�
�G�`c@s�dd
lj
Z
dd
lZdd
lZdd
lZddlmZ
ddlmZm	Z	m
Z
mZ
ddlm
Z

ddlmZmZmZmZmZmZ
ddlmZ
ddlmZ
de
f
d	��YZd
e	f
d��YZd
S(i����N(
tconfig(tPY2t	IO_ObjecttIO_Object_ContentHandlertIO_Object_XMLGenerator(
tlog(tuniqifyt	checkUsertcheckUidtcheckCommandtcheckContextt
u2b_if_py2(
terrors(
t
FirewallErrort!lockdown_whitelist_ContentHandlerc
BseZ
d�Zd
�ZRS(cCstj
||
�
t|_dS(
N(Rt__init__tFalset	whitelist(tselftitem((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR%s

cCs�
tj
||
|�
|jj|
|�
|
d
kr\|jrPttjd��
nt|_n[
|
dkr�|js�t	j
d�

dS|d}|jj|�

n
|
dkrH
|js�t	j
d�

dSd|kr"
yt|d�
}Wn't
k
r



t	j
d	|d�

dSX|jj|�

q�
d|kr�
|jj|d�

q�
no|
d
kr�
|jsn
t	j
d�

dSd|kr�
t	j
d
�

dS|jj|d�

nt	j
d|
�

dSdS(NRsMore than one whitelist.tcommands)Parse Error: command outside of whitelisttnametusers&Parse Error: user outside of whitelisttids"Parse Error: %s is not a valid uidtselinuxs)Parse Error: selinux outside of whitelisttcontextsParse Error: no contextsUnknown XML element %s(RtstartElementRtparser_check_element_attrsRR
RtPARSE_ERRORtTrueRterrortadd_commandtintt
ValueErrortadd_uidtadd_usertadd_context(RRtattrsRtuid((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR)sJ


	
	


	






	








	





	








(t__name__t
__module__RR(((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR$s
	tLockdownWhitelistcBsx
eZ
dZd
dg
fddg
fddg
fddg
ffZdZdg
Zid*d	6d
g
d6d*d6d
g
d6Zi
dd
gd6Zd�Z	d�Z
d�Zd�Zd�Z
d�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd �Zd!�Zd"�Zd#�Zd$�Zd%�Zd&�Zd'�Z d(�Z!d)�Z"RS(+s LockdownWhitelist class tcommandsttcontextstuserstuidsis
(asasasai)t
_RRRRRRRcCsMtt
|�j�
|
|_d|_g|_g|_g|_g|_	dS(
N(
tsuperR)RtfilenametNonetparserR*R,R-R.(RR1((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyRns

	
	
	
	
	
cCs�|d
kr4x�|
D]}|j||d �
qWn�|dkrdt
|
�
s�ttj|
��
q�n�|dkr�t|
�
s�ttj|
��
q�n`|dkr�t|
�
s�ttj|
��
q�n0|d	kr�t	|
�
s�ttj
|
��
q�ndS(NR*R,R-R.i����RRRR&(scommandsscontextssuserssuids(t
_check_configR	R
RtINVALID_COMMANDR
tINVALID_CONTEXTRtINVALID_USERRtINVALID_UID(RRRt
x((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR4ys















c


Cs |j2|j
2|j2|j2dS(
N(R*R,R-R.(
R((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pytcleanup�s



c
Cssg|jD]}
t
|
�
^q
|_g|jD]}
t
|
�
^q/|_g|jD]}
t
|
�
^qT|_d
S(s� HACK. I haven't been able to make sax parser return
            strings encoded (because of python 2) instead of in unicode.
            Get rid of it once we throw out python 2 support.N(R*RR,R-(RR9((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pytencode_strings�s%
%
cCs]t|
�
s!t
tj|
��
n|
|jkrC|jj|
�

nt
tjd
|
��
dS(Ns!Command "%s" already in whitelist(R	R
RR5R*tappendtALREADY_ENABLED(RR((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR�s



	
cCs<|
|jkr"|jj
|
�

nttjd
|
��
dS(NsCommand "%s" not in whitelist.(R*tremoveR
RtNOT_ENABLED(RR((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pytremove_command�s

	
cCs
|
|jkS(
N(
R*(RR((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pythas_command�s
cCsQxJ|jD]?}|j
d
�
r9|
j|d �
rItSq
||
kr
tSq
WtS(Nt
*i����(R*tendswitht
startswithRR(RRt_command((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt
match_command�s





c


Cs|jS(
N(
R*(
R((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pytget_commands�s
cCsct|
�
s't
tjt|
�
��
n|
|jkrI|jj|
�

nt
tjd
|
��
dS(NsUid "%s" already in whitelist(RR
RR8tstrR.R<R=(RR&((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR"�s



	
cCs<|
|jkr"|jj
|
�

nttjd
|
��
dS(NsUid "%s" not in whitelist.(R.R>R
RR?(RR&((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt
remove_uid�s

	
cCs
|
|jkS(
N(
R.(RR&((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pythas_uid�s
cCs
|
|jkS(
N(
R.(RR&((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt	match_uid�s
c


Cs|jS(
N(
R.(
R((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pytget_uids�s
cCs]t|
�
s!t
tj|
��
n|
|jkrC|jj|
�

nt
tjd
|
��
dS(NsUser "%s" already in whitelist(RR
RR7R-R<R=(RR((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR#�s



	
cCs<|
|jkr"|jj
|
�

nttjd
|
��
dS(NsUser "%s" not in whitelist.(R-R>R
RR?(RR((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pytremove_user�s

	
cCs
|
|jkS(
N(
R-(RR((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pythas_user�s
cCs
|
|jkS(
N(
R-(RR((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt
match_user�s
c


Cs|jS(
N(
R-(
R((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt	get_users�s
cCs]t|
�
s!t
tj|
��
n|
|jkrC|jj|
�

nt
tjd
|
��
dS(Ns!Context "%s" already in whitelist(R
R
RR6R,R<R=(RR((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR$"
s



	
cCs<|
|jkr"|jj
|
�

nttjd
|
��
dS(NsContext "%s" not in whitelist.(R,R>R
RR?(RR((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pytremove_context,
s

	
cCs
|
|jkS(
N(
R,(RR((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pythas_context3
s
cCs
|
|jkS(
N(
R,(RR((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt
match_context6
s
c


Cs|jS(
N(
R,(
R((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pytget_contexts9
s
c
Cs�|j�
|j
jd
�
s8ttjd|j
��
nt|�
}
tj�}|j	|
�

y|j
|j
�

Wn2tjk
r�
}
ttjd|j
���
n
X~
~tr�|j�
ndS(Ns.xmls'%s' is missing .xml suffixsNot a valid file: %s(R:R1RCR
RtINVALID_NAMERtsaxtmake_parsertsetContentHandlertparsetSAXParseExceptiontINVALID_TYPEtgetExceptionR
R;(RthandlerR3tmsg((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pytread>
s"



	








	





c
CsHtj
j|j�
reytj|jd
|j�
Wqetk
ra
}

td|j|
f�
�
qeXntj
jtj	�
s�tj
tj	d�
ntj|jdddd�
}t
|�
}|j�
|jdi�
|jd	�

xHt|j�
D]7}|jd
�

|jdi
|d6�
|jd	�

q�WxNt|j�
D]=}|jd
�

|jd
i
t|�
d6�
|jd	�

q<
WxHt|j�
D]7}|jd
�

|jd
i
|d6�
|jd	�

q�
WxHt|j�
D]7}|jd
�

|jdi
|d6�
|jd	�

q�
W|jd�

|jd	�

|j�
|j�
~dS(Ns%s.oldsBackup of '%s' failed: %si�
tmodetwttencodingsUTF-8Rs

s  RRRRRR(tostpathtexistsR1tshutiltcopy2t	ExceptiontIOErrorRt
ETC_FIREWALLDtmkdirtiotopenRt
startDocumentRtignorableWhitespaceRR*t
simpleElementR.RHR-R,t
endElementtendDocumenttclose(RR^t
fR]RR&RR((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pytwriteQ
sB




 





























N(#R'R(t__doc__tIMPORT_EXPORT_STRUCTUREtDBUS_SIGNATUREtADDITIONAL_ALNUM_CHARSR2tPARSER_REQUIRED_ELEMENT_ATTRStPARSER_OPTIONAL_ELEMENT_ATTRSRR4R:R;RR@RARFRGR"RIRJRKRLR#RMRNRORPR$RQRRRSRTR_Ru(((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyR)WsP




	






				
					
		
					
				1	
					(txml.saxRVRcRlRftfirewallRtfirewall.core.io.io_objectR
RRRtfirewall.core.loggerRtfirewall.functionsRRRR	R
RRtfirewall.errorsR
RR)(((sG/usr/lib/python2.7/site-packages/firewall/core/io/lockdown_whitelist.pyt<module>s



"
.
3