a qéqeÌ ã@s ddlmZddlmZmZmZmZddlmZm Z m Z m Z m Z ddl mZddlmZmZmZddlmZdd lmZGd d „d eƒZGd d „d eeƒZdS)é)Ú defaultdict)Ú FrozenSetÚListÚOptionalÚUnioné)Ú AnyConstraintÚConstraintRuletypeÚRoleÚTypeÚUseré)ÚDiffResultDescriptor)Ú DifferenceÚ SymbolWrapperÚWrapper)Úclass_wrapper_factory)ÚRuleListc@sÎeZdZUdZedƒZedƒZedƒZedƒZedƒZ edƒZ edƒZ edƒZ dZ eeefed<dZeeefed<dd œd d „Zdd œd d „Zdd œdd„Zdd œdd„Zdd œdd„Zdd œdd„ZdS)ÚConstraintsDifferencea‚ Determine the difference in constraints between two policies. Since the compiler does not union constraints, there may be multiple constraints with the same ruletype, object class, and permission set, so constraints can only be added or removed, not modified. The constraint expressions are compared only on a basic level. Expressions that are logically equivalent but are structurally different, for example, by associativity, will be considered different. Type and role attributes are also not expanded, so if there are changes to attribute members, it will not be reflected as a difference. Údiff_constrainsÚdiff_mlsconstrainsÚdiff_validatetransÚdiff_mlsvalidatetransNÚ_left_constraintsÚ_right_constraints)ÚreturncCsl|j d |¡¡|jdus&|jdur.| ¡| dd„|jtjDƒdd„|jtjDƒ¡\|_ |_ }dS)zAGenerate the difference in constraint rules between the policies.zJGenerating constraint differences from {0.left_policy} to {0.right_policy}Ncss|]}t|ƒVqdS©N©ÚConstraintWrapper©Ú.0Úc©r"ú>/usr/lib64/python3.9/site-packages/setools/diff/constraints.pyÚ ?óz8ConstraintsDifference.diff_constrains..css|]}t|ƒVqdSrrrr"r"r#r$@r%) ÚlogÚinfoÚformatrrÚ_create_constrain_listsÚ _set_diffr Z constrainÚadded_constrainsÚremoved_constrains©ÚselfÚ_r"r"r#r2s ÿþz%ConstraintsDifference.diff_constrainscCsl|j d |¡¡|jdus&|jdur.| ¡| dd„|jtjDƒdd„|jtjDƒ¡\|_ |_ }dS)zEGenerate the difference in MLS constraint rules between the policies.zNGenerating MLS constraint differences from {0.left_policy} to {0.right_policy}Ncss|]}t|ƒVqdSrrrr"r"r#r$Pr%z;ConstraintsDifference.diff_mlsconstrains..css|]}t|ƒVqdSrrrr"r"r#r$Rr%) r&r'r(rrr)r*r Z mlsconstrainÚadded_mlsconstrainsÚremoved_mlsconstrainsr-r"r"r#rBsÿÿ ÿ ÿýz(ConstraintsDifference.diff_mlsconstrainscCsl|j d |¡¡|jdus&|jdur.| ¡| dd„|jtjDƒdd„|jtjDƒ¡\|_ |_ }dS)zDGenerate the difference in validatetrans rules between the policies.zMGenerating validatetrans differences from {0.left_policy} to {0.right_policy}Ncss|]}t|ƒVqdSrrrr"r"r#r$cr%z;ConstraintsDifference.diff_validatetrans..css|]}t|ƒVqdSrrrr"r"r#r$er%) r&r'r(rrr)r*r Z validatetransÚadded_validatetransÚremoved_validatetransr-r"r"r#rUsÿÿ ÿ ÿýz(ConstraintsDifference.diff_validatetranscCsl|j d |¡¡|jdus&|jdur.| ¡| dd„|jtjDƒdd„|jtjDƒ¡\|_ |_ }dS)zHGenerate the difference in MLS validatetrans rules between the policies.zPGenerating mlsvalidatetrans differences from {0.left_policy} to {0.right_policy}Ncss|]}t|ƒVqdSrrrr"r"r#r$vr%z>ConstraintsDifference.diff_mlsvalidatetrans..css|]}t|ƒVqdSrrrr"r"r#r$xr%) r&r'r(rrr)r*r ZmlsvalidatetransÚadded_mlsvalidatetransÚremoved_mlsvalidatetransr-r"r"r#rhsÿÿ ÿ ÿýz+ConstraintsDifference.diff_mlsvalidatetranscCsättƒ|_|j d |¡¡|j ¡D]}|j|j  |¡q&|j  ¡D] \}}|j d t |ƒ|¡¡qHttƒ|_ |j d |¡¡|j  ¡D]}|j |j  |¡q�|j   ¡D] \}}|j d t |ƒ|¡¡q²|j d¡dS)z$Create rule lists for both policies.z.Building constraint lists from {0.left_policy}zLoaded {0} {1} rules.z/Building constraint lists from {0.right_policy}z)Completed building constraint rule lists.N)rÚlistrr&Údebugr(Z left_policyÚ constraintsÚruletypeÚappendÚitemsÚlenrZ right_policy)r.Úruler9Zrulesr"r"r#r)~s  z-ConstraintsDifference._create_constrain_listscCsL|j d¡d|_d|_d|_d|_d|_d|_d|_d|_ d|_ d|_ dS)z%Reset diff results on policy changes.z%Resetting all constraints differencesN) r&r7r+r,r0r1r2r3r4r5rr©r.r"r"r#Ú _reset_diff’s z!ConstraintsDifference._reset_diff)Ú__name__Ú __module__Ú __qualname__Ú__doc__rr+r,r0r1r2r3r4r5rrr rÚ__annotations__rrrrrr)r?r"r"r"r#rs" rc@s<eZdZdZdZeddœdd„Zdd„Zd d „Zd d „Z dS) rz#Wrap constraints for diff purposes.©r9ÚtclassÚpermsÚexprN)r=rcCs’||_|j|_t|jƒ|_z |j|_Wnty>d|_Yn0t|ƒ|_g|_|j D]6}t |t ƒr€|j  t dd„|Dƒƒ¡qV|j  |¡qVdS)Ncss|]}t|ƒVqdSr)r)r Úitemr"r"r#r$»r%z-ConstraintWrapper.__init__..) Úoriginr9rrFrGÚAttributeErrorÚhashÚkeyrHZ expressionÚ isinstanceÚ frozensetr:)r.r=Úopr"r"r#Ú__init__©s       zConstraintWrapper.__init__cCs|jSr©rMr>r"r"r#Ú__hash__ÀszConstraintWrapper.__hash__cCs |j|jkSrrR©r.Úotherr"r"r#Ú__lt__ÃszConstraintWrapper.__lt__cCs0|j|jko.|j|jko.|j|jko.|j|jkSrrErTr"r"r#Ú__eq__Æs  ÿ þ ýzConstraintWrapper.__eq__) r@rArBrCÚ __slots__rrQrSrVrWr"r"r"r#r£s rN)Ú collectionsrÚtypingrrrrZ policyreprr r r r Z descriptorsrÚ differencerrrZobjclassrrrrr"r"r"r#Ús