+ ,ilcs8aRt/0t^RIt^RIt^RIt^RIHt^RIHt^RIH t ^RI H t H t ^RI t ^RIt^RIHtHtHt^RIHtHtHtHt^R IH t H!t!H"t"Rt#]^k] !R R 44t$] !RR 44t%]]%,t&]]PN](]PR,3,t*!RR ]PV4t,] !RR]PZ44t.R# ]d9t]P,!]4P1]P2 R24RtALRtAii;i)iN defaultdict)Iterable)suppress) dataclassInitVar) NetworkXErrorNetworkXNoPath NodeNotFoundz failed to import.) exceptionmixins policyrepquery)CriteriaDescriptor EdgeAttrDict EdgeAttrListDomainTransitionAnalysisDomainTransitionDomainEntrypointcsTa]tRt^toRtV3RlRltV3RlRltV3RltRtVt R#) rzEntrypoint list entry.cs$<V^8dQhRRRS[/#)otherrreturnboolformat __classdict__"2/usr/lib64/python3.14/site-packages/setools/dta.py __annotate__DomainEntrypoint.__annotate__)s&&.&4&cs4VPVP8#N)name)selfr&&r__lt__ZDomainEntrypoint.__lt__)syy5::%%rc <V^8dQhRS[/#rrstrrrrrr-s     rcsRVP R2R.pVPR\VP444VP R4VPR\VP 444VP 'd=VP R4VPR\VP 444RPV4#) z Entrypoint Z:z Domain entrypoint rule(s):c3,"TF pRV 2xK R#5iZ N.0e& r +DomainEntrypoint.__str__..0s?'>!r!X'>z File execute rule(s):c3r)r*r+r,r/rr0r13s<';!r!X';r2z Type transition rule(s):c3r)r*r+r-tr/rr0r17sH+Ga2aS+Gr2 )r!extendsorted entrypointappendexecutetype_transitionjoin)r"linesr/r__str__ZDomainEntrypoint.__str__-s+DII;a8:< ?vdoo'>?? 01 __annotate_func____static_attributes____classdictcell__r@rrrs%!&&   rcs`aa]tRt^ r5fullzDomain transition rule(s):c38"TFp\V4xK R#5ir r'r3r/rr0.DomainTransition.__format__..NE-DSVV-Dz Set execution context rule(s):c3rOr r'r-sr/rr0rPRs F1EAQ1ErRc3s*"TF q R2xK R#5i)r5Nr+r,r/rr0rPTsH/G!s"X/GszDynamic transition rule(s):c3rOr r')r-dr/rr0rPXsH-GSVV-GrRz% Set current process context rule(s):c3rOr r'rSr/rr0rP[rQrR) sourcetarget transitionr9r6r7setexec entrypoints dyntransition setcurrentr<super __format__)r"rLr= __class__s&& rr_ZDomainTransition.__format__Is;#{{m4 }B?@ 6> 9: EVDOO-DEE<<<LL!CDLL F 1E FF Hvd6F6F/GHH!!! :; HVD4F4F-GHH EF EVDOO-DEE R 99U# #8Ow!$''rcr%r&r'rrrrrMfs'''rcs$VPR4#)rN)r_r"&rr>ZDomainTransition.__str__fsv&&rcs6<V^8dQh/S[P;R&S[P;R&S[S[P,;R&S[S[,;R&S[S[P,;R&S[S[P,;R&S[S[P,;R&#)rrWrXrYr[rZr\r])r r?r@rArrrrrrM<s NN  NN Y(())&'')%% && ++,,Y(())rr+) rBrCrDrErFr_r>rGrHrI __classcell__r`r@@rrr<s&"((:''Urc saa]tRt^qtoRt!RR]P 4t]P]P3t ]P]P3t ]]P ,!RR7t]]P ,!RR7t]PtRRRR R R R ]PR ^R R /V3RlV3Rlllt]V3RlRl4t]P.V3RlRl4t]V3RlRl4t]P.V3RlRl4t]V3RlRl4t]P.V3RlRl4tV3RlRltV3RlRltV3R lR!lt]V3R"lR#l4tV3R$lR%ltV3R&lR'lt V3R(lR)lt!V3R*lR+lt"V3R,lt#R-t$Vt%V;t&#).ra_ Domain transition analysis. Parameters: policy The policy to analyze. Keyword Parameters source The source type of the analysis. target The target type of the analysis. mode The analysis mode (see DomainTransitionAnalysis.Mode) exclude The types excluded from the domain transition analysis. (default is none) cs*]tRt^tRtRtRtRtRtRt R#)DomainTransitionAnalysis.Modez Domain transition analysis modeszAll shortest pathszAll paths up toz%Transitions out of the source domain.z#Transitions into the target domain.r+N) rBrCrDrErF ShortestPathsAllPathsTransitionsOut TransitionsInrHr+rrModerfs., $@= rrk lookup_type)Zlookup_functionreverseFrWNrXmode depth_limitexcludecs<V^8dQhRS[PRS[RS[PS[,R,RS[PS[,R,RS[RS[R,RS[S[PS[,,R,R R/#) rpolicyrmrWNrXrnrorpr)r Z SELinuxPolicyrr?r(rkintrrrrr%DomainTransitionAnalysis.__annotate__sy66"#-4##-4  "Dj  #9>>C#784?  LP rc sR<\SV`WW4VWgR7VVRVnRVn\P !4VnVP P4VnR# \d9TPPR4TPPR4hi;i))rmrWrXrnrorpTzLNetworkX is not available. This is required for Domain Transition Analysis.z2This is typically in the python3-networkx package.N) r^__init__ rebuildgraphrebuildsubgraphnxDiGraphGcopysubGZ NameErrorlogZcritical) r"rqrmrWrXrnrorpr`s ""$$$$$$rrtZ!DomainTransitionAnalysis.__init__s UY%0  C   # ZZ\DF DI  HH  I J HH  R S   s 9A##AB&cs.<V^8dQhRS[R,/#rrNrrrrrrrss!!S4Z!rcVP#r ) _depth_limitrarbrro$DomainTransitionAnalysis.depth_limits   rcs2<V^8dQhRS[R,RR/#)rvalueNrr~rrrrrss""t""rcs>VeV^8d \R4hWnR#)Nz-Domain transition max depth must be positive.) ValueErrorr)r"rr#rrors  LM M!rcr%r&rrrrrrssrcrr )_reverserarbrrm DomainTransitionAnalysis.reverse }}rc<V^8dQhRR/#r}r+rrrrrss$$D$rcs4\V4VnRVnR#TN)rrrv)r"Z directionr#rrmrsY #rcsD<V^8dQhRS[S[P,/#r&)r@r r?rrrrrssinn-rcrr )_excluderarbrrp DomainTransitionAnalysis.excluderrcsf<V^8dQhRS[S[PS[,,R,RR/#)rtypesNr)rr r?r(rrrrrss.$$Xinns&:;dB$t$rcsV'd1VUu.uFq PPV4NK upVnM.VnRVnR#uupir)rqrlrrv)r"rr4s&& rrprs= AFGA[[44Q7GDMDM# Hs#A csP<V^8dQhRS[S[,S[S[,,/#r&)rDTAPathrrrrrrss*JLJL'*X6F-GGJLrc #s* "VP'dVP4VPPRVP 24VPP RVP : 24VPP RVP: 24VPP RVP: RVP: 24\\\\4;_uu_4VP;\PP 8Xd\#VP VP34'g \%R4hVPPRVP RVP R24\&P(!VP*VP VP4FpVP-V4xK EM;\PP.8Xd\#VP VP34'g \%R4hVPPR VP RVP R VP R24\&P0!VP*VP VPVPR 7FpVP-V4xK EM%;\PP28XdVP 'g \%R 4hVPPR VP 24\&P4!VP*VP VPR7Fewr#\7VP*W#4p\9VVVP:VP=V4VP>VP@VPB4xKg EM\PPD8XdVP'g \%R4hVPPRVP 24\&P4!VP*VPRVPR7Fewr2\7VP*W#4p\9VVVP:VP=V4VP>VP@VPB4xKg M\%RVP 24hRRR4R# +'giR#;i5i)z*Generating domain transition results from self.source= self.target= self.mode=, self.depth_limit=*Source and target types must be specified.z5Generating all shortest domain transition paths from  to ...,Generating all domain transition paths from , max length ZcutoffSource type must be specified.)Generating all domain transitions out of roTarget type must be specified.'Generating all domain transitions into TrmroUnknown analysis mode: N)#rv_build_subgraphr|inforqdebugrWrXrnrorrrrrrkrgallrrwall_shortest_pathsr{_generate_stepsrhall_simple_pathsriZ bfs_edgesEdgerrY_generate_entrypointsrZr\r]rj)r"pathrWrXedges& rresultsZ DomainTransitionAnalysis.resultss      "  B4;;-PQ ,$++() ,$++() *$))%9(8(8':;< nlM B B))@-22@@ T[[9::()UVVHHMM"Y%)[[Mdkk]##GH!# 5 5dii6:kk6:kk!C#22488 !C <-22;; T[[9::()UVVHHMM$PQUQ\Q\P]^((, }M$BRBRASSV#XY!# 3 3DII48KK48KK;?;K;K!M #22488 !MB-22AA;;;()IJJHHMM$Mdkk]"[\*,,,tyy$++CGCSCS+U#DIIv>.v/5/3/3/I/I$/O/3||/3/A/A/3 @@ +U.22@@;;;()IJJHHMM$KDKK="YZ*,,,tyy$++W[CGCSCS+U#DIIv>.v/5/3/3/I/I$/O/3||/3/A/A/3 @@ +U$'>tyyk%JKKCC B B Bs-C5T7H S?DS?C.S?5 T? T Tcr)rr nx.DiGraphr+rrrrrssGGGG<GGrc  s VP'dVP4VPPRVP 24VPP RVP : 24VPP RVP: 24VPP RVP: RVP: 24VP;\PP8XEd \VP VP34'g \R4hVPPRVP RVP R 24\P !VP"VP VP4pVUUu.uF4p\P$P&P)V4Fq3NK K6 ppp\P*!4pVP-V4V#;\PP.8XEd#\VP VP34'g \R4hVPPR VP RVP R VP R 24\P0!VP"VP VPVPR 7pVUUu.uF4p\P$P&P)V4Fq3NK K6 ppp\P*!4pVP-V4V#;\PP28XdVP 'g \R 4hVPPRVP R24\P4!VP"VP VPR7#\PP68XdVP'g \R4hVPPRVP R24\P4!VP"VPRVPR7p\P8!VRR7#\RVP 24huuppiuuppi \:d p\<P>!RT 24ThRp?ii;i)a Return the results of the analysis as a NetworkX directed graph. Caller has the responsibility of converting the graph to a visualization. For example, to convert to a pygraphviz graph: pgv = nx.nx_agraph.to_agraph(g.graphical_results()) pgv.layout(prog="dot") z4Generating graphical domain transition results from rrrrrz?Generating graphical all shortest domain transition paths from rrrrrrr.rrrTrFrzrz&Unable to generate graphical results: N) rvrr|rrqrrWrXrnrorrkrgrrrwrr{utilsmiscpairwiserxZadd_edges_fromrhrriZbfs_treerjrmZ Exceptionr ZAnalysisException)r"ZpathsrZpairedgesZoutZex& rgraphical_resultsZ*DomainTransitionAnalysis.graphical_resultss      "  LT[[MZ[ ,$++() ,$++() *$))%9(8(8':;<3 G))@-22@@ T[[9::()UVVHHMM"c%)[[Mdkk]##GH11$))T[[$++VE.3]ed @V@VW[@\T@\TeE]**,C&&u-J;-22;; T[[9::()UVVHHMM$PQUQ\Q\P]^((, }M$BRBRASSV#XY// 4;; 7;7G7GIE.3]ed @V@VW[@\T@\TeE]**,C&&u-JA-22AA;;;()IJJHHMM$Mdkk]Z["\];;tyy$++4K[K[\\-22@@;;;()IJJHHMM$KDKK=XY"Z[++diid262B2BDC::c66$'>tyyk%JKKM^^4 G--8=?DF G GsXCS$:R5*S CS&:R; *S 1S=A*S(/SBS%S S+ S&&S+cr%r&r'rrrrrsbs # #3 #rc sVP'dVP4R\P!VP4: R\P !VP4: R\ VP4: R2#)z: Get the domain transition graph statistics. Return: str znx.number_of_nodes(self.G)=z nx.number_of_edges(self.G)=z len(self.G)=r5)ru _build_graphrwnumber_of_nodesrynumber_of_edgesZlenrarbr get_statsZ"DomainTransitionAnalysis.get_statsbsk        -"$$TVV,./.$$TVV,./dff+r# #rcs4<V^8dQhRRRS[S[,/#)rrrr)r@rrrrrrsss!**F*t4D/E*rc  sVPUu.uFCp\WPV,VPV,VPV,4NKE up#uupi)aR Creates a list of entrypoint, execute, and type_transition rules for each entrypoint. Parameter: data The dictionary of entrypoints. Return: list of tuple(type, entry, exec, trans) type The entrypoint type. entry The list of entrypoint rules. exec The list of execute rules. trans The list of type_transition rules. )r8rr:r;)rr.r/rrZ.DomainTransitionAnalysis._generate_entrypointsrsS"*(A!OOA$6 QI]I]^_I`a(* **sA AcsJ<V^8dQhRS[S[P,RS[/#)rrr)r@r r?rrrrrrss$$4$4D$8$4W$4rc # s^"\PPPV4F{wr#\ VP W#4pVP 'dY2reMY#re\WVVPVPV4VPVPVP4xK} R#5i)a Generator which yields the source, target, and associated rules for each domain transition. Parameter: path A list of graph node names representing an information flow path. Yield: tuple(source, target, transition, entrypoints, setexec, dyntransition, setcurrent) source The source type for this step of the domain transition. target The target type for this step of the domain transition. transition The list of transition rules. entrypoints Generator which yields entrypoint-related rules. setexec The list of setexec rules. dyntranstion The list of dynamic transition rules. setcurrent The list of setcurrent rules. N) rwrrrrr{rmrrYrrZr\r])r"rrWrXrZ real_sourceZ real_targets&& rrZ(DomainTransitionAnalysis._generate_stepss(!hhmm44T:NF 62D |||+1[+1[";#'??#'#=#=d#C#'<<#'#5#5#'?? 4 4;sB+B-crr}r+rrrrrssR5R5dR5rc sVPP4RVP R2VPnVPP RVP R24\ \4p\ \4p\ R4p\ R4p\ R4pVPP4EFpVP\PP8XEdVPR9dKAVPR8XEdRVP9d\P !VP"P%4VP&P%44F@wrxWx8wgK \)VPWxR R 7p V P*P-V4KB R VP9d\P !VP"P%4VP&P%44F@wrxWx8wgK \)VPWxR R 7p V P.P-V4KB R VP9d9VP"P%4FpW,P-V4K R VP9d<VP"P%4FpW',P-V4K EK EK#RVP9do\P !VP"P%4VP&P%44F#wrxW7,V,P-V4K% RVP9dr\P !VP"P%4VP&P%44F#wrxWG,V,P-V4K% EK$EK'VP\PP08XgEKSVPR8wdEKgVP2p \P !VP"P%4VP&P%44F*wrxWW,V,V ,P-V4K, EK .p .p .pVPP54EFFwrx\)VPWx4p RpRpV P*'Edw\7WH,P944p\7W7,P944pVP;V4pV'gR pEMVFpWq9gWW,V,'dYV P<V;;,WH,V,, uu&V P>V;;,W7,V,, uu&WW,V,V,'gKV P0V;;,WW,V,V,, uu&K Wq9d"V P@PCW,4V P@'gV P0'gR pMR pV P.'d,Wr9d#V PDPCW',4MR pMR pV'dV'dV P-V 4EKV'dV P-V 4EK*V'gEK5VP-V 4EKI VPPGV 4V F p V =V =V =V =V = K VFp V =V ="K RVn$R Vn%VPP R4VPPMR\NPP!VP4 R\NPR!VP4 R24R#)zDomain transition graph for rz&Building domain transition graph from rc \\4#r rr@r+rr7DomainTransitionAnalysis._build_graph..s [Y]M^rcrr rr+rrrrs P[\`Parcs\R4#)crr rr+rrrZIDomainTransitionAnalysis._build_graph....s K4Errr+rrrrs ,E FrprocessrYT)creater\rZr]r:r8Fz+Completed building domain transition graph.zGraph stats: nodes: , edges: N)rZfile)*ryZclearrqr!r|rrr@ZterulesZruletyper Z TERuletypeZallowZtclassZperms itertoolsZproductrWZexpandrXrrYr9r\r;ZdefaultrsetZkeysZ intersectionr8r:rZr6r]remove_edges_fromrurvrrwrr)r"rZr]r:r8Z type_transZrulerTr4rr.rUZ invalid_edgeZclear_transitionZclear_dyntransitionZ invalid_transZinvalid_dyntransZentryZexeZmatchZms& rrZ%DomainTransitionAnalysis._build_graphs  4T[[MC   >t{{m3OP(-*40 :EE^9_tyy>594F4FH[H[3\L8<8J8JDMM7Z   / NF   / NF   D!&7;8<#00  ,-  CG 4!!"" ^^$$ ^^$$JLJLXGGGGR # # **$$4$4xR5R5h33888Arcsa]tRtRtoRtRt]!4t]!4t]!4t ]!4t ] !4t ] !4t ] !4tV3RlRltV3RltRtVtR#) ria/ A graph edge. Also used for returning domain transition steps. Parameters: graph The NetworkX graph. source The source type of the edge. target The target type of the edge. Keyword Parameters: create (T/F) create the edge if it does not exist. The default is False. Fcrr}r+rrrrEdge.__annotate__s A At Arcs^VPPVPVP4'gwV'ddVPP VPVP4RVnRVnRVnRVnRVn RVn RVn R#\R4hR#)NzEdge does not exist in graph) ryZhas_edgerWrXZadd_edgerYr8r:r;rZr\r]r)r"rr#r __post_init__ZEdge.__post_init__svvt{{DKK88 T[[9"&"&# '+$# %)""& !?@@9rcs<V^8dQh/R;R&S[P;R&S[P;R&S[S[,;R&#)rrryrWrXr)r r?rrrrrrrsD O!" NN#$ NN%& DM!'r)r\r8r:r]rZrYr;N)rBrCrDrErFrrrYrZr\r]rr8r:r;rrGrHrIrJrKrrrsU  "FJnG NMJJnG"nO A A9rrcsV^8dQh/^\9d,\P\\R3,,;R&#)r.__all__)__conditional_annotations__rrrr()rs"rrrs- &55eCHo &5' r)rrrr)0rrrZloggingZ collectionsrZcollections.abcrZ contextlibrZ dataclassesrrrZnetworkxrwZnetworkx.exceptionrrrZ ImportErrorZiexZ getLoggerrBrr!rVr r r r Z descriptorsr rrrrrrr?r@rAZRuleHashZDirectedGraphAnalysisrZNetworkXGraphEdgerr)rrKrrs  #$* GNN 21GG*55      8 *'*' *'` # $ y~~tI,?,?'@@ Ax8u::x8v 'A6 # #'A 'AuG h%% 2D&EFFGsCD!.DD