o

T��e�)�@s@dd
lZddl
mZmZ
ddlmZ
e�ZdZdZdeZ	dZ
dZd	ed
Zd	edZ
dZd
ZdZe�de�
Ze�ede	�
Ze�de	�
Ze�de	�
Zejdeejd�Ze�de�
Ze�de�
Ze�d�
Ze�d�
Ze�ede	�
Ze�de	�
Ze�dede�
Ze�ede�
Ze�ede�
Z e�ede�
Z!e�ed e�
Z"e�ed!e�
Z#e�ed"e�
Z$e�ed#e�
Z%d$Z&e�d%e&d&�
Z'e�d'e&d(d)�
Z(e�d*e
d+d,d-d.d/e
d0d1e
d2d3d(d(eede�
Z)e�ed4d1ed3d1e
d5d3d6e
d7d3e	�
Z*d8Z+e�ed9d-d:d,d;d-e
d<d/e+d=d,e+d>d/e
d?d(d6e
d@d3d,dAdBe
dCd/dDd/e
dEd(e	�
Z,dFdG�Z-dHZ.e�dIe.e	�
Z/e�dJe.e�
Z0dKdL�Z1dMdN�Z2dOdP�Z3dQdR�Z4d
S)S�N)�AppArmorBug�AppArmorException)
�init_translationz4^\s*(?P<audit>audit\s+)?(?P<allow>allow\s+|deny\s+)?z\s*(?P<comment>#.*?)?\s*$z\s*,z(?P<%s>(\S+|"[^"]+"))z
/\S*|"/[^"]*"z(?P<%s>(z))z|@{\S+}\S*|"@{\S+}[^"]*"))z(?P<execmode>(safe|unsafe))z<(\s+xattrs\s*=\s*\((?P<xattrs>([^)=]+(=[^)=]+)?\s?)+)\)\s*)?z)(\s+(flags\s*=\s*)?\((?P<flags>[^)]+)\))?z^\s*\}z$capability(?P<capability>(\s+\S+)+)?zA^\s*alias\s+(?P<orig_path>"??.+?"??)\s+->\s*(?P<target>"??.+?"??)zL^\s*set\s+rlimit\s+(?P<rlimit>[a-z]+)\s*<=\s*(?P<value>[^ ]+(\s+[a-zA-Z]+)?)z)^\s*(\$\{?\w*\}?)\s*=\s*(true|false)\s*,?)
�flagsz@^\s*(?P<varname>@\{?\w+\}?)\s*(?P<mode>\+?=)\s*(?P<values>@*.+?)z$^\s*if\s+(not\s+)?(\$\{?\w*\}?)\s*\{z7^\s*if\s+(not\s+)?defined\s+(@\{?\w+\}?)\s*\{\s*(#.*)?$z8^\s*if\s+(not\s+)?defined\s+(\$\{?\w+\}?)\s*\{\s*(#.*)?$znetwork(?P<details>\s+.*)?z^\s*\^("??.+?"??)zE^(?P<leadingspace>\s*)(?P<hat_keyword>\^|hat\s+)(?P<hat>"??[^)]+?"??)z\s*\{z((dbus\s*,|dbus(?P<details>\s+[^#]*)\s*,)z/((mount|remount|umount|unmount)(\s+[^#]*)?\s*,)z,(signal\s*,|signal(?P<details>\s+[^#]*)\s*,)z,(ptrace\s*,|ptrace(?P<details>\s+[^#]*)\s*,)z'(pivot_root\s*,|pivot_root\s+[^#]*\s*,)z(unix\s*,|unix\s+[^#]*\s*,)z,(mqueue\s*,|mqueue(?P<details>\s+[^#]*)\s*,)z([^#"]|"[^"]*")*�
^z,\s*(#.*)?$z^(?P<not_comment>�
)z(?P<comment>#.*)$z^(?P<leadingspace>\s*)(�plainprofile�
|�
(�profilez\s+�namedprofilez(\s+�
attachmentz)?�change_profile�execcondz	(\s+->\s*�
targetprofilez(?P<%s>[mrwalkPUCpucix]+)z(?P<owner>owner\s+)?z(?P<bare_file>file)z(?P<file_keyword>file\s+)?�path�perms�perms2�path2�targetz(?P<link_keyword>link\s+)z(?P<subset_keyword>subset\s+)?�	link_pathz->�link_targetcCs�t�
|�
}|std
|
|d��
�
i}dD]}|�|�
r/|�|�
||<|dvr.t||�
||<qd||<q|drK|d��dkrKttd|
|d��
�
�
|dr[|d|d	<d
|d<|S|d|d	<d
|d<|S)NzMThe given line from file %(filename)s is not the start of a profile: %(line)s)�filename�line)�leadingspacerrr
�xattrsr�comment)rrr
r�zDInvalid syntax in %(filename)s: Empty set of flags in line %(line)s.rrF�profile_keywordrT)�RE_PROFILE_START�searchr�group�strip_quotes�stripr�
_)rr�matches�result�section�r(�0/usr/lib/python3/dist-packages/apparmor/regex.py�parse_profile_start_liness(






�



�
r*zD(<(?P<magicpath>.*)>|"(?P<quotedpath>.*)"|(?P<unquotedpath>[^<>"]*))z^\s*#?abi\s*z-^\s*#?include(?P<ifexists>\s+if\s+exists)?\s*cCs\
|
d
kr
t�
|�
}n|
dkrt�
|�
}ntd|
�
�
|sdSd}d}|�d�
r1|�d�
��}d}nI|�d	�
rX|�d	�
��}t�
d
|�rKttd�
|
�
�
|
d
krWttd�
|
�
�
n"|�d�
rz|�d�
}|
d
krzt	|�
d
krz|d
dkrzttd�
|
�
�
|dus�|dkr�ttd�
|
�
�
|
d
kr�t�
d
|�r�ttd�
|
�
�
d}|
d
kr�|�d�
r�d}|||fS)a
Matches the path for include, include if exists and abi rules

    rule_name can be 'include' or 'abi'

    Returns a tuple with
    - if the "if exists" condition is given
    - the include/abi path
    - if the path is a magic path (enclosed in <...>)
    �include�abiz9re_match_include_parse() called with invalid rule name %s)NNNNF�	magicpathT�unquotedpathz\sz.Syntax error: %s must use quoted path or <...>�
quotedpathr
�
/rz)Syntax error: %s rule with empty filenamez4Syntax error: %s rule filename cannot contain spaces�ifexists)
�
RE_INCLUDEr �RE_ABIrr!r#�rerr$�len)r�	rule_namer%r�ismagicr1r(r(r)�re_match_include_parse�s>














�


 





r8c
Cst|d
�\}
}}|s|
SdS)z! return path of a 'include' rule r+N)
r8)rrr1r7r(r(r)�re_match_include�s
r9c

Cs,|d
|ddkr|dd���S|��S)z�strips parenthesis from the given string and returns the strip()ped result.
       The parenthesis must be the first and last char, otherwise they won't be removed.
       Even if no parenthesis get removed, the result will be strip()ped.
       r
���z()�
)
r#�
�datar(r(r)�strip_parenthesis�s
r>c

Cs0t|�
d
kr|d|ddkr|d
d�S|S)Nr;r
r:z"")
r5r<r(r(r)r"�s 

r")5r4�apparmor.commonrr�apparmor.translationsrr$�
RE_AUDIT_DENY�RE_EOL�RE_COMMA_EOL�RE_PROFILE_NAME�RE_PATH�RE_PROFILE_PATH�RE_PROFILE_PATH_OR_VAR�RE_SAFE_OR_UNSAFE�	RE_XATTRS�RE_FLAGS�compile�RE_PROFILE_END�RE_PROFILE_CAP�RE_PROFILE_ALIAS�RE_PROFILE_RLIMIT�
IGNORECASE�RE_PROFILE_BOOLEAN�RE_PROFILE_VARIABLE�RE_PROFILE_CONDITIONAL�RE_PROFILE_CONDITIONAL_VARIABLE�RE_PROFILE_CONDITIONAL_BOOLEAN�RE_PROFILE_NETWORK�RE_PROFILE_CHANGE_HAT�RE_PROFILE_HAT_DEF�RE_PROFILE_DBUS�RE_PROFILE_MOUNT�RE_PROFILE_SIGNAL�RE_PROFILE_PTRACE�RE_PROFILE_PIVOT_ROOT�RE_PROFILE_UNIX�RE_PROFILE_MQUEUE�__re_no_or_quoted_hash�RE_RULE_HAS_COMMA�RE_HAS_COMMENT_SPLITr�RE_PROFILE_CHANGE_PROFILE�
RE_PATH_PERMS�RE_PROFILE_FILE_ENTRYr*�RE_MAGIC_OR_QUOTED_PATHr3r2r8r9r>r"r(r(r(r)�<module>
sH
































�
�
��������������	��


������������

����������	�	�	�
�����
����������

6