1 # Copyright 2016, Tresys Technology, LLC 2 # 3 # This file is part of SETools. 4 # 5 # SETools is free software: you can redistribute it and/or modify 6 # it under the terms of the GNU Lesser General Public License as 7 # published by the Free Software Foundation, either version 2.1 of 8 # the License, or (at your option) any later version. 9 # 10 # SETools is distributed in the hope that it will be useful, 11 # but WITHOUT ANY WARRANTY; without even the implied warranty of 12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 # GNU Lesser General Public License for more details. 14 # 15 # You should have received a copy of the GNU Lesser General Public 16 # License along with SETools. If not, see 17 # <http://www.gnu.org/licenses/>. 18 # 19 from collections import namedtuple 20 21 from .descriptors import DiffResultDescriptor 22 from .difference import Difference, SymbolWrapper, Wrapper 23 from .mls import RangeWrapper 24 25 26 modified_mlsrule_record = namedtuple("modified_mlsrule", ["rule", 27 "added_default", 28 "removed_default"]) 29 30 31 class MLSRulesDifference(Difference): 32 33 """Determine the difference in MLS rules between two policies.""" 34 35 added_range_transitions = DiffResultDescriptor("diff_range_transitions") 36 removed_range_transitions = DiffResultDescriptor("diff_range_transitions") 37 modified_range_transitions = DiffResultDescriptor("diff_range_transitions") 38 39 # Lists of rules for each policy 40 _left_range_transitions = None 41 _right_range_transitions = None 42 43 def diff_range_transitions(self): 44 """Generate the difference in range_transition rules between the policies.""" 45 46 self.log.info( 47 "Generating range_transition differences from {0.left_policy} to {0.right_policy}". 48 format(self)) 49 50 if self._left_range_transitions is None or self._right_range_transitions is None: 51 self._create_mls_rule_lists() 52 53 self.added_range_transitions, \ 54 self.removed_range_transitions, \ 55 self.modified_range_transitions = self._diff_mls_rules( 56 self._expand_generator(self._left_range_transitions, MLSRuleWrapper), 57 self._expand_generator(self._right_range_transitions, MLSRuleWrapper)) 58 59 # 60 # Internal functions 61 # 62 def _create_mls_rule_lists(self): 63 """Create rule lists for both policies.""" 64 self._left_range_transitions = [] 65 for rule in self.left_policy.mlsrules(): 66 # do not expand yet, to keep memory 67 # use down as long as possible 68 if rule.ruletype == "range_transition": 69 self._left_range_transitions.append(rule) 70 else: 71 self.log.error("Unknown rule type: {0} (This is an SETools bug)". 72 format(rule.ruletype)) 73 74 self._right_range_transitions = [] 75 for rule in self.right_policy.mlsrules(): 76 # do not expand yet, to keep memory 77 # use down as long as possible 78 if rule.ruletype == "range_transition": 79 self._right_range_transitions.append(rule) 80 else: 81 self.log.error("Unknown rule type: {0} (This is an SETools bug)". 82 format(rule.ruletype)) 83 84 def _diff_mls_rules(self, left_list, right_list): 85 """Common method for comparing type_* rules.""" 86 added, removed, matched = self._set_diff(left_list, right_list) 87 88 modified = [] 89 90 for left_rule, right_rule in matched: 91 # Criteria for modified rules 92 # 1. change to default range 93 if RangeWrapper(left_rule.default) != RangeWrapper(right_rule.default): 94 modified.append(modified_mlsrule_record(left_rule, 95 right_rule.default, 96 left_rule.default)) 97 98 return added, removed, modified 99 100 def _reset_diff(self): 101 """Reset diff results on policy changes.""" 102 self.log.debug("Resetting MLS rule differences") 103 self.added_range_transitions = None 104 self.removed_range_transitions = None 105 self.modified_range_transitions = None 106 107 # Sets of rules for each policy 108 self._left_range_transitions = None 109 self._right_range_transitions = None 110 111 112 class MLSRuleWrapper(Wrapper): 113 114 """Wrap MLS rules to allow set operations.""" 115 116 def __init__(self, rule): 117 self.origin = rule 118 self.ruletype = rule.ruletype 119 self.source = SymbolWrapper(rule.source) 120 self.target = SymbolWrapper(rule.target) 121 self.tclass = SymbolWrapper(rule.tclass) 122 self.key = hash(rule) 123 124 def __hash__(self): 125 return self.key 126 127 def __lt__(self, other): 128 return self.key < other.key 129 130 def __eq__(self, other): 131 # because MLSRuleDifference groups rules by ruletype, 132 # the ruletype always matches. 133 return self.source == other.source and \ 134 self.target == other.target and \ 135 self.tclass == other.tclass 136
