File: //lib/python3/dist-packages/apparmor/rule/__pycache__/change_profile.cpython-310.pyc
o
%`b; � @ sv d dl mZmZ d dlmZmZmZ d dlmZm Z m
Z
m Z m Z d dl
mZ e� ZG dd� de�ZG dd� de �Zd S )
� )�RE_PROFILE_CHANGE_PROFILE� strip_quotes)� AppArmorBug�AppArmorException� type_is_str)�BaseRule� BaseRuleset�parse_modifiers�logprof_value_or_all�quote_if_needed)�init_translationc s� e Zd ZdZG dd� de�ZeZdZg d�Z d� fd d
� Z e
d d � �Z e
d
d� �Z ddd�Z
dd� Zdd� Zdd� Z� ZS )�ChangeProfileRulez6Class to handle and store a single change_profile rulec @ s e Zd ZdS )z$ChangeProfileRule.__ChangeProfileAllN)�__name__�
__module__� __qualname__� r r �>/usr/lib/python3/dist-packages/apparmor/rule/change_profile.py�__ChangeProfileAll s r �change_profile)�safe� NFr Nc s t t| �j|||||d� |r(|dkr |dkr td| ��|r$|tjkr(td��|| _d| _d| _|tjkr:d| _n*t |�r\|�
� sFtd ��|� d
�sP|� d �rT|| _ntd t |� ��td
t |� ��d| _
d| _|tjkrtd| _dS t |�r�|�
� r�|| _
dS td��td
t |� ��)zl
CHANGE_PROFILE RULE = 'change_profile' [ [ EXEC MODE ] EXEC COND ] [ -> PROGRAMCHILD ]
)�audit�deny�
allow_keyword�comment� log_eventr �unsafez-Unknown exec mode (%s) in change_profile rulezCExec condition is required when unsafe or safe keywords are presentNFTz+Empty exec condition in change_profile rule�/�@z?Exec condition in change_profile rule does not start with /: %sz.Passed unknown object to ChangeProfileRule: %s�+Empty target profile in change_profile rule)�superr
�__init__r �ALLr �execmode�execcond�
all_execcondsr �strip�
startswith�str�
targetprofile�all_targetprofiles) �selfr# r$ r) r r r r r �� __class__r r r! ' s> �
zChangeProfileRule.__init__c C s
t �|�S )N)r �search)�cls�raw_ruler r r �_matchT s
zChangeProfileRule._matchc
C s� | � |�}|sttd�| ��t|�\}}}}|�d�}|�d�r)t|�d��}ntj}|�d�r9t|�d��} ntj} t||| ||||d�S )z+parse raw_rule and return ChangeProfileRulez Invalid change_profile rule '%s'r# r$ r) )r r r r )r1 r �_r �groupr r
r" )
r/ r0 �matchesr r r r r# r$ r) r r r �_parseX s
�zChangeProfileRule._parser c C s� d| }| j r
d| j }nd}| jrd}n| jr dt| j� }ntd��| jr*d}n| jr5dt| j� }ntd��d|| �� |||| jf S )z)return rule (in clean/default formatting)z z %sr z%Empty execcond in change_profile rulez -> %sr z%s%schange_profile%s%s%s,%s) r# r% r$ r r r* r) �
modifiers_strr )r+ �depth�spacer# r$ r) r r r � get_cleanq s zChangeProfileRule.get_cleanc C sh | j |j kr| j tjvs|j tjvrdS | �| j| j|j|jd�s#dS | �| j| j|j|jd�s2dS dS )z2check if other_rule is covered by this rule objectFzexec conditionztarget profileT)r# r
�equiv_execmodes�_is_covered_plainr$ r% r) r* )r+ �
other_ruler r r �is_covered_localvars� s z&ChangeProfileRule.is_covered_localvarsc C s� t |�tkstdt|� ��| j|jkr"| jtjvs |jtjvr"dS | j|jks.| j|jkr0dS | j|jks<| j |j kr>dS dS )z,compare if rule-specific variables are equalz"Passed non-change_profile rule: %sFT)
�typer
r r( r# r: r$ r% r) r* )r+ �rule_obj�strictr r r �is_equal_localvars� s z$ChangeProfileRule.is_equal_localvarsc C sP g }| j r|td�| j g7 }t| j| j�}t| j| j�}|td�|td�|g S )Nz Exec ModezExec ConditionzTarget Profile)r# r2 r
r$ r% r) r* )r+ �headers� execcond_txt�targetprofiles_txtr r r �logprof_header_localvars� s �z*ChangeProfileRule.logprof_header_localvars)FFFr N)r )r r r �__doc__�object�$_ChangeProfileRule__ChangeProfileAllr" � rule_namer: r! � classmethodr1 r5 r9 r= rA rE �
__classcell__r r r, r r
s" �-
r
c @ s e Zd ZdZdd� ZdS )�ChangeProfileRulesetz>Class to handle and store a collection of change_profile rulesc C s dS )z�Return the next possible glob. For change_profile rules, that can be "change_profile EXECCOND,",
"change_profile -> TARGET_PROFILE," or "change_profile," (all change_profile).
Also, EXECCOND filename can be globbedzchange_profile,r )r+ � path_or_ruler r r �get_glob� s z ChangeProfileRuleset.get_globN)r r r rF rN r r r r rL � s rL N)�apparmor.regexr r �apparmor.commonr r r �
apparmor.ruler r r r
r �apparmor.translationsr r2 r
rL r r r r �<module> s (