+ :i.csRt^RIHt^RIHt^RIHtRt!RR]P4tRt !RR 4t R t R t !R R 4t R#)aW Classes representing basic access. SELinux - at the most basic level - represents access as the 4-tuple subject (type or context), target (type or context), object class, permission. The policy language elaborates this basic access to facilitate more concise rules (e.g., allow rules can have multiple source or target types - see refpolicy for more information). This module has objects for representing the most basic access (AccessVector) and sets of that access (AccessVectorSet). These objects are used in Madison in a variety of ways, but they are the fundamental representation of access. ) refpolicy)util) audit2whycs\V4^8d$V^,R8Xd\VR,4R#R# \dR#i;i)zDetermine if an id is a parameter in the form $N, where N is an integer. Returns: True if the id is a parameter False if the id is not a parameter Z$:iNNFT)lenZint ValueError)Zid&4/usr/lib/python3.14/site-packages/sepolgen/access.py is_idparamr'sE 2w{r!u|  2K   s6 AAcsRa]tRt^8toRtR RltRtRtRtRt Rt R t R t Vt R#) AccessVectora An access vector is the basic unit of access in SELinux. Access vectors are the most basic representation of access within SELinux. It represents the access a source type has to a target type in terms of an object class and a set of permissions. Access vectors are distinct from AVRules in that they can only store a single source type, target type, and object class. The simplicity of AccessVectors makes them useful for storing access in a form that is easy to search and compare. The source, target, and object are stored as string. No checking done to verify that the strings are valid SELinux identifiers. Identifiers in the form $N (where N is an integer) are reserved as interface parameters and are treated as wild cards in many circumstances. Properties: .src_type - The source type allowed access. [String or None] .tgt_type - The target type to which access is allowed. [String or None] .obj_class - The object class to which access is allowed. [String or None] .perms - The permissions allowed to the object class. [IdSet] .audit_msgs - The audit messages that generated this access vector [List of strings] .xperms - Extended permissions attached to the AV. [Dictionary {operation: xperm set}] NcsV'dVPV4M/RVnRVnRVn\P !4Vn.Vn\PVn .Vn /Vn RVn RVnR#N) from_listsrc_typetgt_type obj_classrIdSetperms audit_msgsrTERULEtypedataxperms__hash__ info_flow_dir)selfZ init_list&&r__init__ZAccessVector.__init__Ssi  NN9 % DM DM!DN"*DJ$$    "c s\V4^8d\R\V4,4hV^,VnV^,VnV^,Vn\ P!VR,4VnR#)a(Initialize an access vector from a list. Initialize an access vector from a list treating the list as positional arguments - i.e., 0 = src_type, 1 = tgt_type, etc. All of the list elements 3 and greater are treated as perms. For example, the list ['foo_t', 'bar_t', 'file', 'read', 'write'] would create an access vector list with the source type 'foo_t', target type 'bar_t', object class 'file', and permissions 'read' and 'write'. This format is useful for very simple storage to strings or disc (see to_list) and for initializing access vectors. z+List must contain at least four elements %s:iNNN) rrZstrr r r rrr)rlistrrr ZAccessVector.from_listhsZ t9q=JSQUYVW WQ Q a__T"X. rc sVPVPVP.pVP\ VP 44V#)z Convert an access vector to a list. Convert an access vector to a list treating the list as positional values. See from_list for more information on how an access vector is represented in a list. )r r r extendZsortedr)rl& rto_listZAccessVector.to_list}s6]]DMM4>> :  #$rc s@VPPVP4VPFhpW P9d#\P!4VPV&VPV,P VPV,4Kj R#)z0Add permissions and extended permissions from AVN)rupdaterrZXpermSetr)ravZop&& rmergeZAccessVector.mergesd "((#))B$"+"4"4"6 B KKO " "299R= 1rcs"VP4#r ) to_stringrrr__str__ZAccessVector.__str__s~~rc sRVP: RVP: RVP: RVPP 4: R2 #)zallow Z Z:Z;)r r r rZ to_space_strr%rrr$ZAccessVector.to_strings1'+}}dmm(, 8O8O8QS Srcsr\VP4pVPVPVPV3p\VP4pVP 4VP 4VPVPVPV3pV!WF4# \ \3d \u#i;ir ) rrr r r ZsortZAttributeErrorZ TypeErrorZNotImplemented)rZotherZmethodZxaZyZbs&&& r_compareZAccessVector._compares "TZZ A t~~qAAU[[!A FFH FFH!DA!<  * "! ! "sBBB65B6) rrrrr rr r rrr )__name__ __module__ __qualname____firstlineno____doc__rr rr#r&r$r(__static_attributes____classdictcell__Z __classdict__@rrr8s34"*/* 2 S " "rrcsF\V\4'dV.#.pVPFupVPFbpVPFOp\4pW%nW5nWEnVPP4VnVPV4KQ Kd Kw V#)a6Convert an avrule into a list of access vectors. AccessVectors and AVRules are similarly, but differ in that an AVRule can more than one source type, target type, and object class. This function expands a single avrule into a list of one or more AccessVectors representing the access defined in the AVRule. ) Z isinstancerZ src_typesZ tgt_typesZ obj_classesr r r rZcopyappend)Zavruler'r r r Zaccesss& ravrule_to_access_vectorsr3s&,''x A$$((H#// %"*"*#, %||002  0)% Hrcspa]tRt^toRtRtRtRtRtRt R] P.3Rlt R R lt R tVtR#) AccessVectorSetaA non-overlapping set of access vectors. An AccessVectorSet is designed to store one or more access vectors that are non-overlapping. Access can be added to the set incrementally and access vectors will be added or merged as necessary. For example, adding the following access vectors using add_av: allow $1 etc_t : read; allow $1 etc_t : write; allow $1 var_log_t : read; Would result in an access vector set with the access vectors: allow $1 etc_t : { read write}; allow $1 var_log_t : read; c s"/VnRVnR#)z)Initialize an access vector set. N)srcinfo_dirr%rrrZAccessVectorSet.__init__s rc# s"VPP4F5pVP4FpVP4FpVxK K K7 R#5i)z9Iterate over all of the unique access vectors in the set.N)r5values)rtgtsobjsr!& r__iter__ZAccessVectorSet.__iter__s?HHOO%D ++-BH(&&sAAc s^pVPP4F,pVP4FpV\V4, pK K. V#)aReturn the number of unique access vectors in the set. Because of the internal representation of the access vector set, __len__ is not a constant time operation. Worst case is O(N) where N is the number of unique access vectors, but the common case is probably better. )r5r7r)rrr8r9r:r__len__ZAccessVectorSet.__len__sB HHOO%D CI~q&&rc sZ.pVF"pVPVP44K$ V#)aReturn the unique access vectors in the set as a list. The format of the returned list is a set of nested lists, each access vector represented by a list. This format is designed to be simply serializable to a file. For example, consider an access vector set with the following access vectors: allow $1 user_t : file read; allow $1 etc_t : file { read write}; to_list would return the following: [[$1, user_t, file, read] [$1, etc_t, file, read, write]] See AccessVector.to_list for more information. )r2rrrr!& rrZAccessVectorSet.to_lists," B HHRZZ\ "rc sLVFpVP\V44K R#)zAdd access vectors stored in a list. See to list for more information on the list format that this method accepts. This will add all of the access from the list. Any existing access vectors in the set will be retained. N)add_avrr=r"rr ZAccessVectorSet.from_listsB KK R( )rNc s\4pWnW(nW8nWHnWxnWhnVPW4R#)z)Add an access vector to the set. N)rr r r rrrr?) rr r r r audit_msgZavc_typerr!s &&&&&&&& raddZAccessVectorSet.adds5^    B"rc sVPPVP/4pVPVP/4pVPVP 3V9d/WAPVP 3,P V4MWVPVP 3&V'd:WAPVP 3,PPV4R#R#)z Add an access vector to the set.N) r5Z setdefaultr r r rr#rr2)rr!r@ZtgtZclss&&& rr?ZAccessVectorSet.add_avshh!!"++s3nnR[[#. LL"'' "c )  bgg% & , ,R 0)+ bgg% &   bgg% & 1 1 8 8 C r)r6r5r )r)r*r+r,r-rr;r<rr rrrAr?r.r/r0r1rr4r4sG  . *CGQZQaQahj # D Drr4cs\P!4pVF9pVPVP4VPVP4K; V#r )rrrAr r )avstypesr!r>ravs_extract_typesrD*s? OO E "++ "++ Lrcs/pVFepVPV9dWP,pM#\P!4pW1VP&VPVP4Kg V#r )r rrr r)rBrr!Zsr:ravs_extract_obj_permsrE2sX E <<5 ll#A!A"#",,    Lrcs<a]tRtRtoRtRtRtRtRtRt Vt R#) RoleTypeSeti=zA non-overlapping set of role type statements. This class allows the incremental addition of role type statements and maintains a non-overlapping list of statements. c s/VnR#)z Initialize an access vector set.N role_typesr%rrrZRoleTypeSet.__init__Cs rc# sX"VPP4FpVxK R#5i)zAIterate over all of the unique role allows statements in the set.N)rHr7)r role_typerrr;ZRoleTypeSet.__iter__Gs!//1IO2s(*c sH\VPP44#)z2Return the unique number of role allow statements.)rrHZkeysr%rrr<ZRoleTypeSet.__len__Ls4??'')**rcsWP9dVPV,pM)\P!4pWnW0PV&VPP V4R#r )rHrZRoleTyperolerCrA)rrJrrIs&&& rrAZRoleTypeSet.addPsK ?? "-I!**,I!N$-OOD !D!rrGN) r)r*r+r,r-rr;r<rAr.r/r0r1rrFrF=s#  +""rrFN)r-ZrrZselinuxrrZ Comparisonrr3r4rDrErF)rrrKsU( "l"4??l"^ 2hDhDT ""r