3
n`h @ s d dl mZ dddddddgZd d lZd d
lmZmZ d d lZd d lZd d l Z d d l
Z
d d l Z d d l T d d l
Z
d d lmZ d d
lmZ d d lT d d lT d d lT d d lT d d lT d d lT d d lT d dlmZ dd ZG dd de Z G dd de Z G dd de Z G dd de e
j Z!G dd de Z"G dd de Z#G dd de Z$G dd de%e&e'ejZ(ej)e( G dd dejZ*ej)e* d S ) )print_function
AnalyzeThreadAnalyzePluginReportReceiverTestPluginReportReceiverSETroubleshootDatabaseSETroubleshootDatabaseLocalLogfileAnalyzerN)GObjectGLib)*)
cmp_to_key)
get_config)validate_database_docc C s | |k| |k S )N )xyr r /usr/lib/python3.6/analyze.py4 s r c @ s< e Zd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
S )PluginStatisticsc C s0 |j | _d | _d | _d | _d | _d | _d | _d S )N) analysis_idnameanalyze_start_timeanalyze_end_timeanalyze_elapsed_timereport_start_timereport_end_timereport_elapsed_time)selfpluginr r r __init__= s zPluginStatistics.__init__c C sR t | j}| jd kr"d| j|f S t | j| j }t | j}d| j|||f S d S )Nz%s: %s elapsedz5%s: %s elapsed, %s analyze elapsed, %s report elapsed)format_elapsed_timer r r r r )r r Ztotal_elapsed_timer r r r __str__F s
zPluginStatistics.__str__c C s t j | _d S )N)timer )r r r r
analyze_startR s z PluginStatistics.analyze_startc C s t j | _| j| j | _d S )N)r# r r r )r r r r analyze_endU s
z PluginStatistics.analyze_endc C s t j | _d S )N)r# r )r r r r report_startY s z PluginStatistics.report_startc C s t j | _| j| j | _d S )N)r# r r r )r r r r
report_end\ s
zPluginStatistics.report_endN) __name__
__module__ __qualname__r r" r$ r% r& r' r r r r r ; s r c @ s< e Zd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
S )AnalyzeStatisticsc C s( || _ d | _g | _d | _d | _d | _d S )N) num_plugins
cur_plugincalled_plugins
start_timeend_time elapsed_time)r r, r r r r e s zAnalyzeStatistics.__init__c C sP d }d }t | j}| jd k r8t| j}|r8t| j| }d|| j||| j f S )NzB%d/%d plugins in %s elapsed, avg plugin %s elapsed, plugins=[
%s
])lenr. r1 r! r, called_plugins_to_string)r r1 Zavg_plugin_timeZn_calledr r r r" m s
zAnalyzeStatistics.__str__c C s dj dd | jD S )N
c S s g | ] }t |qS r )str).0r r r r
{ s z>AnalyzeStatistics.called_plugins_to_string..)joinr. )r r r r r3 z s z*AnalyzeStatistics.called_plugins_to_stringc C s t j | _d S )N)r# r/ )r r r r start} s zAnalyzeStatistics.startc C s t j | _| j| j | _d S )N)r# r0 r/ r1 )r r r r end s
zAnalyzeStatistics.endc C s& t || _| jj| j | jj d S )N)r r- r. appendr$ )r r r r r
new_plugin s
z AnalyzeStatistics.new_pluginN) r( r) r* r r" r3 r9 r: r< r r r r r+ c s
r+ c @ s. e Zd Zdd Zdd Zdd Zd dd Zd
S ) r c C s t | _tdt| j d S )NzNumber of Plugins = %d)Z load_pluginsplugins log_debugr2 )r r r r r s zAnalyze.__init__c C s t }|r|j |S )N)Z
SEEnvironmentupdate)r query_environment environmentr r r get_environment s zAnalyze.get_environmentc C s$ t |j|j|j|j|j|jd}|S )N)hostaccessscontexttcontexttclasstpath)ZSEFaultSignaturerC rD rE rF rG rH )r avcrA sigr r r
get_signature s
zAnalyze.get_signatureTc C s t d| |j | j|j}ddlm} |jjd k rD|jjj t |j|j
|j |j |j
|j|j|j|j|j|j| j||||jjt|jj|j dd}x | jD ]}y|j|}|d k rD|jdkrt d d S |jd k o|jdkr|jdks|jd kr|j|_t|t r8x(|D ]} |j j | q W n |j j | W q t k
r }
zVt |
t!j"d
t#j#t#j$d |j% t!j& \} } }
t d j't(j)|
| jj*| W Y d d }
~
X qX qW |j+| d S )
Nzanalyze_avc() avc=%sr )TemplateZyellow) audit_eventsourcespathrH Z src_rpm_listZ tgt_rpm_listrE rF rG portrC rJ rA line_numberslast_seen_datelocal_idlevelZwhitez!plugin level white, not reportingZredZgreen)filezPlugin Exception %s r4 ),r> r? rB r@ stringrL rM rQ sortZSEFaultSignatureInforN rO rH Zsrc_rpmsZtgt_rpmsrE rF rG rP rC rK TimeStampZ timestamp generate_idr= analyzerT
isinstancelistZ plugin_listr; ExceptionprintsysstderrsyslogLOG_ERRr exc_infor8 traceback format_tbremovereport_problem)r rI report_receiverr@ rA rL siginfor ZreportreZv1Zv2Zv3r r r analyze_avc sZ
"zAnalyze.analyze_avcN)T)r( r) r* r rB rK rl r r r r r s
c @ s e Zd ZdddZdd ZdS )r
c C s& t jj| tj| || _|| _d S )N) threadingThreadr r queuetimeout)r rp rq r r r r s
zAnalyzeThread.__init__c C s xy6| j j \}}tjtjd tjd | j|| W nf tk
rl } ztjtjd| W Y d d }~X n4 t k
r } ztjtjd| W Y d d }~X nX tjtjdj
| j tj| j qW d S )Nz)AnalyzeThread.run(): Cancel pending alarmr z!Exception during AVC analysis: %sz,AnalyzeThread.run(): Set alarm timeout to {}) rp getra Z LOG_DEBUGsignalalarmrl r] rb
ValueErrorformatrq )r rI rh rk r r r run s
"$zAnalyzeThread.runN)rm )r( r) r* r rw r r r r r s
c @ s$ e Zd Zdd Zdd Zdd ZdS )r c C s
|| _ d S )N)database)r rx r r r r s z PluginReportReceiver.__init__c C s y0| j j|j}|j| | j j| td W nL tk
r| } z0|jtkrjtd |j |_
| j j |}n W Y d d }~X nX |S )Nzsignature found in databaseznot in database yet) rx lookup_signaturerJ Z update_mergemodify_siginfor> ProgramErrorerrnoERR_NO_SIGNATURE_MATCHrR first_seen_date add_siginfo)r ri Zdatabase_siginfork r r r rg s
z#PluginReportReceiver.report_problemc C s | j jj S )N)rx sigsZgenerate_local_id)r r r r rY s z PluginReportReceiver.generate_idN)r( r) r* r rg rY r r r r r s c s$ e Zd Z fddZdd Z ZS )r c s t t| j| d S )N)superr r )r rx ) __class__r r r s z!TestPluginReportReceiver.__init__c C s t d|jj d S )NzAnalysis Result: %s)r^ rJ r )r ri r r r rg s z'TestPluginReportReceiver.report_problem)r( r) r* r rg
__classcell__r r )r r r s c @ s e Zd Zd2ddZdd Zdd Zdd Zd
d Zd3d
dZd4ddZ dd Z
dd Z dd Z dd Z
dd Zdd Zd d Zd d Zd!d" Zd5d#d$Zd%d& Zd'd( Zd)d* Zd6d,d-Zd.d/ Zd0d1 ZdS )7r Nc C s || _ d | _t||| j | _tj | _d| _d| _d| _ d| _
d | _ t ddt
| _d | _t dd}|d k r|j }|rt|| _td| jj| jj| jj f | j d S ) NFr rx
max_alerts
max_alert_agez r
friendly_nameload)r r r r r r r r r $ s$
z SETroubleshootDatabase.__init__c C s | j p
| jsdS | jjjtdd d | jr t }|| j8 }d}x$| jjD ]}|j|kr^P |d7 }qNW |dkr td| j|j f td| jjd jj | jj|d jj f td | jj| jj | jjd jj f d
d | jjd | D }x |D ]}| j
|d d
qW | j rt | jj| j }|dkrdd | jjd | D }td|t ||f x |D ]}| j
|d d
qxW d S )NFc S s t | j|jS )N)cmprR )abr r r r ? s z.SETroubleshootDatabase.prune..)keyr z5prune by age: max_alert_age=%s min_time_to_survive=%sz prune by age: pruning [%s - %s]z prune by age: keeping [%s - %s]c S s g | ]
}|j qS r )rJ )r6 ri r r r r7 O s z0SETroubleshootDatabase.prune..T)prunec S s g | ]
}|j qS r )rJ )r6 ri r r r r7 V s z*prune first %d alerts, len(sigs=%d sigs=%s) r r r signature_listrW r
rX rR r> rv delete_signaturer2 )r Zmin_time_to_surviveZkeepri r rJ r r r r : s2
0,
z SETroubleshootDatabase.prunec C s
|| _ d S )N)r )r r r r r
set_notify[ s z!SETroubleshootDatabase.set_notifyc C s6 x0| j jD ]$}|j|jk r
|j}|j|_||_q
W d S )N)r r rR r~ )r ri Ztmpr r r validate^ s
z SETroubleshootDatabase.validatec C sh t | _| jd krd S tjj| jrTtj| j}|t dkrT| jj| jdt rTd| _
| j | j d S )Nr r T)
SEFaultSignatureSetr r ospathexistsstatST_SIZEZ
read_xml_filer r r r )r stat_infor r r r f s
zSETroubleshootDatabase.loadFc C sj | j d krd S td| j | jf |s.| j | jjd| j d| _d| _| jd k rftj | j d | _d S )Nz'writing database (%s) modified_count=%sr Tr )
r r> r r r Z write_xmlr r r Z
source_remove)r r r r r saveu s
zSETroubleshootDatabase.savec C s` | j d7 _ | jd kr d S | j | jks0| j r<| j| n | jd kr\tj| jd | j | _d S )Nr i )
r r r r r r r Z timeout_addr auto_save_callback)r r r r r
mark_modified s
z$SETroubleshootDatabase.mark_modifiedc C s t d| j| jf | j dS )Nz)auto_save database (%s) modified_count=%sF)r> r r r )r r r r r s z)SETroubleshootDatabase.auto_save_callbackc C s: | j d krd S tjj| j r6td| j tj| j d S )Nzdeleting database (%s))r r r r r> rf )r r r r rf s
z SETroubleshootDatabase.removec C s | j j d S )N)r acquire)r r r r r s z SETroubleshootDatabase.acquirec C s | j j d S )N)r release)r r r r r s z SETroubleshootDatabase.releasec C s d }| j j|}tdt|djdd |D f t|dkrHttt|dkrxtdt|djdd |D f |d j}|S )Nz1lookup_signature: found %d matches with scores %s,c S s g | ]}d |j qS )z%.2f)score)r6 r r r r r7 s z;SETroubleshootDatabase.lookup_signature..r r c S s g | ]}d |j qS )z%.2f)r )r6 r r r r r7 s )r Zmatch_signaturesr> r2 r8 r{ r} ri )r rJ ri Zmatchesr r r ry s $ $
z'SETroubleshootDatabase.lookup_signaturec C s2 | j j|}|d kr.td| ttd| |S )Nz lookup_local_id: %s not foundzid (%s) not found)r lookup_local_idr> r{ ZERR_SIGNATURE_ID_NOT_FOUND)r rS ri r r r r s
z&SETroubleshootDatabase.lookup_local_idc C s. | j j|}| jr"| jjd|j | j |S )Nadd)r r r signatures_updatedrS r )r ri r r r r s
z"SETroubleshootDatabase.add_siginfoc C s | j S )N)r )r r r r get_properties s z%SETroubleshootDatabase.get_propertiesc C s8 t d| |dkr| jS t }| j|}|j| |S )Nzquery_alerts: criteria=%sr )r> r r r r )r Zcriteriar ri r r r query_alerts s
z#SETroubleshootDatabase.query_alertsc C s t d| y| j|}W n: tk
rT } z |jtkrBt d d S W Y d d }~X nX | jj| | jrx| jjd|j | j
| d S )Nzdelete_signature: sig=%szSignature not found!delete) r> ry r{ r| r} r Zremove_siginfor r rS r )r rJ r ri rk r r r r s
z'SETroubleshootDatabase.delete_signaturec C s" | j r| j jd|j | j d S )NZmodify)r r rS r )r ri r r r rz s z%SETroubleshootDatabase.modify_siginfoc C sh t d||f y| j|}W n: tk
rX } z |jtkrFt d dS W Y d d }~X nX |j|}|S )Nz)evaluate_alert_filter: username=%s sig=%szSignature not found!ignore)r> ry r{ r| r} Zevaluate_filter_for_user)r rJ usernameri rk actionr r r evaluate_alert_filter s
z,SETroubleshootDatabase.evaluate_alert_filterc C s t d||||f y| j|}W n: tk
r\ } z |jtkrJt d d S W Y d d }~X nX |j|}|j|| | j| d S )Nz2set_user_data: username=%s item=%s data=%s sig=
%szSignature not found!)r> ry r{ r| r} Z
get_user_dataZ update_itemrz )r rJ r itemdatari rk Z user_datar r r
set_user_data s
z$SETroubleshootDatabase.set_user_data c C sx t d|||f y| j|}W n: tk
rZ } z |jtkrHt d d S W Y d d }~X nX |j||| | j| d S )Nz.set_filter: username=%s filter_type=%s sig=
%szSignature not found!)r> ry r{ r| r} Zupdate_user_filterrz )r rJ r Z filter_typer ri rk r r r
set_filter s
z!SETroubleshootDatabase.set_filterc C s | j jj|| _| j d S )N)r usersadd_useruserr )r r r r r r s z SETroubleshootDatabase.add_userc C s | j jj|S )N)r r get_user)r r r r r r s z SETroubleshootDatabase.get_user)N)F)F)F)r )r( r) r* r r r r r r r r rf r r ry r r r r r rz r r r r r r r r r r " s.
!
c @ s^ e Zd ZejjdejejffejjdejejejffdZ dd Z
dd Z dd Z d d
Z
dS ) r N)r z async-errorc C s, t j j| tj| || _| jj| d S )N)r
r RpcManagerx r )r rx r r r r % s
z$SETroubleshootDatabaseLocal.__init__c C s | j j| d S )N)rx r )r r r r r r + s z&SETroubleshootDatabaseLocal.set_notifyc G s t d| jj|jdjdd |D |f | j| }t| j|jd }|d krdtt d|j| jjf y(|| |_
d|_ |j
d k r|j
g|_
W n6 tk
r } z|j |j
g|_
d|_ W Y d d }~X nX |j
d k rtj| j| d S )Nz%s emit %s(%s) id=%sr c S s g | ] }t |qS r )r5 )r6 argr r r r7 / s z8SETroubleshootDatabaseLocal.emit_rpc..z'method %s not found in base class of %sZ
method_returnZ error_return)r> r r( methodr8 Zasync_rpc_cachegetattrrx r{ ZERR_METHOD_NOT_FOUNDZ return_argsZ return_typer| strerrorr
idle_addZprocess_async_return)r Zrpc_idtypeZrpc_defargsZ async_rpcfuncrk r r r emit_rpc. s *
z$SETroubleshootDatabaseLocal.emit_rpcc C s" t d||f | jd|| d S )Nz4signatures_updated() database local: type=%s item=%sr )r> emit)r r r r r r r A s z.SETroubleshootDatabaseLocal.signatures_updated)r( r) r* r
SignalFlagsRUN_LAST
TYPE_PYOBJECTZ TYPE_STRINGZTYPE_INT __gsignals__r r r r r r r r r s c @ sn e Zd ZejjdejffejjdejffdZdddZ dddZ
dd Z d d
Z d d Z
d
d Zdd ZdS )r N)progressz
state-changedc C sf t j j| td| jj|f || _d | _d | _d| _d | _ d | _
d | _ d | _ d | _
d | _d | _d S )Nz%s.__init__(%s) )r
r r> r r( logfile_pathrU fileno read_size
record_readerrecord_receiveranalyzerrh idle_proc_idr| r )r r r r r r R s zLogfileAnalyzer.__init__c C sT |d k r|| _ td| jj| j f y2tj| j }|t | _t| j | _ | j j
| _
W nR t k
r } z6t j t j
d| jj|jf |j| _|j| _|W Y d d }~X nX d| _d| _d| _d| _d| _| jd| j tjj| j }dtjj|d | _td || jd| _t t j | _ t | _ t! | _"t#d d
t$sDt%| j| _&n t'| j| _&d S ) Nz %s.open(%s)z
%s.open(): %sr g Fr zfile: %s)r ZtestrZ T)(r r> r r( r r r file_sizeopenrU r EnvironmentErrorra rb r r| n_bytes_readZ
line_count record_countr cancelledr r basenamesplitextr r rx ZAuditRecordReaderZ TEXT_FORMATr ZAuditRecordReceiverr r r r boolr rh r )r r r rk Zlogfile_basenamer r r r f s:
zLogfileAnalyzer.openc s6 t d| jj| jf | j tj fdd| _dS )Nz
%s.run(%s)c s t S )N)nextr )task_generatorr r r s z%LogfileAnalyzer.run..T)r> r r( rU taskr r r )r r )r r rw s zLogfileAnalyzer.runc C s | j d k r&tj| j| j}d | _ d | _| j| jk rddd l}d| j| j| jf }t | |j
| _|| _ | j d k rx | j j
D ]}| j| qzW | js| jdd d S )Nr zFfailed to read complete file, %d bytes read out of total %d bytes (%s)r g ?)rU r readr r r r r| r r> ZEIOr r closeavc_event_handlerr r )r new_dataZErrnor rM r r r r s
zLogfileAnalyzer.closec c sx | j dd xR| jr`y8tj| j| jjd}|dkrNtd| j | j W n| t k
r } z0|j
| _
|j | _ | j | j dd dV W Y d d }~X n2 t k
r } zt
d|tjd W Y d d }~X nX | jt|7 _| jd
krt| jt| j | _| j d | j xF| jj|D ]6\}}}}}| j||||| d V | jr dV q W d V qW | j dd dV d S )
Nz
state-changedZrunningzutf-8r z EOF on %sZstoppedFr4 )rU r r T)r r r r r decoder> r r r r| r ru r^ r_ r` r r2 r floatr r feednew_audit_record_handlerr )r r rk record_typeevent_id body_textfields line_numberr r r r s6 "
zLogfileAnalyzer.taskc C sH t d| |j rD|j rD|j dkrDt|}| jj|| jd d S )Nz"avc_event_handler() audit_event=%sr F)r> Zis_avcZ
is_grantedZ num_recordsZAVCr rl rh )r rM rI r r r r s z!LogfileAnalyzer.avc_event_handlerc C s t d|||f | jd7 _t|||||}xT| jj|D ]D}y| j| W q> tk
r } zt|tj d W Y dd}~X q>X q>W dS )z"called to enter a new audit recordzBnew_audit_record_handler() record_type=%s event_id=%s body_text=%sr )rU N)
r> r Z AuditRecordr r r ru r^ r_ r` ) r r r r r r Z audit_recordrM rk r r r r s z(LogfileAnalyzer.new_audit_record_handler)N)N)r( r) r* r
r r Z
TYPE_FLOATr r r r rw r r r r r r r r r J s
$ )+Z
__future__r __all__ra Z
gi.repositoryr
r r rs r# rn rd r r_ functoolsr
Zsetroubleshoot.configr Zsetroubleshoot.avc_auditZsetroubleshoot.errcodeZsetroubleshoot.rpcZ setroubleshoot.rpc_interfacesZsetroubleshoot.signatureZsetroubleshoot.utilZsetroubleshoot.audit_dataZ setroubleshoot.xml_serializer r objectr r+ r ro r r r r r Z SETroubleshootDatabaseInterfaceZ%SETroubleshootDatabaseNotifyInterfacer Z
type_registerr r r r r sV ()W x )