3
��n`�h � @ s� d dl mZ dddddddgZd d lZd d
lmZmZ d d lZd d lZd d l Z d d l
Z
d d l Z d d l T d d l
Z
d d lmZ d d
lmZ d d lT d d lT d d lT d d lT d d lT d d lT d d lT d dlmZ dd� ZG dd� de �Z G dd� de �Z G dd� de �Z G dd� de e
j �Z!G dd� de �Z"G dd� de �Z#G dd� de �Z$G dd� de%e&e'ej�Z(ej)e(� G dd� dej�Z*ej)e*� d S ) � )�print_function�
AnalyzeThread�Analyze�PluginReportReceiver�TestPluginReportReceiver�SETroubleshootDatabase�SETroubleshootDatabaseLocal�LogfileAnalyzerN)�GObject�GLib)�*)�
cmp_to_key)�
get_config)�validate_database_docc C s | |k| |k S )N� )�x�yr r � /usr/lib/python3.6/analyze.py�<lambda>4 s r c @ s< e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
S )�PluginStatisticsc C s0 |j | _d | _d | _d | _d | _d | _d | _d S )N)� analysis_id�name�analyze_start_time�analyze_end_time�analyze_elapsed_time�report_start_time�report_end_time�report_elapsed_time)�self�pluginr r r �__init__= s zPluginStatistics.__init__c C sR t | j�}| jd kr"d| j|f S t | j| j �}t | j�}d| j|||f S d S )Nz%s: %s elapsedz5%s: %s elapsed, %s analyze elapsed, %s report elapsed)�format_elapsed_timer r r r r )r r Ztotal_elapsed_timer r r r �__str__F s
zPluginStatistics.__str__c C s t j � | _d S )N)�timer )r r r r �
analyze_startR s z PluginStatistics.analyze_startc C s t j � | _| j| j | _d S )N)r# r r r )r r r r � analyze_endU s
z PluginStatistics.analyze_endc C s t j � | _d S )N)r# r )r r r r � report_startY s z PluginStatistics.report_startc C s t j � | _| j| j | _d S )N)r# r r r )r r r r �
report_end\ s
zPluginStatistics.report_endN) �__name__�
__module__� __qualname__r r" r$ r% r& r' r r r r r ; s r c @ s< e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
S )�AnalyzeStatisticsc C s( || _ d | _g | _d | _d | _d | _d S )N)� num_plugins�
cur_plugin�called_plugins�
start_time�end_time� elapsed_time)r r, r r r r e s zAnalyzeStatistics.__init__c C sP d }d }t | j�}| jd k r8t| j�}|r8t| j| �}d|| j||| j� f S )NzB%d/%d plugins in %s elapsed, avg plugin %s elapsed, plugins=[
%s
])�lenr. r1 r! r, �called_plugins_to_string)r r1 Zavg_plugin_timeZn_calledr r r r" m s
zAnalyzeStatistics.__str__c C s dj dd� | jD ��S )N�
c S s g | ] }t |��qS r )�str)�.0r r r r �
<listcomp>{ s z>AnalyzeStatistics.called_plugins_to_string.<locals>.<listcomp>)�joinr. )r r r r r3 z s z*AnalyzeStatistics.called_plugins_to_stringc C s t j � | _d S )N)r# r/ )r r r r �start} s zAnalyzeStatistics.startc C s t j � | _| j| j | _d S )N)r# r0 r/ r1 )r r r r �end� s
zAnalyzeStatistics.endc C s& t |�| _| jj| j� | jj� d S )N)r r- r. �appendr$ )r r r r r �
new_plugin� s
z AnalyzeStatistics.new_pluginN) r( r) r* r r" r3 r9 r: r< r r r r r+ c s
r+ c @ s. e Zd Zdd� Zdd� Zdd� Zd dd �Zd
S ) r c C s t � | _tdt| j� � d S )NzNumber of Plugins = %d)Z load_plugins�plugins� log_debugr2 )r r r r r � s zAnalyze.__init__c C s t � }|r|j� |S )N)Z
SEEnvironment�update)r �query_environment� environmentr r r �get_environment� s zAnalyze.get_environmentc C s$ t |j|j|j|j|j|jd�}|S )N)�host�access�scontext�tcontext�tclass�tpath)ZSEFaultSignaturerC rD rE rF rG rH )r �avcrA �sigr r r �
get_signature� s
zAnalyze.get_signatureTc C s� t d| � |j� | j|j�}ddlm} |jjd k rD|jjj� t |j|j
|j |j |j
|j|j|j|j|j|j| j||�||jjt|jj�|j� dd�}�x | jD �]}y�|j|�}|d k �rD|jdkr�t d� d S |jd k o�|jdk�r|jdk�s|jd k�r|j|_t|t ��r8x(|D ]} |j j | � �q W n |j j |� W q� t k
�r� }
zVt |
t!j"d
� t#j#t#j$d |j% � t!j&� \} } }
t d j't(j)|
��� | jj*|� W Y d d }
~
X q�X q�W |j+|� d S )
Nzanalyze_avc() avc=%sr )�TemplateZyellow)� audit_event�source�spathrH Z src_rpm_listZ tgt_rpm_listrE rF rG �portrC rJ rA � line_numbers�last_seen_date�local_id�levelZwhitez!plugin level white, not reportingZredZgreen)�filezPlugin Exception %s r4 ),r> r? rB r@ �stringrL rM rQ �sortZSEFaultSignatureInforN rO rH Zsrc_rpmsZtgt_rpmsrE rF rG rP rC rK � TimeStampZ timestamp� generate_idr= �analyzerT �
isinstance�listZ plugin_listr; � Exception�print�sys�stderr�syslog�LOG_ERRr �exc_infor8 � traceback� format_tb�remove�report_problem)r rI �report_receiverr@ rA rL �siginfor Zreport�r�eZv1Zv2Zv3r r r � analyze_avc� sZ
"zAnalyze.analyze_avcN)T)r( r) r* r rB rK rl r r r r r � s
c @ s e Zd Zddd�Zdd� ZdS )r �
c C s& t jj| � tj| � || _|| _d S )N)� threading�Threadr r �queue�timeout)r rp rq r r r r � s
zAnalyzeThread.__init__c C s� x�y6| j j� \}}tjtjd� tjd� | j||� W nf tk
rl } ztjtjd| � W Y d d }~X n4 t k
r� } ztjtjd| � W Y d d }~X nX tjtjdj
| j �� tj| j � qW d S )Nz)AnalyzeThread.run(): Cancel pending alarmr z!Exception during AVC analysis: %sz,AnalyzeThread.run(): Set alarm timeout to {}) rp �getra Z LOG_DEBUG�signal�alarmrl r] rb �
ValueError�formatrq )r rI rh rk r r r �run� s
"$zAnalyzeThread.runN)rm )r( r) r* r rw r r r r r � s
c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )r c C s
|| _ d S )N)�database)r rx r r r r s z PluginReportReceiver.__init__c C s� y0| j j|j�}|j|� | j j|� td� W nL tk
r| } z0|jtkrjtd� |j |_
| j j |�}n� W Y d d }~X nX |S )Nzsignature found in databaseznot in database yet) rx �lookup_signaturerJ Z update_merge�modify_siginfor> � ProgramError�errno�ERR_NO_SIGNATURE_MATCHrR �first_seen_date� add_siginfo)r ri Zdatabase_siginfork r r r rg s
z#PluginReportReceiver.report_problemc C s | j jj� S )N)rx �sigsZgenerate_local_id)r r r r rY s z PluginReportReceiver.generate_idN)r( r) r* r rg rY r r r r r � s c s$ e Zd Z� fdd�Zdd� Z� ZS )r c s t t| �j|� d S )N)�superr r )r rx )� __class__r r r s z!TestPluginReportReceiver.__init__c C s t d|jj � d S )NzAnalysis Result: %s)r^ rJ r )r ri r r r rg s z'TestPluginReportReceiver.report_problem)r( r) r* r rg �
__classcell__r r )r� r r s c @ s� e Zd Zd2dd�Zdd� Zdd� Zdd � Zd
d � Zd3d
d�Zd4dd�Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd � Zd d � Zd d � Zd!d"� Zd5d#d$�Zd%d&� Zd'd(� Zd)d*� Zd6d,d-�Zd.d/� Zd0d1� ZdS )7r Nc C s� || _ d | _t||| j �| _tj� | _d| _d| _d| _ d| _
d | _ t ddt
�| _d | _t dd�}|d k r�|j� }|r�t|�| _td| jj| jj| jj f � | j� d S ) NFr � �� rx �
max_alerts�
max_alert_agez<created new database: name=%s, friendly_name=%s, filepath=%s)�filepath�notifyZSEDatabaseProperties�
propertiesrn ZLock�lock� file_exists�modified_count�auto_save_interval�auto_save_threshold�auto_save_timerr �intr� r� �stripZparse_datetime_offsetr> r �
friendly_name�load)r r� r r� r� r r r r $ s$
z SETroubleshootDatabase.__init__c C s� | j p
| jsdS | jjjtdd� �d� | j�r t� }|| j8 }d}x$| jjD ]}|j|kr^P |d7 }qNW |dk�r td| j|j � f � td| jjd jj � | jj|d jj � f � td | jj| jj � | jjd jj � f � d
d � | jjd |� D �}x |D ]}| j
|d d
� �qW | j �r�t | jj�| j }|dk�r�dd � | jjd |� D �}td|t |�|f � x |D ]}| j
|d d
� �qxW d S )NFc S s t | j|j�S )N)�cmprR )�a�br r r r ? s z.SETroubleshootDatabase.prune.<locals>.<lambda>)�keyr � z5prune by age: max_alert_age=%s min_time_to_survive=%sz prune by age: pruning [%s - %s]z prune by age: keeping [%s - %s]c S s g | ]
}|j �qS r )rJ )r6 ri r r r r7 O s z0SETroubleshootDatabase.prune.<locals>.<listcomp>T)�prunec S s g | ]
}|j �qS r )rJ )r6 ri r r r r7 V s z*prune first %d alerts, len(sigs=%d sigs=%s���) r� r� r� �signature_listrW r
rX rR r> rv �delete_signaturer2 )r Zmin_time_to_surviveZkeepri r� rJ r r r r� : s2
0,
z SETroubleshootDatabase.prunec C s
|| _ d S )N)r� )r r� r r r �
set_notify[ s z!SETroubleshootDatabase.set_notifyc C s6 x0| j jD ]$}|j|jk r
|j}|j|_||_q
W d S )N)r� r� rR r~ )r ri Ztmpr r r �validate^ s
z SETroubleshootDatabase.validatec C sh t � | _| jd krd S tjj| j�rTtj| j�}|t dkrT| jj| jdt �rTd| _
| j � | j � d S )Nr r� T)
�SEFaultSignatureSetr� r� �os�path�exists�stat�ST_SIZEZ
read_xml_filer r� r� r� )r � stat_infor r r r� f s
zSETroubleshootDatabase.loadFc C sj | j d krd S td| j | jf � |s.| j� | jjd| j � d| _d| _| jd k rftj | j� d | _d S )Nz'writing database (%s) modified_count=%sr� Tr )
r� r> r� r� r� Z write_xmlr� r� r Z
source_remove)r r� r r r �saveu s
zSETroubleshootDatabase.savec C s` | j d7 _ | jd kr d S | j | jks0| j r<| j|� n | jd kr\tj| jd | j �| _d S )Nr� i� )
r� r� r� r� r� r� r Z timeout_addr� �auto_save_callback)r r� r r r �
mark_modified� s
z$SETroubleshootDatabase.mark_modifiedc C s t d| j| jf � | j� dS )Nz)auto_save database (%s) modified_count=%sF)r> r� r� r� )r r r r r� � s z)SETroubleshootDatabase.auto_save_callbackc C s: | j d krd S tjj| j �r6td| j � tj| j � d S )Nzdeleting database (%s))r� r� r� r� r> rf )r r r r rf � s
z SETroubleshootDatabase.removec C s | j j� d S )N)r� �acquire)r r r r r� � s z SETroubleshootDatabase.acquirec C s | j j� d S )N)r� �release)r r r r r� � s z SETroubleshootDatabase.releasec C s� d }| j j|�}tdt|�djdd� |D ��f � t|�dkrHtt��t|�dkrxtdt|�djdd� |D ��f � |d j}|S )Nz1lookup_signature: found %d matches with scores %s�,c S s g | ]}d |j �qS )z%.2f)�score)r6 r r r r r7 � s z;SETroubleshootDatabase.lookup_signature.<locals>.<listcomp>r r� c S s g | ]}d |j �qS )z%.2f)r� )r6 r r r r r7 � s )r� Zmatch_signaturesr> r2 r8 r{ r} ri )r rJ ri Zmatchesr r r ry � s $ $
z'SETroubleshootDatabase.lookup_signaturec C s2 | j j|�}|d kr.td| � ttd| ��|S )Nz lookup_local_id: %s not foundzid (%s) not found)r� �lookup_local_idr> r{ ZERR_SIGNATURE_ID_NOT_FOUND)r rS ri r r r r� � s
z&SETroubleshootDatabase.lookup_local_idc C s. | j j|�}| jr"| jjd|j� | j� |S )N�add)r� r r� �signatures_updatedrS r� )r ri r r r r � s
z"SETroubleshootDatabase.add_siginfoc C s | j S )N)r� )r r r r �get_properties� s z%SETroubleshootDatabase.get_propertiesc C s8 t d| � |dkr| jS t� }| j|�}|j|� |S )Nzquery_alerts: criteria=%sr )r> r� r� r� r )r Zcriteriar� ri r r r � query_alerts� s
z#SETroubleshootDatabase.query_alertsc C s� t d| � y| j|�}W n: tk
rT } z |jtkrBt d� d S � W Y d d }~X nX | jj|� | jrx| jjd|j � | j
|� d S )Nzdelete_signature: sig=%szSignature not found!�delete) r> ry r{ r| r} r� Zremove_siginfor� r� rS r� )r rJ r� ri rk r r r r� � s
z'SETroubleshootDatabase.delete_signaturec C s" | j r| j jd|j� | j� d S )NZmodify)r� r� rS r� )r ri r r r rz � s z%SETroubleshootDatabase.modify_siginfoc C sh t d||f � y| j|�}W n: tk
rX } z |jtkrFt d� dS � W Y d d }~X nX |j|�}|S )Nz)evaluate_alert_filter: username=%s sig=%szSignature not found!�ignore)r> ry r{ r| r} Zevaluate_filter_for_user)r rJ �usernameri rk �actionr r r �evaluate_alert_filter� s
z,SETroubleshootDatabase.evaluate_alert_filterc C s� t d||||f � y| j|�}W n: tk
r\ } z |jtkrJt d� d S � W Y d d }~X nX |j|�}|j||� | j|� d S )Nz2set_user_data: username=%s item=%s data=%s sig=
%szSignature not found!)r> ry r{ r| r} Z
get_user_dataZ update_itemrz )r rJ r� �item�datari rk Z user_datar r r �
set_user_data� s
z$SETroubleshootDatabase.set_user_data� c C sx t d|||f � y| j|�}W n: tk
rZ } z |jtkrHt d� d S � W Y d d }~X nX |j|||� | j|� d S )Nz.set_filter: username=%s filter_type=%s sig=
%szSignature not found!)r> ry r{ r| r} Zupdate_user_filterrz )r rJ r� Z filter_typer� ri rk r r r �
set_filter s
z!SETroubleshootDatabase.set_filterc C s | j jj|�| _| j� d S )N)r� �users�add_user�userr� )r r� r r r r� s z SETroubleshootDatabase.add_userc C s | j jj|�S )N)r� r� �get_user)r r� r r r r� s z SETroubleshootDatabase.get_user)N)F)F)F)r� )r( r) r* r r� r� r� r� r� r� r� rf r� r� ry r� r r� r� r� rz r� r� r� r� r� r r r r r " s.
!
c @ s^ e Zd Zejjdejejffejjdejejejffd�Z dd� Z
dd� Z dd� Z d d
� Z
dS ) r N)r� z async-errorc C s, t j j| � tj| � || _| jj| � d S )N)r
r � RpcManagerx r� )r rx r r r r % s
z$SETroubleshootDatabaseLocal.__init__c C s | j j|� d S )N)rx r� )r r� r r r r� + s z&SETroubleshootDatabaseLocal.set_notifyc G s� t d| jj|jdjdd� |D ��|f � | j| }t| j|jd �}|d krdtt d|j| jjf ��y(||� |_
d|_ |j
d k r�|j
g|_
W n6 tk
r� } z|j |j
g|_
d|_ W Y d d }~X nX |j
d k r�tj| j|� d S )Nz%s emit %s(%s) id=%sr� c S s g | ] }t |��qS r )r5 )r6 �argr r r r7 / s z8SETroubleshootDatabaseLocal.emit_rpc.<locals>.<listcomp>z'method %s not found in base class of %sZ
method_returnZ error_return)r> r� r( �methodr8 Zasync_rpc_cache�getattrrx r{ ZERR_METHOD_NOT_FOUNDZ return_argsZ return_typer| �strerrorr
�idle_addZprocess_async_return)r Zrpc_id�typeZrpc_def�argsZ async_rpc�funcrk r r r �emit_rpc. s *
z$SETroubleshootDatabaseLocal.emit_rpcc C s" t d||f � | jd||� d S )Nz4signatures_updated() database local: type=%s item=%sr� )r> �emit)r r� r� r r r r� A s z.SETroubleshootDatabaseLocal.signatures_updated)r( r) r* r
� SignalFlags�RUN_LAST�
TYPE_PYOBJECTZ TYPE_STRINGZTYPE_INT� __gsignals__r r� r� r� r r r r r s c @ sn e Zd Zejjdejffejjdejffd�Zddd�Z ddd�Z
dd� Z d d
� Z d d � Z
d
d� Zdd� ZdS )r N)�progressz
state-changedc C sf t j j| � td| jj|f � || _d | _d | _d| _d | _ d | _
d | _ d | _ d | _
d | _d | _d S )Nz%s.__init__(%s)� )r
r r> r� r( � logfile_pathrU �fileno� read_size�
record_reader�record_receiver�analyzerrh � idle_proc_idr| r� )r r� r r r r R s zLogfileAnalyzer.__init__c C sT |d k r|| _ td| jj| j f � y2tj| j �}|t | _t| j �| _ | j j
� | _
W nR t k
r� } z6t j t j
d| jj|jf � |j| _|j| _|�W Y d d }~X nX d| _d| _d| _d| _d| _| jd| j� tjj| j �}dtjj|�d | _td || jd�| _t t j �| _ t � | _ t!� | _"t#d d
t$��sDt%| j�| _&n t'| j�| _&d S ) Nz %s.open(%s)z
%s.open(): %sr g Fr� zfile: %s)r� ZtestrZ T)(r� r> r� r( r� r� r� � file_size�openrU r� �EnvironmentErrorra rb r� r| � n_bytes_readZ
line_count� record_countr� � cancelledr� r� �basename�splitextr� r rx ZAuditRecordReaderZ TEXT_FORMATr� ZAuditRecordReceiverr� r r� r �boolr rh r )r r� r� rk Zlogfile_basenamer r r r� f s:
zLogfileAnalyzer.openc s6 t d| jj| jf � | j� � tj� fdd��| _dS )Nz
%s.run(%s)c s t � �S )N)�nextr )�task_generatorr r r � s z%LogfileAnalyzer.run.<locals>.<lambda>T)r> r� r( rU �taskr r� r� )r r )r� r rw � s zLogfileAnalyzer.runc C s� | j d k r&tj| j| j�}d | _ d | _| j| jk rddd l}d| j| j| jf }t |� |j
| _|| _ | j d k r�x | j j
� D ]}| j|� qzW | js�| jdd� d S )Nr zFfailed to read complete file, %d bytes read out of total %d bytes (%s)r� g �?)rU r� �readr� r� r� r� r| r� r> ZEIOr� r� �close�avc_event_handlerr� r� )r �new_dataZErrnor� rM r r r r� � s
zLogfileAnalyzer.closec c sx | j dd� �xR| j�r`y8tj| j| j�jd�}|dkrNtd| j � | j� W n| t k
r� } z0|j
| _
|j | _ | j� | j dd� dV W Y d d }~X n2 t k
r� } zt
d|tjd � W Y d d }~X nX | jt|�7 _| jd
k�rt| j�t| j� | _| j d | j� xF| jj|�D ]6\}}}}}| j|||||� d V | j�r dV �q W d V qW | j dd� dV d S )
Nz
state-changedZrunningzutf-8r� z EOF on %sZstoppedFr4 )rU r r� T)r� r� r� r� r� �decoder> r� r� r� r| r� ru r^ r_ r` r� r2 r� �floatr� r� �feed�new_audit_record_handlerr� )r r� rk � record_type�event_id� body_text�fields� line_numberr r r r� � s6 "
zLogfileAnalyzer.taskc C sH t d| � |j� rD|j� rD|j� dkrDt|�}| jj|| jd� d S )Nz"avc_event_handler() audit_event=%sr F)r> Zis_avcZ
is_grantedZ num_recordsZAVCr� rl rh )r rM rI r r r r� � s z!LogfileAnalyzer.avc_event_handlerc C s� t d|||f � | jd7 _t|||||�}xT| jj|�D ]D}y| j|� W q> tk
r� } zt|tj d� W Y dd}~X q>X q>W dS )z"called to enter a new audit recordzBnew_audit_record_handler() record_type=%s event_id=%s body_text=%sr� )rU N)
r> r� Z AuditRecordr� r� r� ru r^ r_ r` ) r r� r� r� r� r� Z audit_recordrM rk r r r r� � s z(LogfileAnalyzer.new_audit_record_handler)N)N)r( r) r* r
r� r� Z
TYPE_FLOATr� r� r r� rw r� r� r� r� r r r r r J s
$ )+Z
__future__r �__all__ra Z
gi.repositoryr
r r� rs r# rn rd r� r_ � functoolsr
Zsetroubleshoot.configr Zsetroubleshoot.avc_auditZsetroubleshoot.errcodeZsetroubleshoot.rpcZ setroubleshoot.rpc_interfacesZsetroubleshoot.signatureZsetroubleshoot.utilZsetroubleshoot.audit_dataZ setroubleshoot.xml_serializer r� �objectr r+ r ro r r r r r� Z SETroubleshootDatabaseInterfaceZ%SETroubleshootDatabaseNotifyInterfacer Z
type_registerr r r r r �<module> sV ()W x )