|
Server : Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 System : Linux localhost 2.6.18-419.el5 #1 SMP Fri Feb 24 22:47:42 UTC 2017 x86_64 User : nobody ( 99) PHP Version : 5.2.17 Disable Function : NONE Directory : /proc/21573/root/usr/lib/python2.4/site-packages/setroubleshoot/ |
Upload File : |
m
3Uc @ sD d d d d d d d d g Z d k Z d k Z d k Z d k Z d k Z d k Z d k Td k Td k Td k
Td k Te Z
d
Z d Z e i d Z d
Z e i d Z d Z d e f d YZ d e f d YZ d e f d YZ d f d YZ d e f d YZ d f d YZ d S( t derive_record_formatt parse_audit_record_textt
AvcContextt AVCt AuditEventIDt
AuditEventt AuditRecordt AuditRecordReaderN( t *c C s. t | \ } } } } t | | | } | S( N( R t textt parse_succeededt record_typet event_idt body_textR t audit_record( R R
R
R R R ( ( t= /usr/lib/python2.4/site-packages/setroubleshoot/audit_data.pyt audit_record_from_text3 s c C sC t i d | o t i Sn t i d | o t i Sn t i S( Ns /audispd_events$s /audit_events$( t ret searcht socket_pathR t TEXT_FORMATt
BINARY_FORMAT( R ( ( R R : s
sL (host=(\S+)\s+)?(type=(\S+)\s+)?(msg=)?audit\(((\d+)\.(\d+):(\d+))\):\s*(.*)c
C s t } d } d } d } d } t i | } | d j o t } | i d o | i d } n | i d o | i d } n | i d oX t
| i d } t
| i d } t
| i d } t | | | | } n | i d } n | | | | f S( Ni i i i i i i
( t FalseR
t Nonet hostR R R
t audit_input_reR t inputt matcht Truet groupt intt secondst millit serialR (
R R
R
R R R R R R! R ( ( R R S s&
s% audit\(((\d+)\.(\d+):(\d+))\):\s*(.*)c C s t } d } d } t i | } | d j o~ t } | i
d oU t | i
d } t | i
d } t | i
d } t | | | } n | i
d } n | | | f S( Ni i i i i ( R R
R R R
t audit_binary_input_reR R R R R R R R R! R ( R R
R
R R R R! R ( ( R t parse_audit_binary_textp s
c B s t Z h d h d d <<d h d d <<d h d d <<d h d d <<Z d Z d Z d Z d
Z d Z RS( Nt usert XMLFormt attributet rolet typet mlsc C s t t | i t | t j o | i d } t | d j oa | d | _
| d | _ | d | _ t | d j o d i | d | _
q d | _
q n d S( Nt :i i i i t s0( t superR t selft __init__R( t datat
StringTypet splitt fieldst lenR$ R' t joinR) ( R- R/ R2 ( ( R R. s
c C s d | i | i | i | i f S( Ns %s:%s:%s:%s( R- R$ R' R( R) ( R- ( ( R t __str__ s c C s t i t | \ } } | S( N( t selinuxt selinux_raw_to_trans_contextt strR- t rct trans( R- R: R9 ( ( R t format s c C s | i | S( N( R- t __eq__t other( R- R= ( ( R t __ne__ s c C sE x> | i i D]- } t | | t | | j o t Sq q Wt S( N( R- t _xml_infot keyst namet getattrR= R R ( R- R= RA ( ( R R< s
( t __name__t
__module__R? R. R5 R; R> R< ( ( ( R R s N
c B s t Z h d h d d <d e <<d h d d <d e <<d h d d <d e <<d h d d <<Z d d Z d Z d
Z d Z e d Z
d
Z d Z RS( NR R% R& t import_typecastR R! R c C sL t t | i | | _ | | _ | | _ | d j o
| | _ n d S( N( R, R R- R. R R R! R R ( R- R R R! R ( ( R R. s
c C sp | i | i j o t Sn | i | i j o t Sn | i | i j o t Sn | i | i j o t Sn t S( N( R- R R= R R R R! R ( R- R= ( ( R R< s c C s | i | i j o) t d | i i | i | i f n t | i | i } | d j o | Sn t | i | i } | d j o | Sn t | i
| i
} | d j o | Sn d S( Ns? cannot compare two %s objects whose host values differ (%s!=%s)i ( R- R R= t
ValueErrort __class__RC t cmpR t resultR R! ( R- R= RI ( ( R t __cmp__ s )
c C s
t i | S( N( t copyR- ( R- ( ( R RK s c C s t | i | i d S( Nf1000.0( t floatR- t secR ( R- ( ( R t <lambda> s c C s d | i | i | i f S( Ns audit(%d.%d:%d)( R- R R R! ( R- ( ( R R5 s c C sL | i d j o t Sn | i d j o t Sn | i d j o t Sn t S( N( R- R R R R R! R ( R- ( ( R t is_valid s (
RC RD R R? R R. R< RJ RK t propertyt timeR5 RO ( ( ( R R s i c B s+ t Z h d h d d <<d h d d <d e <<d h d d <<d h d d <d e <<Z d Z d
Z e i e Z e
i d Z e
i d Z
e
i d
Z d d d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z RS( NR R% R& R t elementRE R
t line_numberi t iiiis ([^ ]+)\s*=\s*([^ ]+)s$ avc:\s+([^\s]+)\s+{([^}]+)}\s+for\s+s ^a\d+$c C sN t t | i | | _ | | _ | | _ | | _ | | _ | i d S( N(
R, R R- R. R R R
R2 RS t _init_postprocess( R- R R R
R2 RS ( ( R R. s c C s t | d d d j o | i | i n | i d d g j oy | i i d pb t i i
| i } | oB | i d } | | i d <| i d } | i | i d <q q n d S( NR2 R t USER_AVCt seresulti i t seperms( RB R- R t set_fields_from_textR
R R2 t has_keyR t avc_reR R R RW RX R1 ( R- RW RX R ( ( R RU s
c C s
| i S( N( R- t to_host_text( R- ( ( R R5 s c C s3 d | _ | i i d j o t | i _ n d S( N( R R- RS R R t get_hostname( R- ( ( R t audispd_rectify s c C sL | i i p t Sn | i d j o t Sn | i d j o t Sn t S( N( R- R RO R R R t messageR ( R- ( ( R RO s c C s d d d d d d d d d d
d d d
d d d g } xo | D]g } | i i | oN | i d j o | d j o q= n | i | } t | } | | i | <q= q= W| i d j oa x^ | i i D]I \ } } | i
i | o* | i | } t | } | | i | <q q Wn d S( Nt acctt cmdt commt cwdR/ t dirt exet fileR t keyt msgRA t newt ocommoldt patht watchR t saddrt EXECVE( t encoded_fieldst fieldR- R2 RZ R t valuet audit_msg_decodet
decoded_valuet itemst exec_arg_reR ( R- Ro Rq Rp Rs ( ( R t
decode_fields s 6
c C sd h | _ xT t i i | D]@ } | i d } | i d } | i
d } | | i | <q Wd S( Ni i t "( R- R2 R t key_value_pair_ret finditerR
R R Rg Rq t strip( R- R
Rq Rg R ( ( R RY . s c C s | i i | S( N( R- R2 t getRA ( R- RA ( ( R t get_field7 s c C s1 t | } t i t i t i t i | i
| S( N( R3 Rh t
msg_lengtht structt packR t binary_header_formatt binary_versiont binary_header_sizeR- R ( R- Rh R} ( ( R t get_binary_header: s c C sj | i d j o d Sn | i i } | i d i g } | D] } | d | | i | f qB ~ S( Nt t s %s=%s( R- R2 R R@ t sortR4 t _[1]t k( R- R@ R R ( ( R t fields_to_text? s
c C s d | i | i | i f S( Ns type=%s msg=%s: %s
( R- R R R
( R- ( ( R t to_textE s c C sH | i i d j o' d | i i | i | i | i f Sn | i Sd S( Ns host=%s type=%s msg=%s: %s
( R- R R R R R
R ( R- ( ( R R\ H s 'c C s' d | i | i f } | i | | S( Ns %s: %s( R- R R
t recordR ( R- R ( ( R t to_binaryO s ( RC RD R R R? R R R~ t calcsizeR R t compileRx R[ Ru R R. RU R5 R^ RO Rv RY R| R R R R\ R ( ( ( R R s( `
c B s/ t Z d Z d Z d Z d Z d Z RS( Ni i c C s | | _ d | _ d | _ | i | i j o | i | _ n@ | i | i j o | i | _ n t d | | i
i f d S( NR i s unknown record format (%s) in %s( t
record_formatR- t
_input_bufferRS R t feed_textt feedR t feed_binaryRF RG RC ( R- R ( ( R R. Y s c c s t | d j o d Sn | i | 7_ x t o t | i t i j o d Sn t i t i | i d t i ! \ } }
} } t i | } t | i | j o d Sn | i t i | !} t | \ } } } | i | | _ | o t i | | | d d f Vq- q- Wd S( Ni ( R3 t new_dataR- R R R R R~ t unpackR R R R} t total_lenR R# R
R R
t auditt audit_msg_type_to_nameR ( R- R R
R R R R
R} R R R ( ( R R e s$ "
%c c s t | d j o d Sn | i | 7_ d } | i i d | } x | d j o | i d 7_ | d 7} | i | | !} t | \ } } } } | o | | | d | i f Vn | } | i i d | } qH W| i | | _ d S( Ni s
i ( R3 R R- R t startt findt endRS t lineR R
R R R
R ( R- R R
R R R R
R R ( ( R R s"
( RC RD R R R. R R ( ( ( R R U s
!c B s t Z h d h d d <d d <d e <<d h d d <d e <<Z d Z d Z d
Z d d Z d
Z e
d Z d Z d Z
d d Z d Z d Z d Z d Z d Z RS( Nt recordsR% RR t listR RE R c C s2 t t | i d | _ g | _ h | _ d S( N( R, R R- R. R R R t record_types( R- ( ( R R. s c C sK t | d d d j o
h | _ n x | i D] } | i | q0 Wd S( NR ( RB R- R R R R t process_record( R- R ( ( R RU s
c C s | i } | i d | i | i | i d i g } | D] } | t | q? ~ d i g } | i
D] } | d | qo ~ f S( Ns2 %s: is_avc=%s, is_granted=%s: line_numbers=[%s]
%st ,s
s %s( R- t line_numbersR R t is_avct
is_grantedR4 R t xR8 R R ( R- R R R R ( ( R R5 s
s
c C s1 | i g } | i D] } | t | q ~ S( N( t separatorR4 R R- R R R8 ( R- R R R ( ( R R; s c C s
t | i S( N( R3 R- R ( R- ( ( R t num_records s c C s3 g } | i D] } | i o | | i q q ~ S( N( R R- R R RS ( R- R R ( ( R RN s c C s! | i i | | i | d S( N( R- R t appendR R ( R- R ( ( R t
add_record s c C s | i d j o9 | i i | _ t | i i | i i d | _ n4 | i | i j p t d | i | i f n | i
i | i g } | i | d S( Nf1000.0sB cannot add audit record to audit event, event_id mismatch %s != %s( R- R R R RK RL R R t timestampRF R t
setdefaultR t record_listR ( R- R R ( ( R R s ' c C s g } | d j o
| i } n | i | } xJ | D]B } | i i | } | d j o q6 n | i | | i f q6 W| S( sN Return list of (value, record_type) tuples.
In other words return the value matching name for every record_type.
If record_type is not specified then all records are searched.
Note: it is possible to have more than one record of a given type
thus it is always possible to have multiple values returned.N(
Rt R R R- R t get_records_of_typeR R2 R{ RA Rq R R( ( R- RA R R Rt Rq R ( ( R R| s
c C s1 d } | i i | } | o | d } n | S( Ni ( R R R- R R{ R( R ( R- R( R R ( ( R t get_record_of_type s
c C s | i i | g S( N( R- R R{ R( ( R- R( ( ( R R s c C s- | i d } | p | i d } n | S( NR RV ( R- R R ( R- R ( ( R t get_avc_record s c C s | i d j S( N( R- R R ( R- ( ( R R s c C so | i } | d j o t Sn | i d } | d j o t Sn | d j o t Sn t i i
d | t S( NRW t deniedt granteds! unknown value for seresult ('%s')( R- R t
avc_recordR R R2 RW R t logt avct warn( R- RW R ( ( R R s
( RC RD R R R? R. RU R5 R; R RP R R R R R| R R R R R ( ( ( R R s E c B s/ t Z d g Z d d g Z d d d d g Z d d d d d g Z d d d d d g Z d d d d g Z d
d d d d d d g Z d
d d d d d d d d d d g Z d d d d
d g Z
d d d d
d d d d g Z d d d d
d d d g Z d
d d d d d d d d d
d d d d d g Z
d d d d g Z d d
g Z d g Z d g Z d d
d d d g Z d d
d d d d g Z d d
d d d d g Z d
d d d d d d d d
d d d d d d g Z d g Z d g Z d d d d g Z d d d d g Z d d d d d g Z d d d d d d g Z d d g Z d
d d d d d d d d d d g Z e i d Z e i d Z! e" d Z# d Z$ d Z% d Z& d Z' d Z( d Z) d Z* d Z+ d Z, d! Z- d" Z. d# Z/ d$ Z0 d% Z1 d& Z2 d' Z3 d( Z4 RS() NRB t executet readt lockt ioctlR t linkt unlinkt renamet createt setattrt writeR t add_namet remove_namet reparentt rmdirt mountt remountt unmounts ^(\w+):\[([^\]]*)\]s ^(/proc/)(\d+)(.*)c C s | | _ | | _ | i d j o t | i _ n h | _ d | _ d | _ d | _ d | _
d | _ d | _ d | _
d | _ d | _ g | _ g | _ d | _ | i d S( N( t audit_eventR- t query_environmentR R t TimeStampt template_substitutionst tpatht spatht sourcet
source_pkgt accesst scontextt tcontextt tclasst portt src_rpmst tgt_rpmsR t derive_avc_info_from_audit_event( R- R R ( ( R R. / s$ c C s
| i S( N( R- t
format_avc( R- ( ( R R5 D s c C s_ d } | d | i 7} | d | i 7} | d | i 7} | d | i 7} | d | i 7} | S( NR s scontext=%s s tcontext=%s s
access=%s s
tclass=%s s tpath=%s ( R R- R R R R R ( R- R ( ( R R G s c C sE | i d j o t Sn x& | i D] } | | j o t Sq" q" Wt S( sM Returns true if the AVC contains _any_ of the permissions in the access list.N( R- R R R t at access_listR ( R- R R ( ( R t has_any_access_inT s
c C sE | i d j o t Sn x& | i D] } | | j o t Sq" q" Wt S( sm Returns true if _every_ access in the AVC matches at
least one of the permissions in the access list.N( R- R R R R R R ( R- R R ( ( R t all_accesses_are_in^ s
c C s3 x, | D]$ } t i | | i o t Sq q Wt S( N( t type_listR( R R t contextR R ( R- R R R( ( ( R t __typeMatchi s
c C s+ | i d j o t Sn | i | i | S( s Returns true if the type in the source context of the
avc regular expression matches any of the types in the type list.N( R- R R R t _AVC__typeMatchR ( R- R ( ( R t matches_source_typeso s c C s+ | i d j o t Sn | i | i | S( s Returns true if the type in the target context of the
avc regular expression matches any of the types in the type list.N( R- R R R R R ( R- R ( ( R t matches_target_typesu s c C s% | i d j o t Sn | i | j S( N( R- R R R t tclass_list( R- R ( ( R t
has_tclass_in| s c C s | i | i d S( N( R- t derive_environmental_infot% update_derived_template_substitutions( R- ( ( R t update s
c C s% | i d j o t Sn | i t j S( N( R- R R R t standard_directories( R- ( ( R t path_is_not_standard_directory s c C sg d } d } | i i d } | d j o0 | i i d } | o | i d } q[ n | d j o | i i d } | d j oi | i i d } | d j o d | } q | d j o% | d j o
| } q d | } q | } q n | d j oY | i
d o | i i d | } qZ| i
i | } | o | i d
} qZn | | _ d S( s Derive the target path.
If path information is available the avc record will have a path field
and no name field because the path field is more specific and supercedes
name. The name field is typically the directory entry.
For some special files the kernel embeds instance information
into the file name. For example 'pipe:[1234]' or 'socket:[1234]'
where the number inside the brackets is the inode number. The proc
pseudo file system has the process pid embedded in the name, for
example '/proc/1234/mem'. These numbers are ephemeral and do not
contribute meaningful information for our reports. Plus we may use
the path information to decide if an alert is identical to a
previous alert, we coalesce them if they are. The presence of an
instance specific number in the path confuses this comparision.
For these reasons we strip any instance information out of the
path,
Example input and output:
pipe:[1234] --> pipe
socket:[1234] --> socket
/proc/1234/fd --> /proc/<pid>/fd
./foo --> ./foo
/etc/sysconfig --> /etc/sysconfig
Rk t AVC_PATHRA R Rf s ./%sRd t /s \1<pid>\3i N( R Rk RA R- R R| R R t avc_path_recordR t
startswitht proc_pid_instance_ret subt pipe_instance_path_reR R R R ( R- RA Rk R R R ( ( R t
_set_tpath s4
c C sO d | _ d | _ d | _ g | _ d } } } } | i
i | _ | i
i
d }
| i i d | _ t | i t p t | i i d | _ n t | i t p t | i i d | _ n | i i d | _ | i i d d j o | i i d | _ n | i i d | _ | i |
o |
i d } |
i d } |
i d
} |
i d } | d j oh | d j o[ t | d } t | } t i | t i | | _ t i | t i | | _ qd | _ n | d j o | i i d } n | d j o | i i d } n | | _ | o
| | _ n | o
| | _ n | i
i
d
} | o | i d } n d } | i
i d } xk | D]c } | i d } t" i! i# | p | o | i i$ | q| i i$ t" i! i% | | qWg | _& g | _' | i
i( i) | _) d S( Nt SYSCALLRX R R R t destt srcRe Rb t archt syscalli t CWDRc t PATHRA (* R R- R R R t
syscall_pathsRe Rb R R R R R R t syscall_recordR| R t
isinstanceR R R R R R R R t audit_syscall_to_namet audit_elf_to_machinet
cwd_recordRc R t path_recordst path_recordRk t ost isabsR R4 R R R R ( R- Re R R R Rb R Rk R Rc R ( ( R R sf
"
# c C s | i o} | i o7 t | i | _ | i o | i i | i qK n | i o. t | i } | o | i i | q q n d S( N(
R- R R t" get_rpm_nvr_by_file_path_temporaryR R R R t rpmR ( R- R ( ( R R s
c C s! | i d j o
| | _ n d S( N( R- R R Rk ( R- Rk ( ( R t set_alt_path, s c K s9 x2 | i D]$ \ } } | o | | i | <q
q
Wd S( N( t kwdsRt Rg Rq R- R ( R- R Rq Rg ( ( R t set_template_substitutions0 s
c C s t | i i | i d <t | i i | i d <t | i | i d <t | i | i d <t | i | i d <| i d j o d | i d <nn | i
d j o t | i | i d <nD | i
d j o& t t i i
| i | i d <n d | i d <t | i
| i d <| i d j o d | i d
<n t d i | i | i d
<t | i | i d <t | i | i d
<d S( Nt SOURCE_TYPEt TARGET_TYPEt SOURCEt SOURCE_PATHt TARGET_PATHt
TARGET_DIRRd Rf t TARGET_CLASSt ACCESSR t SOURCE_PACKAGEt PORT_NUMBER( t escape_htmlR- R R( R R R R R R R R Rk t dirnameR R4 R R ( R- ( ( R R 5 s$ &
c C sN xG | i i D]6 \ } } | d j o t t | | i | <q q Wd S( N( R- R Rt Rg Rq R R t default_text( R- Rq Rg ( ( R t validate_template_substitutionsQ s
(5 RC RD t stat_file_permst x_file_permst r_file_permst
rx_file_permst
ra_file_permst link_file_permst create_lnk_permst create_file_permst r_dir_permst rw_dir_permst ra_dir_permst create_dir_permst mount_fs_permst search_dir_permst getattr_dir_permst setattr_dir_permst list_dir_permst add_entry_dir_permst del_entry_dir_permst manage_dir_permst getattr_file_permst setattr_file_permst read_file_permst append_file_permst write_file_permst
rw_file_permst delete_file_permst manage_file_permsR R R R R R. R5 R R R R R R R R R R R R R R R R ( ( ( R R s` ' 3 3 '
K J ( t __all__R RK R R R~ R6 t typest setroubleshoot.logt setroubleshoot.utilt setroubleshoot.html_utilt setroubleshoot.xml_serializet get_standard_directoriesR R R R R R R" R# t XmlSerializeR R R R R R ( R6 R R~ R1 R R R R" R R R# R R RK R R R R R R ( ( R t ? s0 (7pLg