a h@s*ddlmZgdZddlmZmZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlmZmZeddZeddZiZe jd krd ed <e jfeed ee jeed d Zz ejZWneyej ZYn0ddlmZddlm Z m!Z!m"Z"m#Z#ddl$TddlmZddl$m%Z%ddl&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-ddl.m/Z/m0Z0m1Z1m2Z2ddl3m4Z4m5Z5m6Z6ddl7m8Z8m9Z9m:Z:m;Z;mZ>eZfdCd@dAZgehdBkr&egdS)D)absolute_import)RunFaultServerClientConnectionHandlerget_host_databasesend_alert_notificationConnectionPool)GObjectGLibN)parse_config_setting get_configZgeneralZi18n_text_domainZi18n_locale_dir)TZunicode)domain localedir)r rfallback) ServerAccess)PluginReportReceiverSETroubleshootDatabaseTestPluginReportReceiver AnalyzeThread)*)r )AuditRecordReceiver) ProgramErrorERR_NOT_AUTHENTICATEDERR_USER_LOOKUPERR_USER_PROHIBITEDERR_USER_PERMISSION ERR_FILE_OPENERR_DATABASE_NOT_FOUND) RpcChannelConnectionStateget_socket_list_from_configListeningServer)SETroubleshootServerInterface%SETroubleshootDatabaseNotifyInterfaceSEAlertInterface) get_hostnamemake_database_filepath!assure_file_ownership_permissions get_identitylog_init log_debug syslog_tracesetroubleshootd_logcCs:td|ddlm}|tjkr6td|dSdS)Nreceived signal=%srzreloading configuration file)r*setroubleshoot.configconfigsignalSIGHUPZ config_init)signumframer/r49/usr/lib/python3.9/site-packages/setroubleshoot/server.py sighandlerms    r6cCs(td|ttjdtddS)Nr-z=/sys/fs/selinux/policy is in use by another process. Exiting!)r*syslogLOG_ERRos_exitr2r3r4r4r5polling_failed_handlervs r=cCs0ddl}t}t}t|}d|||fS)Nrz%s:%s:%s)timer%r:getpidstr)r>hostnamepidZstampr4r4r5make_instance_id}s  rCcCstSN) host_databaser4r4r4r5rsrZ system_dbusZbus_name object_pathZ interfacecCsPtjttd}||j||jt |t dD]}| |q}d|j}|||j}|dkr"td|j | |jq"t |rddl m }||||jtdddlm}ttj|td|j|jjD]}|jd kr|jd } qqtd d trtjj| | t!d |j"D]<} | j#dddkr*q|| j#}|dkr|Sqt$||S)Nzemail:%signorezEmail: siginfo.sig=%sr) email_alertzsending alert to all clients) html_to_textz1 For complete SELinux messages run: sealert -l %sAVCrBr,Zlog_full_report)Z OBJECT_PIDZSYSLOG_IDENTIFIERzemail:)%rfrereport_problememail_recipientsZrecipient_listaddressevaluate_filter_for_user filter_typer*sigrLlenZsetroubleshoot.email_alertrkrgZ mark_modifiedZsetroubleshoot.html_utilrlr8r9summary_rN audit_eventrecords record_typefieldsr boolsystemdZjournalsendZ format_textrTZusersusernamer) rYrRZto_addrsZ recipientractionrkrl audit_recordrBurhr4r5ros<              z(AlertPluginReportReceiver.report_problem)rbrcrdrZro __classcell__r4r4rhr5res rec@s$eZdZddZddZddZdS)rcCs*t|d||_|jd|jdS)NrHZchanged)rrZcopysocket_addressconnection_stateZconnecton_connection_state_changerYrr4r4r5rZs  z ClientConnectionHandler.__init__cCsTtd|jj||||||jf|tj@r| ||kr>| | j | | jfq>|S)N@Br)r(rrrrrZ TimeStampfloatrsignature_listlast_seen_daterrrLrNrv report_count) rYsincer alert_actionrrgZ since_alertsdatabase_alertsZalertsrGr4r4r5_get_all_alerts_since s  z/SetroubleshootdDBusObject._get_all_alerts_sincetza(ssi)cCs |||SrDr)rYrrr4r4r5get_all_alerts_sincesz.SetroubleshootdDBusObject.get_all_alerts_sincercCs |d|S)a Return array of *local_id*'s, *summary*'s, and *report_count*'s of all current alerts in a setroubleshoot database returns list of: * `local_id(s)`: a report id in a setroubleshoot database * `summary(s)`: a brief description of an alert. E.g. `"SELinux is preventing /usr/bin/bash from ioctl access on the unix_stream_socket unix_stream_socket."` * `report_count(i)`: count of reports of this alert rrrYrr4r4r5get_all_alertss z(SetroubleshootdDBusObject.get_all_alertscCs|jd|ddS)a Return array of *local_id*'s, *summary*'s, and *report_count*'s of all alerts which a user set to be ignored by a user returns list of: * `local_id(s)`: a report id in a setroubleshoot database * `summary(s)`: a brief description of an alert. E.g. `"SELinux is preventing /usr/bin/bash from ioctl access on the unix_stream_socket unix_stream_socket."` * `report_count(i)`: count of reports of this alert rrj)rrrr4r4r5get_all_alerts_ignored)s z0SetroubleshootdDBusObject.get_all_alerts_ignoredc CsHz||}Wn(ty6}z|WYd}~n d}~00|}|SrD)rrr__next__)rYrNrgrerGr4r4r5 _get_alert5s  z$SetroubleshootdDBusObject._get_alertzssiasa(ssssbbi)ttsc Cst|j|}t}|||}||jj}dd|D}|\}} g} | D]R\} } | | | || | | || | | || | j| j| j| jfqT|j||j|| t|jddt|jdd|jpdfS)ar Return an alert with summary, audit events, fix suggestions ##### arguments * `local_id(s)`: an alert id ##### return values * `local_id(s)`: an alert id * `summary(s)`: a brief description of an alert. E.g. `"SELinux is preventing /usr/bin/bash from ioctl access on the unix_stream_socket unix_stream_socket."` * `report_count(i)`: count of reports of this alert * `audit_event(as)`: an array of audit events (AVC, SYSCALL) connected to the alert * `plugin_analysis(a(ssssbb)`: an array of plugin analysis structure * `if_text(s)`: * `then_text(s)` * `do_text(s)` * `analysis_id(s)`: plugin id. It can be used in `org.fedoraproject.SetroubleshootFixit.run_fix()` * `fixable(b)`: True when an alert is fixable by a plugin * `report_bug(b)`: True when an alert should be reported to bugzilla * `priority(i)`: An analysis priority. Typically the value is between 1 - 100. * `first_seen_date(t)`: when the alert was seen for the first time, number of microseconds since the Epoch * `last_seen_date(t)`: when the alert was seen for the last time, number of microseconds since the Epoch * `level(s)`: "green", "yellow" or "red" cSsg|] }|qSr4)Zto_text).0Zeventr4r4r5 _z7SetroubleshootdDBusObject.get_alert..z%srr)r(rrrrZ%update_derived_template_substitutionsrxryZ get_pluginsrLZ substituteZ get_if_textZ get_then_textZ get_do_textZ analysis_idZfixableZ report_bugpriorityrNrvrintZfirst_seen_dateformatrrM) rYrNrrrgrGrZ audit_eventsZtotal_priorityZ alert_pluginsZpluginsZpluginargsr4r4r5 get_alert=s0    z#SetroubleshootdDBusObject.get_alertbcCs^zJt|j|}t}|||}ddlm}||j|||dWdSYdS0dS)z Sets a filter on an alert. The alert can be "always" filtered, "never" filtered or "after_first" filtered. ##### arguments * `local_id(s)`: an alert id * `filter_type(s)`: "always", "never", "after_first" ##### return values * `success(b)`: r)map_filter_name_to_valueNTF) r(rrrrsetroubleshoot.signaturerrrt)rYrNrsrrrgrGrr4r4r5rus  z$SetroubleshootdDBusObject.set_filtercCs8z$t}|||}||jWdSYdS0dS)zz Deletes an alert from the database. ##### arguments * `local_id(s)`: an alert id ##### return values * `success(b)`: TFN)rrrrt)rYrNrrgrGr4r4r5 delete_alerts   z&SetroubleshootdDBusObject.delete_alert)rrc Cst|}z|jd7_|dtd||jf|j|D]B\}}}}}t|||||}||j|D]}| |qrq@|j dD]}| |qW|jd8_||j n|jd8_||j 0t dS)Nr7rz#dbus avc(%s) called: %d Connectionsrm) r@rrr*rZfeedZ AuditRecordZaudispd_rectifyrrflushrrw) rYrrzZevent_idZ body_textr{Z line_numberrrxr4r4r5rs" zSetroubleshootdDBusObject.avccCs,|jd8_td|j||jdS)Nr7z*dbus iface finish() called: %d Connectionsr)rr*rrrXr4r4r5finishs z SetroubleshootdDBusObject.finishcCs |jdks|dkrt|dS)Nr)rr0r)rYrr4r4r5rszSetroubleshootdDBusObject.alarmN)r)r)r)rbrcrdrZrrIrr0rKrrGmethodrrrrrrrrrrrrrr4r4r4r5rs:            7     rcCs|jSrD)r)ar4r4r5rsrc@seZdZddZddZdS)SetroubleshootdDBusc Csfz&tdtttftt||||_Wn:ty`}z"ttjd||WYd}~n d}~00dS)Nz=creating system dbus: bus_name=%s object_path=%s interface=%sz$cannot start system DBus service: %s) r*dbus_system_bus_namerJrKrdbus_obj Exceptionr8r9)rYrrrrr4r4r5rZs zSetroubleshootdDBus.__init__cCs|jddS)Nzdaemon requestT)rrrXr4r4r5 do_restarts zSetroubleshootdDBus.do_restartN)rbrcrdrZrr4r4r4r5rsrcCs|tdSrD)save audit2whyr)rgr4r4r5goodbyesrcCstdtdS)Nz SIGALRM raised in RunFaultServer)r* main_loopquitr<r4r4r5 alarm_handlersrrc Cst|ttjtzttdWqWqtyr}z(dt|vrZWYd}~q|WYd}~qd}~0ty}z0dtt |ddvrWYd}~q|WYd}~qd}~00qttjt ttj t zt ttt}tdd}t|}t|ddt||td d at|tttd }tjjD]}tt|jj t|jj!t|jj"|jj#\}}|tj$tj%tj&tj'tj(tj)fvr@|tj$krd } nv|tj%krd } nd|tj&krd|jj } nJ|tj'krd|jj!} n0|tj(krd|jj"} } ndd*|jj#} t t j+d|j,| fd}t-|jq@|r^tj.ddtddt/svt0t} nt1t} ddl2} | j3j45da6t7t6|} | 8d| 9ddl:m;} | at=WnBt?y}z(|j@tAkrtB|jCn|WYd}~n d}~00tDd}|D]}tE|tF}|Gq,tHjIJtKt6| |}tLMWntNy}ztBdWYd}~nd}~0tOy}ztBdWYd}~n`d}~0tPy}z>ddlQ}tR|St t jTd|jUjVt|fWYd}~n d}~00dS)Nrz%unable to open /sys/fs/selinux/policy __context__rrgfilenameirzAudit Listener)Z friendly_nameFz it is allowedzit is dontaudit'dzsource context %s is undefinedztarget context %s is undefinedzsecurity class %s is undefinedzpermission %s is undefined,z'Deleting alert %s, %s in current policyT)Zprunetestanalyze)SEEmailRecipientSetZlisten_for_clientz#KeyboardInterrupt in RunFaultServerz$raising SystemExit in RunFaultServerzexception %s: %s)Wr0rSIGALRMr=rinit ValueErrorr@ SystemErrorgetattrrr1r6r8ZopenlogrTrrPr r&r'rrwrEZ set_notifyatexitregisterrrrr rtZscontextZtcontextZtclassrZALLOWZ DONTAUDITZBADSCONZBADTCONZ BADTCLASSZBADPERMjoinZ LOG_NOTICErNrrr|rerZsix.moves.queueZmovesrZQueuerr setDaemonrrr rprZparse_recipient_filererrnorr*strerrorr r!rrrIZglibZ init_threadsrrrunKeyboardInterrupt SystemExitr tracebackr+ format_excr9rirb)rrZclient_notifierZdatabase_filenameZdatabase_filepathZdeletediwhyZboolsrrZsixZanalyze_threadr Zlisten_addressesZlisten_addressZlistening_serverZsetroubleshootd_dbusrr4r4r5rs          0"                   r__main__)r)iZ __future__r__all__Z gi.repositoryrr rIZ dbus.serviceZ dbus.glibgettextr:r0rsysr8Zsystemd.journalr}r.r r r rkwargs version_infoinstall translationZugettextrwAttributeErrorZsetroubleshoot.access_controlrZsetroubleshoot.analyzerrrrZsetroubleshoot.avc_auditrZsetroubleshoot.errcoderrrrrrrZsetroubleshoot.rpcrrr r!Zsetroubleshoot.rpc_interfacesr"r#r$Zsetroubleshoot.utilr%r&r'r(r)r*r+r6r=rCrrrJrKrrOZ request_namerrErrprrTrUrVZ instance_idobjectrrPrerrrZsetroubleshoot.audit_datarrrrrrrZselinux.audit2whyrrZMainLooprrrrbr4r4r4r5s          $ $          0 !