MINI MINI MANI MO
ó
dßØ[c @ sÛ d d l j Z d d l Z d d l Z d d l Z d d l m Z d d l Td d l m Z d d l
m Z m Z m
Z
m Z m Z m Z d d l m Z d d l m Z d e f d „ ƒ YZ d
e f d „ ƒ YZ d S( iÿÿÿÿN( t config( t *( t log( t uniqifyt checkUsert checkUidt checkCommandt checkContextt
u2b_if_py2( t errors( t
FirewallErrort! lockdown_whitelist_ContentHandlerc B s e Z d „ Z d „ Z RS( c C s t j | | ƒ t | _ d S( N( t IO_Object_ContentHandlert __init__t Falset whitelist( t selft item( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR
$ s c C s» t j | | | ƒ | j j | | ƒ | d k r\ | j rP t t j d ƒ ‚ n t | _ n[| d k rŸ | j s‚ t j
d ƒ d S| d } | j j | ƒ n| d k rH| j sÅ t j
d ƒ d Sd | k r"y t | d ƒ } Wn' t
k
rt j
d | d ƒ d SX| j j | ƒ q·d | k r·| j j | d ƒ q·no | d
k r¢| j snt j
d ƒ d Sd | k r‹t j
d
ƒ d S| j j | d ƒ n t j
d | ƒ d Sd S( NR s More than one whitelist.t commands) Parse Error: command outside of whitelistt namet users& Parse Error: user outside of whitelistt ids" Parse Error: %s is not a valid uidt selinuxs) Parse Error: selinux outside of whitelistt contexts Parse Error: no contexts Unknown XML element %s( R t startElementR t parser_check_element_attrsR R
R t PARSE_ERRORt TrueR t errort add_commandt intt
ValueErrort add_uidt add_usert add_context( R R t attrsR t uid( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR ( sJ
( t __name__t
__module__R
R ( ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR # s t LockdownWhitelistc B sx e Z d Z d d g f d d g f d d g f d d g f f Z d Z d g Z i d* d 6d
g d 6d* d 6d
g d 6Z i d d
g d 6Z d „ Z d „ Z
d „ Z d „ Z d „ Z
d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d! „ Z d" „ Z d# „ Z d$ „ Z d% „ Z d& „ Z d' „ Z d( „ Z! d) „ Z" RS(+ s LockdownWhitelist class t commandst t contextst userst uidsi s
(asasasai)t _R R R R R R R c C sM t t | ƒ j ƒ | | _ d | _ g | _ g | _ g | _ g | _ d S( N(
t superR' R
t filenamet Nonet parserR( R* R+ R, ( R R/ ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR
m s c C sø | d
k r4 xå | D] } | j | | d ƒ q WnÀ | d k rd t | ƒ sô t t j | ƒ ‚ qô n | d k r” t | ƒ sô t t j | ƒ ‚ qô n` | d k rÄ t | ƒ sô t t j | ƒ ‚ qô n0 | d k rô t | ƒ sô t t j
| ƒ ‚ qô n d S( NR( R* R+ R, iÿÿÿÿR R R R$ ( s commandss contextss userss uids( t
_check_configR R
R t INVALID_COMMANDR t INVALID_CONTEXTR t INVALID_USERR t INVALID_UID( R R R t x( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR2 x s
c C s | j 2| j 2| j 2| j 2d S( N( R( R* R+ R, ( R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt cleanup‰ s c C ss g | j D] } t | ƒ ^ q
| _ g | j D] } t | ƒ ^ q/ | _ g | j D] } t | ƒ ^ qT | _ d S( s» HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.N( R( R R* R+ ( R R7 ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt encode_strings‘ s %%c C s] t | ƒ s! t t j | ƒ ‚ n | | j k rC | j j | ƒ n t t j d | ƒ ‚ d S( Ns! Command "%s" already in whitelist( R R
R R3 R( t appendt ALREADY_ENABLED( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR › s c C s< | | j k r" | j j | ƒ n t t j d | ƒ ‚ d S( Ns Command "%s" not in whitelist.( R( t removeR
R t NOT_ENABLED( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt remove_command¤ s c C s
| | j k S( N( R( ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt has_command« s c C sQ xJ | j D]? } | j d ƒ r9 | j | d ƒ rI t Sq
| | k r
t Sq
Wt S( NR iÿÿÿÿ( R( t endswitht
startswithR R ( R R t _command( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt
match_command® s c C s | j S( N( R( ( R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt get_commands¸ s c C sc t | ƒ s' t t j t | ƒ ƒ ‚ n | | j k rI | j j | ƒ n t t j d | ƒ ‚ d S( Ns Uid "%s" already in whitelist( R R
R R6 t strR, R: R; ( R R$ ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR ½ s c C s< | | j k r" | j j | ƒ n t t j d | ƒ ‚ d S( Ns Uid "%s" not in whitelist.( R, R< R
R R= ( R R$ ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt
remove_uidÇ s c C s
| | j k S( N( R, ( R R$ ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt has_uidÎ s c C s
| | j k S( N( R, ( R R$ ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt match_uidÑ s c C s | j S( N( R, ( R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt get_uidsÔ s c C s] t | ƒ s! t t j | ƒ ‚ n | | j k rC | j j | ƒ n t t j d | ƒ ‚ d S( Ns User "%s" already in whitelist( R R
R R5 R+ R: R; ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR! Ù s c C s< | | j k r" | j j | ƒ n t t j d | ƒ ‚ d S( Ns User "%s" not in whitelist.( R+ R< R
R R= ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt remove_userã s c C s
| | j k S( N( R+ ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt has_userê s c C s
| | j k S( N( R+ ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt
match_userí s c C s | j S( N( R+ ( R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt get_usersð s c C s] t | ƒ s! t t j | ƒ ‚ n | | j k rC | j j | ƒ n t t j d | ƒ ‚ d S( Ns! Context "%s" already in whitelist( R R
R R4 R* R: R; ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR" ! s c C s< | | j k r" | j j | ƒ n t t j d | ƒ ‚ d S( Ns Context "%s" not in whitelist.( R* R< R
R R= ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt remove_context+ s c C s
| | j k S( N( R* ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt has_context2 s c C s
| | j k S( N( R* ( R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt
match_context5 s c C s | j S( N( R* ( R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt get_contexts8 s c C sà | j ƒ | j j d ƒ s8 t t j d | j ƒ ‚ n t | ƒ } t j ƒ } | j | ƒ y | j
| j ƒ Wn2 t j k
r¥ } t t j d | j
ƒ ƒ ‚ n X~ ~ t r¿ | j ƒ n d S( Ns .xmls '%s' is missing .xml suffixs Not a valid file: %s( R8 R/ R@ R
R t INVALID_NAMER t saxt make_parsert setContentHandlert parset SAXParseExceptiont INVALID_TYPEt getExceptiont PY2R9 ( R t handlerR1 t msg( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt read= s"
c C sH t j j | j ƒ re y t j | j d | j ƒ Wqe t k
ra } t d | j | f ƒ ‚ qe Xn t j j t j ƒ s t j
t j d ƒ n t j | j d d d d ƒ} t
| ƒ } | j ƒ | j d i ƒ | j d ƒ xH t | j ƒ D]7 } | j d
ƒ | j d i | d 6ƒ | j d ƒ qñ WxN t | j ƒ D]= } | j d
ƒ | j d
i t | ƒ d 6ƒ | j d ƒ q<WxH t | j ƒ D]7 } | j d
ƒ | j d
i | d 6ƒ | j d ƒ qWxH t | j ƒ D]7 } | j d
ƒ | j d i | d 6ƒ | j d ƒ qØW| j d ƒ | j d ƒ | j ƒ | j ƒ ~ d S( Ns %s.olds Backup of '%s' failed: %siè t modet wtt encodings UTF-8R s
s R R R R R R ( t ost patht existsR/ t shutilt copy2t Exceptiont IOErrorR t
ETC_FIREWALLDt mkdirt iot opent IO_Object_XMLGeneratort
startDocumentR t ignorableWhitespaceR R( t
simpleElementR, RE R+ R* t
endElementt endDocumentt close( R R\ t fR[ R R$ R R ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt writeP sB
N(# R% R& t __doc__t IMPORT_EXPORT_STRUCTUREt DBUS_SIGNATUREt ADDITIONAL_ALNUM_CHARSR0 t PARSER_REQUIRED_ELEMENT_ATTRSt PARSER_OPTIONAL_ELEMENT_ATTRSR
R2 R8 R9 R R> R? RC RD R RF RG RH RI R! RJ RK RL RM R" RN RO RP RQ R] Rt ( ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR' V sP
1
( t xml.saxRS Ra Rj Rd t firewallR t firewall.core.io.io_objectt firewall.core.loggerR t firewall.functionsR R R R R R R t firewall.errorsR
R R t IO_ObjectR' ( ( ( sG /usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt <module> s
.3
OHA YOOOO