or p.type == refpolicy.SRC_TYPE): #print name, refpolicy.field_to_str[p.type] # If the object is not implicitly typed, tell the # caller there is a likely conflict. ret = 1 if av: avobjs = [av.obj_class] else: avobjs = [] for obj in itertools.chain(p.obj_classes, avobjs): if obj in objectmodel.implicitly_typed_objects: ret = 0 break # "Promote" to a SRC_TYPE as this is the likely usage. # We do this even if the above test fails on purpose # as there is really no sane way to resolve the conflict # here. The caller can take other actions if needed. p.type = refpolicy.SRC_TYPE else: # There is some conflict - no way to resolve it really # so we just leave the first entry and tell the caller # there was a conflict. ret = 1 else: p = Param() p.name = name p.type = type params[p.name] = p if av: p.obj_classes.add(av.obj_class) return ret def av_extract_params(av, params): """Extract the parameters from an access vector. Extract the parameters (in the form $N) from an access vector, storing them as Param objects in a dictionary. Some attempt is made at resolving conflicts with other entries in the dict, but if an unresolvable conflict is found it is reported to the caller. The goal here is to figure out how interface parameters are actually used in the interface - e.g., that $1 is a domain used as a SRC_TYPE. In general an interface will look like this: interface(`foo', ` allow $1 foo : file read; ') This is simple to figure out - $1 is a SRC_TYPE. A few interfaces are more complex, for example: interface(`foo_trans',` domain_auto_trans($1,fingerd_exec_t,fingerd_t) allow $1 fingerd_t:fd use; allow fingerd_t $1:fd use; allow fingerd_t $1:fifo_file rw_file_perms; allow fingerd_t $1:process sigchld; ') Here the usage seems ambiguous, but it is not. $1 is still domain and therefore should be returned as a SRC_TYPE. Returns: 0 - success 1 - conflict found """ ret = 0 found_src = False if access.is_idparam(av.src_type): if __param_insert(av.src_type, refpolicy.SRC_TYPE, av, params) == 1: ret = 1 if access.is_idparam(av.tgt_type): if __param_insert(av.tgt_type, refpolicy.TGT_TYPE, av, params) == 1: ret = 1 if access.is_idparam(av.obj_class): if __param_insert(av.obj_class, refpolicy.OBJ_CLASS, av, params) == 1: ret = 1 return ret def role_extract_params(role, params): if access.is_idparam(role.role): return __param_insert(role.role, refpolicy.ROLE, None, params) def type_rule_extract_params(rule, params): def extract_from_set(set, type): ret = 0 for x in set: if access.is_idparam(x): if __param_insert(x, type, None, params): ret = 1 return ret ret = 0 if extract_from_set(rule.src_types, refpolicy.SRC_TYPE): ret = 1 if extract_from_set(rule.tgt_types, refpolicy.TGT_TYPE): ret = 1 if extract_from_set(rule.obj_classes, refpolicy.OBJ_CLASS): ret = 1 if access.is_idparam(rule.dest_type): if __param_insert(rule.dest_type, refpolicy.DEST_TYPE, None, params): ret = 1 return ret def ifcall_extract_params(ifcall, params): ret = 0 for arg in ifcall.args: if access.is_idparam(arg): # Assume interface arguments are source types. Fairly safe # assumption for most interfaces if __param_insert(arg, refpolicy.SRC_TYPE, None, params): ret = 1 return ret class AttributeVector: def __init__(self): self.name = "" self.access = access.AccessVectorSet() def add_av(self, av): self.access.add_av(av) class AttributeSet: def __init__(self): self.attributes = { } def add_attr(self, attr): self.attributes[attr.name] = attr def from_file(self, fd): def parse_attr(line): fields = line[1:-1].split() if len(fields) != 2 or fields[0] != "Attribute": raise SyntaxError("Syntax error Attribute statement %s" % line) a = AttributeVector() a.name = fields[1] return a a = None for line in fd: line = line[:-1] if line[0] == "[": if a: self.add_attr(a) a = parse_attr(line) elif a: l = line.split(",") av = access.AccessVector(l) a.add_av(av) if a: self.add_attr(a) class InterfaceVector: def __init__(self, interface=None, attributes={}): # Enabled is a loose concept currently - we are essentially # not enabling interfaces that we can't handle currently. # See InterfaceVector.add_ifv for more information. self.enabled = True self.name = "" # The access that is enabled by this interface - eventually # this will include indirect access from typeattribute # statements. self.access = access.AccessVectorSet() # Parameters are stored in a dictionary (key: param name # value: Param object). self.params = { } if interface: self.from_interface(interface, attributes) self.expanded = False def from_interface(self, interface, attributes={}): self.name = interface.name # Add allow rules for avrule in interface.avrules(): if avrule.rule_type != refpolicy.AVRule.ALLOW: continue # Handle some policy bugs if "dontaudit" in interface.name: #print "allow rule in interface: %s" % interface continue avs = access.avrule_to_access_vectors(avrule) for av in avs: self.add_av(av) # Add typeattribute access if attributes: for typeattribute in interface.typeattributes(): for attr in typeattribute.attributes: if attr not in attributes.attributes: # print "missing attribute " + attr continue attr_vec = attributes.attributes[attr] for a in attr_vec.access: av = copy.copy(a) if av.src_type == attr_vec.name: av.src_type = typeattribute.type if av.tgt_type == attr_vec.name: av.tgt_type = typeattribute.type self.add_av(av) # Extract parameters from roles for role in interface.roles(): if role_extract_params(role, self.params): pass #print "found conflicting role param %s for interface %s" % \ # (role.name, interface.name) # Extract parameters from type rules for rule in interface.typerules(): if type_rule_extract_params(rule, self.params): pass #print "found conflicting params in rule %s in interface %s" % \ # (str(rule), interface.name) for ifcall in interface.interface_calls(): if ifcall_extract_params(ifcall, self.params): pass #print "found conflicting params in ifcall %s in interface %s" % \ # (str(ifcall), interface.name) def add_av(self, av): if av_extract_params(av, self.params) == 1: pass #print "found conflicting perms [%s]" % str(av) self.access.add_av(av) def to_string(self): s = [] s.append("[InterfaceVector %s]" % self.name) for av in self.access: s.append(str(av)) return "\n".join(s) def __str__(self): return self.__repr__() def __repr__(self): return "<InterfaceVector %s:%s>" % (self.name, self.enabled) class InterfaceSet: def __init__(self, output=None): self.interfaces = { } self.tgt_type_map = { } self.tgt_type_all = [] self.output = output def o(self, str): if self.output: self.output.write(str + "\n") def to_file(self, fd): for iv in sorted(self.interfaces.values(), key=lambda x: x.name): fd.write("[InterfaceVector %s " % iv.name) for param in sorted(iv.params.values(), key=lambda x: x.name): fd.write("%s:%s " % (param.name, refpolicy.field_to_str[param.type])) fd.write("]\n") avl = sorted(iv.access.to_list()) for av in avl: fd.write(",".join(av)) fd.write("\n") def from_file(self, fd): def parse_ifv(line): fields = line[1:-1].split() if len(fields) < 2 or fields[0] != "InterfaceVector": raise SyntaxError("Syntax error InterfaceVector statement %s" % line) ifv = InterfaceVector() ifv.name = fields[1] if len(fields) == 2: return for field in fields[2:]: p = field.split(":") if len(p) != 2: raise SyntaxError("Invalid param in InterfaceVector statement %s" % line) param = Param() param.name = p[0] param.type = refpolicy.str_to_field[p[1]] ifv.params[param.name] = param return ifv ifv = None for line in fd: line = line[:-1] if line[0] == "[": if ifv: self.add_ifv(ifv) ifv = parse_ifv(line) elif ifv: l = line.split(",") av = access.AccessVector(l) ifv.add_av(av) if ifv: self.add_ifv(ifv) self.index() def add_ifv(self, ifv): self.interfaces[ifv.name] = ifv def index(self): for ifv in self.interfaces.values(): tgt_types = set() for av in ifv.access: if access.is_idparam(av.tgt_type): self.tgt_type_all.append(ifv) tgt_types = set() break tgt_types.add(av.tgt_type) for type in tgt_types: l = self.tgt_type_map.setdefault(type, []) l.append(ifv) def add(self, interface, attributes={}): ifv = InterfaceVector(interface, attributes) self.add_ifv(ifv) def add_headers(self, headers, output=None, attributes={}): for i in itertools.chain(headers.interfaces(), headers.templates()): self.add(i, attributes) self.expand_ifcalls(headers) self.index() def map_param(self, id, ifcall): if access.is_idparam(id): num = int(id[1:]) if num > len(ifcall.args): # Tell caller to drop this because it must have # been generated from an optional param. return None else: arg = ifcall.args[num - 1] if isinstance(arg, list): return arg else: return [arg] else: return [id] def map_add_av(self, ifv, av, ifcall): src_types = self.map_param(av.src_type, ifcall) if src_types is None: return tgt_types = self.map_param(av.tgt_type, ifcall) if tgt_types is None: return obj_classes = self.map_param(av.obj_class, ifcall) if obj_classes is None: return new_perms = refpolicy.IdSet() for perm in av.perms: p = self.map_param(perm, ifcall) if p is None: continue else: new_perms.update(p) if len(new_perms) == 0: return for src_type in src_types: for tgt_type in tgt_types: for obj_class in obj_classes: ifv.access.add(src_type, tgt_type, obj_class, new_perms) def do_expand_ifcalls(self, interface, if_by_name): # Descend an interface call tree adding the access # from each interface. This is a depth first walk # of the tree. stack = [(interface, None)] ifv = self.interfaces[interface.name] ifv.expanded = True while len(stack) > 0: cur, cur_ifcall = stack.pop(-1) cur_ifv = self.interfaces[cur.name] if cur != interface: for av in cur_ifv.access: self.map_add_av(ifv, av, cur_ifcall) # If we have already fully expanded this interface # there is no reason to descend further. if cur_ifv.expanded: continue for ifcall in cur.interface_calls(): if ifcall.ifname == interface.name: self.o(_("Found circular interface class")) return try: newif = if_by_name[ifcall.ifname] except KeyError: self.o(_("Missing interface definition for %s" % ifcall.ifname)) continue stack.append((newif, ifcall)) def expand_ifcalls(self, headers): # Create a map of interface names to interfaces - # this mirrors the interface vector map we already # have. if_by_name = { } for i in itertools.chain(headers.interfaces(), headers.templates()): if_by_name[i.name] = i for interface in itertools.chain(headers.interfaces(), headers.templates()): self.do_expand_ifcalls(interface, if_by_name) objectmodel.py 0000644 00000014567 15025012421 0007412 0 ustar 00 # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> # # Copyright (C) 2006 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; version 2 only # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # """ This module provides knowledge object classes and permissions. It should be used to keep this knowledge from leaking into the more generic parts of the policy generation. """ # Objects that can be implicitly typed - these objects do # not _have_ to be implicitly typed (e.g., sockets can be # explicitly labeled), but they often are. # # File is in this list for /proc/self # # This list is useful when dealing with rules that have a # type (or param) used as both a subject and object. For # example: # # allow httpd_t httpd_t : socket read; # # This rule makes sense because the socket was (presumably) created # by a process with the type httpd_t. implicitly_typed_objects = ["socket", "fd", "process", "file", "lnk_file", "fifo_file", "dbus", "capability", "unix_stream_socket"] #:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: # #Information Flow # # All of the permissions in SELinux can be described in terms of # information flow. For example, a read of a file is a flow of # information from that file to the process reading. Viewing # permissions in these terms can be used to model a variety of # security properties. # # Here we have some infrastructure for understanding permissions # in terms of information flow # #:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: # Information flow deals with information either flowing from a subject # to and object ("write") or to a subject from an object ("read"). Read # or write is described from the subject point-of-view. It is also possible # for a permission to represent both a read and write (though the flow is # typical asymettric in terms of bandwidth). It is also possible for # permission to not flow information (meaning that the result is pure # side-effect). # # The following constants are for representing the directionality # of information flow. FLOW_NONE = 0 FLOW_READ = 1 FLOW_WRITE = 2 FLOW_BOTH = FLOW_READ | FLOW_WRITE # These are used by the parser and for nice display of the directions str_to_dir = { "n" : FLOW_NONE, "r" : FLOW_READ, "w" : FLOW_WRITE, "b" : FLOW_BOTH } dir_to_str = { FLOW_NONE : "n", FLOW_READ : "r", FLOW_WRITE : "w", FLOW_BOTH : "b" } class PermMap: """A mapping between a permission and its information flow properties. PermMap represents the information flow properties of a single permission including the direction (read, write, etc.) and an abstract representation of the bandwidth of the flow (weight). """ def __init__(self, perm, dir, weight): self.perm = perm self.dir = dir self.weight = weight def __repr__(self): return "<sepolgen.objectmodel.PermMap %s %s %d>" % (self.perm, dir_to_str[self.dir], self.weight) class PermMappings: """The information flow properties of a set of object classes and permissions. PermMappings maps one or more classes and permissions to their PermMap objects describing their information flow characteristics. """ def __init__(self): self.classes = { } self.default_weight = 5 self.default_dir = FLOW_BOTH def from_file(self, fd): """Read the permission mappings from a file. This reads the format used by Apol in the setools suite. """ # This parsing is deliberately picky and bails at the least error. It # is assumed that the permission map file will be shipped as part # of sepolgen and not user modified, so this is a reasonable design # choice. If user supplied permission mappings are needed the parser # should be made a little more robust and give better error messages. cur = None for line in fd: fields = line.split() if len(fields) == 0 or len(fields) == 1 or fields[0] == "#": continue if fields[0] == "class": c = fields[1] if c in self.classes: raise ValueError("duplicate class in perm map") self.classes[c] = { } cur = self.classes[c] else: if len(fields) != 3: raise ValueError("error in object class permissions") if cur is None: raise ValueError("permission outside of class") pm = PermMap(fields[0], str_to_dir[fields[1]], int(fields[2])) cur[pm.perm] = pm def get(self, obj, perm): """Get the permission map for the object permission. Returns: PermMap representing the permission Raises: KeyError if the object or permission is not defined """ return self.classes[obj][perm] def getdefault(self, obj, perm): """Get the permission map for the object permission or a default. getdefault is the same as get except that a default PermMap is returned if the object class or permission is not defined. The default is FLOW_BOTH with a weight of 5. """ try: pm = self.classes[obj][perm] except KeyError: return PermMap(perm, self.default_dir, self.default_weight) return pm def getdefault_direction(self, obj, perms): dir = FLOW_NONE for perm in perms: pm = self.getdefault(obj, perm) dir = dir | pm.dir return dir def getdefault_distance(self, obj, perms): total = 0 for perm in perms: pm = self.getdefault(obj, perm) total += pm.weight return total sepolgeni18n.py 0000644 00000001765 15025012421 0007433 0 ustar 00 # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> # # Copyright (C) 2006 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; version 2 only # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # try: import gettext t = gettext.translation("selinux-python", localedir="/usr/share/locale", fallback=True) _ = t.gettext except: def _(str): return str __init__.py 0000644 00000000000 15025012421 0006633 0 ustar 00 matching.py 0000644 00000020721 15025012421 0006702 0 ustar 00 # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> # # Copyright (C) 2006 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; version 2 only # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # """ Classes and algorithms for matching requested access to access vectors. """ import itertools from . import access from . import objectmodel from . import util class Match(util.Comparison): def __init__(self, interface=None, dist=0): self.interface = interface self.dist = dist self.info_dir_change = False # when implementing __eq__ also __hash__ is needed on py2 # if object is muttable __hash__ should be None self.__hash__ = None def _compare(self, other, method): try: a = (self.dist, self.info_dir_change) b = (other.dist, other.info_dir_change) return method(a, b) except (AttributeError, TypeError): # trying to compare to foreign type return NotImplemented class MatchList: DEFAULT_THRESHOLD = 150 def __init__(self): # Match objects that pass the threshold self.children = [] # Match objects over the threshold self.bastards = [] self.threshold = self.DEFAULT_THRESHOLD self.allow_info_dir_change = False self.av = None def best(self): if len(self.children): return self.children[0] if len(self.bastards): return self.bastards[0] return None def __len__(self): # Only return the length of the matches so # that this can be used to test if there is # a match. return len(self.children) + len(self.bastards) def __iter__(self): return iter(self.children) def all(self): return itertools.chain(self.children, self.bastards) def append(self, match): if match.dist <= self.threshold: if not match.info_dir_change or self.allow_info_dir_change: self.children.append(match) else: self.bastards.append(match) else: self.bastards.append(match) def sort(self): self.children.sort() self.bastards.sort() class AccessMatcher: def __init__(self, perm_maps=None): self.type_penalty = 10 self.obj_penalty = 10 if perm_maps: self.perm_maps = perm_maps else: self.perm_maps = objectmodel.PermMappings() # We want a change in the information flow direction # to be a strong penalty - stronger than access to # a few unrelated types. self.info_dir_penalty = 100 def type_distance(self, a, b): if a == b or access.is_idparam(b): return 0 else: return -self.type_penalty def perm_distance(self, av_req, av_prov): # First check that we have enough perms diff = av_req.perms.difference(av_prov.perms) if len(diff) != 0: total = self.perm_maps.getdefault_distance(av_req.obj_class, diff) return -total else: diff = av_prov.perms.difference(av_req.perms) return self.perm_maps.getdefault_distance(av_req.obj_class, diff) def av_distance(self, req, prov): """Determine the 'distance' between 2 access vectors. This function is used to find an access vector that matches a 'required' access. To do this we comput a signed numeric value that indicates how close the req access is to the 'provided' access vector. The closer the value is to 0 the closer the match, with 0 being an exact match. A value over 0 indicates that the prov access vector provides more access than the req (in practice, this means that the source type, target type, and object class is the same and the perms in prov is a superset of those in req. A value under 0 indicates that the prov access less - or unrelated - access to the req access. A different type or object class will result in a very low value. The values other than 0 should only be interpreted relative to one another - they have no exact meaning and are likely to change. Params: req - [AccessVector] The access that is required. This is the access being matched. prov - [AccessVector] The access provided. This is the potential match that is being evaluated for req. Returns: 0 : Exact match between the access vectors. < 0 : The prov av does not provide all of the access in req. A smaller value indicates that the access is further. > 0 : The prov av provides more access than req. The larger the value the more access over req. """ # FUTURE - this is _very_ expensive and probably needs some # thorough performance work. This version is meant to give # meaningful results relatively simply. dist = 0 # Get the difference between the types. The addition is safe # here because type_distance only returns 0 or negative. dist += self.type_distance(req.src_type, prov.src_type) dist += self.type_distance(req.tgt_type, prov.tgt_type) # Object class distance if req.obj_class != prov.obj_class and not access.is_idparam(prov.obj_class): dist -= self.obj_penalty # Permission distance # If this av doesn't have a matching source type, target type, and object class # count all of the permissions against it. Otherwise determine the perm # distance and dir. if dist < 0: pdist = self.perm_maps.getdefault_distance(prov.obj_class, prov.perms) else: pdist = self.perm_distance(req, prov) # Combine the perm and other distance if dist < 0: if pdist < 0: return dist + pdist else: return dist - pdist elif dist >= 0: if pdist < 0: return pdist - dist else: return dist + pdist def av_set_match(self, av_set, av): """ """ dist = None # Get the distance for each access vector for x in av_set: tmp = self.av_distance(av, x) if dist is None: dist = tmp elif tmp >= 0: if dist >= 0: dist += tmp else: dist = tmp + -dist else: if dist < 0: dist += tmp else: dist -= tmp # Penalize for information flow - we want to prevent the # addition of a write if the requested is read none. We are # much less concerned about the reverse. av_dir = self.perm_maps.getdefault_direction(av.obj_class, av.perms) if av_set.info_dir is None: av_set.info_dir = objectmodel.FLOW_NONE for x in av_set: av_set.info_dir = av_set.info_dir | \ self.perm_maps.getdefault_direction(x.obj_class, x.perms) if (av_dir & objectmodel.FLOW_WRITE == 0) and (av_set.info_dir & objectmodel.FLOW_WRITE): if dist < 0: dist -= self.info_dir_penalty else: dist += self.info_dir_penalty return dist def search_ifs(self, ifset, av, match_list): match_list.av = av for iv in itertools.chain(ifset.tgt_type_all, ifset.tgt_type_map.get(av.tgt_type, [])): if not iv.enabled: #print "iv %s not enabled" % iv.name continue dist = self.av_set_match(iv.access, av) if dist >= 0: m = Match(iv, dist) match_list.append(m) match_list.sort()
| ver. 1.4 |
Github
|
.
| PHP 8.2.28 | Generation time: 0.03 |
proxy
|
phpinfo
|
Settings