File: //lib/python3/dist-packages/apparmor/rule/__pycache__/signal.cpython-310.pyc
o
%`b�% � @ sx d dl Z d dlmZmZ d dlmZmZ d dlmZm Z m
Z
m Z m Z m
Z
d dlmZ e� Zg d�Zg d�Zdd gZee e Zg d
�Ze �d �Zd d
�e� d Zed
d e d d e d d ZdZde d
d e d d e d d Z e �de d d d e d d d ed d d �Z e �d �Z e �d!�Z e �d"�Z e �d#�Z!G d$d%� d%e�Z"G d&d'� d'e �Z#dS )(� N)�RE_PROFILE_SIGNAL�RE_PROFILE_NAME)� AppArmorBug�AppArmorException)�BaseRule� BaseRuleset�check_and_split_list�logprof_value_or_all�parse_modifiers�quote_if_needed)�init_translation)�receive�r�read)�send�w�write�rw�wr)!�hup�int�quit�ill�trap�abrt�bus�fpe�kill�usr1�segv�usr2�pipe�alrm�term�stkflt�chld�cont�stop�stp�ttin�ttou�urg�xcpu�xfsz�vtalrm�prof�winch�io�pwr�sys�emt�existsz#^rtmin\+0*([0-9]|[12][0-9]|3[0-2])$z\s*(�|z)\s*z\(�(z(\s|,)+z)*z\)z \s*([a-z0-9+]+|"[a-z0-9+]+")\s*z
set\s*=\s*z set\s*=\s*\(z^(\s+(?P<access>z))?z (?P<signal>z(\s+(z))+z)?z
(\s+(peer=�peerz\s*$zset\s*=\s*\(([^)]*)\)zset\s*=z\((.*)\)z
"([a-z0-9]+)"c sx e Zd ZdZG dd� de�ZeZdZ d� fdd � Ze d
d � �Z
e d d
� �Z ddd�Z dd� Z
dd� Zdd� Z� ZS )�
SignalRulez.Class to handle and store a single signal rulec @ s e Zd ZdS )zSignalRule.__SignalAllN)�__name__�
__module__� __qualname__� r= r= �6/usr/lib/python3/dist-packages/apparmor/rule/signal.py� __SignalAllE s r? �signalF� Nc s� t t| �j|||||d� t|ttjdd�\| _| _} | r(tt d�d�
| � ��t|t tjdd�\| _ | _
} | rP| D ]}
t�|
�rH| j �|
� q:tt d�|
��| j|dd |d
�\| _| _d S ) N)�audit�deny�
allow_keyword�comment� log_eventr9 �accessz/Passed unknown access keyword to SignalRule: %s� r@ z/Passed unknown signal keyword to SignalRule: %sr8 F)�is_pathrF )�superr9 �__init__r �access_keywords�ALLrG �
all_accessr �_�join�signal_keywordsr@ � all_signals�RE_SIGNAL_REALTIME�match�add� _aare_or_allr8 � all_peers) �selfrG r@ r8 rB rC rD rE rF �
unknown_items�item�� __class__r= r> rK L s �
zSignalRule.__init__c C s
t �|�S )N)r �search)�cls�raw_ruler= r= r> �_matchb s
zSignalRule._matchc C sJ | � |�}|sttd�| ��t|�\}}}}d}|�d�r#|�d�}|r�t�|�}|s4ttd| ���|�d�rW|�d�} | �d�rN| �d�rN| dd � } | � d
d ��
� } nt j } |�d �r|�d �}
t
�d
|
�}
t�d|
�}
t�d|
�}
|
� d
d ��
� }
nt j }
|�d�r�|�d�} n
t j } n t j } t j }
t j } t | |
| ||||d�S )z$parse raw_rule and return SignalRulezInvalid signal rule '%s'rA �detailsz)Invalid or unknown keywords in 'signal %srG r7 �)� ����,rH r@ z\1z \1 r8 )rB rC rD rE )r` r rO r
�group�RE_SIGNAL_DETAILSr] �
startswith�endswith�replace�splitr9 rM �RE_FILTER_SET_1�sub�RE_FILTER_SET_2�RE_FILTER_QUOTES) r^ r_ �matchesrB rC rD rE � rule_detailsra rG r@ r8 r= r= r> �_parsef sB
�zSignalRule._parser c C s� d| }| j r
d}n"t| j�dkrdd�| j� }n| jr(dd�t| j�� }ntd��| jr2d}n"t| j�dkrBdd�| j� }n| jrPd d�t| j�� }ntd
��| jrZd}n| j rfd t
| j j � }ntd ��d
|| � � |||| j
f S )z)return rule (in clean/default formatting)z rA rc z %srH z (%s)zEmpty access in signal rulez set=%sz set=(%s)zEmpty signal in signal rulez peer=%szEmpty peer in signal rulez%s%ssignal%s%s%s,%s)rN �lenrG rP �sortedr rR r@ rW r8 r �regex�
modifiers_strrE )rX �depth�spacerG r@ r8 r= r= r> � get_clean� s* zSignalRule.get_cleanc C s^ | � | j| j|j|jd�sdS | � | j| j|j|jd�s dS | �| j| j|j|jd�s-dS dS )z2check if other_rule is covered by this rule objectrG Fr@ r8 T)�_is_covered_listrG rN r@ rR �_is_covered_aarer8 rW )rX �
other_ruler= r= r> �is_covered_localvars� s z SignalRule.is_covered_localvarsc C sv t |�tkstdt|� ��| j|jks| j|jkr dS | j|jks(| j|jkr*dS | �| j | j
|j |j
d�s9dS dS )z,compare if rule-specific variables are equalzPassed non-signal rule: %sFr8 T) �typer9 r �strrG rN r@ rR �_is_equal_aarer8 rW )rX �rule_obj�strictr= r= r> �is_equal_localvars� s z SignalRule.is_equal_localvarsc C sF t | j| j�}t | j| j�}t | j| j�}td�|td�|td�|gS )Nz Access mode�Signal�Peer)r rG rN r@ rR r8 rW rO )rX rG r@ r8 r= r= r> �logprof_header_localvars� s �z#SignalRule.logprof_header_localvars)FFFrA N)r )r: r; r< �__doc__�object�_SignalRule__SignalAllrM � rule_namerK � classmethodr` rr ry r} r� r� �
__classcell__r= r= r[ r> r9 @ s �
/ r9 c @ s e Zd ZdZdd� ZdS )�
SignalRulesetz6Class to handle and store a collection of signal rulesc C s dS )z[Return the next possible glob. For signal rules, that means removing access, signal or peerzsignal,r= )rX � path_or_ruler= r= r> �get_glob� s zSignalRuleset.get_globN)r: r; r< r� r� r= r= r= r> r� � s r� )$�re�apparmor.regexr r �apparmor.commonr r �
apparmor.ruler r r r r
r �apparmor.translationsr rO �access_keywords_read�access_keywords_write�access_keywords_rwrL rQ �compilerS rP �joint_access_keyword�RE_ACCESS_KEYWORDS�signal_keyword�RE_SIGNAL_KEYWORDSrg rl rn �RE_FILTER_PARENTHESISro r9 r� r= r= r= r> �<module> s�
�����������������������������
%