3
n`ǝ @ sd d dl mZ d dlZd dlmZ d dlZdddddd d
d gZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
Z
d d lT d dljZd d lT d d lT d d lT d d lT d
Zdd Ze Zdd Zdd Ze jdZ dd Z e jdZ dd Z d dl Z dd Z!G dd de"Z#G dd de"Z$G d d
d
e"Z%G d d d Z&G d d d e"Z'G d d dZ(dS ) )absolute_importN)rangederive_record_formatparse_audit_record_text
AvcContextAVC AuditEventID
AuditEvent AuditRecordAuditRecordReader)* c C s | |k| |k S )N )xyr r /usr/lib/python3.6/audit_data.py6 s r c C s t | \}}}}t|||}|S )N)r r
)textparse_succeeded record_typeevent_id body_text audit_recordr r r audit_record_from_text@ s r c C s* t jd| rtjS t jd| r$tjS tjS )Nz/audispd_events$z/audit_events$)researchr TEXT_FORMAT
BINARY_FORMAT)Z socket_pathr r r r H s
zL(node=(\S+)\s+)?(type=(\S+)\s+)?(msg=)?audit\(((\d+)\.(\d+):(\d+))\):\s*(.*)c
C s d}d }d }d }d }t j| }|d k rd}|jdr>|jd}|jdrR|jd}|jdrt|jd}t|jd}t|jd} t||| |}|jd }||||fS )
NFT
)audit_input_rer groupintr )
inputr hostr r r matchsecondsmilliserialr r r r a s&
z%audit\(((\d+)\.(\d+):(\d+))\):\s*(.*)c C sv d}d }d }t j| }|d k rld}|jdrbt|jd}t|jd}t|jd}t|||}|jd}|||fS )NFT r r
r )audit_binary_input_rer r& r' r )r( r r r r* r+ r, r- r r r parse_audit_binary_text s
r1 c C s" | r dd | D }|| kr dS dS )Nc S s g | ]}|t jkr|qS r )string printable).0r r r r
s z printable..TFr )sZ
filtered_pathr r r r3 s
r3 c sZ e Zd ZddiddiddiddidZ fddZdd Zdd Zd
d Zd d
Z Z S )r XMLForm attribute)userroletypemlsc sz t t| j t|tjrv|jd}t|dkrv|d | _|d | _ |d | _
t|dkrpdj |dd | _ nd| _ d S )N:r
r r. r Zs0)
superr __init__
isinstancesixZ string_typessplitlenr9 r: r; joinr< )selfdatafields) __class__r r r? s
zAvcContext.__init__c C s d| j | j| j| jf S )Nz %s:%s:%s:%s)r9 r: r; r< )rE r r r __str__ s zAvcContext.__str__c C s t jt| \}}|S )N)selinuxZ selinux_raw_to_trans_contextstr)rE ZrcZtransr r r format s zAvcContext.formatc C s | j | S )N)__eq__)rE otherr r r __ne__ s zAvcContext.__ne__c C s4 x.t | jj D ] }t| |t||krdS qW dS )NFT)list _xml_infokeysgetattr)rE rN namer r r rM s zAvcContext.__eq__)
__name__
__module__ __qualname__rQ r? rI rL rO rM
__classcell__r r )rH r r s
c sv e Zd ZdeddeddedddidZd fdd Zdd Zd
d Zd d
Ze dd Z
dd Z dd Z Z
S )r r8 )r7 import_typecastr7 )r+ r, r- r) Nc s2 t t| j || _|| _|| _|d k r.|| _d S )N)r> r r? r+ r, r- r) )rE r+ r, r- r) )rH r r r? s zAuditEventID.__init__c C sD | j |j krdS | j|jkr dS | j|jkr0dS | j|jkr@dS dS )NFT)r) r+ r, r- )rE rN r r r rM s zAuditEventID.__eq__c C sb | j |j kr&td| jj| j |j f | j|jkr>| j|jk S | j|jkrV| j|jk S | j|jk S )Nz?cannot compare two %s objects whose host values differ (%s!=%s))r)
ValueErrorrH rU r+ r, r- )rE rN r r r __lt__ s zAuditEventID.__lt__c C s dd l }|j | S )Nr )copy)rE r\ r r r r\ s zAuditEventID.copyc C s t | j| jd S )Ng @@)floatZsecr, )rE r r r r s zAuditEventID.c C s d| j | j| jf S )Nzaudit(%d.%d:%d))r+ r, r- )rE r r r rI s zAuditEventID.__str__c C s. | j d krdS | jd kr dS | jd kr*dS dS )NFT)r+ r, r- )rE r r r is_valid s
zAuditEventID.is_valid)N)rU rV rW r' rQ r? rM r[ r\ propertyZtimerI r^ rX r r )rH r r s c s e Zd ZddidedddideddZdZdZej eZ
e j dZ
e j d Ze j d
Zd( fd d
Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zd d Zd d Zd d! Zd"d# Zd$d% Z d&d' Z Z S ))r
r7 r8 element)r7 rY )r r r line_numberr Ziiiiz([^ \t]+)\s*=\s*([^ \t]+)z$avc:\s+([^\s]+)\s+{([^}]+)}\s+for\s+z^a\d+$Nc s8 t t| j || _|| _|| _|| _|| _| j d S )N) r> r
r? r r r rG ra _init_postprocess)rE r r r rG ra )rH r r r? s zAuditRecord.__init__c C sr t | dd d kr | j| j | jd
krnd| jkrntjj| j}|rn|jd}|| jd< |jd}|j | jd < d S ) NrG r USER_AVC14001107seresultr. r seperms)r rc rd re )
rS set_fields_from_textr r rG r
avc_rer r& rB )rE r* rf rg r r r rb s
z AuditRecord._init_postprocessc C s | j S )N) to_host_text)rE r r r rI + s zAuditRecord.__str__c C s d | _ | jjd kr t | j_d S )N)ra r r) Z get_hostname)rE r r r audispd_rectify. s zAuditRecord.audispd_rectifyc C s. | j j sdS | jd kr dS | jd kr*dS dS )NFT)r r^ r message)rE r r r r^ 3 s
zAuditRecord.is_validc C s ddddddddd d
d d d
dddg}xF|D ]>}|| j kr*| jdkrL|dkrLq*| j | }t|}|| j |< q*W | jdkrxBt| j j D ]0\}}| jj|r| j | }t|}|| j |< qW d S )NZacctcmdcommcwdrF direxefiler) keymsgrT newZocommoldpathZwatchr ZsaddrZEXECVE)rG r Zaudit_msg_decoderP items exec_arg_rer )rE Zencoded_fieldsZfieldvalueZ
decoded_valuer r r
decode_fields< s
zAuditRecord.decode_fieldsc C s< y,t jd dk r|jdS tj|jdS W n
|S d S )Nr r
hexzutf-8)sys version_infodecode bytearrayfromhex)rE rv r r r
translate_hexP s
zAuditRecord.translate_hexc C s
g | _ i | _ xtjj|D ]}|jd}|jd}|jd}y|dkrbtjt |d}tj
|}|dkr|jdj ds| j |}|d kryt
jtt | }W n Y nX |d
krtjt |tj }|r|}W n tk
r Y nX || j|< | j j| q W d S )Nr. r "arch rT rv rn rm rq ro exitsyscall)rT rv rn rm rq ro )
fields_ordrG r
key_value_pair_refinditerr& stripauditZaudit_elf_to_machiner' Zaudit_machine_to_name
startswithr errno errorcodeabsZaudit_syscall_to_nameZaudit_detect_machinerZ append)rE r r* rs ry iZ syscall_namer r r rh _ s4
z AuditRecord.set_fields_from_textc C s | j j|S )N)rG get)rE rT r r r get_field s zAuditRecord.get_fieldc C s" t |}tjtjtjtj| j|S )N)rC structpackr
binary_header_formatbinary_versionbinary_header_sizer )rE rt
msg_lengthr r r get_binary_header s z AuditRecord.get_binary_headerc sj j d krdS jdkr4d j jdj jf }nd j jf }|dj fdd jD d 7 }|S ) N r z#type=%s msg=%s: avc: denied { %s } ztype=%s msg=%s: c s g | ]}d | j | f qS )z%s=%s)rG )r4 k)rE r r r5 s z.AuditRecord.fields_to_text..
)rG r r rD accessr )rE Zbufr )rE r fields_to_text s
"zAuditRecord.fields_to_textc C s d| j | j| jf S )Nztype=%s msg=%s: %s
)r r r )rE r r r to_text s zAuditRecord.to_textc C s2 | j jd k r&d| j j| j| j | jf S | j S d S )Nznode=%s type=%s msg=%s: %s
)r r) r r r )rE r r r rj s zAuditRecord.to_host_textc C s d| j | jf }| j|| S )Nz%s: %s)r r r )rE recordr r r to_binary s zAuditRecord.to_binary)NN) rU rV rW r r' rQ r r r calcsizer r compiler ri rx r? rb rI rk r^ rz r rh r r r r rj r rX r r )rH r r
s0
"
c @ s, e Zd ZdZdZdd Zdd Zdd Zd S )
r r. r c C sV || _ d| _d| _| j | jkr(| j| _n*| j | jkr>| j| _ntd|| j j
f d S )Nr r z unknown record format (%s) in %s)
record_format
_input_bufferra r feed_textZfeedr feed_binaryrZ rH rU )rE r r r r r? s
zAuditRecordReader.__init__c c s t |dkrd S | j|7 _xt | jtjk r4d S tjtj| jdtj \}}}}tj| }t | j|k rrd S | jtj| }t|\}} }
| j|d | _|r tj || |
d dfV q W d S )Nr )
rC r r
r r unpackr r1 r Zaudit_msg_type_to_name) rE new_datar r r r Z total_lenr r r r r r r r s"
z AuditRecordReader.feed_binaryc c s t |dkrd S | j|7 _d}| jjd|}xh|dkr| jd7 _|d7 }| j|| }t|\}}}}|r|||d | jfV |}| jjd|}q2W | j|d | _d S )Nr r r. )rC r findra r ) rE r startendliner r r r r r r r s
zAuditRecordReader.feed_textN)rU rV rW r r r? r r r r r r r s
!c s e Zd ZddeddeddZ fddZdd Zd
d Zd$d
dZ dd Z
e dd Z dd Z
dd Zd%ddZdd Zd d Zd d Zd d! Zd"d# Z ZS )&r r` r )r7 rP rY )r7 rY )recordsr c s* t t| j d | _g | _i | _d | _d S )N)r> r r? r r record_types timestamp)rE )rH r r r? s
zAuditEvent.__init__c C s4 t | dd d kri | _x| jD ]}| j| q W d S )Nr )rS r r process_record)rE r r r r rb s z AuditEvent._init_postprocessc C sL | j }|j d| j| j | j djdd |D djdd | jD f S )Nz2%s: is_avc=%s, is_granted=%s: line_numbers=[%s]
%s,c S s g | ] }t |qS r )rK )r4 r r r r r5
s z&AuditEvent.__str__..r c S s g | ] }d | qS )z %sr )r4 r r r r r5 s ) line_numberssortr is_avc
is_grantedrD r )rE r r r r rI s zAuditEvent.__str__r c C s |j dd | jD S )Nc S s g | ] }t |qS r )rK )r4 r r r r r5 s z%AuditEvent.format..)rD r )rE Z separatorr r r rL
s zAuditEvent.formatc C s
t | jS )N)rC r )rE r r r num_records s zAuditEvent.num_recordsc C s dd | j D S )Nc S s g | ]}|j r|j qS r )ra )r4 r r r r r5 s z'AuditEvent...)r )rE r r r r s zAuditEvent.c C s | j j| | j| d S )N)r r r )rE r r r r
add_record s zAuditEvent.add_recordc C sp | j d kr2|j j | _ t| j j| j jd | _n | j |j ksRtd| j |j f | jj|j g }|j
| d S )Ng @@zBcannot add audit record to audit event, event_id mismatch %s != %s) r r\ r] r+ r, r rZ r
setdefaultr r )rE r Z record_listr r r r s
zAuditEvent.process_recordNc C sV g }|dkr| j }n
| j|}x2|D ]*}|jj|}|dkr>q$|j||jf q$W |S )aN Return list of (value, record_type) tuples.
In other words return the value matching name for every record_type.
If record_type is not specified then all records are searched.
Note: it is possible to have more than one record of a given type
thus it is always possible to have multiple values returned.N)r get_records_of_typerG r r r; )rE rT r rw r r ry r r r r % s
zAuditEvent.get_fieldc C s d }| j j|}|r |d }|S )Nr )r r )rE r; r r r r r get_record_of_type9 s
z AuditEvent.get_record_of_typec C s | j j|g S )N)r r )rE r; r r r r @ s z AuditEvent.get_records_of_typec C s$ x dD ]}| j |}|r|S qW d S )Nr rc rd re )r rc rd re )r )rE r r r r r get_avc_recordC s
zAuditEvent.get_avc_recordc C s | j d k S )N)r )rE r r r r I s zAuditEvent.is_avcc C sH | j }|d krdS |jd }|dkr*dS |dkr6dS tjjd| dS )NFrf ZdeniedZgrantedTz!unknown value for seresult ('%s'))r rG logZavcwarn)rE
avc_recordrf r r r r L s
zAuditEvent.is_granted)r )N)rU rV rW r
r rQ r? rb rI rL r r_ r r r r r r r r r rX r r )rH r r s
c @ s| e Zd ZdgZddgZdddddgZddddddgZddddddgZddd d
gZd ddd dd d
gZ dd ddddd
d ddd d
g Z
ddddddgZ ddddddddd
g Z dddddddd
gZ
dd dddd ddd d
ddddd
dgZddddgZddgZdgZd gZddddddgZdddddd
dgZdddddd
dgZdd dd dd
dd d
dddddddgZdgZd gZdddddgZdddddgZddd
dddgZdddd
dddgZ dd gZ dd dd dd
dd
dd ddg Z e j dZ!e j dZ"dBddZ#dd Z$d d Z%d d Z&d!d" Z'd#d$ Z(d%d& Z)d'd( Z*d)d* Z+d+d, Z,d-d. Z-d/d0 Z.d1d2 Z/d3d4 Z0d5d6 Z1d7d8 Z2d9d: Z3d;d< Z4d=d> Z5d?d@ Z6dAS )Cr rS ZexecuteopenreadlockZioctlr linkunlinkrenameZcreatesetattrwriter Zadd_nameZ remove_nameZreparentrmdirZmountZremountZunmountz^(\w+):\[([^\]]*)\]z^(/proc/)(\d+)(.*)Tc C s || _ || _i | _d | _d | _d | _d | _d | _d | _d | _ d | _
d | _ g | _ g | _
d | _d | _d | _d | _d | _g | _| j d S )N) audit_eventquery_environmenttemplate_substitutionstpathspathsource
source_pkgr scontexttcontexttclassportsrc_rpmstgt_rpmsr) pidkmodr whybools derive_avc_info_from_audit_event)rE r r r r r r? s* z AVC.__init__c C s | j S )N)
format_avc)rE r r r rI s z AVC.__str__c C sN d}|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|S )Nr z scontext=%s z tcontext=%s z
access=%s z
tclass=%s z tpath=%s )r r r r r )rE r r r r r s zAVC.format_avcc C s. | j dkrdS x| j D ]}||krdS qW dS )zMReturns true if the AVC contains _any_ of the permissions in the access list.NFT)r )rE access_listar r r has_any_access_in s
zAVC.has_any_access_inc C s. | j dkrdS x| j D ]}||krdS qW dS )zmReturns true if _every_ access in the AVC matches at
least one of the permissions in the access list.NFT)r )rE r r r r r all_accesses_are_in s
zAVC.all_accesses_are_inc
C s t t }|j t }|j g }dd dd ttgt| jjt | j
t | j iD D }|}x,|D ]$}||krd|j
ttt|d qdW x&|D ] }||kr||kr|j| qW |j |S )Nc S s g | ] }|t qS r )ZTARGET)r4 r r r r r5 s z,AVC.allowed_target_types..c S s g | ]}|d r|qS )Zenabledr )r4 r r r r r5 s types)Zget_all_file_typesZget_all_port_typesr Zget_all_attributesr ALLOWSOURCEr r; ZCLASSr ZPERMSr extendnextinfoZ ATTRIBUTEr )rE Z all_typesZall_attributesZ
allowed_typesZwtypesr tr r r allowed_target_types s 4
zAVC.allowed_target_typesc C s@ | j dgr pipe
socket:[1234] --> socket
/proc/1234/fd --> /proc//fd
./foo --> ./foo
/etc/sysconfig --> /etc/sysconfig
NrT rv inoPATHZnametypeZPARENTr rr z%srp /r devz/dev/z /proc/mountsrr r. r
z/dev/%sr zunknown mountpointFZlocatez-bz\%sT)stderrZuniversal_newlinesz \1\3 @Z
filesystemr Z
udp_socketZ
tcp_socketzport %sZUnknown)"r r r r endswithr rv existslstatst_rdevr' r r rB rC statst_inor OSErrorclose TypeErrorr
subprocessZ check_outputZSTDOUTproc_pid_instance_resubpipe_instance_path_rer r r r _r )rE rv rT ZinodestrZavc_path_recordsZavc_path_recordr r ZmatchesZdev_rdevr r fdr r r Zcommandoutputrr r* r r r
_set_tpath s
:
zAVC._set_tpathc C sx d | _ d | _d | _d | _d| _g | _d } } }}| jj | _| jj d}| jj
d| _ t | j
tsxt| jj
d| _
t | jtst| jj
d| _| jj
d| _| jj
dd kr| jj
d| _n| jj
d| _| j | jj
d | _| jj
d
| _|r8|j
d }|j
d }|j
d
| _|j
ddk| _|j
d| _|d krN| jj
d }|d krd| jj
d }|| _|rx|| _n|r| j| _| js| j| _| js| j
j| _| jj d}|r|j
d}nd }| jjd}xR|D ]J} | j
d}
tjj|
s | r| jj|
n| jjtjj ||
qW g | _ g | _ | jj j | _ t!j"t#| j
t#| jt#| j| j \| _$} | j$t!j%krt&t'd| j | j$t!j(krt&t'd| j | j$t!j)krt&t'd| j$t!j*krt&t'd| j | j$t!j+krt&t'd| j | j$t!j,kr&t&t'd| j | j$t!j-krFt&t'd| j | j$t!j.kr`t&t'd | j$t!j/krt| | _0d S ) NFZSYSCALLrg r r r destsrcr r rq rn r successyesr ZCWDro r rT z8%s
**** Recorded AVC is allowed in current policy ****
zh%s
**** Recorded AVC is dontaudited in current policy. 'semodule -B' will turn on dontaudit rules ****
zMust call policy_init firstz.%s
**** Invalid AVC: bad target context ****
z.%s
**** Invalid AVC: bad source context ****
z*%s
**** Invalid AVC: bad type class ****
z*%s
**** Invalid AVC: bad permission ****
z&Error during access vector computation)1r r r r r Z
syscall_pathsr r r r r r r@ r r r r r r r r r r; r r rv isabsr rD r r r r) audit2whyZanalyzerK r r rZ r Z DONTAUDITZNOPOLICYZBADTCONZBADSCONZ BADTCLASSZBADPERMZ
BADCOMPUTEZBOOLEANr ) rE rq rn r r Zsyscall_recordZ
cwd_recordro Z path_recordsZ path_recordrv r r r r r s
* z$AVC.derive_avc_info_from_audit_eventc C sP | j rL| jr,t| j| _| jr,| jj| j | jrLt| j}|rL| jj| d S )N)r r Z get_package_nvr_by_file_pathr r r r r )rE Zrpmr r r r s
z AVC.derive_environmental_infoc C s | j d kr|| _ d S )N)r )rE rv r r r set_alt_path
s
zAVC.set_alt_pathc K s, x&t |j D ]\}}|r|| j|< qW d S )N)rP rw r )rE kwdsrs ry r r r set_template_substitutions s z AVC.set_template_substitutionsc C sV t | jj| jd< t | jj| jd< t | j| jd< t | j| jd< | jrdtjddt | j| jd< t | j | jd< | j rtjddt | j | jd < | j d krd | jd
< nJ| j
d krt | j | jd
< n.| j
d krt t j j
| j | jd
< n
d | jd
< t | j
| jd
< | jd kr d | jd< nt dj| j| jd< t | j| jd< t | j| jd< d S )NZ SOURCE_TYPEZ TARGET_TYPEr Z SOURCE_PATHr .ZFIX_SOURCE_PATHZ TARGET_PATHZFIX_TARGET_PATHZ
TARGET_DIRrp rr Z TARGET_CLASSZACCESSZSOURCE_PACKAGEZ PORT_NUMBER) escape_htmlr r; r r r r r r
r r r rv dirnamer rD r r )rE r r r r s,
z)AVC.update_derived_template_substitutionsc C s: x4t | jj D ]"\}}|d krtt|| j|< qW d S )N)rP r rw r Z default_text)rE rs ry r r r validate_template_substitutions5 s z#AVC.validate_template_substitutionsN)T)7rU rV rW Zstat_file_permsZ x_file_permsZ r_file_permsZ
rx_file_permsZ
ra_file_permsZlink_file_permsZcreate_lnk_permsZcreate_file_permsZ r_dir_permsZ rw_dir_permsZ ra_dir_permsZcreate_dir_permsZmount_fs_permsZsearch_dir_permsZgetattr_dir_permsZsetattr_dir_permsZlist_dir_permsZadd_entry_dir_permsZdel_entry_dir_permsZmanage_dir_permsZgetattr_file_permsZsetattr_file_permsZread_file_permsZappend_file_permsZwrite_file_permsZ
rw_file_permsZdelete_file_permsZmanage_file_permsr r r r r? rI r r r r r r r r r r r r r r r r r r r r r r r [ sn
b ))Z
__future__r rA Z six.movesr r| __all__r r r r r rJ base64r Zselinux.audit2whyr Zsetroubleshoot.utilZsetroubleshoot.html_utilZ setroubleshoot.xml_serializeZsepolicyr ZcmpZget_standard_directoriesr r r r r% r r0 r1 r2 r3 Z XmlSerializer r r
r r r r r r r sV
)< !Mj