from __future__ import absolute_import
# Authors: John Dennis <jdennis@redhat.com>
# Thomas Liu <tliu@redhat.com>
# Dan Walsh <dwalsh@redhat.com>
#
# Copyright (C) 2006-2010 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
#
__all__ = ['RunFaultServer',
'ClientConnectionHandler',
'get_host_database',
'send_alert_notification',
'ConnectionPool',
]
from gi.repository import GObject, GLib
import dbus
import dbus.service
import dbus.glib
import gettext
#import errno as Errno
import os
#import pwd
import signal
import atexit
#from stat import *
import sys
import syslog
import systemd.journal
#import threading
#from types import *
from setroubleshoot.config import parse_config_setting, get_config
domain = get_config('general', 'i18n_text_domain')
localedir = get_config('general', 'i18n_locale_dir')
kwargs = {}
if sys.version_info < (3,):
kwargs['unicode'] = True
gettext.install(domain=domain,
localedir=localedir,
**kwargs)
translation = gettext.translation(domain=domain,
localedir=localedir,
fallback=True)
try:
_ = translation.ugettext # This raises exception in Python3, succ. in Py2
except AttributeError:
_ = translation.gettext # Python3
from setroubleshoot.access_control import ServerAccess
from setroubleshoot.analyze import (PluginReportReceiver,
SETroubleshootDatabase,
TestPluginReportReceiver,
AnalyzeThread,
)
from setroubleshoot.avc_audit import *
from setroubleshoot.config import get_config
from setroubleshoot.avc_audit import AuditRecordReceiver
from setroubleshoot.errcode import (ProgramError,
ERR_NOT_AUTHENTICATED,
ERR_USER_LOOKUP,
ERR_USER_PROHIBITED,
ERR_USER_PERMISSION,
ERR_FILE_OPEN,
ERR_DATABASE_NOT_FOUND,
)
from setroubleshoot.rpc import (RpcChannel,
ConnectionState,
get_socket_list_from_config,
ListeningServer,
)
from setroubleshoot.rpc_interfaces import (SETroubleshootServerInterface,
SETroubleshootDatabaseNotifyInterface,
SEAlertInterface,
)
from setroubleshoot.util import (get_hostname,
make_database_filepath,
assure_file_ownership_permissions,
get_identity, log_init, log_debug, syslog_trace
)
log_init('setroubleshootd_log')
#------------------------------ Utility Functions -----------------------------
def sighandler(signum, frame):
log_debug("received signal=%s" % signum)
import setroubleshoot.config as config
if signum == signal.SIGHUP:
log_debug("reloading configuration file")
config.config_init()
return
def polling_failed_handler(signum, frame):
log_debug("received signal=%s" % signum)
syslog.syslog(syslog.LOG_ERR, "/sys/fs/selinux/policy is in use by another process. Exiting!")
os._exit(1)
# TODO: change to sys.exit(1) when the bug in audti2why is fixed
def make_instance_id():
import time
hostname = get_hostname()
pid = os.getpid()
stamp = str(time.time())
return '%s:%s:%s' % (hostname, pid, stamp)
def get_host_database():
return host_database
dbus_system_bus_name = get_config('system_dbus', 'bus_name')
dbus_system_object_path = get_config('system_dbus', 'object_path')
dbus_system_interface = get_config('system_dbus', 'interface')
system_bus = dbus.SystemBus()
system_bus.request_name(dbus_system_bus_name)
# FIXME: this should be part of ClientNotifier
def send_alert_notification(siginfo):
alert = dbus.lowlevel.SignalMessage(dbus_system_object_path, dbus_system_interface, "alert")
alert.append(siginfo.level)
alert.append(siginfo.local_id)
system_bus.send_message(alert)
for client in connection_pool.clients('sealert'):
client.alert(siginfo)
#------------------------------ Variables -------------------------------
host_database = None
analysis_queue = None
email_recipients = None
email_recipients_filepath = get_config('email', 'recipients_filepath')
pkg_name = get_config('general', 'pkg_name')
pkg_version = get_config('general', 'pkg_version')
rpc_version = get_config('general', 'rpc_version')
instance_id = make_instance_id()
#-----------------------------------------------------------------------------
class ConnectionPool(object):
def __init__(self):
self.client_pool = {}
def add_client(self, handler):
if handler in self.client_pool:
log_debug("add_client: client (%s) already in client pool" % handler)
return
self.client_pool[handler] = None
def remove_client(self, handler):
if handler not in self.client_pool:
log_debug("remove_client: client (%s) not in client pool" % handler)
return
del(self.client_pool[handler])
def clients(self, channel_type=None):
for client in self.client_pool:
if channel_type is None:
yield client
elif client.channel_type == channel_type:
yield client
def close_all(self, channel_type=None):
for client in self.client_pool:
if client.channel_type == channel_type:
client.close_connection()
connection_pool = ConnectionPool()
#------------------------------------------------------------------------------
class AlertPluginReportReceiver(PluginReportReceiver):
def __init__(self, database):
super(AlertPluginReportReceiver, self).__init__(database)
def report_problem(self, siginfo):
siginfo = super(AlertPluginReportReceiver, self).report_problem(siginfo)
if email_recipients is not None:
to_addrs = []
for recipient in email_recipients.recipient_list:
username = "email:%s" % recipient.address
action = siginfo.evaluate_filter_for_user(username, recipient.filter_type)
if action != "ignore":
log_debug("Email: siginfo.sig=%s" % siginfo.sig)
to_addrs.append(recipient.address)
if len(to_addrs):
from setroubleshoot.email_alert import email_alert
email_alert(siginfo, to_addrs)
self.database.mark_modified()
log_debug("sending alert to all clients")
from setroubleshoot.html_util import html_to_text
syslog.syslog(syslog.LOG_ERR, siginfo.summary() + _(" For complete SELinux messages run: sealert -l %s") % siginfo.local_id)
for audit_record in siginfo.audit_event.records:
if audit_record.record_type == 'AVC':
pid = audit_record.fields["pid"]
break
if get_config('setroubleshootd_log', 'log_full_report', bool):
global pkg_name
systemd.journal.send(siginfo.format_text(), OBJECT_PID=pid, SYSLOG_IDENTIFIER=pkg_name)
for u in siginfo.users:
if u.username[0:6] == "email:":
# skip email users - they were evaluated before
continue
action = siginfo.evaluate_filter_for_user(u.username)
if action == "ignore":
return siginfo
send_alert_notification(siginfo)
return siginfo
#-----------------------------------------------------------------------------
class ClientConnectionHandler(RpcChannel):
def __init__(self, socket_address):
RpcChannel.__init__(self, 'sealert')
self.socket_address = socket_address.copy()
self.connection_state.connect('changed', self.on_connection_state_change)
def on_connection_state_change(self, connection_state, flags, flags_added, flags_removed):
log_debug("%s.on_connection_state_change: connection_state=%s flags_added=%s flags_removed=%s address=%s" % (self.__class__.__name__, connection_state, connection_state.flags_to_string(flags_added), connection_state.flags_to_string(flags_removed), self.socket_address))
if flags_removed & ConnectionState.OPEN:
connection_pool.remove_client(self)
if flags_added & ConnectionState.OPEN:
connection_pool.add_client(self)
def open(self, socket, socket_address):
if self.connection_state.flags & ConnectionState.OPEN:
return True
self.socket_address.socket = socket
self.connection_state.update(ConnectionState.OPEN)
self.io_watch_add(self.handle_client_io)
#-----------------------------------------------------------------------------
class SetroubleshootdClientConnectionHandler(ClientConnectionHandler,
SETroubleshootServerInterface,
SETroubleshootDatabaseNotifyInterface,
SEAlertInterface,
):
def __init__(self, socket_address):
ClientConnectionHandler.__init__(self, socket_address)
self.database = get_host_database()
self.connect_rpc_interface('SETroubleshootServer', self)
self.connect_rpc_interface('SETroubleshootDatabase', self)
self.access = ServerAccess()
self.username = None
self.uid = None
self.gid = None
def on_connection_state_change(self, connection_state, flags, flags_added, flags_removed):
log_debug("%s.on_connection_state_change: connection_state=%s flags_added=%s flags_removed=%s address=%s" % (self.__class__.__name__, connection_state, connection_state.flags_to_string(flags_added), connection_state.flags_to_string(flags_removed), self.socket_address))
if flags_removed & ConnectionState.OPEN:
connection_pool.remove_client(self)
if flags_added & ConnectionState.OPEN:
self.uid, self.gid = self.access.get_credentials(self.socket_address.socket)
log_debug("%s.on_connection_state_change: open, socket credentials: uid=%s gid=%s" % (self.__class__.__name__, self.uid, self.gid))
connection_pool.add_client(self)
def open(self, socket, socket_address):
if self.connection_state.flags & ConnectionState.OPEN:
return True
self.socket_address.socket = socket
self.connection_state.update(ConnectionState.OPEN)
self.io_watch_add(self.handle_client_io)
# ---- SETroubleshootServerInterface Methods ----
def database_bind(self, database_name):
if not (self.connection_state.flags & ConnectionState.AUTHENTICATED):
raise ProgramError(ERR_NOT_AUTHENTICATED)
host_database = get_host_database()
if host_database.properties.name == database_name:
return [host_database.properties]
raise ProgramError(ERR_DATABASE_NOT_FOUND, "database (%s) not found" % database_name)
def logon(self, type, username, password):
log_debug("logon(%s) type=%s username=%s" % (self, type, username))
if username != get_identity(self.uid):
raise ProgramError(ERR_USER_LOOKUP, detail="uid=%s does not match logon username (%s)" % (self.uid, username))
if type == 'sealert':
privilege = 'client'
else:
privilege = None
if not self.access.user_allowed(privilege, username):
raise ProgramError(ERR_USER_PROHIBITED)
self.channel_type = type
self.channel_name = username
self.username = username
self.user = self.database.get_user(username)
if self.user is None:
self.database.add_user(username)
self.connection_state.update(ConnectionState.AUTHENTICATED)
return [pkg_version, rpc_version]
def query_email_recipients(self):
if not (self.connection_state.flags & ConnectionState.AUTHENTICATED):
raise ProgramError(ERR_NOT_AUTHENTICATED)
return [email_recipients]
def set_email_recipients(self, recipients):
global email_recipients
log_debug("set_email_recipients: %s" % recipients)
if not (self.connection_state.flags & ConnectionState.AUTHENTICATED):
raise ProgramError(ERR_NOT_AUTHENTICATED)
email_recipients = recipients
email_recipients.write_recipient_file(email_recipients_filepath)
# ---- SETroubleshootDatabaseInterface Methods ----
def delete_signature(self, sig):
log_debug("delete_signature: sig=%s" % sig)
if not (self.connection_state.flags & ConnectionState.AUTHENTICATED):
raise ProgramError(ERR_NOT_AUTHENTICATED)
siginfo = self.database.delete_signature(sig)
return None
def get_properties(self):
log_debug("get_properties")
if not (self.connection_state.flags & ConnectionState.AUTHENTICATED):
raise ProgramError(ERR_NOT_AUTHENTICATED)
properties = self.database.get_properties()
return [properties]
def evaluate_alert_filter(self, sig, username):
log_debug("evaluate_alert_filter: username=%s sig=%s" % (username, sig))
if not (self.connection_state.flags & ConnectionState.AUTHENTICATED):
raise ProgramError(ERR_NOT_AUTHENTICATED)
action = self.database.evaluate_alert_filter(sig, username)
return [action]
def lookup_local_id(self, local_id):
log_debug("lookup_local_id: %s" % local_id)
if not (self.connection_state.flags & ConnectionState.AUTHENTICATED):
raise ProgramError(ERR_NOT_AUTHENTICATED)
siginfo = self.database.lookup_local_id(local_id)
return [siginfo]
def query_alerts(self, criteria):
log_debug("query_alerts: criteria=%s" % criteria)
if not (self.connection_state.flags & ConnectionState.AUTHENTICATED):
raise ProgramError(ERR_NOT_AUTHENTICATED)
sigs = self.database.query_alerts(criteria)
return [sigs]
def set_filter(self, sig, username, filter_type, data=""):
log_debug("set_filter: username=%s filter_type=%s sig=\n%s" % (username, filter_type, sig))
if not (self.connection_state.flags & ConnectionState.AUTHENTICATED):
raise ProgramError(ERR_NOT_AUTHENTICATED)
if username != self.username:
raise ProgramError(ERR_USER_PERMISSION, detail=_("The user (%s) cannot modify data for (%s)") % (self.username, username))
self.database.set_filter(sig, username, filter_type, data)
return None
def set_user_data(self, sig, username, item, data):
log_debug("set_user_data: username=%s item=%s data=%s sig=\n%s" % (username, item, data, sig))
if not (self.connection_state.flags & ConnectionState.AUTHENTICATED):
raise ProgramError(ERR_NOT_AUTHENTICATED)
self.database.set_user_data(sig, username, item, data)
return None
#------------------------------------------------------------------------------
class ClientNotifier(object):
def __init__(self, connection_pool):
self.connection_pool = connection_pool
# ---- SETroubleshootDatabaseNotifyInterface Methods ----
def signatures_updated(self, type, item):
for client in self.connection_pool.clients('sealert'):
client.signatures_updated(type, item)
#------------------------------------------------------------------------------
from setroubleshoot.audit_data import *
import setroubleshoot.util
class SetroubleshootdDBusObject(dbus.service.Object):
def __init__(self, object_path, analysis_queue, alert_receiver, timeout=10):
dbus.service.Object.__init__(self, dbus.SystemBus(), object_path)
self.conn_ctr = 0
self.timeout = timeout
self.alarm(self.timeout)
log_debug('dbus __init__ %s called' % object_path)
self.queue = analysis_queue
self.receiver = alert_receiver
self.record_reader = AuditRecordReader(AuditRecordReader.TEXT_FORMAT)
self.record_receiver = AuditRecordReceiver()
def add(self, avc):
try:
# FIXME: do not hardcode /var/lib/selinux/ store_path
policy_type = selinux.selinux_getpolicytype()[1]
for store_path in [
"%s%s/modules/active/disable_dontaudit" % (selinux.selinux_path(), policy_type),
"/var/lib/selinux/%s/active/disable_dontaudit" % policy_type
]:
if os.path.exists(store_path):
raise ValueError("Setroubleshoot can not analyze AVCs while dontaudit rules are disabled, 'semodule -B' will turn on dontaudit rules.")
if verify_avc(avc):
self.queue.put((avc, self.receiver))
except ValueError as e:
syslog.syslog(syslog.LOG_ERR, str(e))
@dbus.service.signal(dbus_system_interface)
def restart(self, reason):
pass
@dbus.service.signal(dbus_system_interface, signature='ss')
def alert(self, level, local_id):
pass
@dbus.service.method(dbus_system_interface)
def start(self):
self.alarm(0)
self.conn_ctr += 1
log_debug('dbus iface start() called: %d Connections' % self.conn_ctr)
return _("Started")
@dbus.service.method(dbus_system_interface, sender_keyword="sender", in_signature='s', out_signature='ii')
def check_for_new(self, last_seen_id, sender):
username = get_identity(self.connection.get_unix_user(sender))
database = get_host_database()
s = ""
signatures = []
for sig in database.query_alerts("*").siginfos():
action = sig.evaluate_filter_for_user(username)
if action != "ignore":
signatures.append(sig)
signatures.sort(key=compare_sig)
count = 0
red = 0
for sig in signatures:
count += 1
if sig.level == "red":
red += 1
if sig.local_id == last_seen_id:
red = 0
count = 0
return count, red
def _get_all_alerts_since(self, since, sender, alert_action="display"):
username = get_identity(self.connection.get_unix_user(sender))
database = get_host_database()
since_alerts = setroubleshoot.util.TimeStamp(float(since / 1000000))
database_alerts = database.query_alerts("*").signature_list
alerts = []
for alert in database_alerts:
if alert.last_seen_date < since_alerts:
continue
if alert.evaluate_filter_for_user(username) == alert_action:
alerts.append((alert.local_id, alert.summary(), alert.report_count))
return alerts
@dbus.service.method(dbus_system_interface, sender_keyword="sender", in_signature='t', out_signature='a(ssi)')
def get_all_alerts_since(self, since, sender):
return self._get_all_alerts_since(since, sender)
@dbus.service.method(dbus_system_interface, sender_keyword="sender", in_signature='', out_signature='a(ssi)')
def get_all_alerts(self, sender):
"""
Return array of *local_id*'s, *summary*'s, and *report_count*'s of all current alerts in a setroubleshoot database
returns list of:
* `local_id(s)`: a report id in a setroubleshoot database
* `summary(s)`: a brief description of an alert. E.g. `"SELinux is preventing /usr/bin/bash from ioctl access on the unix_stream_socket unix_stream_socket."`
* `report_count(i)`: count of reports of this alert
"""
return self._get_all_alerts_since(0, sender)
@dbus.service.method(dbus_system_interface, sender_keyword="sender", in_signature='', out_signature='a(ssi)')
def get_all_alerts_ignored(self, sender):
"""
Return array of *local_id*'s, *summary*'s, and *report_count*'s of all alerts which a user set to be ignored by a user
returns list of:
* `local_id(s)`: a report id in a setroubleshoot database
* `summary(s)`: a brief description of an alert. E.g. `"SELinux is preventing /usr/bin/bash from ioctl access on the unix_stream_socket unix_stream_socket."`
* `report_count(i)`: count of reports of this alert
"""
return self._get_all_alerts_since(0, sender, alert_action="ignore")
def _get_alert(self, local_id, database):
try:
database_alerts = database.query_alerts(local_id)
except ProgramError as e:
raise e
alert = database_alerts.siginfos().__next__()
return alert
@dbus.service.method(dbus_system_interface, sender_keyword="sender", in_signature='s', out_signature='ssiasa(ssssbbi)tts')
def get_alert(self, local_id, sender):
"""
Return an alert with summary, audit events, fix suggestions
##### arguments
* `local_id(s)`: an alert id
##### return values
* `local_id(s)`: an alert id
* `summary(s)`: a brief description of an alert. E.g. `"SELinux is preventing /usr/bin/bash from
ioctl access on the unix_stream_socket unix_stream_socket."`
* `report_count(i)`: count of reports of this alert
* `audit_event(as)`: an array of audit events (AVC, SYSCALL) connected to the alert
* `plugin_analysis(a(ssssbb)`: an array of plugin analysis structure
* `if_text(s)`:
* `then_text(s)`
* `do_text(s)`
* `analysis_id(s)`: plugin id. It can be used in `org.fedoraproject.SetroubleshootFixit.run_fix()`
* `fixable(b)`: True when an alert is fixable by a plugin
* `report_bug(b)`: True when an alert should be reported to bugzilla
* `priority(i)`: An analysis priority. Typically the value is between 1 - 100.
* `first_seen_date(t)`: when the alert was seen for the first time, number of microseconds since the Epoch
* `last_seen_date(t)`: when the alert was seen for the last time, number of microseconds since the Epoch
* `level(s)`: "green", "yellow" or "red"
"""
username = get_identity(self.connection.get_unix_user(sender))
database = get_host_database()
alert = self._get_alert(local_id, database)
alert.update_derived_template_substitutions()
avc = alert.audit_event.records
audit_events = [event.to_text() for event in avc]
total_priority, alert_plugins = alert.get_plugins()
plugins = []
for plugin, args in alert_plugins:
plugins.append((
alert.substitute(plugin.get_if_text(avc, args)),
alert.substitute(plugin.get_then_text(avc, args)),
alert.substitute(plugin.get_do_text(avc, args)),
plugin.analysis_id,
plugin.fixable,
plugin.report_bug,
plugin.priority)
)
return (alert.local_id, alert.summary(), alert.report_count,
audit_events, plugins,
int(alert.first_seen_date.format("%s")) * 1000000,
int(alert.last_seen_date.format("%s")) * 1000000,
alert.level or ''
)
@dbus.service.method(dbus_system_interface, sender_keyword="sender", in_signature='ss', out_signature='b')
def set_filter(self, local_id, filter_type, sender):
"""
Sets a filter on an alert. The alert can be "always" filtered, "never" filtered or "after_first" filtered.
##### arguments
* `local_id(s)`: an alert id
* `filter_type(s)`: "always", "never", "after_first"
##### return values
* `success(b)`:
"""
try:
username = get_identity(self.connection.get_unix_user(sender))
database = get_host_database()
alert = self._get_alert(local_id, database)
from setroubleshoot.signature import map_filter_name_to_value
database.set_filter(alert.sig, username, map_filter_name_to_value[filter_type], None)
return True
except:
return False
@dbus.service.method(dbus_system_interface, sender_keyword="sender", in_signature='s', out_signature='b')
def delete_alert(self, local_id, sender):
"""
Deletes an alert from the database.
##### arguments
* `local_id(s)`: an alert id
##### return values
* `success(b)`:
"""
try:
database = get_host_database()
alert = self._get_alert(local_id, database)
database.delete_signature(alert.sig)
return True
except:
return False
@dbus.service.method(dbus_system_interface, in_signature='s', out_signature='s')
def avc(self, data):
data = str(data)
self.alarm(0)
self.conn_ctr += 1
log_debug('dbus avc(%s) called: %d Connections' % (data, self.conn_ctr))
for (record_type, event_id, body_text, fields, line_number) in self.record_reader.feed(str(data)):
audit_record = AuditRecord(record_type, event_id, body_text, fields, line_number)
audit_record.audispd_rectify()
for audit_event in self.record_receiver.feed(audit_record):
self.add(AVC(audit_event))
for audit_event in self.record_receiver.flush(0):
try:
self.add(AVC(audit_event))
except ValueError as e:
syslog.syslog(syslog.LOG_ERR, "Unable to add audit event: %s" % e)
self.conn_ctr -= 1
self.alarm(self.timeout)
return _("AVC")
@dbus.service.method(dbus_system_interface)
def finish(self):
self.conn_ctr -= 1
log_debug('dbus iface finish() called: %d Connections' % self.conn_ctr)
self.alarm(self.timeout)
return ""
def alarm(self, timeout=10):
if self.conn_ctr == 0:
signal.alarm(timeout)
def compare_sig(a):
return a.last_seen_date
class SetroubleshootdDBus:
def __init__(self, analysis_queue, alert_receiver, timeout):
try:
log_debug("creating system dbus: bus_name=%s object_path=%s interface=%s" % (dbus_system_bus_name, dbus_system_object_path, dbus_system_interface))
self.dbus_obj = SetroubleshootdDBusObject(dbus_system_object_path, analysis_queue, alert_receiver, timeout)
except Exception as e:
syslog.syslog(syslog.LOG_ERR, "cannot start system DBus service: %s" % e)
raise e
def do_restart(self):
self.dbus_obj.restart("daemon request")
return True
#------------------------------------------------------------------------------
import selinux
import selinux.audit2why as audit2why
def goodbye(database):
database.save()
audit2why.finish()
main_loop = GLib.MainLoop()
def alarm_handler(signum, frame):
log_debug("SIGALRM raised in RunFaultServer")
main_loop.quit()
def RunFaultServer(timeout=10):
signal.alarm(timeout)
signal.signal(signal.SIGALRM, polling_failed_handler)
# polling for /sys/fs/selinux/policy file
while True:
try:
audit2why.init()
signal.alarm(0)
break
# retry if init() failed to open /sys/fs/selinux/policy
except ValueError as e:
# The value error contains the following error message,
# followed by strerror string (which can differ with localization)
if "unable to open /sys/fs/selinux/policy" in str(e):
continue
raise e
except SystemError as e:
# As a result of a bug in audit2why.c, SystemError is raised instead of ValueError.
# Python reports: "SystemError occurs as a direct cause of ValueError"
# Error message of the ValueError is stored in __context__
# TODO: remove this except clause when the bug in audti2why is fixed
if "unable to open /sys/fs/selinux/policy" in str(getattr(e, "__context__", "")):
continue
raise e
global host_database, analysis_queue, email_recipients
signal.signal(signal.SIGALRM, alarm_handler)
signal.signal(signal.SIGHUP, sighandler)
#interface_registry.dump_interfaces()
try:
# FIXME: should this be using our logging objects in log.py?
# currently syslog is only used for putting an alert into
# the syslog with its id
global pkg_name
syslog.openlog(pkg_name)
# Create an object responsible for sending notifications to clients
client_notifier = ClientNotifier(connection_pool)
# Create a database local to this host
database_filename = get_config('database', 'filename')
database_filepath = make_database_filepath(database_filename)
assure_file_ownership_permissions(database_filepath, 0o600, 'setroubleshoot')
host_database = SETroubleshootDatabase(database_filepath, database_filename,
friendly_name=_("Audit Listener"))
host_database.set_notify(client_notifier)
atexit.register(goodbye, host_database)
deleted = False
for i in host_database.sigs.signature_list:
why, bools = audit2why.analyze(str(i.sig.scontext), str(i.sig.tcontext), str(i.sig.tclass), i.sig.access)
if why == audit2why.ALLOW or why == audit2why.DONTAUDIT:
if why == audit2why.ALLOW:
reason = "allowed"
else:
reason = "dontaudit'd"
syslog.syslog(syslog.LOG_ERR, "Deleting alert %s, it is %s in current policy" % (i.local_id, reason))
deleted = True
host_database.delete_signature(i.sig)
if deleted:
host_database.save(prune=True)
# Attach the local database to an object which will send alerts
# specific to this host
if not get_config('test', 'analyze', bool):
alert_receiver = AlertPluginReportReceiver(host_database)
else:
alert_receiver = TestPluginReportReceiver(host_database)
# Create a synchronized queue for analysis requests
import six.moves.queue
analysis_queue = six.moves.queue.Queue(0)
# Create a thread to peform analysis, it takes AVC objects off
# the analysis queue and runs the plugins against the
# AVC. Analysis requests in the queue may arrive from a
# variety of places; from the audit system, from a log file
# scan, etc. The disposition of the analysis (e.g. where the
# results of the analysis are to go) are included in the queued
# object along with the data to analyze.
analyze_thread = AnalyzeThread(analysis_queue, timeout)
analyze_thread.setDaemon(True)
analyze_thread.start()
# Create a thread to receive messages from the audit system.
# This is a time sensitive operation, the primary job of this
# thread is to receive the audit message as quickly as
# possible and return to listening on the audit socket. When
# it receives a complete audit event it places it in the
# analysis queue where another thread will process it
# independently.
# audit_socket_thread = AuditSocketReceiverThread(analysis_queue, alert_receiver)
# audit_socket_thread.setDaemon(True)
# audit_socket_thread.start()
# Initialize the email recipient list
from setroubleshoot.signature import SEEmailRecipientSet
email_recipients = SEEmailRecipientSet()
assure_file_ownership_permissions(email_recipients_filepath, 0o600, 'setroubleshoot')
try:
email_recipients.parse_recipient_file(email_recipients_filepath)
except ProgramError as e:
if e.errno == ERR_FILE_OPEN:
log_debug(e.strerror)
else:
raise e
# Create a server to listen for alert clients and then run.
listen_addresses = get_socket_list_from_config('listen_for_client')
for listen_address in listen_addresses:
listening_server = ListeningServer(listen_address, SetroubleshootdClientConnectionHandler)
listening_server.open()
dbus.glib.init_threads()
setroubleshootd_dbus = SetroubleshootdDBus(analysis_queue, alert_receiver, timeout)
main_loop.run()
except KeyboardInterrupt as e:
log_debug("KeyboardInterrupt in RunFaultServer")
except SystemExit as e:
log_debug("raising SystemExit in RunFaultServer")
except Exception as e:
import traceback
syslog_trace(traceback.format_exc())
syslog.syslog(syslog.LOG_ERR, "exception %s: %s" % (e.__class__.__name__, str(e)))
if __name__ == '__main__':
RunFaultServer()