+ :ics^RIHt.R8Ot^RIHtHt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI t ^RIt^RIt^RIHtHt]!RR4t]!RR 4t/t] P.R98dR ]R &] P0!R:R ]R ]/]B] P2!]]R R7t]P4t^RIHt^RIH t H!t!H"t"H#t#^RI$5^RIHt^RI$H%t%^RI&H't'H(t(H)t)H*t*H+t+H,t,H-t-^RI.H/t/H0t0H1t1H2t2^RI3H4t4H5t5H6t6^RI7H8t8H9t9H:t:H;t;Ht>]aa]tRt^toV3RltV3RltRtVtV;t#)AlertPluginReportReceivercs.<\\V` V4R#r<)superrhrW)rUdatabase __class__s&&r/rWZ"AlertPluginReportReceiver.__init__s '7Ar1cs`<\\V` V4p\e.p\PFqpRVP ,pVP WCP4pVR8wgK:\RVP,4VPVP 4Ks \V4'd^RI H pV!W4VPP4\R4^RIHp\$P$!\$P&VP)4\+R4VP,,,4VP.P0F)pVP2R8XgKVP4R ,p M \7R R \84'd5\:P<P?VPA4X \BR 7VPDFCp V PFR ,R8XdKVP V PF4pVR8XgKAVu# \IV4V#)Nzemail:%signorezEmail: siginfo.sig=%s) email_alertzsending alert to all clients) html_to_textz1 For complete SELinux messages run: sealert -l %sAVCr:r&Zlog_full_report)Z OBJECT_PIDZSYSLOG_IDENTIFIER:riNzemail:)%rirhreport_problememail_recipientsZrecipient_listZaddressevaluate_filter_for_user filter_typer$sigrFZlenZsetroubleshoot.email_alertrmrjZ mark_modifiedZsetroubleshoot.html_utilrnr2r3summary_rH audit_eventrecords record_typefieldsrboolsystemdZjournalZsendZ format_textrOZusersusernamerN) rUrLZto_addrsZ recipientr}actionrmrn audit_recordr:Zurks && r/rpZ(AlertPluginReportReceiver.report_problems14GP  'H-<< % (9(99 99(DYDYZX%5 CDOOI$5$56 =8}}BG. MM ' ' )019 fnngoo&7! E E OO !4!4!63Zb cAzz#(*55ajjAF!  (r1r>) r_r`rarbrWrprcrdZ __classcell__)rkrfs@@r/rhrhsB&&r1rhcs2a]tRt^toRtRtRtRtVtR#)rcs\P!VR4VP4VnVPP RVP 4R#)rBZchangedN)rrWZcopysocket_addressconnection_stateZconnecton_connection_state_changerUrr6r/rWZ ClientConnectionHandler.__init__s?D),,113 %%i1P1PQr1c s\VPP: RV: RVPV4: RVPV4: RVP: 2 4V\ P ,'d\PV4V\ P ,'d\PV4R#R#)..on_connection_state_change: connection_state= flags_added= flags_removed= address=N) r$rkr_flags_to_stringrrOPENrJr[rZrUrflagsZ flags_addedZ flags_removed&&&&&r/rZ2ClientConnectionHandler.on_connection_state_changesuyvDvDvMvMO_aqaAaABMaNP`PpPpq~PAEATATU V ?// / /  ) )$ / -- - -  & &t , .r1cVPP\P,'dR#WPnVPP \P4VPVP4R#TN rrrrrsocketupdateZ io_watch_addZhandle_client_iorUrr&&&r/openZClientConnectionHandler.open \  & &)=)= = =%+" $$_%9%9: $//0r1)rN) r_r`rarbrWrrrcrdrergr/rrsR -11r1csxa]tRtRtoRtRtRtRtRtRt Rt R t R t R t R tR tRRltRtRtVtR#)&SetroubleshootdClientConnectionHandlerics\PW4\4VnVP RV4VP RV4\ 4VnRVnRVnRVn R#)ZSETroubleshootServerr N) rrWr?rjZconnect_rpc_interfacer accessr}uidgidrr6r/rWZ/SetroubleshootdClientConnectionHandler.__init__sZ((>)+  ""#94@ ""#;TB"n  r1c sz\VPP: RV: RVPV4: RVPV4: RVP: 2 4V\ P ,'d\PV4V\ P ,'dVPPVPP4wVn Vn \VPP: RVP: RVP: 24\PV4R#R#)rrrrz;.on_connection_state_change: open, socket credentials: uid=z gid=N)r$rkr_rrrrrJr[rZget_credentialsrrrrZrrr/rZASetroubleshootdClientConnectionHandler.on_connection_state_change(sBuyvDvDvMvMO_aqaAaABMaNP`PpPpq~PAEATATU V ?// / /  ) )$ / -- - -!%!r1)rrr\rjrrrr}N))r_r`rarbrWrrrrrrrrrrrrrrcrdrergr/rrsR  -1^*0" I r1rc,a]tRtRtoRtRtRtVtR#)ClientNotifiericsWnR#r<rJ)rUrJr6r/rWZClientNotifier.__init__s.r1cslVPPR4FpVPW4K R#)rBN)rJrKsignatures_updated)rUrrrMrr/rZ!ClientNotifier.signatures_updateds+**229=F  % %d 1>r1rN)r_r`rarbrWrrcrdrergr/rrs/ 22r1rcsa]tRtRtoR!RltRt]PP] 4R4t ]PP] RR7R4t ]PP] 4R4t ]PP] R R R R 7R 4tR"Rlt]PP] R RRR 7R4t]PP] R RRR 7R4t]PP] R RRR 7R4tRt]PP] R R RR 7R4t]PP] R RRR 7R4t]PP] R R RR 7R4t]PP] R R R7R4t]PP] 4R4tR!RltRtVtR #)#SetroubleshootdDBusObjectics\PPPV\P!4V4^VnW@nVPVP 4\RV,4W n W0n \\P4Vn \4Vn\ P"P%4VnR#)rzdbus __init__ %s calledN)rCserviceObjectrW SystemBusconn_ctrtimeoutalarmr$queuereceiverZAuditRecordReaderZ TEXT_FORMAT record_readerrrecord_receiversetroubleshootutilZget_store_root store_root)rUr@analysis_queuealert_receiverrrr/rWZ"SetroubleshootdDBusObject.__init__s $$T4>>+;[I   4<< +k9:# & ./@/L/LM24(--<<>r1cs\P!4^,p\P!4: V: R2VP: RV: R23FPp\P P V4'gK*\P!\PR4R# \V4pVF<p\V4'gKVPPWPP34K> R#)z!/modules/active/disable_dontauditZ/z/active/disable_dontauditzsSetroubleshoot can not analyze AVCs while dontaudit rules are disabled, 'semodule -B' will turn on dontaudit rules.N)selinuxZselinux_getpolicytypeZ selinux_pathrr4ZpathZexistsr2r3Z compute_avcsZ verify_avcrZputr)rUrwZ policy_typeZ store_pathZavcsavcs&& r/add_audit_eventZ)SetroubleshootdDBusObject.add_audit_events335a8 7>7K7K7M{ [04 M Jww~~j)) fnn/de  K(C# ]]34r1cR#r<r>)rUreasonr6r/restartZ!SetroubleshootdDBusObject.restart r1Zss)Z signaturecrr<r>)rUrGrHrr/rAZSetroubleshootdDBusObject.alertrr1csVP^4V;P^, un\RVP,4\R4#)rz)dbus iface start() called: %d ConnectionsZStarted)rrr$rvrTrVr/startZSetroubleshootdDBusObject.starts7 1   = MN|r1sendersZii)Zsender_keyword in_signature out_signaturecs\VPPV44p\4pRp.pVP R4P 4F.pVP V4pVR8wgKVPV4K0 VP\R7^p ^p VF=pV ^, p VPR8Xd V ^, p VPV8XgK9^p ^p K? W3#)rrrl)Zkeyred) r" connection get_unix_userr?rsiginfosrrrFZsort compare_sigrGrH) rUZ last_seen_idrr}rjrZ signaturesrtr~Zcountrs &&& r/ check_for_newZ'SetroubleshootdDBusObject.check_for_news = =f EF$&  ((-668C11(;F!!!#&9 K(C QJEyyE!q|||+ zr1cs\VPPV44p\4p\P P \VR, 44pVPR4Pp.pVFdp V PV8dKV PV4V8XgK.VPV PV P4V P34Kf V#)@Br)r"rrr?rrZ TimeStampZfloatrsignature_listlast_seen_daterrrFrHru report_count) rUsincer alert_actionr}rjZ since_alertsdatabase_alertsZalertsrAs &&&& r/_get_all_alerts_sinceZ/SetroubleshootdDBusObject._get_all_alerts_since s = =f EF$&%**44U57?5KL "//4CC$E##l2--h7<G u~~u}}@R@RST %  r1Ztza(ssi)cs$VPW4#r<r)rUrrrr/get_all_alerts_sinceZ.SetroubleshootdDBusObject.get_all_alerts_sinces))%88r1rc s&VP^V4#)a Return array of *local_id*'s, *summary*'s, and *report_count*'s of all current alerts in a setroubleshoot database returns list of: * `local_id(s)`: a report id in a setroubleshoot database * `summary(s)`: a brief description of an alert. E.g. `"SELinux is preventing /usr/bin/bash from ioctl access on the unix_stream_socket unix_stream_socket."` * `report_count(i)`: count of reports of this alert rrUrr6r/get_all_alertsZ(SetroubleshootdDBusObject.get_all_alertss))!V44r1c s*VP^VRR7#)a Return array of *local_id*'s, *summary*'s, and *report_count*'s of all alerts which a user set to be ignored by a user returns list of: * `local_id(s)`: a report id in a setroubleshoot database * `summary(s)`: a brief description of an alert. E.g. `"SELinux is preventing /usr/bin/bash from ioctl access on the unix_stream_socket unix_stream_socket."` * `report_count(i)`: count of reports of this alert rl)rrrr6r/get_all_alerts_ignoredZ0SetroubleshootdDBusObject.get_all_alerts_ignored)s))!V()KKr1csVPV4pTP4P4pT# \dpThRp?ii;ir<)rrrZ__next__)rUrHrjrerAs&&& r/ _get_alertZ$SetroubleshootdDBusObject._get_alert5sL &33H=O ((*335  G s3 AAAzssiasa(ssssbbi)ttsc  s\VPPV44p\4pVP W4pVP 4VP PpVUu.uFqwP4NK ppVP4wr.p V FwrV PVPV PWm44VPV PWm44VPV PWm44V PV P V P"V P$34K VP&VP)4VP*Y\-VP.P1R44R,\-VP2P1R44R,VP4;'gR3#uupi)ar Return an alert with summary, audit events, fix suggestions ##### arguments * `local_id(s)`: an alert id ##### return values * `local_id(s)`: an alert id * `summary(s)`: a brief description of an alert. E.g. `"SELinux is preventing /usr/bin/bash from ioctl access on the unix_stream_socket unix_stream_socket."` * `report_count(i)`: count of reports of this alert * `audit_event(as)`: an array of audit events (AVC, SYSCALL) connected to the alert * `plugin_analysis(a(ssssbb)`: an array of plugin analysis structure * `if_text(s)`: * `then_text(s)` * `do_text(s)` * `analysis_id(s)`: plugin id. It can be used in `org.fedoraproject.SetroubleshootFixit.run_fix()` * `fixable(b)`: True when an alert is fixable by a plugin * `report_bug(b)`: True when an alert should be reported to bugzilla * `priority(i)`: An analysis priority. Typically the value is between 1 - 100. * `first_seen_date(t)`: when the alert was seen for the first time, number of microseconds since the Epoch * `last_seen_date(t)`: when the alert was seen for the last time, number of microseconds since the Epoch * `level(s)`: "green", "yellow" or "red" z%srr)r"rrr?rZ%update_derived_template_substitutionsrwrxZto_textZ get_pluginsrFZ substituteZ get_if_textZ get_then_textZ get_do_textZ analysis_idZfixableZ report_bugZpriorityrHrurZintZfirst_seen_dateZformatrrG)rUrHrr}rjrArZeventZ audit_eventsZtotal_priorityZ alert_pluginsZpluginsZpluginZargss&&& r/ get_alertZ#SetroubleshootdDBusObject.get_alert=s|8  = =f EF$&3 335''589SE S 9(-(9(9(;%)LF NN  !3!3C!>?  !5!5c!@A  !3!3C!>?""!!! * 1C1CE))0067'AE((//56@ !!r  :s*GZbc s\VPPV44p\4pVP W4p^RIHpVPVPWGV,R4R# R#;i)z Sets a filter on an alert. The alert can be "always" filtered, "never" filtered or "after_first" filtered. ##### arguments * `local_id(s)`: an alert id * `filter_type(s)`: "always", "never", "after_first" ##### return values * `success(b)`: )map_filter_name_to_valueNTF) r"rrr?rsetroubleshoot.signaturerrrt)rUrHrsrr}rjrArs&&&& r/rZ$SetroubleshootdDBusObject.set_filterusb #DOO$A$A&$IJH(*HOOH7E I    8k5Z\` a s A)A--A2c s\4pVPW4pVPVP4R# R#;i)zz Deletes an alert from the database. ##### arguments * `local_id(s)`: an alert id ##### return values * `success(b)`: TF)r?rrrt)rUrHrrjrAs&&& r/ delete_alertZ&SetroubleshootdDBusObject.delete_alerts< (*HOOH7E  % %eii 0 s6:?)rrcs\V4pV;P^, unVP^4\RWP3,4VPP V4FWwr#rEp\ W#WEV4pVP4VPP V4FpVPV4K KY VPP^4FpVPV4K V;P^,unVPVP4\R4# T;P^,unTPTP4i;i)rz#dbus avc(%s) called: %d Connectionsro) r9rrr$rZfeedZ AuditRecordZaudispd_rectifyrrZflushrrv) rUrryZevent_idZ body_textrzZ line_numberrrws && r/rZSetroubleshootdDBusObject.avcs4y % MMQ M JJqM ;t]]>SS TKOK]K]KbKbcgKhG ;*;)U`a ,,.#'#7#7#<#<\#JK((5$K Li $3399!< $$[1 = MMQ M JJt|| $x MMQ M JJt|| $s C0D<<6E2csV;P^,un\RVP,4VPVP4R#)rz*dbus iface finish() called: %d Connectionsr)rr$rrrTrVr/finishZ SetroubleshootdDBusObject.finishs5  >NO 4<< r1csfVP^8XgV^8Xd\P!V4R#R#)rN)rr*r)rUrr6r/rZSetroubleshootdDBusObject.alarms% ==A A LL !".r1)rrrrrrrNi )Zdisplay)r_r`rarbrWrrCrr*rErrAZmethodrrrrrrrrrrrrrrcrdrergr/rrs9 ?5  \\./ 0  \\.$? @  \\./0  \\.xVYimno0  \\.xVYiqr9s9 \\.xVXhpq 5r 5 \\.xVXhpq Lr L \\.xVYi}~55n \\.xVZjmno. \\.xVYilmn( \\.SPSTU0 \\./0 ""r1rcsVP#r<)r)ZarVr/rrs  r1cr)SetroubleshootdDBusics\R\: R\: R\: 24\ \WV4VnR# \ d4p\P!\PRT,4ThRp?ii;i)zcreating system dbus: bus_name=z object_path=z interface=z$cannot start system DBus service: %sN) r$dbus_system_bus_namerDrErdbus_obj Exceptionr2r3)rUrrrrrr/rWZSetroubleshootdDBus.__init__sg  YmpGI^_ `56M~ovwDM  MM&..*PST*T UG s9= A;.A66A;cs<VPPR4R#)zdaemon requestT)rrrTrVr/ do_restartZSetroubleshootdDBus.do_restarts ./r1)rN)r_r`rarbrWrrcrdrergr/rrsr1rcsPVP4\P!4R#r<)save audit2whyr)rjrVr/goodbyers MMO r1csD\R4\P4R#)z SIGALRM raised in RunFaultServerN)r$ main_loopZquitr5r6r/ alarm_handlerrs 01 NNr1c s \P!V4\P!\P\4\P !4\P!^4\P!\P\4\P!\P\4\P!\4\!\"4p\%RR4p\'T4p\)TRR4\+YC\-R 4R 7s\.P1T4\2P4!\6\.4R p\.P8P:EF;p\P<!\TP>P@4\TP>PB4\TP>PD4TP>PF4wrxT\PH\PJ\PL\PN\PP\PR39gKT\PH8XdR p MT\PJ8XdR p MT\PL8XdRTP>P@,p MT\PN8XdRTP>PB,p M_T\PP8XdRTP>PD,p M,RRPUTP>PF4,p \P!\PVRTPX: RT : R24Rp\.P[TP>4EK> T'd\.P]RR7\%RR\^4'g\a\.4p M\c\.4p ^RI2p T Pg^4s4\k\hT4p T PmR4T Po4^RI8H9p T !4s:\)\vRR4\tPy\v4\R4pTF#p\T\4pTP4K% \PP4\\hY4p\P4R# \ dpR\T49dRp?EKThRp?i\d*pR\\TRR449dRp?EKThRp?ii;i \zd8pTP|\~8Xd\TP4Rp?ELThRp?ii;i \dp\R4Rp?R#Rp?i\dp\R4Rp?R#Rp?i\dsp^RIOp\TP44\P!\PRTPP: R\T4: 24Rp?R#Rp?ii;i)Tz%unable to open /sys/fs/selinux/policyNZ __context__rrjZfilenameirzAudit Listener)Z friendly_nameFz it is allowedzit is dontaudit'dzsource context %s is undefinedztarget context %s is undefinedzsecurity class %s is undefinedzpermission %s is undefinedZ,zDeleting alert z, z in current policy)ZpruneZtestanalyze)SEEmailRecipientSetZlisten_for_clientz#KeyboardInterrupt in RunFaultServerz$raising SystemExit in RunFaultServerz exception z: )Ur*rZSIGALRMr7rZinitZ ValueErrorr9Z SystemErrorZgetattrrr+r0r2ZopenlogrOrrJrr r!r rvr=Z set_notifyatexitZregisterrrrrrtZscontextZtcontextZtclassrZALLOWZ DONTAUDITZBADSCONZBADTCONZ BADTCLASSZBADPERMZjoinZ LOG_NOTICErHrrr{rhr rZQueuerrZ setDaemonrrrrqrZparse_recipient_filerZerrnorr$ZstrerrorrrrrrCZglibZ init_threadsrrZrunZKeyboardInterruptZ SystemExitr tracebackr%Z format_excr3rkr_)rrZclient_notifierZdatabase_filenameZdatabase_filepathZdeletedZiZwhyZboolsrrrZanalyze_threadrZlisten_addressesZlisten_addressZlistening_serverZsetroubleshootd_dbusrs& r/RunFaultServerrsu LL MM&.."89   NN  LLO & MM&..-0 MM&--,o[ x )9'z:>23DE)*;UDTU./@=>?O=PR   1/##22A"**3quu~~+>AEENN@SUXYZY^Y^YeYeUfhihmhmhthtuJCy (;(;Y=N=NPYPaPaclcvcvyByJyJKK)//),FI///0FI---=NFI---=NFI///&F&UV9CHHQUU\\>[ u 7#a&@G  7#gaXZ>[:\\G J ww-'!**%%  " 9788 :899 [Y))+, fnnAKKFV!!EV! U T" T"" U/U0UUU V'*VV!VVV!! Y, V== Y Y W Y)Y*A'YYZ__main__)rrr?rNr)ir>r)iZ __future__rZ__all__Z gi.repositoryrrrCZ dbus.serviceZ dbus.glibZgettextr4r*rZsysr2Zsystemd.journalr|r(rrrr ZkwargsZ version_infoZinstallZ translationZugettextrvZAttributeErrorZsetroubleshoot.access_controlr Zsetroubleshoot.analyzer r r rZsetroubleshoot.avc_auditrZsetroubleshoot.errcoderrrrrrrZsetroubleshoot.rpcrrrrZsetroubleshoot.rpc_interfacesrrrZsetroubleshoot.utilrr r!r"r#r$r%r0r7r;r?rrDrErrIZ request_namerNr=rrqrrOrPrQZ instance_idZobjectrrJrhrrrZsetroubleshoot.audit_datarrrrrrrZselinux.audit2whyrrZMainLooprrrr_r>r1r/rs&, (  C I1 2 y"3 4 dF9v#!!,5+/1 A 7&& ',8&&&"" --###   /"-<$]MB"=+> ^^  ,-  &w0EF i ,M2 M2  *V*:!" + 4+`1j14[-D-J-R-=[@ 2V 2(~" 3 3~"B  % MMO  O[b zwAs H55I  I