3
Qf4 @ s2 d dl mZ dddddgZd dlmZmZ d dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
Z
d dlZd dlZd d lmZmZ ed
d Zed
d Zi Ze
jdBk rded< e jf eede e jeeddZy
ejZW n e k
r ej ZY nX d dl m Z d dl m Z m!Z!m"Z"m#Z# d dl$T d dlmZ d dl$m%Z% d dl&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z- d dl.m/Z/m0Z0m1Z1m2Z2 d dl3m4Z4m5Z5m6Z6 d dl7m8Z8m9Z9m:Z:m;Z;mZ> e ZfdCd@dZgehdAkr.eg dS )D )absolute_importRunFaultServerClientConnectionHandlerget_host_databasesend_alert_notificationConnectionPool)GObjectGLibN)parse_config_setting
get_configZgeneralZi18n_text_domainZi18n_locale_dir TZunicode)domain localedir)r
r Zfallback) ServerAccess)PluginReportReceiverSETroubleshootDatabaseTestPluginReportReceiver
AnalyzeThread)*)r )AuditRecordReceiver) ProgramErrorERR_NOT_AUTHENTICATEDERR_USER_LOOKUPERR_USER_PROHIBITEDERR_USER_PERMISSION
ERR_FILE_OPENERR_DATABASE_NOT_FOUND)
RpcChannelConnectionStateget_socket_list_from_configListeningServer) SETroubleshootServerInterface%SETroubleshootDatabaseNotifyInterfaceSEAlertInterface) get_hostnamemake_database_filepath!assure_file_ownership_permissions get_identitylog_init log_debug syslog_tracesetroubleshootd_logc C s8 t d| dd lj}| tjkr4t d |j d S d S )Nzreceived signal=%sr z reloading configuration file)r) setroubleshoot.configconfigsignalSIGHUPZ config_init)signumframer- r2 /usr/lib/python3.6/server.py
sighandlerm s
r4 c C s( t d| tjtjd tjd d S )Nzreceived signal=%sz=/sys/fs/selinux/policy is in use by another process. Exiting! )r) syslogLOG_ERRos_exit)r0 r1 r2 r2 r3 polling_failed_handlerv s r: c C s0 dd l } t }tj }t| j }d|||f S )Nr z%s:%s:%s)timer$ r8 getpidstr)r; ZhostnamepidZstampr2 r2 r3 make_instance_id} s
r? c C s t S )N)
host_databaser2 r2 r2 r3 r s Z system_dbusZbus_name object_pathZ interfacec C sT t jjttd}|j| j |j| j tj | x t
j dD ]}|j | q>W d S )Nalertsealert)
dbusZlowlevelZ
SignalMessagedbus_system_object_pathdbus_system_interfaceappendlevellocal_id
system_busZ send_messageconnection_poolclientsrB )siginforB clientr2 r2 r3 r s
ZemailZrecipients_filepathpkg_name pkg_version rpc_versionc @ s8 e Zd Zdd Zdd Zdd Zd dd Zd
d
d ZdS )r c C s
i | _ d S )N) client_pool)selfr2 r2 r3 __init__ s zConnectionPool.__init__c C s( || j krtd| d S d | j |< d S )Nz.add_client: client (%s) already in client pool)rR r) )rS handlerr2 r2 r3
add_client s
zConnectionPool.add_clientc C s& || j krtd| d S | j |= d S )Nz-remove_client: client (%s) not in client pool)rR r) )rS rU r2 r2 r3
remove_client s
z ConnectionPool.remove_clientNc c s4 x.| j D ]$}|d kr |V q|j|kr|V qW d S )N)rR channel_type)rS rX rN r2 r2 r3 rL s
zConnectionPool.clientsc C s& x | j D ]}|j|kr|j qW d S )N)rR rX Zclose_connection)rS rX rN r2 r2 r3 close_all s
zConnectionPool.close_all)N)N)__name__
__module__ __qualname__rT rV rW rL rY r2 r2 r2 r3 r s
c s( e Zd Z fddZ fddZ ZS )AlertPluginReportReceiverc s t t| j| d S )N)superr] rT )rS database) __class__r2 r3 rT s z"AlertPluginReportReceiver.__init__c s^ t t| j|}td k rg }xHtjD ]>}d|j }|j||j}|dkr$td|j |j
|j q$W t |rddl m
} ||| | jj td ddlm} tjtj|j td|j x&|jjD ]}|jd kr|jd
} P qW td d t rt j j |j | t!d
xB|j"D ]8}
|
j#dd dkr2q|j|
j#}|dkr|S qW t$| |S )Nzemail:%signorezEmail: siginfo.sig=%sr ) email_alertz sending alert to all clients) html_to_textz1 For complete SELinux messages run: sealert -l %sAVCr> r+ Zlog_full_report)Z
OBJECT_PIDZSYSLOG_IDENTIFIER zemail:)%r^ r] report_problememail_recipientsZrecipient_listZaddressevaluate_filter_for_user filter_typer) sigrG lenZsetroubleshoot.email_alertrb r_ Z
mark_modifiedZsetroubleshoot.html_utilrc r6 r7 summary_rI audit_eventrecords record_typefieldsr boolsystemdZjournalsendZ format_textrO Zusersusernamer ) rS rM Zto_addrsZ recipientru actionrb rc audit_recordr> u)r` r2 r3 rf s<
z(AlertPluginReportReceiver.report_problem)rZ r[ r\ rT rf
__classcell__r2 r2 )r` r3 r] s r] c @ s$ e Zd Zdd Zdd Zdd ZdS )r c C s* t j| d |j | _| jjd| j d S )NrC Zchanged)r rT copysocket_addressconnection_stateZconnecton_connection_state_change)rS r{ r2 r2 r3 rT s
z ClientConnectionHandler.__init__c C sT t d| jj||j||j|| jf |tj@ r|D ]6} | j
|k rPq@| j ||kr@|j | j
| j | jf q@W |S )Ni@B r )r' r r r setroubleshootutilZ TimeStampfloatr signature_listlast_seen_daterh rG rI rl report_count)
rS sincer alert_actionru r_ Z since_alertsdatabase_alertsZalertsrB r2 r2 r3 _get_all_alerts_since s
z/SetroubleshootdDBusObject._get_all_alerts_sincetza(ssi)c C s | j ||S )N)r )rS r r r2 r2 r3 get_all_alerts_since s z.SetroubleshootdDBusObject.get_all_alerts_sincer c C s | j d|S )a
Return array of *local_id*'s, *summary*'s, and *report_count*'s of all current alerts in a setroubleshoot database
returns list of:
* `local_id(s)`: a report id in a setroubleshoot database
* `summary(s)`: a brief description of an alert. E.g. `"SELinux is preventing /usr/bin/bash from ioctl access on the unix_stream_socket unix_stream_socket."`
* `report_count(i)`: count of reports of this alert
r )r )rS r r2 r2 r3 get_all_alerts s
z(SetroubleshootdDBusObject.get_all_alertsc C s | j d|ddS )a
Return array of *local_id*'s, *summary*'s, and *report_count*'s of all alerts which a user set to be ignored by a user
returns list of:
* `local_id(s)`: a report id in a setroubleshoot database
* `summary(s)`: a brief description of an alert. E.g. `"SELinux is preventing /usr/bin/bash from ioctl access on the unix_stream_socket unix_stream_socket."`
* `report_count(i)`: count of reports of this alert
r ra )r )r )rS r r2 r2 r3 get_all_alerts_ignored( s
z0SetroubleshootdDBusObject.get_all_alerts_ignoredc C sF y|j |}W n& tk
r4 } z
|W Y d d }~X nX |j j }|S )N)r r r __next__)rS rI r_ r r rB r2 r2 r3
_get_alert4 s z$SetroubleshootdDBusObject._get_alertzssiasa(ssssbbi)ttsc
C s t | jj|}t }| j||}|j |jj}dd |D }|j \}} g }
xZ| D ]R\} } |
j |j
| j || |j
| j || |j
| j
|| | j| j| j| jf qVW |j|j |j||
t|jjdd t|jjdd |jpdfS )ar
Return an alert with summary, audit events, fix suggestions
##### arguments
* `local_id(s)`: an alert id
##### return values
* `local_id(s)`: an alert id
* `summary(s)`: a brief description of an alert. E.g. `"SELinux is preventing /usr/bin/bash from
ioctl access on the unix_stream_socket unix_stream_socket."`
* `report_count(i)`: count of reports of this alert
* `audit_event(as)`: an array of audit events (AVC, SYSCALL) connected to the alert
* `plugin_analysis(a(ssssbb)`: an array of plugin analysis structure
* `if_text(s)`:
* `then_text(s)`
* `do_text(s)`
* `analysis_id(s)`: plugin id. It can be used in `org.fedoraproject.SetroubleshootFixit.run_fix()`
* `fixable(b)`: True when an alert is fixable by a plugin
* `report_bug(b)`: True when an alert should be reported to bugzilla
* `priority(i)`: An analysis priority. Typically the value is between 1 - 100.
* `first_seen_date(t)`: when the alert was seen for the first time, number of microseconds since the Epoch
* `last_seen_date(t)`: when the alert was seen for the last time, number of microseconds since the Epoch
* `level(s)`: "green", "yellow" or "red"
c S s g | ] }|j qS r2 )Zto_text).0Zeventr2 r2 r3
^ s z7SetroubleshootdDBusObject.get_alert..z%si@B r )r' r r r r Z%update_derived_template_substitutionsrn ro Z get_pluginsrG Z
substituteZ get_if_textZ
get_then_textZ get_do_textZ analysis_idZfixableZ
report_bugZpriorityrI rl r intZfirst_seen_dateformatr rH )
rS rI r ru r_ rB r Z audit_eventsZtotal_priorityZ
alert_pluginsZpluginsZpluginargsr2 r2 r3 get_alert< s, z#SetroubleshootdDBusObject.get_alertbc C sX yHt | jj|}t }| j||}ddlm} |j|j||| d dS dS dS )z
Sets a filter on an alert. The alert can be "always" filtered, "never" filtered or "after_first" filtered.
##### arguments
* `local_id(s)`: an alert id
* `filter_type(s)`: "always", "never", "after_first"
##### return values
* `success(b)`:
r )map_filter_name_to_valueNTF) r' r r r r setroubleshoot.signaturer r rj )rS rI ri r ru r_ rB r r2 r2 r3 r t s z$SetroubleshootdDBusObject.set_filterc C s2 y"t }| j||}|j|j dS dS dS )zz
Deletes an alert from the database.
##### arguments
* `local_id(s)`: an alert id
##### return values
* `success(b)`:
TFN)r r r rj )rS rI r r_ rB r2 r2 r3 delete_alert s
z&SetroubleshootdDBusObject.delete_alert)r r c
C s t |}| jd | jd7 _td|| jf x^| jjt |D ]J\}}}}}t|||||}|j x"| jj|D ]}| j t
| qxW qDW x\| jj dD ]L}y| j t
| W q t k
r } zt
j
t
jd| W Y d d } ~ X qX qW | jd8 _| j| j tdS )Nr r5 z#dbus avc(%s) called: %d Connectionsz Unable to add audit event: %srd )r= r r r) r ZfeedZ AuditRecordZaudispd_rectifyr r rd flushr r6 r7 r rm )
rS r rp Zevent_idZ body_textrq Z line_numberrw rn r r2 r2 r3 r s"
( z SetroubleshootdDBusObject.avcc C s, | j d8 _ td| j | j| j dS )Nr5 z*dbus iface finish() called: %d Connectionsr )r r) r r )rS r2 r2 r3 finish s z SetroubleshootdDBusObject.finishc C s | j dkrtj| d S )Nr )r r. r )rS r r2 r2 r3 r s
z SetroubleshootdDBusObject.alarmN)r )r )r )rZ r[ r\ rT r rD r r. rF r rB methodr r r r r r r r r r r r r r2 r2 r2 r3 r s"
8 r c C s | j S )N)r )ar2 r2 r3 r s r c @ s e Zd Zdd Zdd ZdS )SetroubleshootdDBusc C sd y&t dtttf tt|||| _W n8 tk
r^ } z tjtjd| |W Y d d }~X nX d S )Nz=creating system dbus: bus_name=%s object_path=%s interface=%sz$cannot start system DBus service: %s) r) dbus_system_bus_namerE rF r dbus_obj Exceptionr6 r7 )rS r r r r r2 r2 r3 rT s z SetroubleshootdDBus.__init__c C s | j jd dS )Nzdaemon requestT)r r )rS r2 r2 r3
do_restart s z SetroubleshootdDBus.do_restartN)rZ r[ r\ rT r r2 r2 r2 r3 r s r c C s | j tj d S )N)save audit2whyr )r_ r2 r2 r3 goodbye s r c C s t d tj d S )Nz SIGALRM raised in RunFaultServer)r) main_loopquit)r0 r1 r2 r2 r3
alarm_handler s r r c C s t j| t j t jt xytj t jd P W q tk
rf } zdt|krRw|W Y d d }~X q tk
r } z dtt |ddkrw|W Y d d }~X qX qW t j t jt
t j t j t yt
jt tt}tdd}t|}t|dd t||td d
atj| tjtt d }xtj j D ]}tj t|j j t|j j!t|j j"|j j#\}}|tj$ksx|tj%kr,|tj$krd } nd
} t
j
t
j&d|j'| f d}tj(|j q,W |rtj)dd tddt*st+t}
nt,t}
dd l-} | j.j/j0da1t2t1| } | j3d | j4 ddl5m6}
|
a7tt8dd yt7j9t8 W n@ t:k
r } z"|j;t n|W Y d d }~X nX t?d}x |D ]}t@|tA}|jB qW tCjDjE tFt1|
| }tGjH W n tIk
r } zt=d W Y d d }~X n tJk
r. } zt=d W Y d d }~X nV tKk
r } z8dd lL}tM|jN t
j
t
j&d|jOjPt|f W Y d d }~X nX d S )Nr z%unable to open /sys/fs/selinux/policy __context__r r_ filenamei r zAudit Listener)Z
friendly_nameFZallowedz dontaudit'dz-Deleting alert %s, it is %s in current policyT)ZpruneZtestanalyze)SEEmailRecipientSetZlisten_for_clientz#KeyboardInterrupt in RunFaultServerz$raising SystemExit in RunFaultServerzexception %s: %s)Qr. r SIGALRMr: r Zinitr r= SystemErrorgetattrr r/ r4 r6 ZopenlogrO r rK r r% r& r rm r@ Z
set_notifyatexitregisterr r r r rj ZscontextZtcontextZtclassr ZALLOWZ DONTAUDITr7 rI r r rr r] r Zsix.moves.queueZmovesr ZQueuer r Z setDaemonr r r rg r Zparse_recipient_filer errnor r) strerrorr r r r rD ZglibZ init_threadsr r ZrunKeyboardInterrupt
SystemExitr tracebackr*
format_excr` rZ )r r Zclient_notifierZdatabase_filenameZdatabase_filepathZdeletediZwhyZboolsr r ZsixZanalyze_threadr Zlisten_addressesZlisten_addressZlistening_serverZsetroubleshootd_dbusr r2 r2 r3 r s
0
__main__)r )r )iZ
__future__r __all__Z
gi.repositoryr r rD Z dbus.serviceZ dbus.glibgettextr8 r. r sysr6 Zsystemd.journalrs r, r
r r
r kwargs version_infoZinstallZ translationZugettextrm AttributeErrorZ setroubleshoot.access_controlr Zsetroubleshoot.analyzer r r r Zsetroubleshoot.avc_auditr Zsetroubleshoot.errcoder r r r r r r Zsetroubleshoot.rpcr r r r Z setroubleshoot.rpc_interfacesr! r" r# Zsetroubleshoot.utilr$ r% r& r' r( r) r* r4 r: r? r r rE rF r rJ Z request_namer r@ r rg r rO rP rQ Z instance_idobjectr rK r] r r r Zsetroubleshoot.audit_datar r r r r r r Zselinux.audit2whyr r ZMainLoopr r r rZ r2 r2 r2 r3 s
$ $
0