Class: Vangrail::FlowPolicy

Inherits:
Object
  • Object
show all
Defined in:
lib/vangrail/flow_policy.rb

Overview

Named, audited authority for integrity endorsement and sink declassification.

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(endorsements: {}, declassifications: {}, audit: nil) ⇒ FlowPolicy

Returns a new instance of FlowPolicy.



12
13
14
15
16
17
 
# File 'lib/vangrail/flow_policy.rb', line 12

def initialize(endorsements: {}, declassifications: {}, audit: nil)
  @endorsements = normalize_rules(endorsements, required: :integrity)
  @declassifications = normalize_rules(declassifications, required: :sinks)
  @audit = audit || AuditLog.new
  freeze
end

Instance Attribute Details

#audit ⇒ Object (readonly)

Returns the value of attribute audit.



10
11
12
 
# File 'lib/vangrail/flow_policy.rb', line 10

def audit
  @audit
end

Instance Method Details

#declassify(operation, cell, actor:) ⇒ Object 



35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/vangrail/flow_policy.rb', line 35

def declassify(operation, cell, actor:)
  rule = fetch_rule(@declassifications, operation)
  validate_actor!(actor, rule)
  validate_cell!(cell)

  label = Label.new(
    provenance: cell.origins + actor.origins,
    integrity: cell.integrity,
    confidentiality: rule.fetch(:sinks),
    capabilities: cell.capabilities,
  )
  Cell.new(cell.raw, label: label).tap do |output|
    audit.record(:declassification, operation: operation, actor: actor,
                                    input: cell, output: output)
  end
end

#endorse(operation, cell, actor:) ⇒ Object 



19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
 
# File 'lib/vangrail/flow_policy.rb', line 19

def endorse(operation, cell, actor:)
  rule = fetch_rule(@endorsements, operation)
  validate_actor!(actor, rule)
  validate_cell!(cell)

  label = Label.new(
    provenance: cell.origins + actor.origins,
    integrity: rule.fetch(:integrity),
    confidentiality: cell.confidentiality,
    capabilities: cell.capabilities,
  )
  Cell.new(cell.raw, label: label).tap do |output|
    audit.record(:endorsement, operation: operation, actor: actor, input: cell, output: output)
  end
end