+
    	:iס  c                   s   ^ RI Ht ^ RIt. ROt^ RIt^ RIt^ RIt^ RIt^ RIt^ RI	t	^ RI
t
^ R	I5 ^ RIHt ^ R	I5 ^ R	I5 ^ R	I5 ^ R	I5 ^tR
 tR tR t]P,                  ! R4      tR t]P,                  ! R4      tR t^ RItR t ! R R]4      t ! R R]4      t ! R R]4      t  ! R R4      t! ! R R]4      t" ! R R]#4      t$ ! R R4      t%R t&R# )    )absolute_importN
AvcContextAVCAuditEventID
AuditEventAuditRecordAuditRecordReader)Z*c                 s    W8  W8  ,
          # N )xy   &&>/usr/lib/python3.14/site-packages/setroubleshoot/audit_data.py<lambda>r   4   s    AEae$    c                 s:    \        V 4      w  rr4\        W#V4      pV# r   )parse_audit_record_textr   )textparse_succeededrecord_typeevent_id	body_textaudit_records   &     r   audit_record_from_textr   :   s$    8OPT8U5O({i@Lr   c                 s    \         P                  ! R V 4      '       d   \        P                  # \         P                  ! RV 4      '       d   \        P                  # \        P                  # )z/audispd_events$z/audit_events$)researchr   TEXT_FORMATBINARY_FORMAT)Zsocket_path   &r   derive_record_formatr   B   sJ    	yy#[11 ,,,	yy!;// ...(((r   zL(node=(\S+)\s+)?(type=(\S+)\s+)?(msg=)?audit\(((\d+)\.(\d+):(\d+))\):\s*(.*)c                 s   R pRpRpRpRp\         P                  V 4      pVe   RpVP                  ^4      '       d   VP                  ^4      pVP                  ^4      '       d   VP                  ^4      pVP                  ^4      '       d[   \        VP                  ^4      4      p\        VP                  ^4      4      p\        VP                  ^	4      4      p	\	        WxW4      pVP                  ^
4      pWWE3# FNT)audit_input_rer   groupintr   )
inputr   hostr   r   r   matchsecondsmilliserials
   &         r   r   r   [   s    ODKHI!!%(E;;q>>;;q>D;;q>>++a.K;;q>>%++a.)GA'EQ(F#GFAHKKO	(>>r   z%audit\(((\d+)\.(\d+):(\d+))\):\s*(.*)c                 sP   R pRpRp\         P                  V 4      pVe   RpVP                  ^4      '       d[   \        VP                  ^4      4      p\        VP                  ^4      4      p\        VP                  ^4      4      p\	        WVV4      pVP                  ^4      pWV3# r   )audit_binary_input_rer   r    r!   r   )r"   r   r   r   r$   r%   r&   r'      &       r   parse_audit_binary_textr*   y   s    OHI!((/E;;q>>%++a.)GA'EQ(F#GF;HKKN	y11r   c                 s~    V '       d0   V  Uu. uF  q\         P                  9   g   K  VNK  	  ppW 8X  d   R # R# u upi TF)string	printable)Zsr
   Zfiltered_path   &  r   r-   r-      s8    $%?Aqf.>.>)>A? @s   ::c            	       sn   a a ] tR t^t oRRR/RRR/RRR/RRR//tV 3R ltR tR	 tR
 tR t	Rt
VtV ;t# )r   userXMLForm	attributeroletypemlsc                sb  < \         \        V `  4        \        V\        4      '       d   VP                  R 4      p\        V4      ^8  dc   V^ ,          V n        V^,          V n        V^,          V n	        \        V4      ^8  d    R P                  VR,          4      V n        R# RV n        R# R# R# )::   NNZs0N)superr   __init__
isinstancestrsplitlenr/   r2   r3   joinr4   )selfdatafields	__class__s   && r   r8   ZAvcContext.__init__   s    j$(*dC  ZZ_F6{a"1I	"1I	"1I	v;?"xxr
3DH#DH   !r   c                st    V P                   : R V P                  : R V P                  : R V P                  : 2# )r5   )r/   r2   r3   r4   r>   r   r   __str__ZAvcContext.__str__   s!     $		499diiJJr   c                sH    \         P                  ! \        V 4      4      w  rV# r   )selinuxZselinux_raw_to_trans_contextr:   )r>   ZrcZtransr.   r   formatZAvcContext.format   s    ::3t9Er   c                s.    V P                  V4      '       * # r   )__eq__r>   otherr   r   __ne__ZAvcContext.__ne__   s    ;;u%%%r   c                s    \        V P                  P                  4       4       F  p\        W4      \        W4      8w  g   K   R # 	  R# FT)list	_xml_infoZkeysgetattr)r>   rH   name   && r   rF   ZAvcContext.__eq__   s8    ,,./Dt"ge&:: 0 r   )r4   r2   r3   r/   )__name__
__module____qualname____firstlineno__rL   r8   rC   rE   rI   rF   __static_attributes____classdictcell____classcell__rA   __classdict__   @@r   r   r      sS     K(K(K(	;'	I$K
& r   c            	       s   a a ] tR t^t oRRRR]/RRRR]/RRRR]/RRR//tRV 3R lltR	 tR
 tR t	]
! R 4      tR tR tRtVtV ;t# )r   r%   r0   r1   import_typecastr&   r'   r#   c                sh   < \         \        V `  4        Wn        W n        W0n        Ve	   W@n        R # R # r   )r7   r   r8   r%   r&   r'   r#   )r>   r%   r&   r'   r#   rA   s   &&&&&r   r8   ZAuditEventID.__init__   s/    lD*,
I r   c                s    V P                   VP                   8w  d   R # V P                  VP                  8w  d   R # V P                  VP                  8w  d   R # V P                  VP                  8w  d   R # R# rJ   )r#   r%   r&   r'   rG   r   r   rF   ZAuditEventID.__eq__   sQ    99

"<<5==(::$;;%,,&r   c           	     s   V P                   VP                   8w  dA   \        R V P                  P                  : RV P                   : RVP                   : R24      hV P                  VP                  8w  d   V P                  VP                  8  # V P
                  VP
                  8w  d   V P
                  VP
                  8  # V P                  VP                  8  # )zcannot compare two z# objects whose host values differ (z!=Z))r#   
ValueErrorrA   rP   r%   r&   r'   rG   r   r   __lt__ZAuditEventID.__lt__   s    99

" $ 7 7EJJP Q Q <<5==(<<%--//::$::++{{U\\))r   c                s,    ^ RI pVP                  V 4      # r    N)copy)r>   r^      & r   r^   ZAuditEventID.copy   s    yyr   c                s\    \        V P                  4      V P                  R ,          ,           # )     @@)floatZsecr&   rB   r   r   r   ZAuditEventID.<lambda>   s    txx4::3F!Fr   c                sV    R V P                   V P                  V P                  3,          # )zaudit(%d.%d:%d)r%   r&   r'   rB   r   r   rC   ZAuditEventID.__str__   s      DLL$**dkk#JJJr   c                sf    V P                   f   R# V P                  f   R# V P                  f   R# R# )NFTrb   rB   r   r   is_validZAuditEventID.is_valid   s,    <<::;;r   )r#   r&   r%   r'   r   )rP   rQ   rR   rS   r!   rL   r8   rF   r\   r^   propertyZtimerC   rc   rT   rU   rV   rW   rY   r   r   r      st     I{,=sC)[*;SA9k+<cBK(	I	
* FGDK r   c                   sN  a a ] tR t^t oRRR/RRRR]/RRR/RRRR]//t^ tR	t]	P                  ! ]4      t]P                  ! R
4      t]P                  ! R4      t]P                  ! R4      tRV 3R lltR tR tR tR tR tR tR tR tR tR tR tR tR tR tRt Vt!V ;t"# )r   r   r0   r1   r   elementrZ   r   line_numberZiiiiz([^ \t]+)\s*=\s*([^ \t]+)z$avc:\s+([^\s]+)\s+{([^}]+)}\s+for\s+z^a\d+$c                s   < \         \        V `  4        Wn        W n        W0n        W@n        WPn        V P                  4        R # r   )	r7   r   r8   r   r   r   r@   rf   _init_postprocess)r>   r   r   r   r@   rf   rA   s   &&&&&&r   r8   ZAuditRecord.__init__  s7    k4)+& "& r   c                s   \        V R R4      f   V P                  V P                  4       V P                  R9   d   RV P                  9  d   \
        P                  P                  V P                  4      pV'       dP   VP                  ^4      pW P                  R&   VP                  ^4      pVP                  4       V P                  R&   R# R# R# R# )r@   Nseresultsepermsr   ZUSER_AVCZ1400Z1107)
rM   set_fields_from_textr   r   r@   r   avc_rer   r    r;   )r>   r$   rh   ri      &   r   rg   ZAuditRecord._init_postprocess  s    44(0%%dnn5BB,#**11$..A${{1~H.6KK
+#kk!nG-4]]_DKK	*  - Cr   c                "    V P                  4       # r   )to_host_textrB   r   r   rC   ZAuditRecord.__str__%  s      ""r   c                sz    R V n         V P                  P                  f   \        4       V P                  n        R # R # r   )rf   r   r#   Zget_hostnamerB   r   r   audispd_rectifyZAuditRecord.audispd_rectify(  s-    ==%!-DMM &r   c                s    V P                   P                  4       '       g   R # V P                  f   R # V P                  f   R # R# rJ   )r   rc   r   ZmessagerB   r   r   rc   ZAuditRecord.is_valid-  s7    }}%%''#<<r   c                s    V P                   R ,          pVR8X  d   R# VR8X  d   R# \        P                  P                  RV4       R# )rh   ZdeniedFZgrantedTz!unknown value for seresult ('%s'))r@   ZlogZavcZwarn)r>   rh   r_   r   
is_grantedZAuditRecord.is_granted6  s<    ;;z*xy 8(Cr   c                s   . ROpV F[  pW P                   9   g   K  V P                  R8X  d
   VR8X  d   K/  V P                   V,          p\        V4      pW@P                   V&   K]  	  V P                  R8X  d~   \        V P                   P	                  4       4       FT  w  r#V P
                  P                  V4      '       g   K(  V P                   V,          p\        V4      pW@P                   V&   KV  	  R# R# )acctr   ZsaddrZEXECVEN)rr   cmdcommcwdr?   direxefiler#   keymsgrN   ZnewZocommoldpathZwatch)r@   r   Zaudit_msg_decoderK   itemsexec_arg_rer   )r>   Zencoded_fieldsZfieldvalueZdecoded_value   &    r   decode_fieldsZAuditRecord.decode_fields?  s    2 $E###u,'1AE* 0 7%2E" $ x' $T[[%6%6%8 9##**511 KK.E$4U$;M)6KK&	 !: (r   c                s     \         P                  ^ ,          ^8  d   VP                  R4      # \        P	                  V4      P                  R4      #    Tu # ; i)r    Zhexzutf-8)sysZversion_infoZdecodeZ	bytearrayZfromhexr>   r{   r   r   translate_hexZAuditRecord.translate_hexS  sU    	"Q& {{5)) !((.55g>>	Ks   ,A #A Ac                s<   . V n         / V n        \        P                  P	                  V4       EFQ  pVP                  ^4      pVP                  ^4      pVP                  R4      p VR8X  d7   \        P                  ! \        V^4      4      p\        P                  ! V4      pVR9   d8   VP                  ^4      P                  R4      '       g   V P                  V4      pVR8X  d+    \        P                  \        \        V4      4      ,          pVR8X  d>   \        P                   ! \        V4      \        P"                  ! 4       4      pV'       d   TpY@P                  T&   T P                   P'                  T4       EKT  	  R#     Lx; i  \$         d     LDi ; i)i   Z"archZexitsyscallN)rN   r{   rt   rs   rw   ru   )
fields_ordr@   r   key_value_pair_reZfinditerr    stripauditZaudit_elf_to_machiner!   Zaudit_machine_to_name
startswithr   errnoZ	errorcodeZabsZaudit_syscall_to_nameZaudit_detect_machiner[   append)r>   r   r$   ry   r~   iZsyscall_names   &&     r   rk   Z AuditRecord.set_fields_from_textb  sH    22;;IFE++a.CKKNEKK$E&=223ub>BA!77:EGG ;;q>44S99 $ 2 25 9&= %CJ @ )##(#>#>s5z5KeKeKg#hL# ,  %KKOO""3'9 G"  s2   &A)FF))FAFF
FFFc                s8    V P                   P                  V4      # r   )r@   get)r>   rN   r   r   	get_fieldZAuditRecord.get_field  s    {{t$$r   c                s    \        V4      p\        P                  ! \        P                  \        P
                  \        P                  V P                  V4      # r   )r<   structZpackr   binary_header_formatbinary_versionbinary_header_sizer   )r>   rz   
msg_lengthrO   r   get_binary_headerZAuditRecord.get_binary_header  sA    X
{{;;;[=W=W&994;K;KZY 	Yr   c           
     s   V P                   f   R# V P                  R8X  d>   RV P                  : RV P                  : RRP                  V P                  4      : R2pMRV P                  : RV P                  : R2pTRP                  V P
                   Uu. uF  q": R	V P                   V,          : 2NK  	  up4      R
,           ,          pV# u upi )N r   type= msg=z: avc: denied {  z } : Z=
)r@   r   r   r=   accessr   )r>   ZbufZkr.   r   fields_to_textZAuditRecord.fields_to_text  s    ;;u$;?;K;KT]]\_\d\deiepep\qrC % )-(8(8$--HCsxxP1At{{1~6PQTXXX
 Qs   "C
c                s\    R V P                   : RV P                  : RV P                  : R2# )r   r   r   r   )r   r   r   rB   r   r   to_textZAuditRecord.to_text  s    )-)9)94==$..YYr   c           	     s    V P                   P                  eF   RV P                   P                  : RV P                  : RV P                   : RV P                  : R2	# V P	                  4       # )Nznode=z type=r   r   r   )r   r#   r   r   r   rB   r   r   ro   ZAuditRecord.to_host_text  sM    ==)MM&&(8(8$--Y Y <<>!r   c                sl    V P                   : R V P                  : 2pV P                  V4      V,           # )r   )r   r   r   r>   recordr_   r   	to_binaryZAuditRecord.to_binary  s*    !]]DNN;%%f-66r   )r   r   r@   r   rf   r   )NN)#rP   rQ   rR   rS   r   r!   rL   r   r   r   Zcalcsizer   r   compiler   rl   r}   r8   rg   rC   rp   rc   rq   r   r   rk   r   r   r   r   ro   r   rT   rU   rV   rW   rY   r   r   r      s     	;1Y	+<lKi+	;0A3G	I N!)=>

#?@ZZ?@F**Y'K!=#0
7( (D%Y
Z"7 7r   c                   s:   a  ] tR tRt o ^t^tR tR tR tRt	V t
R# )r   i  c                s0   Wn         R V n        ^ V n        V P                   V P                  8X  d   V P                  V n        R# V P                   V P                  8X  d   V P                  V n        R# \        RV: RV P                  P                  : 24      h)r   zunknown record format (z) in N)record_format_input_bufferrf   r   	feed_textfeedr   feed_binaryr[   rA   rP   )r>   r   r   r   r8   ZAuditRecordReader.__init__  su    *!1!11DI4#5#55((DI=RVR`R`RiRijkkr   c              #  sr  "   \        V4      ^ 8:  d   R# V ;P                  V,          un         \        V P                  4      \        P                  8  d   R# \        P
                  ! \        P                  V P                  ^ \        P                   4      w  r#rE\        P                  V,           p\        V P                  4      V8  d   R# V P                  \        P                  V p\        V4      w  rp
V P                  VR V n        V'       g   K  \        P                  ! V4      WR^ 3x  EK	  5ir]   )
r<   r   r   r   r   Zunpackr   r*   r   Zaudit_msg_type_to_name)r>   new_datar   r   r   r   Z	total_lenr   r   r   r   s   &&         r   r   ZAuditRecordReader.feed_binary  s    x=Ah&
  4%%&)G)GG k>>"00;3Q3QRT HN $66CI4%%&2%%k&D&DYOD3J43P0Oy!%!3!3IJ!?D33K@(W[]^__s   DD7D7c              #  s  "   \        V4      ^ 8:  d   R# V ;P                  V,          un        ^ pV P                  P                  RV4      pV^ 8  dy   V ;P                  ^,          un        V^,          pV P                  W# p\	        V4      w  rVrxV'       d   WgVRV P                  3x  TpV P                  P                  RV4      pK  V P                  VR V n        R# 5i)r    Nr   )r<   r   Zfindrf   r   )	r>   r   ZstartZendZliner   r   r   r   s	   &&       r   r   ZAuditRecordReader.feed_text  s     x=Ah&   %%dE2Qh!1HC%%e0D@WX\@]=O("it?O?OPPE$$))$6C!//7s   CC!)r   r   rf   r   N)rP   rQ   rR   rS   r   r   r8   r   r   rT   rU   rX      @r   r   r     s%     MK
lB r   c                   s   a a ] tR tRt oRRRRRR]/RRRR]//tV 3R	 ltR
 tR t	RR lt
R t]! R 4      tR tR tRR ltR tR tR tR tR tRtVtV ;t# )r   i  recordsr0   re   rK   r   rZ   r   c                sd   < \         \        V `  4        R V n        . V n        / V n        R V n        R # r   )r7   r   r8   r   r   record_types	timestamp)r>   rA   s   &r   r8   ZAuditEvent.__init__  s-    j$(*r   c                sz    \        V R R4      f   / V n        V P                   F  pV P                  V4       K  	  R# )r   N)rM   r   r   process_recordr   r_   r   rg   ZAuditEvent._init_postprocess  s5    4.6 "DllF' #r   c                st   V P                   pVP                  4        V P                  : R V P                  4       : RV P	                  4       : RRP                  V Uu. uF  p\        V4      NK  	  up4      : RRP                  V P                   Uu. uF  pRV,          NK  	  up4      : 2	# u upi u upi )z	: is_avc=z, is_granted=z: line_numbers=[Z,z]
r   z    %s)line_numberssortr   is_avcrq   r=   r:   r   )r>   r   r
   r   rm   r   rC   ZAuditEvent.__str__  s    ((t{{}doo.?,7,Q#a&,78		4<<H<8f,,<HIK 	K7Hs   B0B5c                st    TP                  V P                   Uu. uF  p\        V4      NK  	  up4      # u upi r   )r=   r   r:   )r>   Z	separatorr   rO   r   rE   ZAuditEvent.format  s+    ~~Fvs6{FGGFs   5c                s,    \        V P                  4      # r   )r<   r   rB   r   r   num_recordsZAuditEvent.num_records  s    4<<  r   c                s~    V P                    Uu. uF"  qP                  '       g   K  VP                  NK$  	  up# u upi r   )r   rf   r   r_   r   r   ZAuditEvent.<lambda>  s)    4<<)n<[m[m*<&*<*<<)n)ns   ::c                s^    V P                   P                  V4       V P                  V4       R # r   )r   r   r   r   r   r   
add_recordZAuditEvent.add_record  s"    F#F#r   c                s   V P                   fg   VP                   P                  4       V n         \        V P                   P                  4      V P                   P                  R,          ,           V n        MBV P                   VP                   8X  g(   \        RV P                   : RVP                   : 24      hV P                  P                  VP                  . 4      pVP                  V4       R # )Nr`   z:cannot add audit record to audit event, event_id mismatch z != )r   r^   ra   r%   r&   r   r[   r   Z
setdefaultr   r   )r>   r   Zrecord_listrO   r   r   ZAuditEvent.process_record  s    == "OO002DM"4==#8#89T]]=P=PSY=YZDN==FOO3 "&--"B C C ''2263E3ErJ6"r   c                s    . pVf   V P                   pMV P                  V4      pV F@  pVP                  P                  V4      pVf   K$  VP	                  WeP
                  34       KB  	  V# )a.  Return list of (value, record_type) tuples.
In other words return the value matching name for every record_type.
If record_type is not specified then all records are searched.
Note: it is possible to have more than one record of a given type
thus it is always possible to have multiple values returned.)r   get_records_of_typer@   r   r   r3   )r>   rN   r   r|   r   r   r~   s   &&&    r   r   ZAuditEvent.get_field(  sh     llG..{;GFMM%%d+E}LL%-.	  r   c                sb    R pV P                   P                  V4      pV'       d
   V^ ,          pV# r   r   r   )r>   r3   r   r   s   &&  r   get_record_of_typeZAuditEvent.get_record_of_type<  s.    ##''-QZFr   c                s:    V P                   P                  V. 4      # r   r   )r>   r3   r   r   r   ZAuditEvent.get_records_of_typeC  s      $$T2..r   c                sR    R F   pV P                  V4      pV'       g   K  Vu # 	  R# )r   Nrj   )r   )r>   r   r   r.   r   get_avc_recordZAuditEvent.get_avc_recordF  s&    >K,,[9F ?r   c                s&    V P                  4       R J# r   )r   rB   r   r   r   ZAuditEvent.is_avcL  s    ""$D00r   c                s    R pR F9  pV P                  V4      pV F  pVP                  4       '       g     R # RpK!  	  K;  	  V# )FTrj   )r   rq   )r>   Zall_grantedr   r   r   r   r   rq   ZAuditEvent.is_grantedO  sJ    >K..{;G!((** " " ? r   )r   r   r   r   )r   r   )rP   rQ   rR   rS   r   r   rL   r8   rg   rC   rE   r   rd   r   r   r   r   r   r   r   r   rq   rT   rU   rV   rW   rY   r   r   r     s     Iy&.BSU`cY	+<lKI
(KH! noL$
#(/1
 
r   c                   s    ] tR tRtRtR# )AVCErrori^  r	   N)rP   rQ   rR   rS   rT   r	   r   r   r   r   ^  s    r   r   c                   s  a  ] tR tRt o R.tRR.t. ROt. R Ot. R!Ot. R"Ot	. R#Ot
. R$Ot. R%Ot. R&Ot. R'Ot. R(Ot. R)OtRR.tR.tR.t. R*Ot. R+Ot. R,Ot. R-OtR.tR.t. R.Ot. R/Ot. R0Ot. R1OtRR.t. R2Ot] PB                  ! R4      t"] PB                  ! R4      t#R3R
 lt$R t%R t&R t'R t(R t)R t*R t+R t,R t-R t.R t/R t0R t1R t2R t3R t4R t5R t6R t7Rt8V t9R	# )4r   ib  rM   executeunlinksetattrr   z^(\w+):\[([^\]]*)\]z^(/proc/)(\d+)(.*)Nc                s<   Wn         W0n        / V n        R V n        R V n        R V n        R V n        R V n        R V n        R V n	        R V n
        R V n        . V n        . V n        R V n        R V n        R V n        R V n        R V n        . V n        V P)                  V4       R # r   )audit_eventquery_environmenttemplate_substitutionstpathspathsource
source_pkgr   scontexttcontexttclassportsrc_rpmstgt_rpmsr#   pidkmodr   whybools derive_avc_info_from_audit_event)r>   r   
avc_recordr   s   &&&&r   r8   ZAVC.__init__  s    &!2 ')#

			
--j9r   c                rn   r   )
format_avcrB   r   r   rC   ZAVC.__str__  s      r   c                s   R pVRV P                   ,          ,          pVRV P                  ,          ,          pVRV P                  ,          ,          pVRV P                  ,          ,          pVRV P                  ,          ,          pV# )r   zscontext=%s ztcontext=%s z
access=%s z
tclass=%s z	tpath=%s )r   r   r   r   r   )r>   r   r_   r   r   ZAVC.format_avc  sk    ....t{{**t{{**djj((r   c                s^    V P                   f   R# V P                    F  pW!9   g   K   R# 	  R# )zMReturns true if the AVC contains _any_ of the permissions in the access list.FTr   r>   Zaccess_listZarO   r   has_any_access_inZAVC.has_any_access_in  s-     ;;A  r   c                s^    V P                   f   R# V P                    F  pW!9  g   K   R# 	  R# )zeReturns true if _every_ access in the AVC matches at
least one of the permissions in the access list.FTr   r   rO   r   all_accesses_are_inZAVC.all_accesses_are_in  s-     ;;A#  r   c           	     s   \        4       \        4       ,           pVP                  4        \        4       pVP                  4        . p\	        \
        .\        V P                  P                  \        V P                  \        V P                  /4       Uu. uF  qDR ,          '       g   K  VNK  	  up Uu. uF  qU\        ,          NK  	  ppTpV F:  pW9   g   K  VP                  \        \!        \"        V4      4      R,          4       K<  	  V F$  pW9   g   K  W9  g   K  VP%                  V4       K&  	  VP                  4        V# u upi u upi )Zenabledtypes)Zget_all_file_typesZget_all_port_typesr   Zget_all_attributesr   ALLOWSOURCEr   r3   ZCLASSr   ZPERMSr   ZTARGETZextendZnextZinfoZ	ATTRIBUTEr   )	r>   Z	all_typesZall_attributesZallowed_typesr   r
   Zwtypesr   Zts	   &        r   allowed_target_typesZAVC.allowed_target_types  sF   &(+=+??	+-17&$--J\J\^ceiepeprwy}  zE  zE  BF  2G  &X  2GA  MV  KW  KWaa  2G  &X  Y  &XF))  &X  YA"d4	1#56w?@  A~)!((+  	 &X  Ys   E(E3Ec                s    V P                  R .4      '       dK    V P                  '       d6   \        V P                  4      \        ,          \        P
                  8w  d   R# R# R#     R# ; i)openTF)r   a1r!   	O_ACCMODEosZO_RDONLYrB   r   r   open_with_writeZAVC.open_with_write  sP    !!6(++777DGGy 8R[[H s   A% 3A% %A*c                sj    V F,  p\         P                  ! W1P                  4      '       g   K+   R # 	  R# r+   )r   r$   r3   )r>   Zcontext	type_listr3   s   &&& r   Z__typeMatchZAVC.__typeMatch  s'    Dxxll++  r   c                Z    V P                   f   R# V P                  V P                   V4      # )zwReturns true if the type in the source context of the
avc regular expression matches any of the types in the type list.F)r   _AVC__typeMatchr>   r   r   r   matches_source_typesZAVC.matches_source_types  (     == y99r   c                r   )zwReturns true if the type in the target context of the
avc regular expression matches any of the types in the type list.F)r   r   r   r   r   matches_target_typesZAVC.matches_target_types  r   r   c                s@    V P                   f   R# V P                   V9   # )NF)r   )r>   Ztclass_listr   r   has_tclass_inZAVC.has_tclass_in  s    ;;{{k))r   c                sF    V P                  4        V P                  4        R # r   )derive_environmental_info%update_derived_template_substitutionsrB   r   r   updateZ
AVC.update  s    &&(224r   c                s6    \        V P                  4      '       * # r   )is_standard_directoryr   rB   r   r   path_is_not_standard_directoryZ"AVC.path_is_not_standard_directory  s    (444r   c                s   V P                   P                  R4      pV P                   P                  R4      pV P                   P                  R4      pVf   V P                  P                  R4      pV Fl  pVP                  R4      pV'       d
   VR8X  d   K%  VP                  R4      pV'       g   K@  V'       g   KJ  VR8w  g   KS  VP	                  V4      '       g   Kl   M	  V'       d   \
        P                  P                  V4      '       gf   Veb   \
        P                  P                  V4      '       d=   \
        P                  P                  \
        P                  P                  W4      4      pVfi   V P                   P                  R4      pVeJ   V P                   P                  R4      pVR	8X  d   R
V,          pMVR8X  d   VR8X  d   TpMR
V,          pMTpVEe   VR8X  Ed4   V'       Ed+   . p	 ^ p
V P                   P                  R4      p\
        P                  P                  RV,           4      '       d(   \
        P                  ! RV,           4      P                  p
\        V4      p\        RR4      pVP                  4       P!                  R4       F  pVP!                  4       p\#        V4      '       g   K&  V^,          ^ ,          R8X  g   K=   V
^ 8X  g-   \
        P$                  ! V^ ,          4      P                  V
8X  dR   \        \
        P                  ! V^,          4      P&                  4      V8X  d   V	P)                  VR,          4       K  K  K  	  VP-                  4        \#        V	4      ^8X  d   V	^ ,          ^,          pEM-\#        V	4      ^8  dy   V	 Fr  pV^ ,          RV,          8X  g   V^,          V8X  d   V^,          p M V
^ 8w  d:   \
        P                  ! V^ ,          4      P                  V
8X  d   V^,          p MKr  Kt  	  MVP1                  R4      R8X  d   V'       d   ^ RIpRRRV,          .p VP5                  VVP6                  RR7      p\        V4      pVP!                  R4       F6  p \        \
        P                  ! V4      P&                  4      V8X  d   Tp MK8  	   Ve   \
        P                  P                  V4      '       d   V P:                  P=                  RV4      pMUV P>                  PA                  V4      pV'       d   V PB                  pV^ ,          R8X  d   RVPE                  R4      ,           pW0n#        V PF                  fr   V PB                  R8X  d
   RV n#        R# V PB                  R 8X  g   V PB                  R!8X  d$   \I        R"4      V PJ                  ,          V n#        R# \I        R#4      V n#        R# R#   \*         d     EKV  i ; i  \*         d     EK_  i ; i  \.         d    Rp ELX\*         d    Rp ELgi ; i  \*         d     EK  i ; i  \8         d     ELi ; i)$a  Derive the target path.

If path information is available the avc record will have a path field
and no name field because the path field is more specific and supersedes
name. The name field is typically the directory entry.

For some special files the kernel embeds instance information
into the file name. For example 'pipe:[1234]' or 'socket:[1234]'
where the number inside the brackets is the inode number. The proc
pseudo file system has the process pid embedded in the name, for
example '/proc/1234/mem'. These numbers are ephemeral and do not
contribute meaningful information for our reports. Plus we may use
the path information to decide if an alert is identical to a
previous alert, we coalesce them if they are. The presence of an
instance specific number in the path confuses this comparison.
For these reasons we strip any instance information out of the
path,

Example input and output:

pipe:[1234]    --> pipe
socket:[1234]  --> socket
/proc/1234/fd  --> /proc/<pid>/fd
./foo          --> ./foo
/etc/sysconfig --> /etc/sysconfig
rN   r{   inoNPATHZnametypeZPARENTr   rx   %srv   Z/devz/dev/z/proc/mountsZrr   :Nr6   Nz/dev/%szunknown mountpointFZlocatez-bz\%sT)ZstderrZuniversal_newlinesz	\1<pid>\3Z Z@Z
filesystemr   Z
udp_socketZ
tcp_socketzport %sZUnknown)&r   r   r   r   Zendswithr   r{   isabsZnormpathr=   ZexistsZlstatZst_rdevr!   r   readr;   r<   ZstatZst_inor   ZOSErrorZcloseZ	TypeErrorr   
subprocessZcheck_outputZSTDOUT	Exceptionproc_pid_instance_resubpipe_instance_path_rer   r   r   r   _r   )r>   ru   rN   r{   ZinodestrZavc_path_recordsZavc_path_recordr   r   ZmatchesZdev_rdevr   r   Zfdr   r
   r   ZcommandZoutputrx   r$   s   &&                   r   
_set_tpathZAVC._set_tpath  s	   8 ((0 ((0??,,U3<#//CCFK#3-77
CK83&008 4DD[H%<tATAT $4 d++BGGMMRUDVDV77##BGGLL$;<D<??,,V4D228<V#$;Du_ s{##d{  Ds{xx$ H//33E:Cww~~gm44#%88GcM#:#B#Bh-Cnc2BWWY__T2GGIq66ad1gn)$,MRWWQqT]5J5Jh5V\_`b`h`hijklim`n`u`u\vz}\}$+NN1R5$9 ]~5V	 3 HHJ7|q(&qz!}W)!(A t	C8AaDCK'(t %!)'/1}!A$9O9OS[9[/0t(- :\} ")& ??3'50X%'v}=G!+!8!8@J@Q@QLP "9 "R "(m$*LL$6D%#&rxx~'<'<#=#D+/D$) $E %7 ww}}T"" 0044\4H 2299$?;;D7d?D!11D 
::{{l*
,|0Ky\DII5
y\
 { $+ ) () (/ !)$(!)  /D /D$ $+ % $%$ s   :AX A>X X B W'8X AX <W:X X =Y 0X0>Y  Y 'W72X 6W77X :X
X 	X

X X-X-&X-,X-0Y ;Y ?Y  Y YYc                s   R V n         R V n        R V n        R V n        RV n        . V n        R ;p;p;rEV'       d   Wn        MV P                  P                  4       V n        V P                  P                  R4      pV P                  P                  R4      V n        \        V P                  \        4      '       g*   \        V P                  P                  R4      4      V n        \        V P                  \        4      '       g*   \        V P                  P                  R4      4      V n        V P                  P                  R4      V n        V P                  P                  R4      f"   V P                  P                  R4      V n        M V P                  P                  R4      V n        V P                  P                  R	4      V n        V P                  P                  R
4      V n        V'       dh   VP                  R4      pVP                  R4      pVP                  R4      V n        VP                  R4      R8H  V n        VP                  R4      V n        Vf   V P                  P                  R4      pVf   V P                  P                  R4      pW n        V'       d   W0n        MV'       d   V P                  V n        V P                  '       g   V P                  V n        V P                  '       g   V P                  P*                  V n        V P                  P                  R4      pV'       d   VP                  R4      pMR pV P-                  V4       V P                  P/                  R4      p	V	 F  p
V
P                  R4      p\0        P2                  P5                  V4      '       g	   V'       g   V P
                  P7                  V4       K^  V P
                  P7                  \0        P2                  P9                  W4      4       K  	  . V n        . V n        V P                  P>                  P@                  V n         \B        PD                  ! \G        V P                  4      \G        V P                  4      \G        V P                   4      V P                  4      w  V n$        pV PH                  \B        PJ                  8X  d&   \M        \O        R4      V P                  ,          4      hV PH                  \B        PP                  8X  d&   \M        \O        R4      V P                  ,          4      hV PH                  \B        PR                  8X  d   \M        \O        R4      4      hV PH                  \B        PT                  8X  d&   \M        \O        R4      V P                  ,          4      hV PH                  \B        PV                  8X  d&   \M        \O        R4      V P                  ,          4      hV PH                  \B        PX                  8X  d&   \M        \O        R4      V P                  ,          4      hV PH                  \B        PZ                  8X  d&   \M        \O        R4      V P                  ,          4      hV PH                  \B        P\                  8X  d   \M        \O        R4      4      hV PH                  \B        P^                  8X  d	   Wn0        R # R # )NFZSYSCALLri   r   r   r   ZdestZsrcr   r   rw   rt   r   successZyesr   ZCWDru   r   rN   z8%s 
**** Recorded AVC is allowed in current policy ****
zh%s 
**** Recorded AVC is dontaudited in current policy. 'semodule -B' will turn on dontaudit rules ****
zMust call policy_init firstz.%s 
**** Invalid AVC: bad target context ****
z.%s 
**** Invalid AVC: bad source context ****
z*%s 
**** Invalid AVC: bad type class ****
z*%s 
**** Invalid AVC: bad permission ****
z&Error during access vector computation)1r   r   r   r   r   syscall_pathsr   r   r   r   r   r   r9   r   r   r   r   r   r   r   r   r3   r   r   r   r{   r   r   r=   r   r   r   r#   	audit2whyZanalyzer:   r   r   r   r   Z	DONTAUDITZNOPOLICYZBADTCONZBADSCONZ	BADTCLASSZBADPERMZ
BADCOMPUTEZBOOLEANr   )r>   r   rw   rt   r   r   Zsyscall_recordZ
cwd_recordru   Zpath_recordsZpath_recordr{   r   s   &&           r   r   Z$AVC.derive_avc_info_from_audit_event  s   

&***d*T(O"..==?DO))<<YGoo//	:$--44&t'@'@'LMDM$--44&t'@'@'LMDMoo//9??$$V,411%8DI11&9DIOO--f5	??,,U3  **51C!++F3D)33I>DL*44Y?5HDL$..t4DG<??,,V4D;//++E2C
K**DKzzzDJzzz++DJ%%88?
&&u-CC'';;FC'K((0Dww}}T""#""))$/""))"'',,s*AB ( $$--22	#++C,>DMM@RTWX\XcXcTdfjfqfqr%88y&1YZ]a]l]llmm88y***1  J  K  NR  N]  N]  ]  ^  ^88y)))1:;<<88y(((1OPSWSbSbbcc88y(((1OPSWSbSbbcc88y***1KLt^__88y(((1KLt^__88y+++1EFGG88y(((J )r   c                s   V P                   '       d   V P                  '       dR   \        V P                  4      V n        V P                  '       d&   V P                  P                  V P                  4       \        V P                  4      '       g=   \        V P                  4      pV'       d   V P                  P                  V4       R # R # R # R # r   )	r   r   Zget_package_nvr_by_file_pathr   r   r   r   r   r   )r>   Zrpmr_   r   r   ZAVC.derive_environmental_info  s    !!!zzz">tzz"J???MM((9(4424::>MM((-  5 "r   c                s2    V P                   f	   Wn         R # R # r   )r   r   r   r   set_alt_pathZAVC.set_alt_path  s    ::J r   c                sz    \        VP                  4       4       F  w  r#V'       g   K  W0P                  V&   K  	  R # r   )rK   r|   r   )r>   Zkwdsry   r~   s   &,  r   set_template_substitutionsZAVC.set_template_substitutions  s,    tzz|,JCu38++C0 -r   c                sx   \        V P                  P                  4      V P                  R &   \        V P                  P                  4      V P                  R&   \        V P
                  4      V P                  R&   \        V P                  4      V P                  R&   V P                  '       d9   \        P                  ! RR\        V P                  4      4      V P                  R&   \        V P                  4      V P                  R&   V P                  '       d9   \        P                  ! RR\        V P                  4      4      V P                  R&   V P                  f   R	V P                  R
&   MV P                  R8X  d$   \        V P                  4      V P                  R
&   M`V P                  R8X  dA   \        \        P                  P                  V P                  4      4      V P                  R
&   MR	V P                  R
&   \        V P                  4      V P                  R&   V P                  f   R	V P                  R&   M1\        RP                  V P                  4      4      V P                  R&   \        V P                   4      V P                  R&   \        V P"                  4      V P                  R&   R	# )ZSOURCE_TYPEZTARGET_TYPEr   ZSOURCE_PATHr   Z.ZFIX_SOURCE_PATHZTARGET_PATHZFIX_TARGET_PATHNZ
TARGET_DIRrv   rx   ZTARGET_CLASSZACCESSZSOURCE_PACKAGEZPORT_NUMBER)escape_htmlr   r3   r   r   r   r   r   r   r   r   r   r{   Zdirnamer   r=   r   r   rB   r   r   r   Z)AVC.update_derived_template_substitutions!  s   5@ASAS5T##M25@ASAS5T##M20;DKK0H##H-5@5L##M2:::=?VVCkZ^ZdZdNe=fD''(9:5@5L##M2:::=?VVCkZ^ZdZdNe=fD''(9:::8<D''5{{e#<G

<S++L9&<GX\XbXbHc<d++L9<@++L96A$++6N##N3;;48D''14?@U4VD''18CDOO8T##$455@5K##M2r   c                s    \        V P                  P                  4       4       F,  w  rVe   K  \        \	        V4      4      V P                  V&   K.  	  R # r   )rK   r   r|   r   Zdefault_text)r>   ry   r~   r.   r   validate_template_substitutionsZ#AVC.validate_template_substitutions@  sB    t::@@BCJC}3>|E?R3S++C0 Dr   )r   r   r   r   r   r#   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   )r   r   rM   lockioctl)r   r   rM   r   r   r   )r   r   r   rM   r   r   )rM   linkr   rename)creater   rM   r   r   r   r  )r   r  r   r   rM   r   writer   r   r   r   r  )r   r   rM   r   r   r   )	r   r   rM   r   r   r   add_nameremove_namer  )r   r   rM   r   r   r   r  r  )r   r  r   rM   r   r   r   r   r   r  r   r  r  reparentr  rmdir)ZmountZremountZunmountrM   )r   rM   r   r   r   r   )r   rM   r   r   r   r  r  )r   rM   r   r   r   r  r  )r   r  rM   r   r   r  r   r   r  r   r  r  r  r  r   r   )r   rM   r   r   r   )r   rM   r   r   r   )r   rM   r  r   r   r   )r   rM   r   r  r   r   r   )r   r  rM   r   r   r  r   r  r   r   r   r   )NT):rP   rQ   rR   rS   Zstat_file_permsZx_file_permsZr_file_permsZrx_file_permsZra_file_permsZlink_file_permsZcreate_lnk_permsZcreate_file_permsZr_dir_permsZrw_dir_permsZra_dir_permsZcreate_dir_permsZmount_fs_permsZsearch_dir_permsZgetattr_dir_permsZsetattr_dir_permsZlist_dir_permsZadd_entry_dir_permsZdel_entry_dir_permsZmanage_dir_permsZgetattr_file_permsZsetattr_file_permsZread_file_permsZappend_file_permsZwrite_file_permsZrw_file_permsZdelete_file_permsZmanage_file_permsr   r   r   r   r8   rC   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rT   rU   r   r   r   r   r   b  sW     !kOy)L?LKMJM=O[5HKmL^Le?N!8,""KN]`c##BOFNSM"H-4 JJ'=>::&;<:2!	
&::*
55_*BdL
.9
L>T Tr   c                 s   . p R F8  pV P                  V4      pV F  p VP                  \        W4      4       K   	  K:  	  V#   \         d3   p^ RIpTP	                  TP
                  RT,          4        Rp?K`  Rp?ii ; i  \         dP   p^ RIp^ RIpTP	                  TP
                  RT,          4       \        TP                  4       4        Rp?T# Rp?ii ; i)r   Nr   z!Unable to process audit event: %srj   )
r   r   r   r   syslogZLOG_ERRr   	tracebackZsyslog_traceZ
format_exc)r   Zavcsr   r   r   Zer  r	  r)   r   compute_avcsr
  G  s    D->K!55kBG!<KKK 89 " ? K   <!MM&..$(;;<  -fnn&IA&MNY))+,,K-s@   B AB B'A<6B <BB CACC)	r   r   r   r   r   r   r   r   r
  )'Z
__future__r   r   Z__all__r   r   r   r   r   rD   Zbase64r   Zselinux.audit2whyr   Zsetroubleshoot.utilZsetroubleshoot.html_utilZsetroubleshoot.xml_serializeZsepolicyr   Zcmpr   r   r   r   r   r(   r*   r,   r-   ZXmlSerializer   r   r   r   r   r   r   r   r
  r	   r   r   <module>r     s    & 
(   	  	    % ! & * 	$), kl?6 

#KL 2* $ $R7< 7xd7, d7RH HZe eT	y 	bT bTJr   