File: //lib64/python2.7/site-packages/setroubleshoot/access_control.pyc
�
�3�Zc @ sK d Z d d l Z d d l Z d d l Z d d l m Z d g Z y
e j Z Wn� e k
r3d d l
Z
d d l Z e
j � d Z
e j d e
� r� d Z q4e j d e
� r� d Z q4e j d e
� r� d
Z q4e j d e
� r� d Z q4e j d
e
� rd Z q4e j d e
� r*d Z q4d Z n Xd d d � � YZ d S( s� Access control for setroubleshoot. For now this is only used for
determining which users are allowed to connect to the server: see
UserServerAccess for more information.i����N( t
get_configt ServerAccessi s ^i\d86i s ^x86_64s ^(ppc|powerpc)i s
^(alpha|mips)i s ^sparci@ s ^parisci@ c B so e Z d Z i i e d 6d 6i e d 6d 6Z d � Z d � Z d � Z d � Z d � Z
d � Z d
� Z RS( sg
Determine if a user should be given access to the server based
on the configuration file.
t wildcardt clientt fix_cmdc C sC i | _ x3 t t j j � � D] } | j | � | j | <q Wd S( N( t
privilegest listR t keyst init_privilege( t selft privilege( ( sC /usr/lib64/python2.7/site-packages/setroubleshoot/access_control.pyt __init__D s c C s9 g t d d | � j d � D] } | j � ^ q } | S( Nt accesss %s_userst ,( R t splitt strip( R R
t namet cfg_names( ( sC /usr/lib64/python2.7/site-packages/setroubleshoot/access_control.pyR O s 2c C s4 | t j k } | r t St j t j d | � t S( Ns unknown access privilege (%s)( R R t Truet syslogt LOG_ERRt False( R R
t valid( ( sC /usr/lib64/python2.7/site-packages/setroubleshoot/access_control.pyt valid_privilegeT s
c C s9 | j | � s t St j | d s( t Sd | j | k S( NR t *( R R R R ( R R
( ( sC /usr/lib64/python2.7/site-packages/setroubleshoot/access_control.pyt unrestricted_privilegeZ s
c C sE | j | � s t S| j | � r& t S| | j | k r= t St Sd S( s�
Determine if the given user name is allowed access.
Returns True if access should be given, False if not.
N( R R R R R ( R R
t user( ( sC /usr/lib64/python2.7/site-packages/setroubleshoot/access_control.pyt user_alloweda s c C sn | j | � s t S| j | � r& t Sy d d l } | j | � } Wn t k
rY t SX| j | | d � S( s�
Determine if the given uid is allowed access. No error
is returned if the uid is invalid (False is returned).
Returns True if access should be given, False if not.
i����Ni ( R R R R t pwdt getpwuidt KeyErrorR ( R R
t uidR t pwd_entry( ( sC /usr/lib64/python2.7/site-packages/setroubleshoot/access_control.pyt uid_allowedo s
c
C s d } } } y& | j } | t j k r3 | | f SWn t k
rG n Xd } t j | � } yv | j t j t | � } t j
| | � \ } } } | d k r� d } n | d k r� d } n | d k r� d } n Wn8 t k
r
} d } } } t j t j
d | � n X| | f S( s� Obtain the effective user and group IDs of the process on
the other end of a socket. SO_PEERCRED is used so the information
returned is generally trustworthy (though root processes can
impersonate any uid/gid).t IIIi����s get_credentials(): %sN( t Nonet familyt Sockett AF_UNIXt AttributeErrort structt calcsizet
getsockoptt
SOL_SOCKETt SO_PEERCREDt unpackt ExceptionR R (
R t sockt pidR t gidR$ t format_ucredt sizeof_ucredt ucredt e( ( sC /usr/lib64/python2.7/site-packages/setroubleshoot/access_control.pyt get_credentials� s,
(
t __name__t
__module__t __doc__R R R R R R R R R! R6 ( ( ( sC /usr/lib64/python2.7/site-packages/setroubleshoot/access_control.pyR : s ( ( R9 R( t socketR% R t setroubleshoot.configR t __all__R, R' t ost ret unamet machinet searchR ( ( ( sC /usr/lib64/python2.7/site-packages/setroubleshoot/access_control.pyt <module> s2