3
h>` @ s d dl mZ d dl mZ d dlZd dlZd dlT d dlmZ d dlm Z d dl
Z
d dl m Z m
Z
e
je
dd e
dd
d d Zy
ejaW n ek
r ej
aY nX d
ddddddddddddddd d gZed kre
je
dd e
dd
d d d l
ma d d!l m
Z
d dlT d dlT d dlT d dlT d dlj Z d dl T d dl Z d dl T d d"l m!Z! d dl"Z"d dl#Z#d#d$ Z$d Z%d%Z&d&Z'e%td'e&td(e'td)iZ(e%d*e&d+e'd,iZ)e%e&e'd-Z*G d.d
d
e+Z,G d/d de-Z.G d0d de-Z/G d1d de-Z0i Z1td2e1d3< td4e1d5< td6e1d7< td8e1d9< td:e1d;< td<e1d<< td=e1d=< td>e1d>< td?e1d?< td@e1d@< tdAe1dA< tdBe1dB< tdCe1dC< dDdE Z2G dFdG dGe-Z3G dHd de-Z4G dId de-Z5G dJd de-Z6G dKd de-Z7G dLd de-Z8G dMd de-Z9G dNd de-Z:G dOd de-Z;G dPd de-ZdQ dRZ?e9 Z@e@jAe?dS e@jBd ZCeCjDjEd ZFeGeFjH eGdTeCjD eGe@ e=jI e=j>dQd kreGdU neGdVe=j>dQ e=jJ dS )W )absolute_import)print_functionN)*)range)
cmp_to_key)parse_config_setting
get_configZgeneralZi18n_text_domainZi18n_locale_dirT)domain localedirZfallbackSignatureMatchSEFilterSEFaultSignatureSEFaultSignatureInfoSEFaultSignatureSetSEFaultSignatureUser
SEEnvironmentSEDatabasePropertiesSEFaultUserInfoSEFaultUserSetSEPluginSEEmailRecipientSEEmailRecipientSet FILTER_NEVER
FILTER_ALWAYSFILTER_AFTER_FIRST filter_text__main__)r r
)ngettext)r )Templatec C s | |k| |k S )N )xyr r /usr/lib/python3.6/signature.pyQ s r# z Never Ignorez
Ignore AlwayszIgnore After First Alertneveralways after_first)r& r' r( c @ s e Zd Zdd ZdS )r c C s || _ || _d S )N)siginfoscore)selfr) r* r r r" __init__o s zSignatureMatch.__init__N)__name__
__module__ __qualname__r, r r r r" r m s c
s e Zd Zddd dddiddiddiddiddiddideddedddiddiddid Z fd d
Zd d Zd
d Zdd Z Z S )r attributec C s dS )Nz1.0r r r r r" r# v s zSEEnvironment.)XMLFormdefaultr1 element)r1 import_typecast) versionplatformkernel policy_type
policy_rpmlocal_policy_rpmenforceselinux_enabledselinux_mls_enabled
policyvershostnameunamec s t t| j | j d S )N)superr r, update)r+ ) __class__r r" r, s zSEEnvironment.__init__c C s dd l }dd l}t \| _ | _|j d | _td| j | _| j| _t |j
| _ |j }|dkrjd| _
nd| _
t|j | _t|j | _|j | _dj|j | _d S )Nr z/etc/selinux/%s
PermissiveZ Enforcing )r6 selinuxZget_os_environmentr7 Zselinux_getpolicytyper8 Z get_package_nvr_by_file_pathr9 r: strZsecurity_policyversr> Zsecurity_getenforcer; boolZis_selinux_enabledr< Zis_selinux_mls_enabledr= noder? joinr@ )r+ r6 rG r; r r r" rB s
zSEEnvironment.updatec C s | j | S )N)__eq__)r+ otherr r r" __ne__ s zSEEnvironment.__ne__c C s4 x.t | jj D ] }t| |t||krdS qW dS )NFT)list _xml_infokeysgetattr)r+ rM namer r r" rL s zSEEnvironment.__eq__)
r- r. r/ booleanrP r, rB rN rL
__classcell__r r )rC r" r t s c sB e Zd Zdedd ddedd ddZef fdd Z ZS ) r r3 c C s t S )N)r r r r r" r# s zSEFilter.)r1 r4 r2 c C s dS )Nr r r r r r" r# s ) filter_typecountc s t t| j || _d S )N)rA r r, rV )r+ rV )rC r r" r, s zSEFilter.__init__)r- r. r/ intrP r r, rU r r )rC r" r s c sd e Zd Zddidedd ddedd ddedd dd Z fd
d Zd d
ZdddZ Z S )r r1 r0 c C s dS )NFr r r r r" r# s z SEFaultSignatureUser.)r1 r4 r2 c C s dS )NFr r r r r" r# s r3 c C s t S )N)r r r r r" r# s )usernameZ seen_flagZ delete_flagfilterc s t t| j || _d S )N)rA r r, rY )r+ rY )rC r r" r, s z SEFaultSignatureUser.__init__c C s: || j krttd| |dkr*ttdt| || d S )Nz!item (%s) is not a defined memberrY z changing the username is illegal)Z_names ProgramErrorZERR_NOT_MEMBERZERR_ILLEGAL_USER_CHANGEsetattr)r+ itemdatar r r" update_item s
z SEFaultSignatureUser.update_itemNc C sX t dtj|d|f |tks0|tks0|tkrHt d t|d| _dS td| d S )Nz%update_filter: filter_type=%s data=%sunknownzupdate_filter: !!!)rV TzBad filter_type (%s)) log_debugmap_filter_value_to_namegetr r r r rZ
ValueError)r+ rV r^ r r r"
update_filter s z"SEFaultSignatureUser.update_filter)N)
r- r. r/ rT r rP r, r_ re rU r r )rC r" r s directorydirZ semaphoreZsemz
shared memoryZshmz
message queueZmsgqmessagemsgfileZsocketprocessprocess2Z
filesystemrJ
capability capability2c C s | t tj krt| S | S )N)rO
class_dictrQ )tclassr r r" translate_class s rq c s e Zd ZdZ fddZ ZS )AttributeValueDictionaryZ unstructuredc s t t| j d S )N)rA rr r, )r+ )rC r r" r, s z!AttributeValueDictionary.__init__)r- r. r/ rP r, rU r r )rC r" rr s rr c sZ e Zd Zddd dddidddded ded ddided d
Z fd d Z ZS )
r
r0 c C s dS )Nz4.0r r r r r" r# s zSEFaultSignature.)r1 r2 r1 r3 Z operation)r1 rO )r1 r4 )r5 hostaccessscontexttcontextrp portc s8 t t| j x$t|j D ]\}}t| || q W d S )N)rA r
r, rO itemsr\ )r+ kwdskv)rC r r" r, s zSEFaultSignature.__init__)r- r. r/
AvcContextrX rP r, rU r r )rC r" r
s c s8 e Zd ZddiddddZ fddZdd Z ZS )
r r1 r3 arg)r1 rO ) analysis_idargsc s t t| j || _|| _d S )N)rA r r, r~ r )r+ r~ r )rC r r" r,
s zSEPlugin.__init__c C s t | j| jfS )N)rH r~ r )r+ r r r" __str__ s zSEPlugin.__str__)r- r. r/ rP r, r rU r r )rC r" r s c s e Zd Zddeddedddiddiddidddddddeddedddideddedddiddiddidedde dde ddedd d
ddidd e
dddiddiddid Z d
dddddddddg
Z fddZ
dd Zdd Zd d Zd d Zd!d" Zd#d$ ZdEd&d'ZdFd(d)Zd*d+ Zd,d- Zd.d/ Zd0d1 Zd2d3 Zd4d5 Zd6d7 Z dGd9d:Z d;d< Z d=d> Z dHd?d@Z dAdB Z!dIdCdDZ" Z#S )Jr r3 Zplugin)r1 rO r4 )r1 r4 r1 Zrpm)r1 rO c C s dS )Nr r r r r r" r# ) s z SEFaultSignatureInfo.)r1 r4 r2 user) plugin_list audit_eventsourcespathtpath src_rpm_list tgt_rpm_listru rv rp rw sigZif_textZ then_textZdo_text environmentfirst_seen_datelast_seen_date report_countlocal_iduserslevelZfixableZ button_textr r r r ru rv rp rw r r c
s| t t| j x$t|j D ]\}}t| || q W d| _g | _d}tj dkrTd}yt
| j |d| j _
W n Y nX d S )NrD Tr F)use_dbus)rA r r, rO rx r\ r r osgetuidZget_rpm_nvr_by_scontextru r r: )r+ ry rz r{ r )rC r r" r, 7 s z SEFaultSignatureInfo.__init__c C sZ |j | j kr"|j | _ | jd7 _x | jD ]}t| |t|| q*W | jd krV|j| _d S )NrD )r r
merge_includer\ rR r )r+ r) rS r r r" update_mergeH s
z!SEFaultSignatureInfo.update_mergec C s | j jS )N)r r9 )r+ r r r" get_policy_rpmT s z#SEFaultSignatureInfo.get_policy_rpmc C s( d| j | jj| jj| jdj| jjf S )Nz%s,%s,%s,%s,%s,)r ru typerv rp rK r rt )r+ r r r" get_hash_strW s z!SEFaultSignatureInfo.get_hash_strc C s t j| j jd}|j S )Nzutf-8)hashlibZsha256r encodeZ hexdigest)r+ hashr r r" get_hashZ s z SEFaultSignatureInfo.get_hashc C sB x | j D ]}|j|kr|S qW td| t|}| j j| |S )Nz new SEFaultSignatureUser for %s)r rY ra r append)r+ rY r r r r"
get_user_data^ s
z"SEFaultSignatureInfo.get_user_datac C s, t d| d }| j|}|d k r(|j}|S )Nzfind_filter_by_username %s)ra r rZ )r+ rY rZ user_datar r r" find_filter_by_usernameg s
z,SEFaultSignatureInfo.find_filter_by_usernameNc C s | j |}|j|| d S )N)r re )r+ rY rV r^ r r r r" update_user_filterp s
z'SEFaultSignatureInfo.update_user_filterc C sT d}| j |}td||f |d k rP|d k r4||_| j|}td|||f |S )Ndisplayz5evaluate_filter_for_user: found %s user's filter = %sz4evaluate_filter_for_user: found filter for %s: %s
%s)r ra rV evaluate_filter)r+ rY rV actionfr r r" evaluate_filter_for_usert s
z-SEFaultSignatureInfo.evaluate_filter_for_userc C sb |j }d}|tkrd}n8|tkr6|jdkr0d}qPd}n|tkrDd}n td| | jd7 _|S )Nr r ignorezunknown filter_type (%s)rD )rV r r rW r rd )r+ rZ rV r r r r" r s
z$SEFaultSignatureInfo.evaluate_filterc C s2 t |tr&t|dkr dj|S dS ntd S d S )Nr rF )
isinstancerO lenrK default_text)r+ Zrpm_listr r r" format_rpm_list s
z$SEFaultSignatureInfo.format_rpm_listc C s d| j | jf S )Nz %s [ %s ])r rp )r+ r r r" format_target_object s z)SEFaultSignatureInfo.format_target_objectc C sT d }| j jd}|d kr<|jddkrz SEFaultSignatureInfo.summaryFc
s t _g }d}|r>x jD ] }||j7 }|j|d
f q W n\xZ jD ]P}xJ jD ]@}|j|jkrR||j7 }|jt|j |j|t|jf P qRW qFW |j t
j d ddddg}d j fd
d |D }x.|D ]&}||krx|D ]\}} d |_
qW P qW ||fS )Nr allow_ypbind1)r Zmozilla_read_contentZ"mozilla_plugin_can_network_connectZ mozilla_plugin_use_bluejeansZ$unconfined_mozilla_plugin_transitionrF c s g | ]\}}|j jj|qS r ) get_do_textr records).0pa)r+ r r"
s z4SEFaultSignatureInfo.get_plugins..F)r r )Z load_pluginspluginsr r r r~ Z init_argstupler sortr r rK Z
report_bug)
r+ allr total_priorityr ZsolutionZnoreport_booleansZdo_textsbr r )r+ r" get_plugins s0
z SEFaultSignatureInfo.get_pluginsc C s t |j| jS )N)r Zsafe_substituter )r+ txtr r r"
substitute s z SEFaultSignatureInfo.substitutec s fdd|D S )Nc s g | ]} j |qS r )r )r r )r+ r r" r s z9SEFaultSignatureInfo.substitute_array..r )r+ r r )r+ r" substitute_array s z%SEFaultSignatureInfo.substitute_arrayc
s | j }td}|ttd| jj 7 }|ttd| jj 7 }|ttd| j 7 }|ttdt| j7 }|ttdt| j 7 }|ttdt| j
7 }|r|ttdd 7 }n|ttdt| j j 7 }|ttd
t| j
| j7 }|ttd t| j
| j7 }|ttd t|j7 }|ttd
t|j7 }|ttdt|j7 }|ttdt|j7 }|ttdt|j7 }|r|ttdd 7 }n|ttdt|j7 }|r|jj }d |d< |ttdtdj|7 }n|ttdt|j7 }|ttdt| j7 }d}|ttd| jj|7 }|ttd| jj|7 }|ttdt| j 7 }|dtd 7 }d }xj| j j D ]^ j d kr|d j d 7 }n6|d j j!f 7 }|dj fd d j"D d 7 }qW |d!| j# 7 }y~d"}t$j%j&|rvd#}t'|gt(t(d$} || j)|d% 7 }t$j%j*d&rn|d'7 }t'|d(gt(t(d$} || j)|d% 7 }||7 }W n Y nX ||d 7 }|S ))NzAdditional Information:
zSource ContextzTarget ContextzTarget ObjectsZSourcez Source PathZPortZHostz (removed)zSource RPM PackageszTarget RPM PackageszSELinux Policy RPMzLocal Policy RPMzSelinux Enabledz Policy TypezEnforcing Modez Host NamerD ZPlatformrF z Alert Countz%Y-%m-%d %H:%M:%S %Zz
First Seenz Last SeenzLocal ID
zRaw Audit Messagesr ZAVCz
type=%s msg=%s: c s g | ]}d | j | f qS )z%s=%s)Zfields)r rz ) audit_recordr r" r 8 s z7SEFaultSignatureInfo.format_details..z
Hash: z/usr/bin/audit2allowz
audit2allow)stdinstdoutr z /var/lib/sepolgen/interface_infoz
audit2allow -Rz-R)+r r Zformat_2_column_name_valueru formatrv r r r r rw r rs r r r r9 r: r< r8 r; r? r@ splitrK r r r r r r record_typeZto_textZevent_idZ
fields_ordr r r ZexistPopenPIPEZ communicateexists)
r+ replaceenvtextr@ Z date_formatZavcbufZ audit2allowZnewbufr r )r r" format_details sl
( z#SEFaultSignatureInfo.format_detailsc
O s2 t }t}zdd a dd a|||S |a |aX dS )zdefine.*untranslated\(.*\nc S s |dkr | S |S )NrD r )r r! zr r r" r# X s z3SEFaultSignatureInfo.untranslated..c S s | S )Nr )r r r r" r# Y s N)r r )r+ funcr kwargsZsaved_translateP_Zsaved_translate_r r r" untranslatedN s
z!SEFaultSignatureInfo.untranslatedc C s> | j | j }| j|\}}x |D ]\}}td|jt|jt| d d f }||7 }x"tt|dD ]} |td7 }qpW |td7 }| j |j
| j j |}
|td|
7 }| j |j
| j j |}
|td|
d j |
d d 7 }| j |j| j j |}
|td
|
d j |
d d 7 }q&W |td 7 }|S ) Nz0
***** Plugin %s (%.4s confidence) suggests d g ?P r r z
Then r rD z
Do
z
)r r r r r~ floatr r r r Z get_if_textr r Z
get_then_textlowerr ) r+ r r r r r r r titleir r r r" format_text_ s" ( $( z SEFaultSignatureInfo.format_text)N)N)F)F)FF)$r- r. r/ r Z
AuditEventr| rX r
r Z TimeStampr rP r r, r r r r r r r r r r r r r r r r r r r r r rU r r )rC r" r sd
/
"
Cc sR e Zd Zddd dddidedd ddd d
d Z fd d
Zdd Z ZS )r r0 c C s dS )Nz1.0r r r r r" r# z s zSEFaultUserInfo.)r1 r2 r1 r3 c C s dS )NFr r r r r" r# | s )r1 r4 r2
email_address)r1 rO )r5 rY Z email_alertemail_address_listc s t t| j || _d S )N)rA r r, rY )r+ rY )rC r r" r, s zSEFaultUserInfo.__init__c C s || j kr| j j| d S )N)r r )r+ r r r r" add_email_address s
z!SEFaultUserInfo.add_email_address)r- r. r/ rT rP r, r rU r r )rC r" r x s c sH e Zd Zddd dddeddZ fd d
Zd d Zd
d Z ZS )r r0 c C s dS )Nz1.0r r r r r" r# s zSEFaultUserSet.)r1 r2 r3 r )r1 rO r4 )r5 user_listc s t t| j d S )N)rA r r, )r+ )rC r r" r, s zSEFaultUserSet.__init__c C s" x | j D ]}||jkr|S qW d S )N)r rY )r+ rY r r r r" get_user s
zSEFaultUserSet.get_userc C s* | j |d k rd S t|}| jj| |S )N)r r r r )r+ rY r r r r" add_user s
zSEFaultUserSet.add_user) r- r. r/ r rP r, r r rU r r )rC r" r s
c s e Zd Zddd ddedd ddded d
Z fd d Zd
d Zdd Zdd Z dd Z
dd Z dd Z de
jfddZ ZS ) r r0 c C s dt tf S )Nz%d.%d)ZDATABASE_MAJOR_VERSIONZDATABASE_MINOR_VERSIONr r r r" r# s z SEFaultSignatureSet.)r1 r2 r3 c C s t S )N)r r r r r" r# s )r1 r4 r2 r) )r1 rO r4 )r5 r signature_listc s t t| j d S )N)rA r r, )r+ )rC r r" r, s z SEFaultSignatureSet.__init__c c s x| j D ]
}|V qW d S )N)r )r+ r) r r r" siginfos s z SEFaultSignatureSet.siginfosc C s | j j| |S )N)r r )r+ r) r r r" add_siginfo s z SEFaultSignatureSet.add_siginfoc C s | j j| d S )N)r remove)r+ r) r r r" remove_siginfo s z"SEFaultSignatureSet.remove_siginfoc C s
g | _ d S )N)r )r+ r r r" clear s zSEFaultSignatureSet.clearc C s t tj S )N)rH uuidZuuid4)r+ r r r" generate_local_id s z%SEFaultSignatureSet.generate_local_idc C s. |d kr d S x | j D ]}|j|kr|S qW d S )N)r r )r+ r r) r r r" lookup_local_id s
z#SEFaultSignatureSet.lookup_local_idexactc
C s t |j }d}|dkr d}n(t|tr:t|}d| }n td| g }x| jD ]} d}
| j} x>|D ]6} t|| t| | kr|rd}
q|
|7 }
qf|rfd}
P qfW |r|
dkr|j t
| |
qR|
|krR|j t
| |
qRW |j t dd d |S )
NFr Tg ?zunknown criteria = %sg c S s t |j| jS )N)r r* )r r r r r" r# s z6SEFaultSignatureSet.match_signatures..)r )
rO rQ r r r rd r r rR r r r r )
r+ ZpatZcriteriaZxml_infoZ
match_targetsr Znum_match_targetsZscore_per_match_targetZmatchesr) r* r rS r r r" match_signatures s6
z$SEFaultSignatureSet.match_signatures)r- r. r/ r r rP r, r r r r r r r
r rU r r )rC r" r s
c s6 e Zd ZddiddiddidZd fdd Z ZS )r r1 r3 )rS
friendly_namefilepathNc s< t t| j |d k r || _|d k r*|| _|d k r8|| _d S )N)rA r r, rS r r )r+ rS r r )rC r r" r, s z SEDatabaseProperties.__init__)NNN)r- r. r/ rP r, rU r r )rC r" r s c s@ e Zd Zddidedd ddZd fdd Zd
d Z ZS )
r r1 r3 c C s t S )N)r r r r r" r# s zSEEmailRecipient.)r1 r4 r2 )addressrV Nc s& t t| j || _|d k r"|| _d S )N)rA r r, r rV )r+ r rV )rC r r" r, s zSEEmailRecipient.__init__c C s d| j tj| jdf S )Nz%s:%sr` )r rb rc rV )r+ r r r" r s zSEEmailRecipient.__str__)N)r- r. r/ rX rP r, r rU r r )rC r" r s c sn e Zd Zddd dddeddZd fd
d Zd d
Zdd ZefddZ dd Z
dd Z dd Z Z
S )r r0 c C s dS )Nr r r r r r" r# s z SEEmailRecipientSet.)r1 r2 r3 recipient)r1 rO r4 )r5 recipient_listNc s t t| j |d k r || _d S )N)rA r r, r )r+ r )rC r r" r, s z SEEmailRecipientSet.__init__c C s dj dd | jD S )Nr c S s g | ] }t |qS r )rH )r r r r r" r s z/SEEmailRecipientSet.__str__..)rK r )r+ r r r" r s zSEEmailRecipientSet.__str__c C s* |j }x | jD ]}||jkr|S qW d S )N)stripr r )r+ r r r r r" find_address s
z SEEmailRecipientSet.find_addressc C sP |j }t|s$ttd| dd S | j|}|d k r:d S | jjt|| d S )Nz address='%s')detail)r Zvalid_email_addressr[ ERR_INVALID_EMAIL_ADDRr r r r )r+ r rV r r r r" add_address s
z SEEmailRecipientSet.add_addressc C s
g | _ d S )N)r )r+ r r r" clear_recipient_list) s z(SEEmailRecipientSet.clear_recipient_listc C s dd l }|jd}|jd}|jd}ddddddddd}y t|}W n8 tk
r } z ttd||jf d W Y d d }~X nX | j x|j D ]} |j d
| } | j
} | r|j | }
|
r|
j d } |
j d } d }
| rNxl|j
| D ]^}
|
j d }|
j d
}|dkr:tj|j d }
|
d krJtd|| f qtd|| f qW y| j| |
W q tk
r } z"|jtkrt|j n|W Y d d }~X qX qW |j d S )Nr z#.*z(\S+)(\s+(.+))?z(\w+)\s*=\s*(\S+)TF)Zenabledtruer ZonZdisabledZfalsenoZoffz%s, %s)r r rD rV z(unknown email filter (%s) for address %sz(unknown email option (%s) for address %s)r compileopenIOErrorr[
ERR_FILE_OPENstrerrorr
readlinesr r searchgroupfinditermap_filter_name_to_valuerc r ra r errnor close)r+ r r Z
comment_reZentry_reZ key_value_reZ map_booleanr elinematchr ZoptionsrV Zoptionr r r r" parse_recipient_file, sT
(
z(SEEmailRecipientSet.parse_recipient_filec C s yt |d}W n8 tk
rF } z ttd||jf dW Y d d }~X nX x,| jD ]"}t|j }|jd|j |f qPW |j
d S )Nwz%s, %s)r z%-40s filter_type=%s
) r r r[ r r r rb rV writer r )r+ r r r r rV r r r" write_recipient_filed s (
z(SEEmailRecipientSet.write_recipient_file)N)r- r. r/ r rP r, r r r r r
r r! rU r r )rC r" r s 8rD zaudit_listener_database.xmlsigszsiginfo.audit_event=%sz Memory OKzMemory leak %d bytes)KZ
__future__r r ZsixZsyslog
subprocessZ six.movesr functoolsr gettextZsetroubleshoot.configr r Z translationZugettextr AttributeError__all__r- Zinstallr r Zsetroubleshoot.errcodeZsetroubleshoot.utilZ setroubleshoot.xml_serializeZsetroubleshoot.html_utilZsetroubleshoot.uuidr Zsetroubleshoot.audit_datar typesstringr r r r r r r r rb r objectr Z XmlSerializer r r ro rq rr r
r r r r r r r r Zlibxml2Z debugMemoryZxml_filer" Z
read_xml_filer r) r r recordprintr Z
cleanupParserZ
dumpMemoryr r r r" s
4 ! gHk