def AaEval.decide.mode

bend-osdev-apparmor@0.1.0.0 · eval.bend:161

import Base
import bend-osdev-apparmor@0.1.0.0/profile.bend as PR

161# cov: the grants cover the request; hit: a deny rule meets it; cd:
162# AaOptions.complain_deny; ok: the allowed outcome; no: the denied one
163def AaEval.decide.mode(m: PR.AaMode, cov: Bool, hit: Bool, cd: Bool, ok: AaDecision, no: AaDecision) -> AaDecision:
164  match m:
165    case PR.AaModeEnforce{}:
166      AaEval.choose(cov, ok, no)
167    case PR.AaModePrompt{}:
168      AaEval.choose(cov, ok, no)
169    case PR.AaModeKill{}:
170      AaEval.choose(cov, ok, AaKill{})
171    case PR.AaModeComplain{}:
172      AaEval.choose(cov, ok, AaEval.choose(Bool.and(cd, hit), no, AaComplain{}))
173    case PR.AaModeDefaultAllow{}:
174      AaEval.choose(hit, no, ok)
175    case PR.AaModeUnconfined{}:
176      AaAllow{}