Admin

name	type	size	perms	modified	actions
[parent directory]
__pycache__/	dir	-	0755	2026-08-19 08:35:27
__init__.py	file	2,585 B	0644	2026-02-17 00:00:00	edit
bool.py	file	2,651 B	0644	2026-02-17 00:00:00	edit
bounds.py	file	3,789 B	0644	2026-02-17 00:00:00	edit
commons.py	file	2,409 B	0644	2026-02-17 00:00:00	edit
conditional.py	file	1,256 B	0644	2026-02-17 00:00:00	edit
constraints.py	file	8,663 B	0644	2026-02-17 00:00:00	edit
context.py	file	1,382 B	0644	2026-02-17 00:00:00	edit
default.py	file	3,679 B	0644	2026-02-17 00:00:00	edit
descriptors.py	file	1,279 B	0644	2026-02-17 00:00:00	edit
difference.py	file	5,522 B	0644	2026-02-17 00:00:00	edit
fsuse.py	file	2,628 B	0644	2026-02-17 00:00:00	edit
genfscon.py	file	2,809 B	0644	2026-02-17 00:00:00	edit
ibendportcon.py	file	2,748 B	0644	2026-02-17 00:00:00	edit
ibpkeycon.py	file	2,769 B	0644	2026-02-17 00:00:00	edit
initsid.py	file	2,168 B	0644	2026-02-17 00:00:00	edit
mls.py	file	10,558 B	0644	2026-02-17 00:00:00	edit
mlsrules.py	file	4,740 B	0644	2026-02-17 00:00:00	edit
netifcon.py	file	3,198 B	0644	2026-02-17 00:00:00	edit
nodecon.py	file	2,742 B	0644	2026-02-17 00:00:00	edit
objclass.py	file	3,325 B	0644	2026-02-17 00:00:00	edit
polcap.py	file	1,177 B	0644	2026-02-17 00:00:00	edit
portcon.py	file	2,742 B	0644	2026-02-17 00:00:00	edit
properties.py	file	1,974 B	0644	2026-02-17 00:00:00	edit
rbacrules.py	file	6,647 B	0644	2026-02-17 00:00:00	edit
roles.py	file	2,869 B	0644	2026-02-17 00:00:00	edit
terules.py	file	25,488 B	0644	2026-02-17 00:00:00	edit
typeattr.py	file	3,010 B	0644	2026-02-17 00:00:00	edit
types.py	file	4,372 B	0644	2026-02-17 00:00:00	edit
typing.py	file	603 B	0644	2026-02-17 00:00:00	edit
users.py	file	5,475 B	0644	2026-02-17 00:00:00	edit

editing: users.py

# Copyright 2016, Tresys Technology, LLC
# Copyright 2018, Chris PeBenito <pebenito@ieee.org>
#
# SPDX-License-Identifier: LGPL-2.1-only
#
from collections import defaultdict
from dataclasses import dataclass

from ..exception import MLSDisabled
from ..policyrep import Level, Range, Role, User

from .descriptors import DiffResultDescriptor
from .difference import Difference, DifferenceResult, SymbolWrapper
from .mls import LevelWrapper, RangeWrapper
from .roles import role_wrapper_factory
from .typing import SymbolCache

_users_cache: SymbolCache[User] = defaultdict(dict)

@dataclass(frozen=True, order=True)
class ModifiedUser(DifferenceResult):

"""Difference details for a modified user."""

user: User
    added_roles: set[Role]
    removed_roles: set[Role]
    matched_roles: set[Role]
    added_level: Level | str | None
    removed_level: Level | str | None
    added_range: Range | str | None
    removed_range: Range | str | None

def user_wrapper_factory(user: User) -> SymbolWrapper[User]:
    """
    Wrap users from the specified policy.

This caches results to prevent duplicate wrapper
    objects in memory.
    """
    try:
        return _users_cache[user.policy][user]
    except KeyError:
        r = SymbolWrapper(user)
        _users_cache[user.policy][user] = r
        return r

class UsersDifference(Difference):

"""Determine the difference in users between two policies."""

def diff_users(self) -> None:
        """Generate the difference in users between the policies."""

self.log.info(
            f"Generating user differences from {self.left_policy} to {self.right_policy}")

self.added_users, self.removed_users, matched_users = self._set_diff(
            (user_wrapper_factory(r) for r in self.left_policy.users()),
            (user_wrapper_factory(r) for r in self.right_policy.users()))

self.modified_users = list[ModifiedUser]()

for left_user, right_user in matched_users:
            # Criteria for modified users
            # 1. change to role set, or
            # 2. change to default level, or
            # 3. change to range
            added_roles, removed_roles, matched_roles = self._set_diff(
                (role_wrapper_factory(r) for r in left_user.roles),
                (role_wrapper_factory(r) for r in right_user.roles))

# keep wrapped and unwrapped MLS objects here so there
            # are not several nested try blocks
            left_level_wrap: LevelWrapper | None
            left_range_wrap: RangeWrapper | None
            left_level: Level | str
            left_range: Range | str
            right_level_wrap: LevelWrapper | None
            right_range_wrap: RangeWrapper | None
            right_level: Level | str
            right_range: Range | str
            added_level: Level | str | None
            added_range: Range | str | None
            removed_level: Level | str | None
            removed_range: Range | str | None
            try:
                left_level_wrap = LevelWrapper(left_user.mls_level)
                left_range_wrap = RangeWrapper(left_user.mls_range)
                left_level = left_user.mls_level
                left_range = left_user.mls_range
            except MLSDisabled:
                left_level_wrap = None
                left_range_wrap = None
                left_level = "None (MLS Disabled)"
                left_range = "None (MLS Disabled)"

try:
                right_level_wrap = LevelWrapper(right_user.mls_level)
                right_range_wrap = RangeWrapper(right_user.mls_range)
                right_level = right_user.mls_level
                right_range = right_user.mls_range
            except MLSDisabled:
                right_level_wrap = None
                right_range_wrap = None
                right_level = "None (MLS Disabled)"
                right_range = "None (MLS Disabled)"

if left_level_wrap != right_level_wrap:
                added_level = right_level
                removed_level = left_level
            else:
                added_level = None
                removed_level = None

if left_range_wrap != right_range_wrap:
                added_range = right_range
                removed_range = left_range
            else:
                added_range = None
                removed_range = None

if added_roles or removed_roles or removed_level or removed_range:
                self.modified_users.append(ModifiedUser(left_user,
                                                        added_roles,
                                                        removed_roles,
                                                        matched_roles,
                                                        added_level,
                                                        removed_level,
                                                        added_range,
                                                        removed_range))

added_users = DiffResultDescriptor[User](diff_users)
    removed_users = DiffResultDescriptor[User](diff_users)
    modified_users = DiffResultDescriptor[ModifiedUser](diff_users)

#
    # Internal functions
    #
    def _reset_diff(self) -> None:
        """Reset diff results on policy changes."""
        self.log.debug("Resetting user differences")
        del self.added_users
        del self.removed_users
        del self.modified_users

cancel