1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
import itertools
""" an example of authz_buffer, sub_meta_rule_dict, rule_dict
authz_buffer = {
'subject_uuid': xxx,
'object_uuid': yyy,
'action_uuid': zzz,
'subject_attributes': {
'subject_category1': [],
'subject_category2': [],
...
'subject_categoryn': []
},
'object_attributes': {},
'action_attributes': {},
}
sub_meta_rule_dict = {
"subject_categories": ["subject_security_level", "aaa"],
"action_categories": ["computing_action"],
"object_categories": ["object_security_level"],
}
rule_dict = [
["high", "vm_admin", "medium", True],
["high", "vm_admin", "low", True],
["medium", "vm_admin", "low", True],
["high", "vm_access", "high", True],
["high", "vm_access", "medium", True],
["high", "vm_access", "low", True],
["medium", "vm_access", "medium", True],
["medium", "vm_access", "low", True],
["low", "vm_access", "low", True]
]
"""
def inclusion(authz_buffer, sub_meta_rule_dict, rule_list):
_cat = []
for subject_cat in sub_meta_rule_dict['subject_categories']:
if subject_cat in authz_buffer['subject_assignments']:
_cat.append(authz_buffer['subject_assignments'][subject_cat])
for action_cat in sub_meta_rule_dict['action_categories']:
if action_cat in authz_buffer['action_assignments']:
_cat.append(authz_buffer['action_assignments'][action_cat])
for object_cat in sub_meta_rule_dict['object_categories']:
if object_cat in authz_buffer['object_assignments']:
_cat.append(authz_buffer['object_assignments'][object_cat])
for _element in itertools.product(*_cat):
# Add the boolean at the end
_element = list(_element)
_element.append(True)
if _element in rule_list:
return True
return False
def comparison(authz_buffer, sub_meta_rule_dict, rule_list):
return
def all_true(decision_buffer):
for _rule in decision_buffer:
if decision_buffer[_rule] == False:
return False
return True
def one_true(decision_buffer):
for _rule in decision_buffer:
if decision_buffer[_rule] == True:
return True
return False
|
