ó
c‰`c @ só d d l j Z d d l Z d d l Z d d l Z d d l m Z d d l m Z m Z m
Z
m Z d d l m
Z
d d l m Z m Z m Z m Z m Z m Z d d l m Z d d l m Z d e
f d „ ƒ YZ d
e f d „ ƒ YZ d S( iÿÿÿÿN( t config( t PY2t IO_Objectt IO_Object_ContentHandlert IO_Object_XMLGenerator( t log( t uniqifyt checkUsert checkUidt checkCommandt checkContextt
u2b_if_py2( t errors( t
FirewallErrort! lockdown_whitelist_ContentHandlerc B s e Z d „ Z d „ Z RS( c C s t j | | ƒ t | _ d S( N( R t __init__t Falset whitelist( t selft item( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR % s c C s» t j | | | ƒ | j j | | ƒ | d k r\ | j rP t t j d ƒ ‚ n t | _ n[| d k rŸ | j s‚ t j
d ƒ d S| d } | j j | ƒ n| d k rH| j sÅ t j
d ƒ d Sd | k r"y t | d ƒ } Wn' t
k
rt j
d | d ƒ d SX| j j | ƒ q·d | k r·| j j | d ƒ q·no | d
k r¢| j snt j
d ƒ d Sd | k r‹t j
d
ƒ d S| j j | d ƒ n t j
d | ƒ d Sd S( NR s More than one whitelist.t commands) Parse Error: command outside of whitelistt namet users& Parse Error: user outside of whitelistt ids" Parse Error: %s is not a valid uidt selinuxs) Parse Error: selinux outside of whitelistt contexts Parse Error: no contexts Unknown XML element %s( R t startElementR t parser_check_element_attrsR R
R t PARSE_ERRORt TrueR t errort add_commandt intt
ValueErrort add_uidt add_usert add_context( R R t attrsR t uid( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR ) sJ
( t __name__t
__module__R R ( ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR $ s t LockdownWhitelistc B sx e Z d Z d d g f d d g f d d g f d d g f f Z d Z d g Z i d* d 6d
g d 6d* d 6d
g d 6Z i d d
g d 6Z d „ Z d „ Z
d „ Z d „ Z d „ Z
d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d! „ Z d" „ Z d# „ Z d$ „ Z d% „ Z d& „ Z d' „ Z d( „ Z! d) „ Z" RS(+ s LockdownWhitelist class t commandst t contextst userst uidsi s
(asasasai)t _R R R R R R R c C sM t t | ƒ j ƒ | | _ d | _ g | _ g | _ g | _ g | _ d S( N(
t superR) R t filenamet Nonet parserR* R, R- R. ( R R1 ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR n s c C sø | d
k r4 xå | D] } | j | | d ƒ q WnÀ | d k rd t | ƒ sô t t j | ƒ ‚ qô n | d k r” t | ƒ sô t t j | ƒ ‚ qô n` | d k rÄ t | ƒ sô t t j | ƒ ‚ qô n0 | d k rô t | ƒ sô t t j
| ƒ ‚ qô n d S( NR* R, R- R. iÿÿÿÿR R R R& ( s commandss contextss userss uids( t
_check_configR R
R t INVALID_COMMANDR
t INVALID_CONTEXTR t INVALID_USERR t INVALID_UID( R R R t x( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR4 y s
c C s | j 2| j 2| j 2| j 2d S( N( R* R, R- R. ( R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt cleanupŠ s c C ss g | j D] } t | ƒ ^ q
| _ g | j D] } t | ƒ ^ q/ | _ g | j D] } t | ƒ ^ qT | _ d S( s» HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.N( R* R R, R- ( R R9 ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt encode_strings’ s %%c C s] t | ƒ s! t t j | ƒ ‚ n | | j k rC | j j | ƒ n t t j d | ƒ ‚ d S( Ns! Command "%s" already in whitelist( R R
R R5 R* t appendt ALREADY_ENABLED( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR œ s c C s< | | j k r" | j j | ƒ n t t j d | ƒ ‚ d S( Ns Command "%s" not in whitelist.( R* t removeR
R t NOT_ENABLED( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt remove_command¥ s c C s
| | j k S( N( R* ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt has_command¬ s c C sQ xJ | j D]? } | j d ƒ r9 | j | d ƒ rI t Sq
| | k r
t Sq
Wt S( Nt *iÿÿÿÿ( R* t endswitht
startswithR R ( R R t _command( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt
match_command¯ s c C s | j S( N( R* ( R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt get_commands¹ s c C sc t | ƒ s' t t j t | ƒ ƒ ‚ n | | j k rI | j j | ƒ n t t j d | ƒ ‚ d S( Ns Uid "%s" already in whitelist( R R
R R8 t strR. R< R= ( R R& ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR" ¾ s c C s< | | j k r" | j j | ƒ n t t j d | ƒ ‚ d S( Ns Uid "%s" not in whitelist.( R. R> R
R R? ( R R& ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt
remove_uidÈ s c C s
| | j k S( N( R. ( R R& ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt has_uidÏ s c C s
| | j k S( N( R. ( R R& ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt match_uidÒ s c C s | j S( N( R. ( R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt get_uidsÕ s c C s] t | ƒ s! t t j | ƒ ‚ n | | j k rC | j j | ƒ n t t j d | ƒ ‚ d S( Ns User "%s" already in whitelist( R R
R R7 R- R< R= ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR# Ú s c C s< | | j k r" | j j | ƒ n t t j d | ƒ ‚ d S( Ns User "%s" not in whitelist.( R- R> R
R R? ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt remove_userä s c C s
| | j k S( N( R- ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt has_userë s c C s
| | j k S( N( R- ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt
match_userî s c C s | j S( N( R- ( R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt get_usersñ s c C s] t | ƒ s! t t j | ƒ ‚ n | | j k rC | j j | ƒ n t t j d | ƒ ‚ d S( Ns! Context "%s" already in whitelist( R
R
R R6 R, R< R= ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR$ " s c C s< | | j k r" | j j | ƒ n t t j d | ƒ ‚ d S( Ns Context "%s" not in whitelist.( R, R> R
R R? ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt remove_context, s c C s
| | j k S( N( R, ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt has_context3 s c C s
| | j k S( N( R, ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt
match_context6 s c C s | j S( N( R, ( R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt get_contexts9 s c C sà | j ƒ | j j d ƒ s8 t t j d | j ƒ ‚ n t | ƒ } t j ƒ } | j | ƒ y | j
| j ƒ Wn2 t j k
r¥ } t t j d | j
ƒ ƒ ‚ n X~ ~ t r¿ | j ƒ n d S( Ns .xmls '%s' is missing .xml suffixs Not a valid file: %s( R: R1 RC R
R t INVALID_NAMER t saxt make_parsert setContentHandlert parset SAXParseExceptiont INVALID_TYPEt getExceptionR R; ( R t handlerR3 t msg( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt read> s"
c C sH t j j | j ƒ re y t j | j d | j ƒ Wqe t k
ra } t d | j | f ƒ ‚ qe Xn t j j t j ƒ s t j
t j d ƒ n t j | j d d d d ƒ} t
| ƒ } | j ƒ | j d i ƒ | j d ƒ xH t | j ƒ D]7 } | j d
ƒ | j d i | d 6ƒ | j d ƒ qñ WxN t | j ƒ D]= } | j d
ƒ | j d
i t | ƒ d 6ƒ | j d ƒ q<WxH t | j ƒ D]7 } | j d
ƒ | j d
i | d 6ƒ | j d ƒ qWxH t | j ƒ D]7 } | j d
ƒ | j d i | d 6ƒ | j d ƒ qØW| j d ƒ | j d ƒ | j ƒ | j ƒ ~ d S( Ns %s.olds Backup of '%s' failed: %siè t modet wtt encodings UTF-8R s
s R R R R R R ( t ost patht existsR1 t shutilt copy2t Exceptiont IOErrorR t
ETC_FIREWALLDt mkdirt iot openR t
startDocumentR t ignorableWhitespaceR R* t
simpleElementR. RH R- R, t
endElementt endDocumentt close( R R^ t fR] R R& R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt writeQ sB
N(# R' R( t __doc__t IMPORT_EXPORT_STRUCTUREt DBUS_SIGNATUREt ADDITIONAL_ALNUM_CHARSR2 t PARSER_REQUIRED_ELEMENT_ATTRSt PARSER_OPTIONAL_ELEMENT_ATTRSR R4 R: R; R R@ RA RF RG R" RI RJ RK RL R# RM RN RO RP R$ RQ RR RS RT R_ Ru ( ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR) W sP
1
( t xml.saxRV Rc Rl Rf t firewallR t firewall.core.io.io_objectR R R R t firewall.core.loggerR t firewall.functionsR R R R R
R R t firewall.errorsR
R R) ( ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt <module> s ".3