3
��n`ǝ � @ sd d dl mZ d dlZd dlmZ d dlZdddddd d
d gZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
Z
d d lT d dljZd d lT d d lT d d lT d d lT d
Zdd� Ze� Zdd� Zdd� Ze jd�Z dd� Z e jd�Z dd� Z d dl Z dd� Z!G dd� de"�Z#G dd� de"�Z$G d d
� d
e"�Z%G d d � d �Z&G d d � d e"�Z'G d d� d�Z(dS ) � )�absolute_importN)�range�derive_record_format�parse_audit_record_text�
AvcContext�AVC� AuditEventID�
AuditEvent� AuditRecord�AuditRecordReader)�*� c C s | |k| |k S )N� )�x�yr r � /usr/lib/python3.6/audit_data.py�<lambda>6 s r c C s t | �\}}}}t|||�}|S )N)r r
)�text�parse_succeeded� record_type�event_id� body_text� audit_recordr r r �audit_record_from_text@ s r c C s* t jd| �rtjS t jd| �r$tjS tjS )Nz/audispd_events$z/audit_events$)�re�searchr � TEXT_FORMAT�
BINARY_FORMAT)Z socket_pathr r r r H s
zL(node=(\S+)\s+)?(type=(\S+)\s+)?(msg=)?audit\(((\d+)\.(\d+):(\d+))\):\s*(.*)c
C s� d}d }d }d }d }t j| �}|d k r�d}|jd�r>|jd�}|jd�rR|jd�}|jd�r�t|jd��}t|jd��}t|jd��} t||| |�}|jd �}||||fS )
NFT� � � � � � �
)�audit_input_rer �group�intr )
�inputr �hostr r r �match�seconds�milli�serialr r r r a s&
z%audit\(((\d+)\.(\d+):(\d+))\):\s*(.*)c C sv d}d }d }t j| �}|d k rld}|jd�rbt|jd��}t|jd��}t|jd��}t|||�}|jd�}|||fS )NFT� r r
r � )�audit_binary_input_rer r& r' r )r( r r r r* r+ r, r- r r r �parse_audit_binary_text s
r1 c C s" | r dd� | D �}|| kr dS dS )Nc S s g | ]}|t jkr|�qS r )�string� printable)�.0r r r r �
<listcomp>� s z printable.<locals>.<listcomp>TFr )�sZ
filtered_pathr r r r3 � s
r3 c sZ e Zd Zddiddiddiddid�Z� fdd�Zdd� Zdd � Zd
d � Zd d
� Z� Z S )r �XMLForm� attribute)�user�role�type�mlsc sz t t| �j� t|tj�rv|jd�}t|�dkrv|d | _|d | _ |d | _
t|�dkrpdj |dd � �| _ nd| _ d S )N�:r
r r. r Zs0)
�superr �__init__�
isinstance�sixZ string_types�split�lenr9 r: r; �joinr< )�self�data�fields)� __class__r r r? � s
zAvcContext.__init__c C s d| j | j| j| jf S )Nz %s:%s:%s:%s)r9 r: r; r< )rE r r r �__str__� s zAvcContext.__str__c C s t jt| ��\}}|S )N)�selinuxZ selinux_raw_to_trans_context�str)rE ZrcZtransr r r �format� s zAvcContext.formatc C s | j |� S )N)�__eq__)rE �otherr r r �__ne__� s zAvcContext.__ne__c C s4 x.t | jj� �D ] }t| |�t||�krdS qW dS )NFT)�list� _xml_info�keys�getattr)rE rN �namer r r rM � s zAvcContext.__eq__)
�__name__�
__module__� __qualname__rQ r? rI rL rO rM �
__classcell__r r )rH r r � s
c sv e Zd Zded�ded�ded�ddid�Zd� fdd� Zdd � Zd
d � Zd d
� Ze dd� �Z
dd� Z dd� Z � Z
S )r r8 )r7 �import_typecastr7 )r+ r, r- r) Nc s2 t t| �j� || _|| _|| _|d k r.|| _d S )N)r> r r? r+ r, r- r) )rE r+ r, r- r) )rH r r r? � s zAuditEventID.__init__c C sD | j |j krdS | j|jkr dS | j|jkr0dS | j|jkr@dS dS )NFT)r) r+ r, r- )rE rN r r r rM � s zAuditEventID.__eq__c C sb | j |j kr&td| jj| j |j f ��| j|jkr>| j|jk S | j|jkrV| j|jk S | j|jk S )Nz?cannot compare two %s objects whose host values differ (%s!=%s))r) �
ValueErrorrH rU r+ r, r- )rE rN r r r �__lt__� s zAuditEventID.__lt__c C s dd l }|j | �S )Nr )�copy)rE r\ r r r r\ � s zAuditEventID.copyc C s t | j�| jd S )Ng @�@)�floatZsecr, )rE r r r r � s zAuditEventID.<lambda>c C s d| j | j| jf S )Nzaudit(%d.%d:%d))r+ r, r- )rE r r r rI � s zAuditEventID.__str__c C s. | j d krdS | jd kr dS | jd kr*dS dS )NFT)r+ r, r- )rE r r r �is_valid� s
zAuditEventID.is_valid)N)rU rV rW r' rQ r? rM r[ r\ �propertyZtimerI r^ rX r r )rH r r � s c s� e Zd Zddided�ddided�d�ZdZdZej e�Z
e j d�Z
e j d �Ze j d
�Zd(� fd d
� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Z d&d'� Z � Z S ))r
r7 r8 �element)r7 rY )r r r � line_numberr Ziiiiz([^ \t]+)\s*=\s*([^ \t]+)z$avc:\s+([^\s]+)\s+{([^}]+)}\s+for\s+z^a\d+$Nc s8 t t| �j� || _|| _|| _|| _|| _| j� d S )N) r> r
r? r r r rG ra �_init_postprocess)rE r r r rG ra )rH r r r? s zAuditRecord.__init__c C sr t | dd �d kr | j| j� | jd
krnd| jkrntjj| j�}|rn|jd�}|| jd< |jd�}|j � | jd < d S ) NrG r �USER_AVC�1400�1107�seresultr. r �seperms)r rc rd re )
rS �set_fields_from_textr r rG r
�avc_rer r& rB )rE r* rf rg r r r rb s
z AuditRecord._init_postprocessc C s | j � S )N)� to_host_text)rE r r r rI + s zAuditRecord.__str__c C s d | _ | jjd kr t� | j_d S )N)ra r r) Z get_hostname)rE r r r �audispd_rectify. s zAuditRecord.audispd_rectifyc C s. | j j� sdS | jd kr dS | jd kr*dS dS )NFT)r r^ r �message)rE r r r r^ 3 s
zAuditRecord.is_validc C s� ddddddddd d
d d d
dddg}xF|D ]>}|| j kr*| jdkrL|dkrLq*| j | }t|�}|| j |< q*W | jdkr�xBt| j j� �D ]0\}}| jj|�r�| j | }t|�}|| j |< q�W d S )NZacct�cmd�comm�cwdrF �dir�exe�filer) �key�msgrT �newZocommold�pathZwatchr ZsaddrZEXECVE)rG r Zaudit_msg_decoderP �items� exec_arg_rer )rE Zencoded_fieldsZfield�valueZ
decoded_valuer r r �
decode_fields< s
zAuditRecord.decode_fieldsc C s< y,t jd dk r|jd�S tj|�jd�S W n
|S d S )Nr r
�hexzutf-8)�sys� version_info�decode� bytearray�fromhex)rE rv r r r �
translate_hexP s
zAuditRecord.translate_hexc C s
g | _ i | _� x�tjj|�D ]�}|jd�}|jd�}|jd�}y�|dkrbtjt |d��}tj
|�}|dkr�|jd�j d�s�| j |�}|d kr�yt
jtt |�� }W n Y nX |d
kr�tjt |�tj� �}|r�|}W n tk
r� Y nX || j|< | j j|� q W d S )Nr. r �"�arch� rT rv rn rm rq ro �exit�syscall)rT rv rn rm rq ro )�
fields_ordrG r
�key_value_pair_re�finditerr& �strip�auditZaudit_elf_to_machiner' Zaudit_machine_to_name�
startswithr� �errno� errorcode�absZaudit_syscall_to_nameZaudit_detect_machinerZ �append)rE r r* rs ry �iZ syscall_namer r r rh _ s4
z AuditRecord.set_fields_from_textc C s | j j|�S )N)rG �get)rE rT r r r � get_field� s zAuditRecord.get_fieldc C s" t |�}tjtjtjtj| j|�S )N)rC �struct�packr
�binary_header_format�binary_version�binary_header_sizer )rE rt �
msg_lengthr r r �get_binary_header� s z AuditRecord.get_binary_headerc sj � j d krdS � jdkr4d� j� jdj� j�f }nd� j� jf }|dj� fdd�� jD ��d 7 }|S ) N� r z#type=%s msg=%s: avc: denied { %s } � ztype=%s msg=%s: c s g | ]}d |� j | f �qS )z%s=%s)rG )r4 �k)rE r r r5 � s z.AuditRecord.fields_to_text.<locals>.<listcomp>�
)rG r r rD �accessr� )rE Zbufr )rE r �fields_to_text� s
"zAuditRecord.fields_to_textc C s d| j | j| jf S )Nztype=%s msg=%s: %s
)r r r )rE r r r �to_text� s zAuditRecord.to_textc C s2 | j jd k r&d| j j| j| j | jf S | j� S d S )Nznode=%s type=%s msg=%s: %s
)r r) r r r� )rE r r r rj � s zAuditRecord.to_host_textc C s d| j | jf }| j|�| S )Nz%s: %s)r r r� )rE �recordr r r � to_binary� s zAuditRecord.to_binary)NN) rU rV rW r r' rQ r� r� r� �calcsizer� r �compiler� ri rx r? rb rI rk r^ rz r� rh r� r� r� r� rj r� rX r r )rH r r
s0
"
c @ s, e Zd ZdZdZdd� Zdd� Zdd� Zd S )
r r. r c C sV || _ d| _d| _| j | jkr(| j| _n*| j | jkr>| j| _ntd|| j j
f ��d S )Nr� r z unknown record format (%s) in %s) �
record_format�
_input_bufferra r � feed_textZfeedr � feed_binaryrZ rH rU )rE r� r r r r? � s
zAuditRecordReader.__init__c c s� t |�dkrd S | j|7 _x�t | j�tjk r4d S tjtj| jdtj� �\}}}}tj| }t | j�|k rrd S | jtj|� }t|�\}} }
| j|d � | _|r tj |�| |
d dfV q W d S )Nr )
rC r� r
r� r� �unpackr� r1 r� Zaudit_msg_type_to_name) rE �new_datar� r� r r� Z total_lenr r r r r r r r� � s"
z AuditRecordReader.feed_binaryc c s� t |�dkrd S | j|7 _d}| jjd|�}xh|dkr�| jd7 _|d7 }| j||� }t|�\}}}}|r�|||d | jfV |}| jjd|�}q2W | j|d � | _d S )Nr r� r. )rC r� �findra r ) rE r� �start�end�liner r r r r r r r� � s
zAuditRecordReader.feed_textN)rU rV rW r r r? r� r� r r r r r � s
!c s� e Zd Zdded�ded�d�Z� fdd�Zdd � Zd
d � Zd$d
d�Z dd� Z
e dd� �Z dd� Z
dd� Zd%dd�Zdd� Zd d � Zd d � Zd d!� Zd"d#� Z� ZS )&r r` r )r7 rP rY )r7 rY )�recordsr c s* t t| �j� d | _g | _i | _d | _d S )N)r> r r? r r� � record_types� timestamp)rE )rH r r r? � s
zAuditEvent.__init__c C s4 t | dd �d kri | _x| jD ]}| j|� q W d S )Nr� )rS r� r� �process_record)rE r� r r r rb � s z AuditEvent._init_postprocessc C sL | j }|j� d| j| j� | j� djdd� |D ��djdd� | jD ��f S )Nz2%s: is_avc=%s, is_granted=%s: line_numbers=[%s]
%s�,c S s g | ] }t |��qS r )rK )r4 r r r r r5
s z&AuditEvent.__str__.<locals>.<listcomp>r� c S s g | ] }d | �qS )z %sr )r4 r� r r r r5 s )� line_numbers�sortr �is_avc�
is_grantedrD r� )rE r� r r r rI s zAuditEvent.__str__r� c C s |j dd� | jD ��S )Nc S s g | ] }t |��qS r )rK )r4 r� r r r r5 s z%AuditEvent.format.<locals>.<listcomp>)rD r� )rE Z separatorr r r rL
s zAuditEvent.formatc C s
t | j�S )N)rC r� )rE r r r � num_records s zAuditEvent.num_recordsc C s dd� | j D �S )Nc S s g | ]}|j r|j �qS r )ra )r4 r� r r r r5 s z'AuditEvent.<lambda>.<locals>.<listcomp>)r� )rE r r r r s zAuditEvent.<lambda>c C s | j j|� | j|� d S )N)r� r� r� )rE r� r r r �
add_record s zAuditEvent.add_recordc C sp | j d kr2|j j� | _ t| j j�| j jd | _n | j |j ksRtd| j |j f ��| jj|j g �}|j
|� d S )Ng @�@zBcannot add audit record to audit event, event_id mismatch %s != %s) r r\ r] r+ r, r� rZ r� �
setdefaultr r� )rE r� Z record_listr r r r� s
zAuditEvent.process_recordNc C sV g }|dkr| j }n
| j|�}x2|D ]*}|jj|�}|dkr>q$|j||jf� q$W |S )aN Return list of (value, record_type) tuples.
In other words return the value matching name for every record_type.
If record_type is not specified then all records are searched.
Note: it is possible to have more than one record of a given type
thus it is always possible to have multiple values returned.N)r� �get_records_of_typerG r� r� r; )rE rT r rw r� r� ry r r r r� % s
zAuditEvent.get_fieldc C s d }| j j|�}|r |d }|S )Nr )r� r� )rE r; r� r� r r r �get_record_of_type9 s
z AuditEvent.get_record_of_typec C s | j j|g �S )N)r� r� )rE r; r r r r� @ s z AuditEvent.get_records_of_typec C s$ x dD ]}| j |�}|r|S qW d S )Nr rc rd re )r rc rd re )r� )rE r r� r r r �get_avc_recordC s
zAuditEvent.get_avc_recordc C s | j � d k S )N)r� )rE r r r r� I s zAuditEvent.is_avcc C sH | j � }|d krdS |jd }|dkr*dS |dkr6dS tjjd|� dS )NFrf ZdeniedZgrantedTz!unknown value for seresult ('%s'))r� rG �logZavc�warn)rE �
avc_recordrf r r r r� L s
zAuditEvent.is_granted)r� )N)rU rV rW r
r rQ r? rb rI rL r� r_ r� r� r� r� r� r� r� r� r� rX r r )rH r r � s
c @ s| e Zd ZdgZddgZdddddgZddddddgZddddddgZddd d
gZd ddd dd d
gZ dd ddddd
d ddd d
g Z
ddddddgZ ddddddddd
g Z dddddddd
gZ
dd dddd ddd d
ddddd
dgZddddgZddgZdgZd gZddddddgZdddddd
dgZdddddd
dgZdd dd dd
dd d
dddddddgZdgZd gZdddddgZdddddgZddd
dddgZdddd
dddgZ dd gZ dd dd dd
dd
dd ddg Z e j d�Z!e j d�Z"dBdd�Z#dd � Z$d d � Z%d d � Z&d!d"� Z'd#d$� Z(d%d&� Z)d'd(� Z*d)d*� Z+d+d,� Z,d-d.� Z-d/d0� Z.d1d2� Z/d3d4� Z0d5d6� Z1d7d8� Z2d9d:� Z3d;d<� Z4d=d>� Z5d?d@� Z6dAS )Cr rS Zexecute�open�read�lockZioctlr� �link�unlink�renameZcreate�setattr�writer Zadd_nameZ remove_nameZreparent�rmdirZmountZremountZunmountz^(\w+):\[([^\]]*)\]z^(/proc/)(\d+)(.*)Tc C s� || _ || _i | _d | _d | _d | _d | _d | _d | _d | _ d | _
d | _ g | _ g | _
d | _d | _d | _d | _d | _g | _| j� d S )N)� audit_event�query_environment�template_substitutions�tpath�spath�source�
source_pkgr� �scontext�tcontext�tclass�port�src_rpms�tgt_rpmsr) �pid�kmodr� �why�bools� derive_avc_info_from_audit_event)rE r� r� r r r r? � s* z AVC.__init__c C s | j � S )N)�
format_avc)rE r r r rI � s z AVC.__str__c C sN d}|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|S )Nr� z scontext=%s z tcontext=%s z
access=%s z
tclass=%s z tpath=%s )r� r� r� r� r� )rE r r r r r� � s zAVC.format_avcc C s. | j dkrdS x| j D ]}||krdS qW dS )zMReturns true if the AVC contains _any_ of the permissions in the access list.NFT)r� )rE � access_list�ar r r �has_any_access_in� s
zAVC.has_any_access_inc C s. | j dkrdS x| j D ]}||krdS qW dS )zmReturns true if _every_ access in the AVC matches at
least one of the permissions in the access list.NFT)r� )rE r� r� r r r �all_accesses_are_in� s
zAVC.all_accesses_are_inc
C s� t � t� }|j� t� }|j� g }dd� dd� ttgt| jjt | j
t | j i�D �D �}|}x,|D ]$}||krd|j
ttt|��d � qdW x&|D ] }||kr�||kr�|j|� q�W |j� |S )Nc S s g | ] }|t �qS r )ZTARGET)r4 r r r r r5 � s z,AVC.allowed_target_types.<locals>.<listcomp>c S s g | ]}|d r|�qS )Zenabledr )r4 r r r r r5 � s �types)Zget_all_file_typesZget_all_port_typesr� Zget_all_attributesr �ALLOW�SOURCEr� r; ZCLASSr� ZPERMSr� �extend�next�infoZ ATTRIBUTEr� )rE Z all_typesZall_attributesZ
allowed_typesZwtypesr� �tr r r �allowed_target_types� s 4
zAVC.allowed_target_typesc C s@ | j dg�r<y"| jr,t| j�t@ tjkr,dS W n Y nX dS )Nr� TF)r� �a1r' � O_ACCMODE�os�O_RDONLY)rE r r r �open_with_write� s zAVC.open_with_writec C s$ x |D ]}t j||j�rdS qW dS )NTF)r r* r; )rE �context� type_listr; r r r Z __typeMatch� s
zAVC.__typeMatchc C s | j dkrdS | j| j |�S )zReturns true if the type in the source context of the
avc regular expression matches any of the types in the type list.NF)r� �_AVC__typeMatch)rE r� r r r �matches_source_types� s
zAVC.matches_source_typesc C s | j dkrdS | j| j |�S )zReturns true if the type in the target context of the
avc regular expression matches any of the types in the type list.NF)r� r� )rE r� r r r �matches_target_types� s
zAVC.matches_target_typesc C s | j d krdS | j |kS )NF)r� )rE Z tclass_listr r r �
has_tclass_in� s
zAVC.has_tclass_inc C s | j � | j� d S )N)�derive_environmental_info�%update_derived_template_substitutions)rE r r r �update� s z
AVC.updatec C s | j d krdS | j tkS )NT)r� �standard_directories)rE r r r � path_is_not_standard_directory� s
z"AVC.path_is_not_standard_directoryc C s4 d}| j jd�}| j jd�}| j jd�}|dkr�| jjd�}xJ|D ]B}|jd�}|r^|dkr^qB|jd�}|rB|rB|dkrB|j|�rBP qBW |dkr�| j jd�}|dk r�| j jd�}|d kr�d
| }n$|d kr�|d kr�|}q�d
| }n|}|dk �r||d ko�|�r�g }�y�d
} | j jd�}
tjjd|
��r8tjd|
�j } t
|�} t dd�} x�| j � j
d�D ]�}
|
j
� }t|��rZ|d d
d k�rZyP| d
k�s�tj|d
�j | k�r�t
tj|d �j�| k�r�|j|dd� � W n tk
�r� �wZY nX �qZW | j� t|�dk�r|d
d }n�t|�dk�r�x�|D ]x}
|
d
d|
k�sP|
d |
k�r\|
d }P nFy.| d
k�r�tj|
d
�j | k�r�|
d }P W n tk
�r� Y nX �q,W W n2 tk
�r� d}Y n tk
�r� d}Y nX n�|jd �dk�r||�r|d
dl}ddd| g}yb|j||jd d �}t
|�} xB|j
d�D ]4}y t
tj|�j�| k�rV|}P W n Y nX �q4W W n Y nX |dk �r�|jd ��r�| jjd |�}n4| jj |�}|�r�| j }|d
d k�r�d |j d � }|| _ | j dk�r0| j d!k�r�d"| _ n4| j d#k�s| j d$k�r&t d%�| j! | _ n
t d&�| _ dS )'a� Derive the target path.
If path information is available the avc record will have a path field
and no name field because the path field is more specific and supercedes
name. The name field is typically the directory entry.
For some special files the kernel embeds instance information
into the file name. For example 'pipe:[1234]' or 'socket:[1234]'
where the number inside the brackets is the inode number. The proc
pseudo file system has the process pid embedded in the name, for
example '/proc/1234/mem'. These numbers are ephemeral and do not
contribute meaningful information for our reports. Plus we may use
the path information to decide if an alert is identical to a
previous alert, we coalesce them if they are. The presence of an
instance specific number in the path confuses this comparison.
For these reasons we strip any instance information out of the
path,
Example input and output:
pipe:[1234] --> pipe
socket:[1234] --> socket
/proc/1234/fd --> /proc/<pid>/fd
./foo --> ./foo
/etc/sysconfig --> /etc/sysconfig
NrT rv �ino�PATHZnametypeZPARENTr� rr z%srp �/r �devz/dev/z /proc/mounts�rr� r. r
z/dev/%sr zunknown mountpointFZlocatez-bz\%sT)�stderrZuniversal_newlinesz \1<pid>\3� �@Z
filesystemr� Z
udp_socketZ
tcp_socketzport %sZUnknown)"r� r� r� r� �endswithr� rv �exists�lstat�st_rdevr' r� r� rB rC �stat�st_inor� �OSError�close� TypeErrorr� �
subprocessZ check_outputZSTDOUT�proc_pid_instance_re�sub�pipe_instance_path_rer r� r� r� �_r� )rE rv rT ZinodestrZavc_path_recordsZavc_path_recordr r� ZmatchesZdev_rdevr� r� �fdr� r r Zcommand�outputrr r* r r r �
_set_tpath s�
:
zAVC._set_tpathc C sx d | _ d | _d | _d | _d| _g | _d } } }}| jj� | _| jj d�}| jj
d�| _ t | j
t�sxt| jj
d��| _
t | jt�s�t| jj
d��| _| jj
d�| _| jj
d�d kr�| jj
d�| _n| jj
d�| _| j� | jj
d �| _| jj
d
�| _|�r8|j
d �}|j
d �}|j
d
�| _|j
d�dk| _|j
d�| _|d k�rN| jj
d �}|d k�rd| jj
d �}|| _|�rx|| _n|�r�| j| _| j�s�| j| _| j�s�| j
j| _| jj d�}|�r�|j
d�}nd }| jjd�}xR|D ]J} | j
d�}
tjj|
��s | �r| jj|
� n| jjtjj ||
�� �q�W g | _ g | _ | jj j | _ t!j"t#| j
�t#| j�t#| j�| j �\| _$} | j$t!j%k�r�t&t'd�| j ��| j$t!j(k�r�t&t'd�| j ��| j$t!j)k�r�t&t'd���| j$t!j*k�r�t&t'd�| j ��| j$t!j+k�rt&t'd�| j ��| j$t!j,k�r&t&t'd�| j ��| j$t!j-k�rFt&t'd�| j ��| j$t!j.k�r`t&t'd ���| j$t!j/k�rt| | _0d S ) NFZSYSCALLrg r� r� r� �dest�srcr� r� rq rn r� �success�yesr� ZCWDro r� rT z8%s
**** Recorded AVC is allowed in current policy ****
zh%s
**** Recorded AVC is dontaudited in current policy. 'semodule -B' will turn on dontaudit rules ****
zMust call policy_init firstz.%s
**** Invalid AVC: bad target context ****
z.%s
**** Invalid AVC: bad source context ****
z*%s
**** Invalid AVC: bad type class ****
z*%s
**** Invalid AVC: bad permission ****
z&Error during access vector computation)1r� r� r� r� r Z
syscall_pathsr� r� r� r� r� r� r@ r� r r� r� r� r r� r� r� r; r� r� rv �isabsr� rD r� r� r r) � audit2whyZanalyzerK r� r� rZ r Z DONTAUDITZNOPOLICYZBADTCONZBADSCONZ BADTCLASSZBADPERMZ
BADCOMPUTEZBOOLEANr� ) rE rq rn r� r� Zsyscall_recordZ
cwd_recordro Z path_recordsZ path_recordrv r� r r r r� � s�
* z$AVC.derive_avc_info_from_audit_eventc C sP | j rL| jr,t| j�| _| jr,| jj| j� | jrLt| j�}|rL| jj|� d S )N)r� r� Z get_package_nvr_by_file_pathr� r� r� r� r� )rE Zrpmr r r r� s
z AVC.derive_environmental_infoc C s | j d kr|| _ d S )N)r� )rE rv r r r � set_alt_path
s
zAVC.set_alt_pathc K s, x&t |j� �D ]\}}|r|| j|< qW d S )N)rP rw r� )rE �kwdsrs ry r r r �set_template_substitutions s z AVC.set_template_substitutionsc C sV t | jj�| jd< t | jj�| jd< t | j�| jd< t | j�| jd< | jrdtjddt | j��| jd< t | j �| jd< | j r�tjddt | j ��| jd < | j d kr�d | jd
< nJ| j
d kr�t | j �| jd
< n.| j
d kr�t t j j
| j ��| jd
< n
d | jd
< t | j
�| jd
< | jd k�r d | jd< nt dj| j��| jd< t | j�| jd< t | j�| jd< d S )NZ SOURCE_TYPEZ TARGET_TYPEr� Z SOURCE_PATHr� �.ZFIX_SOURCE_PATHZ TARGET_PATHZFIX_TARGET_PATHZ
TARGET_DIRrp rr Z TARGET_CLASSZACCESSZSOURCE_PACKAGEZ PORT_NUMBER)� escape_htmlr� r; r� r� r� r� r r
r� r� r� rv �dirnamer� rD r� r� )rE r r r r� s,
z)AVC.update_derived_template_substitutionsc C s: x4t | jj� �D ]"\}}|d krtt|��| j|< qW d S )N)rP r� rw r Z default_text)rE rs ry r r r � validate_template_substitutions5 s z#AVC.validate_template_substitutionsN)T)7rU rV rW Zstat_file_permsZ x_file_permsZ r_file_permsZ
rx_file_permsZ
ra_file_permsZlink_file_permsZcreate_lnk_permsZcreate_file_permsZ r_dir_permsZ rw_dir_permsZ ra_dir_permsZcreate_dir_permsZmount_fs_permsZsearch_dir_permsZgetattr_dir_permsZsetattr_dir_permsZlist_dir_permsZadd_entry_dir_permsZdel_entry_dir_permsZmanage_dir_permsZgetattr_file_permsZsetattr_file_permsZread_file_permsZappend_file_permsZwrite_file_permsZ
rw_file_permsZdelete_file_permsZmanage_file_permsr r� r r r? rI r� r� r� r� r� r� r� r� r� r� r� r r� r� r r r� r r r r r r [ sn
b ))Z
__future__r rA Z six.movesr r| �__all__r� r� r� r� r rJ �base64r� Zselinux.audit2whyr Zsetroubleshoot.utilZsetroubleshoot.html_utilZ setroubleshoot.xml_serializeZsepolicyr� ZcmpZget_standard_directoriesr� r r r� r% r r0 r1 r2 r3 Z XmlSerializer r r
r r r r r r r �<module> sV
)< !Mj