Name	Size	Mode	Actions
access.cpython-39.opt-1.pyc	11361	0644	editdlrm
access.cpython-39.pyc	11361	0644	editdlrm
audit.cpython-39.opt-1.pyc	17260	0644	editdlrm
audit.cpython-39.pyc	17260	0644	editdlrm
classperms.cpython-39.opt-1.pyc	2471	0644	editdlrm
classperms.cpython-39.pyc	2471	0644	editdlrm
defaults.cpython-39.opt-1.pyc	2298	0644	editdlrm
defaults.cpython-39.pyc	2298	0644	editdlrm
interfaces.cpython-39.opt-1.pyc	12592	0644	editdlrm
interfaces.cpython-39.pyc	12592	0644	editdlrm
lex.cpython-39.opt-1.pyc	21377	0644	editdlrm
lex.cpython-39.pyc	21377	0644	editdlrm
matching.cpython-39.opt-1.pyc	6169	0644	editdlrm
matching.cpython-39.pyc	6169	0644	editdlrm
module.cpython-39.opt-1.pyc	7170	0644	editdlrm
module.cpython-39.pyc	7170	0644	editdlrm
objectmodel.cpython-39.opt-1.pyc	3971	0644	editdlrm
objectmodel.cpython-39.pyc	3971	0644	editdlrm
output.cpython-39.opt-1.pyc	3545	0644	editdlrm
output.cpython-39.pyc	3545	0644	editdlrm
policygen.cpython-39.opt-1.pyc	12887	0644	editdlrm
policygen.cpython-39.pyc	12920	0644	editdlrm
refparser.cpython-39.opt-1.pyc	29259	0644	editdlrm
refparser.cpython-39.pyc	29259	0644	editdlrm
refpolicy.cpython-39.opt-1.pyc	40173	0644	editdlrm
refpolicy.cpython-39.pyc	40173	0644	editdlrm
sepolgeni18n.cpython-39.opt-1.pyc	394	0644	editdlrm
sepolgeni18n.cpython-39.pyc	394	0644	editdlrm
util.cpython-39.opt-1.pyc	6364	0644	editdlrm
util.cpython-39.pyc	6364	0644	editdlrm
yacc.cpython-39.opt-1.pyc	53133	0644	editdlrm
yacc.cpython-39.pyc	53212	0644	editdlrm
__init__.cpython-39.opt-1.pyc	144	0644	editdlrm
__init__.cpython-39.pyc	144	0644	editdlrm

a B�i�!�@sbdZd
dl
Z
ddlmZ
ddlmZ
ddlmZ
Gdd�dej�ZGd d �d �ZGdd�d�Z dS) zI Classes and algorithms for matching requested access to access vectors. �N�
)
�access)
�objectmodel)
�utilc@seZ
dZddd�
Zdd�Zd
S)�MatchNr
cCs|
|_||_
d
|_d|_dS�NF)� interface�dist�info_dir_change�__hash__)�selfrr �r �5/usr/lib/python3.9/site-packages/sepolgen/matching.py�__init__ s


zMatch.__init__c CsDz$|j|j
f}|
j|
j
f}|||�WSttfy>


tYS0dS�
N)r r �AttributeError� TypeError�NotImplemented)r�other�method�
a�
br r r�_compare(s




zMatch._compare)Nr
)�__name__� __module__�__qualname__rrr r r rrs
rc@sHeZ
dZd
Zdd�Zdd�Zdd�Zdd �Zd d�Zdd �Z dd�Z dS)� MatchList�c

Cs$g|_g|_
|j|_d
|_d|_dSr)�children�bastards�DEFAULT_THRESHOLD� threshold�allow_info_dir_change�av�
rr r rr3s 


zMatchList.__init__c

Cs,t|j
�
r|j
d
St|j�
r(|jd
SdS�Nr
��lenrrr$r r r�best<s




zMatchList.bestc

Cst|j
�
t|j�
Srr&r$r r r�__len__CszMatchList.__len__c

Cs t|j
�
Sr)�iterrr$r r r�__iter__Is
zMatchList.__iter__c

Cst�
|j|j�Sr)� itertools�chainrrr$r r r�allLs
z MatchList.allcCsD|
j|j
k
r4|
jr|jr&|j�|
�

q@|j�|
�

n|j�|
�

dSr)r r!r r"r�appendr)r�matchr r rr/Os


zMatchList.appendc

Cs|j�
�
|j�
�
dSr)r�sortrr$r r rr1Xs

zMatchList.sortN)rrrr rr(r)r+r.r/r1r r r rr1s

  rc@s>eZ
dZddd�
Zdd�Zdd�Zdd �Zd d�Zdd �Zd
S)� AccessMatcherNcCs,d
|_d
|_
|
r|
|_n t��|_d|_dS)N� �d)�type_penalty�obj_penalty� perm_mapsrZPermMappings�info_dir_penalty)rr7r r rr^s



 zAccessMatcher.__init__cCs"|
|kst�
|�
rd
S|jSdSr%)r� is_idparamr5)rrrr r r� type_distancejs

zAccessMatcher.type_distancecCsR|
j�
|j�
}t|�
d
kr0|j�|
j|�}|S|j�
|
j�
}|j�|
j|�SdSr%)�perms� differencer'r7�getdefault_distance� obj_class)rZav_reqZav_prov�diff�totalr r r� perm_distanceqs


zAccessMatcher.perm_distancecCs�d
}||�|
j
|j
�7}||�|
j|j�7}|
j|jkrNt�|j�
sN||j8}|d
krj|j�|j|j �}n|� |
|�}|d
kr�|d
kr�||S||Sn |d
kr�|d
kr�||S||SdS)a,Determine the 'distance' between 2 access vectors. This function is used to find an access vector that matches a 'required' access. To do this we comput a signed numeric value that indicates how close the req access is to the 'provided' access vector. The closer the value is to 0 the closer the match, with 0 being an exact match. A value over 0 indicates that the prov access vector provides more access than the req (in practice, this means that the source type, target type, and object class is the same and the perms in prov is a superset of those in req. A value under 0 indicates that the prov access less - or unrelated - access to the req access. A different type or object class will result in a very low value. The values other than 0 should only be interpreted relative to one another - they have no exact meaning and are likely to change. Params: req - [AccessVector] The access that is required. This is the access being matched. prov - [AccessVector] The access provided. This is the potential match that is being evaluated for req. Returns: 0 : Exact match between the access vectors. < 0 : The prov av does not provide all of the access in req. A smaller value indicates that the access is further. > 0 : The prov av provides more access than req. The larger the value the more access over req. r
N)r:Zsrc_type�tgt_typer>rr9r6r7r=r;rA)rZreqZprovr Zpdistr r r�av_distance|s '







zAccessMatcher.av_distancecCs�d
}|
D]^}|�||�}|d
ur&|}q|dkrL|dkr@||7}qf||}q|dkr^||7}q||8}q|j
�|j|j�}|
jd
ur�tj|
_|
D]}|
j|j
�|j|j�B|
_q�|tj@dkr�|
jtj@r�|dkr�||j 8}n ||j 7}|S)z Nr
) rCr7Zgetdefault_directionr>r;Zinfo_dirrZ FLOW_NONEZ FLOW_WRITEr8)rZav_setr#r �
x�tmpZav_dirr r r�av_set_match�s0






 



�

 zAccessMatcher.av_set_matchcCsd||_t
�|
j|
j�|jg��D]6}|js,q |�|j |�}|d
kr t ||�}|�|�

q |��
dSr%) r#r,r-Ztgt_type_allZtgt_type_map�getrBZenabledrFrrr/r1)rZifsetr#Z match_listZivr �
mr r r� search_ifs�s


�


zAccessMatcher.search_ifs)
N) rrrrr:rArCrFrIr r r rr2]s
H(r2) �__doc__r,�rrrZ Comparisonrrr2r r r r�s

,