File: //usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyc
�
��^c @ s� d d d d d d d d g Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d
l Td d l j
Z
d d l Z d d
l Td d
l
Td d
l Td d
l Td Z e � Z d � Z d
� Z e j d � Z d � Z e j d � Z d � Z d d l Z d � Z d e f d � � YZ d e f d � � YZ d e f d � � YZ d d d � � YZ d e f d � � YZ! d d d � � YZ" d S( t derive_record_formatt parse_audit_record_textt
AvcContextt AVCt AuditEventIDt
AuditEventt AuditRecordt AuditRecordReaderi����N( t *i c C s. t | � \ } } } } t | | | � } | S( N( R R ( t textt parse_succeededt record_typet event_idt body_textt audit_record( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt audit_record_from_text7 s c C s9 t j d | � r t j St j d | � r2 t j St j S( Ns /audispd_events$s /audit_events$( t ret searchR t TEXT_FORMATt
BINARY_FORMAT( t socket_path( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR > s
sL (node=(\S+)\s+)?(type=(\S+)\s+)?(msg=)?audit\(((\d+)\.(\d+):(\d+))\):\s*(.*)c
C s t } d } d } d } d } t j | � } | d k r� t } | j d � r` | j d � } n | j d � r� | j d � } n | j d � r� t | j d � � } t | j d � � } t | j d � � } t | | | | � } n | j d � } n | | | | f S( Ni i i i i i i
( t Falset Nonet audit_input_reR t Truet groupt intR (
t inputR
t hostR R R
t matcht secondst millit serial( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR W s& s% audit\(((\d+)\.(\d+):(\d+))\):\s*(.*)c C s� t } d } d } t j | � } | d k r� t } | j d � r� t | j d � � } t | j d � � } t | j d � � } t | | | � } n | j d � } n | | | f S( Ni i i i i ( R R t audit_binary_input_reR R R R R ( R R
R R
R R R R ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt parse_audit_binary_textt s c C sE | rA g | D] } | t j k r
| ^ q
} | | k rA t Sn t S( N( t stringt printableR R ( t st xt
filtered_path( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR$ � s
( c B ss e Z i i d d 6d 6i d d 6d 6i d d 6d 6i d d 6d 6Z d � Z d � Z d � Z d � Z d
� Z RS( t attributet XMLFormt usert rolet typet mlsc C s� t t | � j � t | � t k r� | j d � } t | � d k r� | d | _ | d | _ | d | _ t | � d k r� d j | d � | _
q� d | _
q� n d S( Nt :i i i i t s0( t superR t __init__R, t
StringTypet splitt lenR* R+ t joinR- ( t selft datat fields( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR1 � s
c C s d | j | j | j | j f S( Ns %s:%s:%s:%s( R* R+ R, R- ( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt __str__� s c C s t j t | � � \ } } | S( N( t selinuxt selinux_raw_to_trans_contextt str( R6 t rct trans( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt format� s c C s | j | � S( N( t __eq__( R6 t other( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt __ne__� s c C sF x? t | j j � � D]( } t | | � t | | � k r t Sq Wt S( N( t listt _xml_infot keyst getattrR R ( R6 RA t name( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR@ � s ( t __name__t
__module__RD R1 R9 R? RB R@ ( ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR � s
c B s� e Z i i d d 6e d 6d 6i d d 6e d 6d 6i d d 6e d 6d 6i d d 6d 6Z d d � Z d � Z d � Z d
� Z e d � � Z
d � Z d
� Z RS( R( R) t import_typecastR R R R c C sJ t t | � j � | | _ | | _ | | _ | d k rF | | _ n d S( N( R0 R R1 R R R R R ( R6 R R R R ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR1 � s c C s\ | j | j k r t S| j | j k r, t S| j | j k rB t S| j | j k rX t St S( N( R R R R R R ( R6 RA ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR@ � s c C s� | j | j k r: t d | j j | j | j f � � n t | j | j � } | d k r_ | St | j | j � } | d k r� | St | j | j � } | d k r� | Sd S( Ns? cannot compare two %s objects whose host values differ (%s!=%s)i ( R t
ValueErrort __class__RH t cmpR R R ( R6 RA t result( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt __cmp__� s " c C s d d l } | j | � S( Ni����( t copy( R6 RP ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyRP � s c C s t | j � | j d S( Ng @�@( t floatt secR ( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt <lambda>� s c C s d | j | j | j f S( Ns audit(%d.%d:%d)( R R R ( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR9 � s c C s= | j d k r t S| j d k r& t S| j d k r9 t St S( N( R R R R R R ( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt is_valid� s N(
RH RI R RD R R1 R@ RO RP t propertyt timeR9 RT ( ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR � s c B s e Z i i d d 6d 6i d d 6e d 6d 6i d d 6d 6i d d 6e d 6d 6Z d Z d Z e j e � Z e
j d
� Z e
j d � Z
e
j d � Z d d d
� Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z RS( R( R) R t elementRJ R R
t line_numberi t iiiis ([^ ]+)\s*=\s*([^ ]+)s$ avc:\s+([^\s]+)\s+{([^}]+)}\s+for\s+s ^a\d+$c C sN t t | � j � | | _ | | _ | | _ | | _ | | _ | j � d S( N( R0 R R1 R R R
R8 RX t _init_postprocess( R6 R R R
R8 RX ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR1 s c C s� t | d d � d k r+ | j | j � n | j d
k r� d | j k r� t j j | j � } | r� | j d � } | | j d <| j d � } | j
� | j d <q� q� n d S( NR8 R t USER_AVCt 1400t 1107t seresulti i t seperms( s AVCR[ R\ R] ( RF R t set_fields_from_textR
R R8 R t avc_reR R R3 ( R6 R R^ R_ ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyRZ
s
c C s
| j � S( N( t to_host_text( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR9 s c C s1 d | _ | j j d k r- t � | j _ n d S( N( R RX R R t get_hostname( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt audispd_rectify s c C s= | j j � s t S| j d k r& t S| j d k r9 t St S( N( R RT R R R t messageR ( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyRT s c C s d d d d d d d d d d
d d d
d d d g } xg | D]_ } | | j k r= | j d k rs | d k rs q= n | j | } t | � } | | j | <q= q= W| j d k rxa t | j j � � D]G \ } } | j j | � r� | j | } t | � } | | j | <q� q� Wn d S( Nt acctt cmdt commt cwdR7 t dirt exet fileR t keyt msgRG t newt ocommoldt patht watchR t saddrt EXECVE( R8 R t audit_msg_decodeRC t itemst exec_arg_reR ( R6 t encoded_fieldst fieldt valuet
decoded_value( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt
decode_fields& s
"
c C sI y: t j d d k r# | j d � St j | � j d � SWn | SXd S( Ni i t hexs utf-8( t syst version_infot decodet bytearrayt fromhex( R6 Rq ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt
translate_hex: s
c C sv g | _ i | _ x]t j j | � D]I} | j d � } | j d � } | j d � } y� | d k r� t j t | d � � } t j
| � } n | d k r� | j d � j d � s� | j | � } q� n | d k r y t
j t t | � � } Wq q Xn | d
k r<t j t | � t j � � } | r<| } q<n Wn t k
rPn X| | j | <| j j | � q% Wd S( Ni i t "t archi RG Rq Rh Rg Rk Ri t exitt syscall( s names paths comms cmds exes cwd( t
fields_ordR8 R t key_value_pair_ret finditerR t stript auditt audit_elf_to_machineR t audit_machine_to_namet
startswithR� t errnot errorcodet abst audit_syscall_to_namet audit_detect_machineRK t append( R6 R
R Rm Rz t it syscall_name( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR` I s4
c C s | j j | � S( N( R8 t get( R6 RG ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt get_fieldk s c C s1 t | � } t j t j t j t j | j | � S( N( R4 t structt packR t binary_header_formatt binary_versiont binary_header_sizeR ( R6 Rn t
msg_length( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt get_binary_headern s c C s� | j d k r d S| j d k rJ d | j | j d j | j � f } n d | j | j f } | d j g | j D] } d | | j | f ^ qs � d 7} | S( Nt R s# type=%s msg=%s: avc: denied { %s } t s type=%s msg=%s: s %s=%ss
( R8 R R R R5 t accessR� ( R6 t buft k( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt fields_to_texts s (>c C s d | j | j | j f S( Ns type=%s msg=%s: %s
( R R R
( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt to_text{ s c C sC | j j d k r5 d | j j | j | j | j f S| j � Sd S( Ns node=%s type=%s msg=%s: %s
( R R R R R
R� ( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyRb ~ s c C s' d | j | j f } | j | � | S( Ns %s: %s( R R
R� ( R6 t record( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt to_binary� s N( RH RI R R RD R� R� R� t calcsizeR� R t compileR� Ra Rw R R1 RZ R9 Rd RT R| R� R` R� R� R� R� Rb R� ( ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR � s2
" c B s/ e Z d Z d Z d � Z d � Z d � Z RS( i i c C s} | | _ d | _ d | _ | j | j k r< | j | _ n= | j | j k r] | j | _ n t d | | j j
f � � d S( NR� i s unknown record format (%s) in %s( t
record_formatt
_input_bufferRX R t feed_textt feedR t feed_binaryRK RL RH ( R6 R� ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR1 � s c c s t | � d k r d S| j | 7_ x� t r� t | j � t j k rJ d St j t j | j d t j !� \ } } } } t j | } t | j � | k r� d S| j t j | !} t | � \ } } }
| j | | _ | r( t j
| � | |
d d f Vq( q( Wd S( Ni ( R4 R� R R R� R� t unpackR� R" R� t audit_msg_type_to_nameR ( R6 t new_dataR� R� R R� t total_lenR R
R R
( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR� � s" "
$c c s� t | � d k r d S| j | 7_ d } | j j d | � } x� | d k r� | j d 7_ | d 7} | j | | !} t | � \ } } } } | r� | | | d | j f Vn | } | j j d | � } qC W| j | | _ d S( Ni s
i ( R4 R� t findRX R R ( R6 R� t startt endt lineR
R R R
( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR� � s
( RH RI R R R1 R� R� ( ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR � s
!c B s� e Z i i d d 6d d 6e d 6d 6i d d 6e d 6d 6Z d � Z d � Z d � Z d
d � Z d � Z e
d
� � Z d � Z d � Z
d d � Z d � Z d � Z d � Z d � Z d � Z RS( RW R) R RC RJ t recordsR c C s; t t | � j � d | _ g | _ i | _ d | _ d S( N( R0 R R1 R R R� t record_typest timestamp( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR1 � s
c C sI t | d d � d k r$ i | _ n x | j D] } | j | � q. Wd S( NR� ( RF R R� R� t process_record( R6 R� ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyRZ � s c
C s~ | j } | j � d | j | j � | j � d j g | D] } t | � ^ q; � d j g | j D] } d | ^ qc � f S( Ns2 %s: is_avc=%s, is_granted=%s: line_numbers=[%s]
%st ,s
s %s( t line_numberst sortR t is_avct
is_grantedR5 R< R� ( R6 R� R& R� ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR9 � s
%s
c C s) | j g | j D] } t | � ^ q � S( N( R5 R� R< ( R6 t separatorR� ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR? � s c C s
t | j � S( N( R4 R� ( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt num_records� s c C s& g | j D] } | j r
| j ^ q
S( N( R� RX ( R6 R� ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyRS � s c C s! | j j | � | j | � d S( N( R� R� R� ( R6 R� ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt
add_record� s c C s� | j d k rG | j j � | _ t | j j � | j j d | _ n1 | j | j k sx t d | j | j f � � n | j j | j
g � } | j | � d S( Ng @�@sB cannot add audit record to audit event, event_id mismatch %s != %s( R R RP RQ R R R� RK R� t
setdefaultR R� ( R6 R� t record_list( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR� � s &c C s| g } | d k r | j } n | j | � } xH | D]@ } | j j | � } | d k r^ q4 n | j | | j f � q4 W| S( sN Return list of (value, record_type) tuples.
In other words return the value matching name for every record_type.
If record_type is not specified then all records are searched.
Note: it is possible to have more than one record of a given type
thus it is always possible to have multiple values returned.N( R R� t get_records_of_typeR8 R� R� R, ( R6 RG R Rv R� R� Rz ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR� s
c C s/ d } | j j | � } | r+ | d } n | S( Ni ( R R� R� ( R6 R, R� R� ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt get_record_of_type s
c C s | j j | g � S( N( R� R� ( R6 R, ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR� $ s c C s: x3 d d d d g D] } | j | � } | r | Sq Wd S( NR R[ R\ R] ( R� ( R6 R R� ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt get_avc_record' s c C s | j � d k S( N( R� R ( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR� - s c C s` | j � } | d k r t S| j d } | d k r9 t S| d k rI t St j j d | � t S( NR^ t deniedt granteds! unknown value for seresult ('%s')( R� R R R8 R t logt avct warn( R6 t
avc_recordR^ ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR� 0 s
N( RH RI R R RD R1 RZ R9 R? R� RU R� R� R� R R� R� R� R� R� R� ( ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR � s" c B st e Z d g Z d d g Z d d d d d g Z d d d d d d g Z d d d d d d g Z d d d d g Z d
d d d d d d g Z d d
d d d d d d d d d d g Z d d d d d
d g Z
d d d d d
d d d d g Z d d d d d
d d d g Z d d
d d d d d d d d d
d d d d d g Z
d d d d g Z d d
g Z d g Z d g Z d d d
d d d g Z d d d
d d d d g Z d d d
d d d d g Z d d
d d d d d d d d
d d d d d d g Z d g Z d g Z d d d d d g Z d d d d d g Z d d d d d d g Z d d d d d d d g Z d d g Z d d
d d d d d d d d d d g Z e j d � Z e j d � Z! e" d � Z# d � Z$ d � Z% d � Z& d � Z' d � Z( d � Z) d � Z* d � Z+ d � Z, d! � Z- d" � Z. d# � Z/ d$ � Z0 d% � Z1 d& � Z2 d' � Z3 d( � Z4 d) � Z5 d* � Z6 RS(+ RF t executet opent readt lockt ioctlR� t linkt unlinkt renamet createt setattrt writeR t add_namet remove_namet reparentt rmdirt mountt remountt unmounts ^(\w+):\[([^\]]*)\]s ^(/proc/)(\d+)(.*)c C s� | | _ | | _ i | _ d | _ d | _ d | _ d | _ d | _ d | _ d | _
d | _ d | _ g | _
g | _ d | _ d | _ d | _ d | _ d | _ g | _ | j � d S( N( t audit_eventt query_environmentt template_substitutionsR t tpatht spatht sourcet
source_pkgR� t scontextt tcontextt tclasst portt src_rpmst tgt_rpmsR t pidt kmodR� t whyt boolst derive_avc_info_from_audit_event( R6 R� R� ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR1 e s* c C s
| j � S( N( t
format_avc( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR9 ~ s c C s_ d } | d | j 7} | d | j 7} | d | j 7} | d | j 7} | d | j 7} | S( NR� s scontext=%s s tcontext=%s s
access=%s s
tclass=%s s tpath=%s ( R� R� R� R� R� ( R6 R ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR� � s c C s; | j d k r t Sx! | j D] } | | k r t Sq Wt S( sM Returns true if the AVC contains _any_ of the permissions in the access list.N( R� R R R ( R6 t access_listt a( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt has_any_access_in� s c C s; | j d k r t Sx! | j D] } | | k r t Sq Wt S( sm Returns true if _every_ access in the AVC matches at
least one of the permissions in the access list.N( R� R R R ( R6 R� R� ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt all_accesses_are_in� s c
C s8 t � t � } | j � t � } | j � g } t t g i | j j t 6| j t
6| j t 6� } | sp g Sg g | D] } | d rz | ^ qz D] } | t
^ q� } | } x; | D]3 } | | k r� | j t t | � d d � q� q� Wx9 | D]1 } | | k r� | | k r&| j | � q&q� q� W| j � | S( Nt enabledi t types( t get_all_file_typest get_all_port_typesR� t get_all_attributesR t ALLOWR� R, t SOURCER� t CLASSR� t PERMSt TARGETt extendt infot ATTRIBUTER� (
R6 t all_typest all_attributest
allowed_typest allow_rulest yR& t wtypesR� t t( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt allowed_target_types� s&
3:
%
c C sP | j d g � rL y- | j r> t | j � t @t j k r> t SWqL qL Xn t S( NR� ( R� t a1R t O_ACCMODEt ost O_RDONLYR R ( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt open_with_write� s %c C s� y= t t | j � d } | j d g � } | j | d � Wn t k
r^ } | j g } n Xx5 | D]- } x$ | D] } t j | | � rs t Sqs Wqf Wt S( Ni t aliasesRG (
R t TYPER, R� R� t RuntimeErrorR R R R ( R6 t contextt type_listt _infot ctypest
IndexErrorR, R ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt __typeMatch� s
c C s& | j d k r t S| j | j | � S( s Returns true if the type in the source context of the
avc regular expression matches any of the types in the type list.N( R� R R t _AVC__typeMatch( R6 R ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt matches_source_types� s c C s& | j d k r t S| j | j | � S( s Returns true if the type in the target context of the
avc regular expression matches any of the types in the type list.N( R� R R R ( R6 R ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt matches_target_types� s c C s | j d k r t S| j | k S( N( R� R R ( R6 t tclass_list( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt
has_tclass_in� s c C s | j � | j � d S( N( t derive_environmental_infot% update_derived_template_substitutions( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt update� s
c C s | j d k r t S| j t k S( N( R� R R t standard_directories( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt path_is_not_standard_directory� s c C sR d } | j j d � } | j j d � } | j j d � } | d k r� | j j d � } xr | D]g } | j d � } | r� | d k r� qa n | j d � } | ra | ra | d k ra | j | � ra Pqa qa Wn | d k r^| j j d � } | d k r^| j j d � } | d k r$d | } q[| d
k rR| d k rE| } qXd | } q[| } q^n | d k rx| d k r�| r�g } yd } | j j d
� }
t j j d |
� r�t j d |
� j
} n t | � } t d d � } x� | j
� j d � D]� }
|
j � } t | � r�| d d d k r�yb | d k sZt j | d � j
| k r�t t j | d � j � | k r�| j | d � n Wq�t k
r�q�q�Xq�q�W| j � t | � d k r�| d d } n� t | � d k r�x� | D]� }
|
d d |
k s |
d |
k r-|
d } Pq�y: | d k rft j |
d � j
| k rf|
d } Pn Wq�t k
rzq�Xq�Wn Wqut k
r�d } qut k
r�d } quXqx| j d � t k rx| rxd d l } d d d | g } yx | j | d | j �} t | � } xM | j d � D]< } y, t t j | � j � | k rX| } Pn Wq'q'Xq'WWququXqxn | d k r�| j d � r�| j j d | � } q�| j j | � } | r�| j } q�n | | _ | j d k rN| j d k rd | _ qN| j d k s#| j d! k r<t! d" � | j" | _ qNt! d# � | _ n d S($ s� Derive the target path.
If path information is available the avc record will have a path field
and no name field because the path field is more specific and supercedes
name. The name field is typically the directory entry.
For some special files the kernel embeds instance information
into the file name. For example 'pipe:[1234]' or 'socket:[1234]'
where the number inside the brackets is the inode number. The proc
pseudo file system has the process pid embedded in the name, for
example '/proc/1234/mem'. These numbers are ephemeral and do not
contribute meaningful information for our reports. Plus we may use
the path information to decide if an alert is identical to a
previous alert, we coalesce them if they are. The presence of an
instance specific number in the path confuses this comparison.
For these reasons we strip any instance information out of the
path,
Example input and output:
pipe:[1234] --> pipe
socket:[1234] --> socket
/proc/1234/fd --> /proc/<pid>/fd
./foo --> ./foo
/etc/sysconfig --> /etc/sysconfig
RG Rq t inot PATHt objtypet PARENTR� Rl s %sRj t /i t devs /dev/s /proc/mountst rs
i i s /dev/%si s unknown mountpointi����Nt locates -bs \%st stderrs \1<pid>\3t
filesystemR� t
udp_sockett
tcp_sockets port %st Unknown(# R R� R� R� R� t endswithR Rq t existst lstatt st_rdevR R� R� R3 R4 t statt st_inoR� t OSErrort closet TypeErrorR� R t
subprocesst check_outputt STDOUTt proc_pid_instance_ret subt pipe_instance_path_reR R� R� t _R� ( R6 Rq RG t inodestrt avc_path_recordst avc_path_recordR R� t matchest dev_rdevR+ R& t fdR� R& R< t commandt outputRl R ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt
_set_tpath� s�
'
J
$
(
c C s d | _ d | _ d | _ d | _ t | _ g | _ d } } } } | j j � | _
| j j d � } | j
j d � | _
t | j t � s� t | j
j d � � | _ n t | j t � s� t | j
j d � � | _ n | j
j d � | _ | j
j d � d k r&| j
j d � | _ n | j
j d � | _ | j � | j
j d � | _ | j
j d � | _ | r�| j d
� } | j d � } | j d � | _ | j d
� d k | _ | j d � | _ n | d k r�| j
j d � } n | d k r| j
j d
� } n | | _ | r/| | _ n | rD| j | _ n | j s\| j | _ n | j sw| j j | _ n | j j d � } | r�| j d � } n d } | j j d � } xh | D]` } | j d � }
t j j |
� s�| r| j j |
� q�| j j t j j | |
� � q�Wg | _ g | _ | j j! j" | _" t# j$ t% | j � t% | j � t% | j � | j
� \ | _& } | j& t# j' k r�t( t) d � | j
� � n | j& t# j* k r�t( t) d � | j
� � n | j& t# j+ k r
t( t) d � � � n | j& t# j, k r8t( t) d � | j
� � n | j& t# j- k rft( t) d � | j
� � n | j& t# j- k r�t( t) d � | j
� � n | j& t# j. k r�t( t) d � | j
� � n | j& t# j/ k r�t( t) d � � � n | j& t# j0 k r| | _1 n d S( Nt SYSCALLR_ R� R� R� t destt srcR� R� Rk Rh R� t successt yesR t CWDRi R' RG s3 %s
**** Invalid AVC allowed in current policy ***
se %s
**** Invalid AVC dontaudited in current policy. 'semodule -B' will turn on dontaudit rules. ***
s Must call policy_init firsts- %s
**** Invalid AVC bad target context. ***
s- %s
**** Invalid AVC bad source context. ***
s( %s
**** Invalid AVC bad type class ***
s( %s
**** Invalid AVC bad permission ***
s& Error during access vector computation(2 R R� R� R� R R RO t
syscall_pathsR� R� R� R� R� R� t
isinstanceR� R R� R� R� RK R� R� R� R, R� R Rq t isabsR� R5 R� R� R R t audit2whyt analyzeR< R� R� RK RB t DONTAUDITt NOPOLICYt BADTCONt BADSCONt BADPERMt
BADCOMPUTEt BOOLEANR� ( R6 Rk Rh R� R� t syscall_recordt
cwd_recordRi t path_recordst path_recordRq R� ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR� � s�
# ? c C s� | j r} | j rF t | j � | _ | j rF | j j | j � qF n | j r} t | j � } | rz | j j | � qz q} n d S( N( R� R� t get_rpm_nvr_by_file_pathR� R� R� R� R� ( R6 t rpm( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR! � s c C s | j d k r | | _ n d S( N( R� R ( R6 Rq ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt set_alt_path� s c K s= x6 t | j � � D]" \ } } | r | | j | <q q Wd S( N( RC Rv R� ( R6 t kwdsRm Rz ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt set_template_substitutions� s c C s� t | j j � | j d <t | j j � | j d <t | j � | j d <t | j � | j d <| j r� t j d d t | j � � | j d <n t | j � | j d <| j r� t j d d t | j � � | j d <n | j d k r� d | j d
<ni | j d k r t | j � | j d
<nA | j d k rQt t j
j | j � � | j d
<n
d | j d
<t | j � | j d
<| j d k r�d | j d <n t d j | j � � | j d <t | j � | j d <t | j � | j d <d S( Nt SOURCE_TYPEt TARGET_TYPER� t SOURCE_PATHR� t .t FIX_SOURCE_PATHt TARGET_PATHt FIX_TARGET_PATHt
TARGET_DIRRj Rl t TARGET_CLASSt ACCESSt SOURCE_PACKAGEt PORT_NUMBER( t escape_htmlR� R, R� R� R� R� R R@ R� R R� R Rq t dirnameR� R5 R� R� ( R6 ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR" � s, ( (%
c C sR xK t | j j � � D]4 \ } } | d k r t t | � � | j | <q q Wd S( N( RC R� Rv R Rs t default_text( R6 Rm Rz ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt validate_template_substitutions s " (7 RH RI t stat_file_permst x_file_permst r_file_permst
rx_file_permst
ra_file_permst link_file_permst create_lnk_permst create_file_permst r_dir_permst rw_dir_permst ra_dir_permst create_dir_permst mount_fs_permst search_dir_permst getattr_dir_permst setattr_dir_permst list_dir_permst add_entry_dir_permst del_entry_dir_permst manage_dir_permst getattr_file_permst setattr_file_permst read_file_permst append_file_permst write_file_permst
rw_file_permst delete_file_permst manage_file_permsR R� RA R? R R1 R9 R� R� R� R
R R R R R R# R% RK R� R! Rd Rf R" Rv ( ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyR > sl !
� c
( ( (# t __all__R� R� R R� R R: t base64R� t selinux.audit2whyRU R~ t setroubleshoot.utilt setroubleshoot.html_utilt setroubleshoot.xml_serializet sepolicyR t get_standard_directoriesR$ R R R� R R R! R" R# R$ t XmlSerializeR R R R R R ( ( ( s? /usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.pyt <module> sH
(8�Lg