File: //lib/python3/dist-packages/apparmor/rule/__pycache__/capability.cpython-310.pyc
o
%`b� � @ sv d dl Z d dlmZ d dlmZmZmZ d dlmZm Z m
Z
m Z d dl m
Z
e
� ZG dd� de�ZG dd � d e �ZdS )
� N)�RE_PROFILE_CAP)� AppArmorBug�AppArmorException� type_is_str)�BaseRule� BaseRuleset�logprof_value_or_all�parse_modifiers)�init_translationc s� e Zd ZdZG dd� de�ZeZdZ d� fdd � Ze d
d � �Z
e d d
� �Z ddd�Z dd� Z
dd� Zdd� Zdd� Z� ZS )�CapabilityRulez2Class to handle and store a single capability rulec @ s e Zd ZdS )z CapabilityRule.__CapabilityAllN)�__name__�
__module__� __qualname__� r r �:/usr/lib/python3/dist-packages/apparmor/rule/capability.py�__CapabilityAll s r �
capabilityF� Nc s� t t| �j|||||d� d| _|tjkr d| _t� | _d S t|�r'|h| _nt|�t kr9t
|�dkr9t|�| _nt dt |� ��| jD ]}t
|�
� �dkrVt dt |� ��qDd S )N)�audit�deny�
allow_keyword�comment� log_eventFTr z+Passed unknown object to CapabilityRule: %sz-Passed empty capability to CapabilityRule: %s)�superr �__init__�all_caps�ALL�setr r �type�list�lenr �str�strip)�self�cap_listr r r r r �cap�� __class__r r r ' s& �
��zCapabilityRule.__init__c C s
t �|�S )N)r �search)�cls�raw_ruler r r �_matchA s
zCapabilityRule._matchc C sp | � |�}|sttd�| ��t|�\}}}}g }|�d�r,|�d��� }t�d|�}ntj }t|||||d�S )z(parse raw_rule and return CapabilityRulez Invalid capability rule '%s'r z[ ]+)r r r r )
r+ r �_r �groupr" �re�splitr r )r) r* �matchesr r r r r r r r �_parseE s
�zCapabilityRule._parser c C s` d| }| j rd|| �� | jf S d�| j��� }|r,d|| �� d�t| j��| jf S td��)z)return rule (in clean/default formatting)z z%s%scapability,%s� z%s%scapability %s,%szEmpty capability rule)r �
modifiers_strr �joinr r" �sortedr )r# �depth�space�capsr r r � get_clean[ s "zCapabilityRule.get_cleanc C s" | � | j| j|j|jd�sdS dS )z2check if other_rule is covered by this rule objectr FT)�_is_covered_listr r )r# �
other_ruler r r �is_covered_localvarsh s z#CapabilityRule.is_covered_localvarsc C s< t |�tkstdt|� ��| j|jks| j|jkr dS dS )z,compare if rule-specific variables are equalz Passed non-capability rule: %sFT)r r r r! r r )r# �rule_obj�strictr r r �is_equal_localvarsq s z!CapabilityRule.is_equal_localvarsc C sP | j r |�d�}nd}| jD ]}|�|�}t|t�r t||�}q|dkr&|}|S )N�__ALL__���)r �rank_capabilityr �
isinstance�int�max)r# �sev_db�severityr% �sevr r r rG } s
�zCapabilityRule.severityc C s t | j| j�}td�|gS )N�
Capability)r r r r, )r# �cap_txtr r r �logprof_header_localvars� s �z'CapabilityRule.logprof_header_localvars)FFFr N)r )r r
r �__doc__�object� _CapabilityRule__CapabilityAllr � rule_namer � classmethodr+ r1 r9 r< r? rG rK �
__classcell__r r r& r r s" �
r c @ s e Zd ZdZdd� ZdS )�CapabilityRulesetz:Class to handle and store a collection of capability rulesc C s dS )zcReturn the next possible glob. For capability rules, that's always "capability," (all capabilities)z capability,r )r# � path_or_ruler r r �get_glob� s zCapabilityRuleset.get_globN)r r
r rL rT r r r r rR � s rR )r. �apparmor.regexr �apparmor.commonr r r �
apparmor.ruler r r r �apparmor.translationsr
r, r rR r r r r �<module> s y