HEX
Server: LiteSpeed
System: Linux php-prod-1.spaceapp.ru 5.15.0-157-generic #167-Ubuntu SMP Wed Sep 17 21:35:53 UTC 2025 x86_64
User: xnsbb3110 (1041)
PHP: 8.1.33
Disabled: NONE
$ pwd: /lib/python3/dist-packages/apparmor/rule/__pycache__/
Upload Files
File: //lib/python3/dist-packages/apparmor/rule/__pycache__/file.cpython-310.pyc
o

%`b&[�@s�ddlmZddlmZmZddlmZmZmZddl	m
Z
mZmZm
Z
mZmZddlmZe�ZdZdZdZd	ZGd
d�de
�ZGdd
�d
e�Zdd�Zdd�ZdS)�)�AARE)�RE_PROFILE_FILE_ENTRY�strip_quotes)�AppArmorBug�AppArmorException�type_is_str)�BaseRule�BaseRuleset�check_and_split_list�logprof_value_or_all�parse_modifiers�quote_if_needed)�init_translation)�ix�ux�Ux�px�Px�cx�Cx)�pix�Pix�cix�Cix�pux�PUx�cux�CUx�x)�m�r�w�a�l�k�link�subsetcs�eZdZdZGdd�de�ZGdd�de�ZeZeZdZ				d)�fd
d�	Z
edd
��Zedd��Z
d*dd�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd �Zd!d"�Zd#d$�Zd%d&�Zd'd(�Z�ZS)+�FileRulez,Class to handle and store a single file rulec@�eZdZdS)zFileRule.__FileAllN��__name__�
__module__�__qualname__�r-r-�4/usr/lib/python3/dist-packages/apparmor/rule/file.py�	__FileAll%�r/c@r()zFileRule.__FileAnyExecNr)r-r-r-r.�
__FileAnyExec'r0r1�fileF�Nc
sHtt|�j||	|
||d�|�|dd|�\|_|_|�|dd|�\|_|_|j|_|j|_	|j|_
t|�rFt||	�\}}
|
rEt
d��n|dkrMt�}|dhkrVt
d	��|d
hd
dhfvrf||_d|_n+t|ttjdddd
�\|_|_}|r�t
dt|���|jr�d|jvr�d|jvr�td��d|_|dur�d|_nId
|jvr�t
d��||jkr�||_n7t|�r�|	r�|dkr�ttd|���n|dkr�ttd���|tvr�|tvr�t
d|��||_nt
dt|���t|�tur�t
d��||_||_t|�tur�t
d��||_ t|�tu�r
t
d��||_!|j�r |j�s|j�r"t
d��dSdS)anInitialize FileRule

           Parameters:
           - path: string, AARE or FileRule.ALL
           - perms: string, set of chars or FileRule.ALL (must not contain exec mode)
           - exec_perms: None or string
           - target: string, AARE or FileRule.ALL
           - owner: bool
           - file_keyword: bool
           - leading_perms: bool
        )�audit�deny�
allow_keyword�comment�	log_event�pathT�targetFz!perms must not contain exec permsNr&z%subset without link permissions givenr%r'�permissions)�allow_empty_listz$Passed unknown perms to FileRule: %sr"r!z*Conflicting permissions found: 'a' and 'w'z)link rules can't have execute permissionsrzAfile deny rules only allow to use 'x' as execute mode, but not %szLExecute flag ('x') in file rule must specify the exec mode (ix, Px, Cx etc.)z/Unknown execute mode specified in file rule: %sz+Passed unknown perms object to FileRule: %sz&non-boolean value passed to owner flagz-non-boolean value passed to file keyword flagz4non-boolean value passed to leading permissions flagz1exec perms or target specified for bare file rule)"�superr'�__init__�_aare_or_allr9�	all_pathsr:�all_targets�can_glob�can_glob_ext�can_editr�split_permsr�set�perms�	all_permsr
�file_permissions�ALL�strr�original_perms�
exec_perms�ANY_EXEC�_�allow_exec_transitions�allow_exec_fallback_transitions�type�bool�owner�	can_owner�file_keyword�
leading_perms)�selfr9rGrMr:rTrVrWr4r5r6r7r8�tmp_exec_perms�
unknown_items��	__class__r-r.r>/sp�


�
 

��zFileRule.__init__cCs
t�|�S)N)r�search)�cls�raw_ruler-r-r.�_match�s
zFileRule._matchc
Cs�|�|�}|sttd�|��t|�\}}}}t|�d��}d}|�d�r-t|�d��}	n!|�d�r<t|�d��}	d}n|�d�rKt|�d��}	d}ntj}	|�d�r`|�d�}
t	|
|�\}
}n0|�d	�rt|�d	�}
t	|
|�\}
}d}n|�d
�r�|�d�r�dd
h}
ndh}
d}d}ntj}
d}|�d�r�t|�d��}n|�d�r�t|�d��}ntj}t|�d��}
t|	|
||||
|||||d�S)z"parse raw_rule and return FileRulezInvalid file rule '%s'rTFr9�path2T�	link_pathrG�perms2�link_keyword�subset_keywordr%r&Nr:�link_targetrV)r4r5r6r7)
r`rrOrrS�grouprr'rJrE)r^r_�matchesr4r5r6r7rTrWr9rGrMr:rVr-r-r.�_parse�sN












�zFileRule._parserc	Cs"d|}|jr
d}n|jrt|jj�}ntd��|jrd}n
|��}|s(td��|jr2d||f}nd||f}|jr>d}n|j	rJdt|j	j�}ntd��|j
rTd}nd}|jr\d	}nd}|jru|jru|su|su|sud
||��||j
fS|js�|js�|r�|r�d||��|||||j
fStd��)
z)return rule (in clean/default formatting)z  r3zEmpty path in file rulezEmpty permissions in file rulez%s %sz -> %szEmpty exec target in file rulezowner zfile z
%s%s%sfile,%sz%s%s%s%s%s%s,%szcInvalid combination of path and perms in file rule - either specify path and perms, or none of them)r@r9r
�regexrrH�_joint_permsrWrAr:rTrV�
modifiers_strr7)	rX�depth�spacer9rG�path_and_permsr:rTrVr-r-r.�	get_clean�s<zFileRule.get_cleancCs|�|j|j�S)zGreturn the permissions as string (using self.perms and self.exec_perms))�_join_given_permsrGrM�rXr-r-r.rk�szFileRule._joint_permscCsLd}tD]}||vr|dkrd}||}q||jkrtd��|r$||}|S)zTreturn the permissions as string (using the perms and exec_perms given as parameter)r3r&z subsetz0FileRule.ANY_EXEC can't be used for actual rules)rIrNr)rXrGrM�perm_string�permr-r-r.rq�s�
zFileRule._join_given_permscCsV|�|j|j|j|jd�sdS|jr!d|jvr!|jr!d|jvr!dS|jr2d|jvr2|jr2d|jvr2n|jt|j�|jt|j�|jddd�sGdS|jsT|jsT|jsTtd��|js\|jr\dS|j|j	krf|jrfn|jrq|j|jkrqdS|jrz|j|j	ks�|jr�d|jvs�|jr�d|jvr�|�|j
|j|j
|jd	�s�dS|j|jkr�dS|jr�|js�dSd
S)z2check if other_rule is covered by this rule objectr9Fr&r%rG)�sanity_checkz=No permission or exec permission specified in other file ruler#r:T)
�_is_covered_aarer9r@rG�_is_covered_list�perms_with_arHrMrrNr:rArT)rX�
other_ruler-r-r.�is_covered_localvarss<  &�
�
zFileRule.is_covered_localvarscCs�t|�tkstdt|���|j|jkrdS|�|j|j|j|jd�s%dS|j|jkr-dS|j	|j	kr5dS|j
|j
kr=dS|�|j|j|j|jd�sLdS|r^|j
|j
krVdS|j|jkr^dSdS)z,compare if rule-specific variables are equalzPassed non-file rule: %sFr9r:T)rRr'rrKrT�_is_equal_aarer9r@rGrHrMr:rArVrW)rX�rule_obj�strictr-r-r.�is_equal_localvars9s(zFileRule.is_equal_localvarscCsP|jr
|�dd�}nd}|�|jj|���}t|t�r t||�}|dkr&|}|S)Nz/**�mrwlkix���)r@�	rank_pathr9rjrk�
isinstance�int�max)rX�sev_db�severity�sevr-r-r.r�Zs

zFileRule.severitycCsg}t|j|j�}|td�|g7}d}|jrL|�|jddd�}|�|jdd|jddd�}|r>|r>d||f}n|rC|}n	|rJd|}nd}|rV|td�|g7}t|j|j�}|jsc|jrg|�	�}|j
rnd|}|jsyd	||jj
f}|td
�|g7}|S)N�Pathr3�allow�allrTz
%s + owner %szowner %szOld Modez%s -> %szNew Mode)rr9r@rOrLrqrGrHrMrkrTrAr:rj)rX�headersr9�old_mode�original_perms_all�original_perms_ownerrGr-r-r.�logprof_header_localvarsis2$
z!FileRule.logprof_header_localvarscC� |jrdS|j��|_d|_dS)z!Change path to next possible globN)r@r9�	glob_pathr_rrr-r-r.�glob��
z
FileRule.globcCr�)z0Change path to next possible glob with extensionN)r@r9�glob_path_withextr_rrr-r-r.�glob_ext�r�zFileRule.glob_extcCs|jrtd��td�|jjfS)N�Attemp to edit bare file rulezEnter new path: )r@rrOr9rjrrr-r-r.�edit_header�szFileRule.edit_headercCs$|jrtd��t|d�}|�|j�S�Nr�T)r@rr�matchr9�rX�newpathr-r-r.�
validate_edit�s
zFileRule.validate_editcCs$|jrtd��t|d�|_d|_dSr�)r@rrr9r_r�r-r-r.�
store_edit�s
zFileRule.store_edit)FFFFFr3N)r)r*r+r,�__doc__�object�_FileRule__FileAll�_FileRule__FileAnyExecrJrN�	rule_namer>�classmethodr`rirprkrqrzr~r�r�r�r�r�r�r��
__classcell__r-r-r[r.r' s4�W


604!(r'c@s6eZdZdZd
dd�Zd
dd�Zddd	�Zd
d�ZdS)�FileRulesetz4Class to handle and store a collection of file rulesFcCsFt�}|jD]}|js|j�|�r |r|jr |r|jr |�|�q|S)z�Get all rules matching the given path
           path can be str or AARE
           If audit is True, only return rules with the audit flag set.
           If deny is True, only return matching deny rules)r��rulesr@r9r�r5r4�add)rXr9r4r5�matching_rules�ruler-r-r.�get_rules_for_path�s
&
�zFileRuleset.get_rules_for_pathc
Cs"t�t�d�t�t�d�d�}ddd�ddd�d�}t�}|�|||�}|jD]2}d}	|jr0d}	d}
|jr7d}
|jrAd||	|
<q'|jrY||	|
�|j�||	|
<|�|j	j
�q'i}i}d	D]*}|d|rntj||<n|d|||<|d|r�tj||<q`|d|||<q`|||d
�S)a0Get the summarized permissions of all rules matching the given path, and the list of paths involved in the calculation
           path can be str or AARE
           If audit is True, only analyze rules with the audit flag set.
           If deny is True, only analyze matching deny rules
           Returns {'allow': {'owner': set_of_perms, 'all': set_of_perms},
                    'deny':  {'owner': set_of_perms, 'all': set_of_perms},
                    'path':  involved_paths}
           Note: exec rules and exec/link target are not honored!
           )rTr�)r�r5Fr�r5r�rTT)r�rT)r�r5�paths)
rFr�r�r5rTrHrG�unionr�r9rjr'rJ)
rXr9r4r5rGrHr�r�r��
allow_or_deny�owner_or_allr��whor-r-r.�get_perms_for_path�s>
��
�zFileRuleset.get_perms_for_pathTcCsHt�}|�|�jD]}|jr!|j�|�r|�|�q	|s!|�|�q	|S)zfGet all rules matching the given path that contain exec permissions
           path can be str or AARE)r�r�r�rMr9�is_equalr�)rXr9�only_exact_matchesrhr�r-r-r.�get_exec_rules_for_path�s
�z#FileRuleset.get_exec_rules_for_pathcCsJt�}|jr#|�|j�}|jD]}|j|jks|j|jkr"|�|�q|S)z[check if one of the exec rules conflict with oldrule. If yes, return the conflicting rules.)r�rMr�r9r�r:r�)rX�oldrule�conflictingrules�	execrules�	mergeruler-r-r.�get_exec_conflict_ruless

�z#FileRuleset.get_exec_conflict_rulesN)FF)T)r*r+r,r�r�r�r�r�r-r-r-r.r��s


6r�cCs(t�}d}|r�|dtvr|�|d�|dd�}ns|ddkr2|s)ttd���d}|dd�}n\|�t�r\|rO||dd�krOttd||dd�f���|dd�}|dd�}n2|�t�r�|ry||dd�kryttd||dd�f���|dd�}|dd�}nttd	|���|s||fS)
z{parse permission string
       - perm_string: the permission string to parse
       - deny: True if this is a deny rule
   Nr�rz8'x' must be preceded by an exec qualifier (i, P, C or U)�z0conflicting execute permissions found: %s and %s�z+permission contains unknown character(s) %s)rFrIr�rrO�
startswithrPrQ)rsr5rG�	exec_moder-r-r.rEs0

�rEcCs(t�}|rt|�}d|vr|�d�|S)zRif perms includes 'w', add 'a' perms
       - perms: the original permissions
    r!r")rFr�)rGrxr-r-r.rx;s
rxN)�
apparmor.aarer�apparmor.regexrr�apparmor.commonrrr�
apparmor.rulerr	r
rrr
�apparmor.translationsrrOrPrQ�deny_exec_transitionsrIr'r�rErxr-r-r-r.�<module>s" e
@ Telegram