|
Server : Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 System : Linux localhost 2.6.18-419.el5 #1 SMP Fri Feb 24 22:47:42 UTC 2017 x86_64 User : nobody ( 99) PHP Version : 5.2.17 Disable Function : NONE Directory : /proc/21573/root/usr/lib/python2.4/site-packages/setroubleshoot/ |
Upload File : |
m
3Uc @ s d d d d d d d g Z d k Z d k Z d k Z d k Z d k Z d k Td k Z d k Z d k
Z
d k Z d k Z d k
Td k l Z d k Td k Td k Td k Td k Td k Td k Td k Td
k l Z d e f d YZ d
e f d YZ d e f d YZ d e e i f d YZ d e f d YZ d e f d YZ! d e f d YZ" d e# e$ e% e i& f d YZ' e i( e' d e i& f d YZ) e i( e) d S( t
AnalyzeThreadt Analyzet PluginReportReceivert TestPluginReportReceivert SETroubleshootDatabaset SETroubleshootDatabaseLocalt LogfileAnalyzerN( t *( s
get_config( s validate_database_doct PluginStatisticsc B s> t Z d Z d Z d Z d Z d Z d Z RS( Nc C sF | i | _ d | _ d | _ d | _ d | _ d | _ d | _
d S( N( t plugint analysis_idt selft namet Nonet analyze_start_timet analyze_end_timet analyze_elapsed_timet report_start_timet report_end_timet report_elapsed_time( R R ( ( t: /usr/lib/python2.4/site-packages/setroubleshoot/analyze.pyt __init__: s c C st t | i } | i d j o d | i | f Sn= t | i | i } t | i } d | i | | | f Sd S( Ns %s: %s elapseds5 %s: %s elapsed, %s analyze elapsed, %s report elapsed( t format_elapsed_timeR R R R
R R R t total_elapsed_time( R R R R ( ( R t __str__C s c C s t i | _ d S( N( t timeR R ( R ( ( R t
analyze_startO s c C s& t i | _ | i | i | _ d S( N( R R R R R ( R ( ( R t analyze_endR s c C s t i | _ d S( N( R R R ( R ( ( R t report_startV s c C s& t i | _ | i | i | _ d S( N( R R R R R ( R ( ( R t
report_endY s ( t __name__t
__module__R R R R R R ( ( ( R R 9 s t AnalyzeStatisticsc B s> t Z d Z d Z d Z d Z d Z d Z RS( Nc C s: | | _ d | _ g | _ d | _ d | _ d | _ d S( N( t num_pluginsR R
t
cur_plugint called_pluginst
start_timet end_timet elapsed_time( R R! ( ( R R ` s c C s| d } d } t | i } | i d j o1 t | i } | o t | i | } q\ n d | | i | | | i f S( NsB %d/%d plugins in %s elapsed, avg plugin %s elapsed, plugins=[
%s
](
R
R& t avg_plugin_timet lenR R# t n_calledR R! t called_plugins_to_string( R R) R& R' ( ( R R h s c C s1 d i g } | i D] } | t | q ~ S( Ns
( t joint _[1]R R# t xt str( R R, R- ( ( R R* u s c C s t i | _ d S( N( R R R$ ( R ( ( R t startx s c C s& t i | _ | i | i | _ d S( N( R R R% R$ R& ( R ( ( R t end{ s c C s3 t | | _ | i i | i | i i d S( N( R R R R" R# t appendR ( R R ( ( R t
new_plugin s ( R R R R R* R/ R0 R2 ( ( ( R R _ s
c B s t Z d Z e d Z RS( Nc C s4 t | _ t o t i d t | i n d S( Ns Number of Plugins = %d( t load_pluginsR t pluginst debugt log_avcR( ( R ( ( R R s c C sR t o t i d | n | i t o# t t | i } | i
n x | i D] } t o | i | | i
i n yJ | i | } | d j o* t o | i
i n | i | Pn Wn9 t j
o- } t i d | i | i i | n Xt o | i
i qY qY Wt o! | i t i d t | n d S( Ns analyze_avc() avc=%ss Plugin Exception %s s* analyze_avc() audit_event=%s
statistics=%s( R5 R6 t avct updatet profileR R( R R4 t
statisticsR/ R R2 R" R t analyzet reportR
R t report_receivert report_problemt Exceptiont et exceptionR
t removeR0 t log_statst infot audit_event( R R7 R= t query_environmentR@ R R< R: ( ( R t analyze_avc s4
( R R R t TrueRG ( ( ( R R s c B s t Z d Z d Z RS( Nc C s* t i i | t i | | | _ d S( N( t threadingt ThreadR R R t queue( R RK ( ( R R s
c C sd x] t oU y) | i i \ } } | i | | Wq t j
o } t i
d | q Xq Wd S( Ns! Exception during AVC analysis: %s( RH R RK t getR7 R= RG R? R@ R6 RA ( R R@ R= R7 ( ( R t run s ( R R R RM ( ( ( R R s c B s t Z d Z d Z RS( Nc C s
| | _ d S( N( t databaseR ( R RN ( ( R R s c C s yN | i i | i } | i | | i i | t o t i d n Wnw t
j
ok } | i t
j oO t o t i d n | i i i | _ | i | _ | i i | } q n X| i d 7_ | S( Ns signature found in databases not in database yeti ( R RN t lookup_signaturet siginfot sigt database_siginfot update_merget modify_siginfoR5 t log_databaset ProgramErrorR@ t errnot ERR_NO_SIGNATURE_MATCHt sigst generate_local_idt local_idt last_seen_datet first_seen_datet add_siginfot report_count( R RP R@ RR ( ( R R> s
( R R R R> ( ( ( R R s c B s t Z d Z d Z RS( Nc C s t t | i | d S( N( t superR R R RN ( R RN ( ( R R s c C s d | i i GHd S( Ns Analysis Result: %s( RP RQ R
( R RP ( ( R R> s ( R R R R> ( ( ( R R s c B s t Z d d Z d Z d Z d Z d Z d Z d Z d Z
d Z d
Z d Z
d Z d
Z d Z d Z d Z d Z d Z d Z d d Z d Z d Z RS( Nc C s | | _ d | _ t | | | i | _ t i | _
t | _ d | _
d | _ d | _ d | _ t d d t | _ d | _ t d d } | d j o* | i } | o t | | _ q n t o, t i d | i i | i i | i i n | i d S( Ni i i RN t
max_alertst
max_alert_ages< created new database: name=%s, friendly_name=%s, filepath=%s( t filepathR R
t notifyt SEDatabasePropertiesR t
friendly_namet
propertiesRI t Lockt lockt Falset file_existst modified_countt auto_save_intervalt auto_save_thresholdt auto_save_timert
get_configt intRa Rb t stript parse_datetime_offsetR5 RU t load( R Rc R Rf Rb ( ( R R s(
#c C s | i p | i p t Sn | i i i d | i ot } | | i 8} d } x3 | i i D]% } | i | j o Pn | d 7} qe W| d j o t o t
i d | i | i t
i d | i i d i i | i i | d i i t
i d | i i | i i | i i d i i n | i i | | i _ qVn | i o_ t | i i | i } | d j o5 t o* t
i d | | i i | | i _ qqn d S( Nc C s t | i | i S( N( t cmpt aR\ t b( Rv Rw ( ( R t <lambda> s i i s5 prune by age: max_alert_age=%s min_time_to_survive=%ss prune by age: pruning [%s - %s]s prune by age: keeping [%s - %s]is prune first %d alerts( R Ra Rb Rj RY t signature_listt sortt TimeStampt min_time_to_survivet keepRP R\ R5 RU t formatR( ( R RP R} R| ( ( R t prune s:
c C s
| | _ d S( N( Rd R ( R Rd ( ( R t
set_notify" s c C s t | _ | i d j o d Sn t i i | i oT t i | i } | t
d j o- | i i | i d t o
t
| _ q q n | i d S( Ni RY ( t SEFaultSignatureSetR RY Rc R
t ost patht existst statt stat_infot ST_SIZEt
read_xml_filet validate_database_docRH Rk R ( R R ( ( R Rt % s c C s | i d j o d Sn t o t i d | i | i n | i | i i d | i t | _
d | _ | i d j o t i
| i d | _ n d S( Ns' writing database (%s) modified_count=%sRY i ( R Rc R
R5 RU Rl R RY t write_xmlRH Rk Ro t gobjectt
source_remove( R ( ( R t save3 s
c C s | i d 7_ | i d j o d Sn | i | i j p | i o | i n4 | i d j o# t i | i
d | i | _ n d S( Ni i ( R Rl Rc R
Rn Rk R Ro R t timeout_addRm t auto_save_callback( R ( ( R t
mark_modifiedC s c C s2 t o t i d | i | i n | i t S( Ns) auto_save database (%s) modified_count=%s( R5 RU R Rc Rl R Rj ( R ( ( R R O s
c C sd | i d j o d Sn t i i | i o2 t o t i d | i n t i | i n d S( Ns deleting database (%s)( R Rc R
R R R R5 RU RB ( R ( ( R RB V s c C s | i i d S( N( R Ri t acquire( R ( ( R R ^ s c C s | i i d S( N( R Ri t release( R ( ( R R a s c C s d } | i i | } t oH t i d t | d i
g } | D] } | d | i
qB ~ n t | d j o t t n$ t | d j o t t n | d i } | S( Ns1 lookup_signature: found %d matches with scores %st ,s %.2fi i ( R
RP R RY t match_signaturesRQ t matchesR5 t log_sigR( R+ R, R- t scoreRV RX t ERR_MULTIPLE_SIGNATURE_MATCH( R RQ RP R R, R- ( ( R RO d s ?
c C s` | i i | } t o n | d j o2 t o t i d | n t t d | n | S( Ns lookup_local_id: %s not founds id (%s) not found(
R RY t lookup_local_idR[ RP R5 R
RU RV t ERR_SIGNATURE_ID_NOT_FOUND( R R[ RP ( ( R R r s
c C sD | i i | } | i o | i i d | i n | i | S( Nt add( R RY R^ RP Rd t signatures_updatedR[ R ( R RP ( ( R R^ } s
c C s | i S( N( R Rg ( R ( ( R t get_properties s c C s\ t o t i d | n | d j o | i Sn t } | i | } | i | | S( Ns query_alerts: criteria=%sR ( R5 RU t criteriaR RY R R RP R^ ( R R RP RY ( ( R t query_alerts s
c C sl t o t i d | n | i | } | i i | | i o | i i d | i
n | i d S( Ns delete_signature: sig=%st delete( R5 RU RQ R RO RP RY t remove_siginfoRd R R[ R ( R RQ RP ( ( R t delete_signature s
c C s2 | i o | i i d | i n | i d S( Nt modify( R Rd R RP R[ R ( R RP ( ( R RT s
c C s@ t o t i d | | n | i | } | i | } | S( Ns) evaluate_alert_filter: username=%s sig=%s( R5 RU t usernameRQ R RO RP t evaluate_filter_for_usert action( R RQ R RP R ( ( R t evaluate_alert_filter s
c C sc t o t i d | | | | n | i | } | i | } | i | | | i | d S( Ns2 set_user_data: username=%s item=%s data=%s sig=
%s(
R5 RU R t itemt dataRQ R RO RP t
get_user_datat user_datat update_itemRT ( R RQ R R R RP R ( ( R t
set_user_data s t c C sT t o t i d | | | n | i | } | i | | | | i
| d S( Ns. set_filter: username=%s filter_type=%s sig=
%s( R5 RU R t filter_typeRQ R RO RP t update_user_filterR RT ( R RQ R R R RP ( ( R t
set_filter s c C s& | i i i | | _ | i d S( N( R RY t userst add_userR t userR ( R R ( ( R R s c C s | i i i | S( N( R RY R t get_userR ( R R ( ( R R s ( R R R
R R R Rt R R R RB R R RO R R^ R R R RT R R R R R ( ( ( R R s, %
c B s t Z h d e i e i e i e i f f <d e i e i e i e i e i f f <Z d Z d Z
d Z d Z RS( NR s async-errorc C s: t i i | t i | | | _ | i i | d S( N( R t GObjectR R t RpcManageRN R ( R RN ( ( R R s
c C s | i i | d S( N( R RN R Rd ( R Rd ( ( R R s c
G sO t oP t i d | i i | i d i g } | D] } | t | q0 ~ | n | i
| } t | i | i d } | d j o& t t d | i | i i f n y? | | | _ d | _ | i d j o | i g | _ n Wn3 t j
o' } | i | i g | _ d | _ n X| i d j o t i | i | n d S( Ns %s emit %s(%s) id=%sR s' method %s not found in base class of %st
method_returnt error_return( R5 t log_rpcR t __class__R t rpc_deft methodR+ R, t argst argR. t rpc_idt async_rpc_cachet async_rpct getattrRN R
t funcRV t ERR_METHOD_NOT_FOUNDt return_argst return_typeR@ RW t strerrorR t idle_addt process_async_return(
R R t typeR R R R, R R R@ ( ( R t emit_rpc s$ >
c C s5 t o t i d | | n | i d | | d S( Ns4 signatures_updated() database local: type=%s item=%sR ( R5 R R R R t emit( R R R ( ( R R s (
R R R t SIGNAL_RUN_LASTt TYPE_NONEt
TYPE_PYOBJECTt TYPE_STRINGt TYPE_INTt __gsignals__R R R R ( ( ( R R s
T c B s t Z h d e i e i e i f f <d e i e i e i f f <Z d d Z d d Z
d Z d Z d Z
d Z d Z RS(
Nt progresss
state-changedc C s t i i | t o t i d | i i | n | | _ d | _
d | _ d | _ d | _
d | _ d | _ d | _ d | _ d | _ d | _ d S( Ns %s.__init__(%s)i ( R R R R R5 R6 R R t logfile_pathR
t filet filenot read_sizet
record_readert record_receivert analyzerR= t idle_proc_idRW R ( R R ( ( R R s c C s | d j o
| | _ n t o t i d | i i | i n yG t i | i } | t
| _ t | i | _
| i
i | _ Wn] t j
oQ } t i d | i i | i | i | _ | i | _ | i d d t Sn Xd | _ d | _ d | _ d | _ t | _ | i d | i t i i | i } d t i i | d | _ t d | d | i | _! t" t" i# | _$ t% | _& t' | _( t) d
d t* p t+ | i! | _, n t- | i! | _, t. S( Ns %s.open(%s)s %s.open()s
state-changedt stoppedi f0.0R s file: %sRf t testR; (/ R R
R R5 R6 R R R R R R t file_sizet openR R t EnvironmentErrorR@ t errorR RW R Rj t n_bytes_readt
line_countt record_countR t cancelledR t basenamet logfile_basenamet splitextRf R RN t AuditRecordReadert TEXT_FORMATR t AuditRecordReceiverR R R Rp t boolR R= R RH ( R R R R R@ ( ( R R s>
c C sF t o t i d | i i | i n t i | i i | _
t S( Ns
%s.run(%s)( R5 R6 R R R R R R t taskt nextR RH ( R ( ( R RM @ s c C s | i d j o. t i | i | i } d | _ d | _ n | i | i j oB d | i | i | i
f } t i
| t i | _ | | _ n | i d j o+ x( | i i D] } | i | q Wn | i p | i d d n d S( NsF failed to read complete file, %d bytes read out of total %d bytes (%s)R f1.0( R R R
R t readR R t new_dataR R R R R6 t warnt Errnot EIORW R t closeRE t avc_event_handlerR R ( R R RE R ( ( R R F s
c c s | i d d xX| i oMyU t i | i | i } | d j o, t o t i d | i n | i
n WnK t j
o? } | i
| _
| i | _ | i
| i d d t Vn X| i t | 7_ t | i t | i | _ | i d | i xX | i i | D]D \ } } } } } | i | | | | | t V| i o t VqqWt Vq W| i d d t Vd S( Ns
state-changedt runningR s EOF on %sR R ( R R R R R R R R5 R6 R R R R@ RW R Rj R R( t floatR R R t feedt record_typet event_idt body_textt fieldst line_numbert new_audit_record_handlerRH R ( R R R R@ R R R R ( ( R R [ s6
c C sv t o t i d | n | i oJ | i o< | i d j o) t | } | i i
| | i t n d S( Ns" avc_event_handler() audit_event=%si (
R5 R6 RE t is_avct
is_grantedt num_recordst AVCR7 R R RG R= Rj ( R RE R7 ( ( R R x s
. c C sv t o t i d | | | n | i d 7_ t | | | | | } x' | i i | D] } | i | q[ Wd S( s" called to enter a new audit recordsB new_audit_record_handler() record_type=%s event_id=%s body_text=%si N( R5 R6 R R R R R t AuditRecordR R t audit_recordR R RE R ( R R R R R R RE R ( ( R R s ( R R R R R t
TYPE_FLOATR R R
R R RM R R R R ( ( ( R R s B & (* t __all__RW R R R t Queuet signalR t ret sysR RI t commandst typest setroubleshoot.configRp t setroubleshoot.avc_auditt setroubleshoot.errcodet setroubleshoot.logt setroubleshoot.rpct setroubleshoot.rpc_interfacest setroubleshoot.signaturet setroubleshoot.utilt setroubleshoot.audit_datat setroubleshoot.xml_serializeR t objectR R R RJ R R R R R t SETroubleshootDatabaseInterfacet% SETroubleshootDatabaseNotifyInterfaceR R t
type_registerR ( R R R R R R R R
R R R R R Rp R R R R RI R R R ( ( R t ? sB
&')
"1