HEX
Server: Apache/2.4.6 () OpenSSL/1.0.2k-fips PHP/8.3.8
System: Linux gateway.rmc-logistics.net 4.1.12-124.48.6.el7uek.x86_64 #2 SMP Tue Mar 16 14:57:50 PDT 2021 x86_64
User: apache (48)
PHP: 8.3.8
Disabled: NONE
Upload Files
File: //lib64/python2.7/site-packages/setroubleshoot/analyze.pyo
�
�njdc@s�ddlmZdddddddgZdd	lZdd	lZdd	lZdd	lZdd	lZdd
lTdd	l	Z	ddl
mZdd
lTdd
l
Tdd
lTdd
lTdd
lTdd
lTdd
lTddlmZd
efd��YZdefd��YZdefd��YZdeejfd��YZdefd��YZdefd��YZdefd��YZdeee ej!fd��YZ"ej#e"�dej!fd��YZ$ej#e$�d	S(i����(tprint_functiont
AnalyzeThreadtAnalyzetPluginReportReceivertTestPluginReportReceivertSETroubleshootDatabasetSETroubleshootDatabaseLocaltLogfileAnalyzerN(t*(t
get_config(tvalidate_database_doctPluginStatisticscBs>eZd�Zd�Zd�Zd�Zd�Zd�ZRS(cCsF|j|_d|_d|_d|_d|_d|_d|_dS(N(	tanalysis_idtnametNonetanalyze_start_timetanalyze_end_timetanalyze_elapsed_timetreport_start_timetreport_end_timetreport_elapsed_time(tselftplugin((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyt__init__6s					cCsot|j�}|jdkr/d|j|fSt|j|j�}t|j�}d|j|||fSdS(Ns%s: %s elapseds5%s: %s elapsed, %s analyze elapsed, %s report elapsed(tformat_elapsed_timeRRRR
RR(RRttotal_elapsed_timeR((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyt__str__?scCstj�|_dS(N(ttimeR(R((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyt
analyze_startKscCs&tj�|_|j|j|_dS(N(RRRR(R((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pytanalyze_endNscCstj�|_dS(N(RR(R((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pytreport_startRscCs&tj�|_|j|j|_dS(N(RRRR(R((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyt
report_endUs(t__name__t
__module__RRRRRR(((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR5s						tAnalyzeStatisticscBs>eZd�Zd�Zd�Zd�Zd�Zd�ZRS(cCs:||_d|_g|_d|_d|_d|_dS(N(tnum_pluginsRt
cur_plugintcalled_pluginst
start_timetend_timetelapsed_time(RR#((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR\s					cCsxd}d}t|j�}|jdk	rXt|j�}|rXt|j|�}qXnd||j|||j�fS(NsB%d/%d plugins in %s elapsed, avg plugin %s elapsed, plugins=[
%s
](RtlenR%R(RR#tcalled_plugins_to_string(RR(tavg_plugin_timetn_called((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyRdscCs)djg|jD]}t|�^q�S(Ns
(tjoinR%tstr(Rtx((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR*qscCstj�|_dS(N(RR&(R((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pytstarttscCs&tj�|_|j|j|_dS(N(RR'R&R((R((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pytendwscCs3t|�|_|jj|j�|jj�dS(N(RR$R%tappendR(RR((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyt
new_plugin{s(R R!RRR*R0R1R3(((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR"[s		
			cBs/eZd�Zd�Zd�Zed�ZRS(cCs't�|_tdt|j��dS(NsNumber of Plugins = %d(tload_pluginstpluginst	log_debugR)(R((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�scCs t�}|r|j�n|S(N(t
SEEnvironmenttupdate(Rtquery_environmenttenvironment((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pytget_environment�s	
c
CsCtd|jd|jd|jd|jd|jd|j�}|S(Nthosttaccesstscontextttcontextttclassttpath(tSEFaultSignatureR<R=R>R?R@RA(RtavcR:tsig((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyt
get_signature�s					c#Cs[td|�|j�|j|j�}ddlm}|jjdk	r_|jjj	�nt
d|jd|jd|jd|j
d|jd	|jd
|jd|jd|jd
|jd|jd|j||�d|d|jjdt|jj�d|j�dd�}x4|jD])}y�|j|�}|dk	r�|jdkr^td�dS|jdk	r�|jdkr�|jdks�|jdkr�|j|_q�nt|t�r�x1|D]}	|jj|	�q�Wq�|jj|�nWqt k
rE}
t!|
dt"j#�t$j$t$j%d|j&�|jj'|�qXqW|j(|�dS(Nsanalyze_avc() avc=%si����(tTemplatetaudit_eventtsourcetspathRAtsrc_rpm_listttgt_rpm_listR>R?R@tportR<RDR:tline_numberstlast_seen_datetlocal_idtleveltyellowtwhites!plugin level white, not reportingtredtgreentfilesPlugin Exception %s ()R6R8R;R9tstringRFRGRMRtsorttSEFaultSignatureInfoRHRIRAtsrc_rpmsttgt_rpmsR>R?R@RLR<REt	TimeStampt	timestamptgenerate_idR5tanalyzeRPt
isinstancetlisttplugin_listR2t	ExceptiontprinttsyststderrtsyslogtLOG_ERRRtremovetreport_problem(RRCtreport_receiverR9R:RFtsiginfoRtreporttrte((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pytanalyze_avc�sV
												

(R R!RR;REtTrueRo(((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�s			
cBseZd�Zd�ZRS(cCs*tjj|�tj|�||_dS(N(t	threadingtThreadRRtqueue(RRs((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�s
cCs�x�tr�y)|jj�\}}|j||�Wqtk
r^}tjtjd|�qtk
r�}tjtjd|�qXqWdS(Ns!Exception during AVC analysis: %s(RpRstgetRoRbRfRgt
ValueError(RRCRjRn((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pytrun�s	(R R!RRv(((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�s	cBs#eZd�Zd�Zd�ZRS(cCs
||_dS(N(tdatabase(RRw((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�scCs�y@|jj|j�}|j|�|jj|�td�WnPtk
r�}|jtkr�td�|j	|_
|jj|�}q��nX|S(Nssignature found in databasesnot in database yet(Rwtlookup_signatureRDtupdate_mergetmodify_siginfoR6tProgramErrorterrnotERR_NO_SIGNATURE_MATCHRNtfirst_seen_datetadd_siginfo(RRktdatabase_siginfoRn((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyRi�s

cCs|jjj�S(N(Rwtsigstgenerate_local_id(R((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR]�s(R R!RRiR](((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�s		cBseZd�Zd�ZRS(cCstt|�j|�dS(N(tsuperRR(RRw((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyRscCstd|jj�dS(NsAnalysis Result: %s(RcRDR(RRk((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyRis(R R!RRi(((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyRs	cBs�eZdd�Zd�Zd�Zd�Zd�Zed�Z	ed�Z
d�Zd�Zd	�Z
d
�Zd�Zd�Zd
�Zd�Zd�Zed�Zd�Zd�Zd�Zdd�Zd�Zd�ZRS(cCs�||_d|_t|||j�|_tj�|_t|_	d|_
d|_d|_d|_
tddt�|_d|_tdd�}|dk	r�|j�}|r�t|�|_q�ntd|jj|jj|jjf�|j�dS(Niii�Rwt
max_alertst
max_alert_ages<created new database: name=%s, friendly_name=%s, filepath=%s(tfilepathRtnotifytSEDatabasePropertiest
propertiesRqtLocktlocktFalsetfile_existstmodified_counttauto_save_intervaltauto_save_thresholdtauto_save_timerR	tintR�R�tstriptparse_datetime_offsetR6R
t
friendly_nametload(RR�R
R�R�((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyRs$								)cCs|jp|jstS|jjjd��|jrvt�}||j8}d}x1|jjD]#}|j|krwPn|d7}q^W|dkrvtd|j|j	�f�td|jjdjj	�|jj|djj	�f�td|jj|jj	�|jjdjj	�f�g|jj| D]}|j
^q7}x$|D]}|j|dt�qSWqvn|jrt
|jj�|j}|dkrg|jj| D]}|j
^q�}td	|t
|�|f�x$|D]}|j|dt�q�WqndS(
NcSst|j|j�S(N(tcmpRN(tatb((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyt<lambda>&siis5prune by age: max_alert_age=%s min_time_to_survive=%ssprune by age: pruning [%s - %s]sprune by age: keeping [%s - %s]i����tprunes*prune first %d alerts, len(sigs=%d sigs=%s(R�R�R�R�tsignature_listRWR[RNR6tformatRDtdelete_signatureRpR)(Rtmin_time_to_survivetkeepRkR�RD((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�"s2		
>:&
	&
cCs
||_dS(N(R�(RR�((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyt
set_notifyBscCsNxG|jjD]9}|j|jkr
|j}|j|_||_q
q
WdS(N(R�R�RNR~(RRkttmp((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pytvalidateEs
	cCs�t�|_|jdkrdStjj|j�r�tj|j�}|tdkr�|jj	|jdt
�r�t|_q�q�n|j
�|j�dS(NiR�(tSEFaultSignatureSetR�R�RtostpathtexistststattST_SIZEt
read_xml_fileR
RpR�R�R�(Rt	stat_info((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�Ms
cCs�|jdkrdStd|j|jf�|s@|j�n|jjd|j�t|_d|_|j	dk	r�t
j|j	�d|_	ndS(Ns'writing database (%s) modified_count=%sR�i(R�RR6R�R�R�t	write_xmlRpR�R�tgobjectt
source_remove(RR�((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pytsave\s
		cCs�|jd7_|jdkr"dS|j|jks>|jrN|j|�n1|jdkrtj|j	d|j
�|_ndS(Nii�(R�R�RR�R�R�R�R�ttimeout_addR�tauto_save_callback(RR�((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyt
mark_modifiedkscCs(td|j|jf�|j�tS(Ns)auto_save database (%s) modified_count=%s(R6R�R�R�R�(R((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�ws
cCsP|jdkrdStjj|j�rLtd|j�tj|j�ndS(Nsdeleting database (%s)(R�RR�R�R�R6Rh(R((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyRh|s
cCs|jj�dS(N(R�tacquire(R((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR��scCs|jj�dS(N(R�trelease(R((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR��scCs�d}|jj|�}tdt|�djg|D]}d|j^q4�f�t|�dkrvtt��nt|�dkr�tdt|�djg|D]}d|j^q��f�n|dj	}|S(Ns1lookup_signature: found %d matches with scores %st,s%.2fii(
RR�tmatch_signaturesR6R)R-tscoreR{R}Rk(RRDRktmatchesR/((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyRx�s=@
cCsF|jj|�}|dkrBtd|�ttd|��n|S(Nslookup_local_id: %s not foundsid (%s) not found(R�tlookup_local_idRR6R{tERR_SIGNATURE_ID_NOT_FOUND(RRORk((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR��s
cCsB|jj|�}|jr4|jjd|j�n|j�|S(Ntadd(R�RR�tsignatures_updatedROR�(RRk((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�s
	
cCs|jS(N(R�(R((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pytget_properties�scCsJtd|�|dkr!|jSt�}|j|�}|j|�|S(Nsquery_alerts: criteria=%sR(R6R�R�R�R(RtcriteriaR�Rk((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pytquery_alerts�s	
cCs�td|�y|j|�}Wn3tk
rV}|jtkrPtd�dS�nX|jj|�|jr�|jjd|j	�n|j
|�dS(Nsdelete_signature: sig=%ssSignature not found!tdelete(R6RxR{R|R}R�tremove_siginfoR�R�ROR�(RRDR�RkRn((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR��s
	cCs0|jr"|jjd|j�n|j�dS(Ntmodify(R�R�ROR�(RRk((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyRz�s	cCsptd||f�y|j|�}Wn3tk
r\}|jtkrVtd�dS�nX|j|�}|S(Ns)evaluate_alert_filter: username=%s sig=%ssSignature not found!tignore(R6RxR{R|R}tevaluate_filter_for_user(RRDtusernameRkRntaction((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pytevaluate_alert_filter�s
cCs�td||||f�y|j|�}Wn3tk
rb}|jtkr\td�dS�nX|j|�}|j||�|j|�dS(Ns2set_user_data: username=%s item=%s data=%s sig=
%ssSignature not found!(R6RxR{R|R}t
get_user_datatupdate_itemRz(RRDR�titemtdataRkRnt	user_data((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyt
set_user_data�s
tcCs�td|||f�y|j|�}Wn3tk
r_}|jtkrYtd�dS�nX|j|||�|j|�dS(Ns.set_filter: username=%s filter_type=%s sig=
%ssSignature not found!(R6RxR{R|R}tupdate_user_filterRz(RRDR�tfilter_typeR�RkRn((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyt
set_filter�s
cCs&|jjj|�|_|j�dS(N(R�tuserstadd_usertuserR�(RR�((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR��scCs|jjj|�S(N(R�R�tget_user(RR�((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR��sN(R R!RRR�R�R�R�R�R�R�R�RhR�R�RxR�RR�R�R�RzR�R�R�R�R�(((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyRs.	 																cBs|eZiejejejejffd6ejejejejejffd6Zd�Z	d�Z
d�Zd�ZRS(R�sasync-errorcCs:tjj|�tj|�||_|jj|�dS(N(R�tGObjectRt	RpcManageRwR�(RRw((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyRs
	cCs|jj|�dS(N(RwR�(RR�((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�sc		Gs5td|jj|jdjg|D]}t|�^q"�|f�|j|}t|j|jd�}|dkr�t
td|j|jjf��ny=||�|_d|_
|jdk	r�|jg|_nWn1t
k
r}|j|jg|_d|_
nX|jdk	r1tj|j|�ndS(Ns%s emit %s(%s) id=%sR�s'method %s not found in base class of %st
method_returnterror_return(R6t	__class__R tmethodR-R.tasync_rpc_cachetgetattrRwRR{tERR_METHOD_NOT_FOUNDtreturn_argstreturn_typeR|tstrerrorR�tidle_addtprocess_async_return(	Rtrpc_idttypetrpc_deftargstargt	async_rpctfuncRn((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pytemit_rpcs E
	
cCs+td||f�|jd||�dS(Ns4signatures_updated() database local: type=%s item=%sR�(R6temit(RR�R�((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�)s(
R R!R�tSIGNAL_RUN_LASTt	TYPE_NONEt
TYPE_PYOBJECTtTYPE_STRINGtTYPE_INTt__gsignals__RR�R�R�(((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�s"+			cBs�eZiejejejffd6ejejejffd6Zd	d�Z	d	d�Z
d�Zd�Zd�Z
d�Zd�ZRS(
tprogresss
state-changedcCs�tjj|�td|jj|f�||_d|_d|_	d|_
d|_d|_d|_
d|_d|_d|_d|_dS(Ns%s.__init__(%s)i�(R�R�RR6R�R tlogfile_pathRRUtfilenot	read_sizet
record_readertrecord_receivertanalyzerRjtidle_proc_idR|R�(RR�((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR9s										cCs�|dk	r||_ntd|jj|jf�yGtj|j�}|t|_t	|j�|_
|j
j�|_WnWtk
r�}t
j
t
jd|jj|jf�|j|_|j|_|�nXd|_d|_d|_d|_t|_|jd|j�tjj|j�}dtjj|�d|_td|d|j�|_ttj�|_ t!�|_"t#�|_$t%dd	t&�s�t'|j�|_(nt)|j�|_(t*S(
Ns%s.open(%s)s
%s.open(): %sigR�sfile: %sR�ttestR^(+RR�R6R�R R�R�R�t	file_sizetopenRUR�tEnvironmentErrorRfRgR�R|tn_bytes_readt
line_counttrecord_countR�R�t	cancelledR�R�tbasenametsplitextR�RRwtAuditRecordReadertTEXT_FORMATR�tAuditRecordReceiverR�RR�R	tboolRRjRRp(RR�R�Rntlogfile_basename((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�Ms:
&
					cCs<td|jj|jf�tj|j�j�|_t	S(Ns
%s.run(%s)(
R6R�R RUR�R�ttasktnextR�Rp(R((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyRvqscCs�|jdk	r<tj|j|j�}d|_d|_n|j|jkr�ddl}d|j|j|j	f}t
|�|j|_||_n|j
dk	r�x'|j
j�D]}|j|�q�Wn|js�|jdd�ndS(Ni����sFfailed to read complete file, %d bytes read out of total %d bytes (%s)R�g�?(RURR�treadR�R�R�R�R|R�R6tEIOR�R�tclosetavc_event_handlerRR�(Rtnew_datatErrnoR�RG((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyRvs 	
	ccs�|jdd�x�|jr�yFtj|j|j�}|dkratd|j�|j�nWnrtk
r�}|j	|_	|j
|_
|j�|jdd�tVn)tk
r�}t
d|dtj�nX|jt|�7_|jdkrt|j�t|j�|_n|jd	|j�xX|jj|�D]D\}}}}}|j|||||�tV|jrCtVqCqCWtVqW|jdd�tVdS(
Ns
state-changedtrunningR�s	EOF on %ststoppeds
RUiR�(R�R�R�RR�R6R�RR�R|R�R�RuRcRdReR�R)R�tfloatR�R�tfeedtnew_audit_record_handlerRpR(RRRntrecord_typetevent_idt	body_texttfieldstline_number((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR
�s6
"(		cCsetd|�|j�ra|j�ra|j�dkrat|�}|jj||jt�ndS(Ns"avc_event_handler() audit_event=%si(	R6tis_avct
is_grantedtnum_recordstAVCR�RoRjR�(RRGRC((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�s+c	Cs�td|||f�|jd7_t|||||�}xT|jj|�D]@}y|j|�WqQtk
r�}t|dtj	�qQXqQWdS(s"called to enter a new audit recordsBnew_audit_record_handler() record_type=%s event_id=%s body_text=%siRUN(
R6RtAuditRecordR�RRRuRcRdRe(	RRRRRRtaudit_recordRGRn((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR�sN(R R!R�R�R�t
TYPE_FLOATR�R�RRR�RvRR
RR(((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyR1s$				(%t
__future__Rt__all__RfR�R�RRqR�Rdtsetroubleshoot.configR	tsetroubleshoot.avc_audittsetroubleshoot.errcodetsetroubleshoot.rpctsetroubleshoot.rpc_interfacestsetroubleshoot.signaturetsetroubleshoot.utiltsetroubleshoot.audit_datatsetroubleshoot.xml_serializeR
tobjectRR"RRrRRRRR�tSETroubleshootDatabaseInterfacet%SETroubleshootDatabaseNotifyInterfaceR�Rt
type_registerR(((s</usr/lib64/python2.7/site-packages/setroubleshoot/analyze.pyt<module>sJ	







&'S
�+
�