�
�3�Zc@s&
dd
dgZddl
Z
ddlZddlZddlZddlZddlZddlZddl	Z	ddl
Z
ddlmZ
ddl
TddlTddlTyeed�
Wnek
r�


de_n
Xeej�d	�
Zd
�Zd
d
d��YZde	jf
d��YZdS(tAuditSocketReceiverThreadtAuditRecordReceivert
verify_avci����N(
t
get_config(
t
*t	AUDIT_EOEi(i
c
Cs�|jj
dks$|jj
dkr(tStj
|jj
kr�tjtjd
t|jf�
tjtjd|jj	��
ddl
}
|
jd�

ntS(NsUsetroubleshoot generated AVC, exiting to avoid recursion, context=%s, AVC scontext=%ssaudit event
%si����i(
tscontextttypetNonettcontexttFalset
my_contexttsyslogtLOG_ERRtaudit_eventtformattsystexittTrue(tavcR((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pyR1s
$

 
 

cBs�eZ
dZd
Zd�Zd�Zd�Zd�Zd�Zd�Z	d�Z
d	�Zdd
�
Z
dd�
Zd�Zd
�ZRS(sO
    The audit system emits messages about a single event
    independently. Thus one single auditable event may be composed
    from one or more individual audit messages. Each audit message is
    prefixed with a unique event id, which includes a timestamp. The
    last audit message associated with an event is not marked in any
    fashion. Audit messages for a specific event may arrive
    interleaved with audit messages for other events. It is the job of
    higher level software (this code) to assemble the audit messages
    into events. The AuditEvent class is used for assembly. When a new
    event id is seen a new AuditEvent object is created, then
    every time an audit message arrives with that event id it is added
    to that object. The AuditEvent object contains the timestamp
    associated with the audit event as well as other data items useful
    for processing and handling the event.

    The audit system does not tell us when the last message belonging
    to an event has been emitted so we have no explicit way of knowing
    when the audit event has been fully assembled from its constituent
    message parts. We use the heuristic if a sufficient length of
    time has expired since we last saw a message for this event, then
    it must be complete

    Thus when audit events are created we place them in a cache where
    they will reside until their time to live has expired at which
    point we will assume they are complete and emit the event.

    Events are expired in the flush_cache() method. The events
    resident in the cache are sorted by their timestamps. A time
    threshold is established. Any events in the cache older than the
    time threshold are flushed from the cache as complete events.

    When should flushes be performed? The moment when a new message is
    added would seem a likely candidate moment to perform a sweep of
    the cache. But this is costly and does not improve how quickly
    events are expired. We could wait some interval of time (something
    much greater than how long we expect it would take for messages
    percolate) and this has good behavior, except for the following
    case. Sometimes messages are emitted by audit in rapid
    succession. If we swept the cache once a second then the cache may
    have grown quite large. Since it is very likely that any given audit
    event is complete by the time the next several events start
    arriving we can optimize by tracking how many messages have
    arrived since the last time we swept the cache.

    The the heuristic for when to sweep the cache becomes:

    If we've seen a sufficient number of messages then sweep -or- if
    a sufficient length of time has elapsed then we sweep

    Note that when audit messages are injected via log file scanning
    elapsed wall clock time has no meaning relative to when to perform
    the cache sweep. However, the timestamp for an event remains a
    critical factor when deciding if an event is complete (have we
    scanned far enough ahead such we're confident we won't see any
    more messages for this event?). Thus the threshold for when to
    expire an event from the cache during static log file scanning is
    determined not by wall clock time but rather by the oldest
    timestamp in the cache (e.g.there is enough spread between
    timestamps in the cache its reasonable to assume the event is
    complete). One might ask in the case of log file scanning why not
    fill the cache until EOF is reached and then sweep the cache?
    Because in log files it is not unusual to have thousands or tens
    of thousands of events and the cache would grown needlessly
    large. Because we have to deal with the real time case we already
    have code to keep only the most recent events in the cache so we
    might as well use that logic, keep the code paths the same and
    minimize resource usage.
    g{�G�zt?c

Cs2d
|_d|_
i|_g|_|j�
dS(Nii(t
flush_sizetflush_counttcacheteventstreset_statistics(
tself((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pyt__init__�s

	
	
	
	
c

Cs
t|j
�
S(
N(tlenR(
R((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pytnum_cached_events�s
c

Csd
|_d
|_
dS(Ni(tmax_cache_lengthtevent_count(
R((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pyR�s
	
cCs#t�}||j
t|
j�
<|S(
N(t
AuditEventRtstrtevent_id(RtrecordR((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pytinsert_new_event�s
	

cCs|jj
t|
j�
d�S(
N(RtgetR R!R(RR"((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pytget_event_from_record�s
cCs�td
|j
j|
f�

|j|
�
}|
jdkrR|rN|j|�

ndS|dkrp|j|
�
}n|j|
�

dS(Ns%s.add_record_to_cache(): %stEOE(	t	log_debugt	__class__t__name__R%trecord_typetflush_eventRR#t
add_record(RR"R((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pytadd_record_to_cache�s







cCs&|jd
7_|j
jd|
�
dS(Ni
i(RRtinsert(RR((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pyt
emit_event�s

cCs$|j|
�

|j
t|
j�
=dS(
N(R/RR R!(RR((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pyR+�s


cs
t�j
�
d
krdSt�j
�
�jkrFt�j
�
�_n�j
j�}|
d
kr�x(|D] }�j
|}�j|�

qhWdS|j�f
d��

|
dkr��j
|dj�j}
nx:|D]2}�j
|}|j|
kr��j|�

q�q�WdS(sl
Flush events from the cache if they are older than the threshold age.
        If the threshold age is None then the threshold age is set to the age
        of the newest event in the cache minus the cache time to live, in other
        words anything in the cache which is older than the time to live relative
        to the most current event is flushed.
        iNcs!t�j
|j�j
|
j�S(
N(tcmpRt	timestamp(t
at
b(
R(s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pyt<lambda>�si����(	RRRtkeysR+tsortRR1tcache_time_to_live(Rt
threshold_aget	event_idsR!R((
Rs>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pytflush_cache�s"	














ccsJ|j|
�

d
|_
x-t|j�
d
krE|jj�}|V
qWdS(Ni(R:RRRtpop(RR8R((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pytflush�s



	


c
cs#x|jd
�
D]}
|
V
qWdS(s{Emit every event in the cache irrespective of its
        timestamp. This means we're done, nothing should remain buffered.iN(
R<(RR((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pytclose�s
c	cs�|jd
7_|
j
dkr.|j|
�

n|j|jkr_x|j�D]}|V
qMWnx-t|j�
d
kr�|jj�}|V
qbWdS(
s9Accept a new audit record into the system for processing.i
tAVCtAVC_PATHtSYSCALLtCWDtPATHR&t1400t1107iN(sAVCR?R@RAsPATHsEOERCRD(RR*R-RR<RRR;(RR"R((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pytfeed�s





N(R)t
__module__t__doc__R7RRRR#R%R-R/R+RR:R<R=RE(((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pyR
?sE								"	c
Bs>eZ
d�Zd
�Zd�Zd�Zd�Zd�ZRS(cCsctj
j|�

|
|_||_t�|_td
dt�|_	|j
�
d|_t|_
dS(Ntaudittretry_intervali(t	threadingtThreadRtqueuetreport_receiverR
trecord_receiverRtintRItget_socket_pathsttimeout_intervalR
t
has_audit_eoe(RRLRM((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pyR�s
	
	




	
c
CsKg|_t
d
d�}
|jj|
�

t
d
d�}
|jj|
�

dS(NRHttext_protocol_socket_pathtbinary_protocol_socket_path(taudit_socket_pathsRtappend(Rtaudit_socket_path((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pyRP
s

	

c
Cs�
x�
tr�
y+
x

|j
D]�|_|jdk	ry�t|j�
}
t|
�
|_tjtj	tj
�|_tj|jj
�tjtj�
|jj|j�

|jj�|_td
|j�

dSWq
tjk
r

}
t|�
\}}td|j|f�

q
XqqWtddj|j
�
|jf�

Wnxtjk
r{

}
t|�
\}}td|j||jf�

n4tk
r�

}
td|j|d|jf�

n
Xtj|j�

qWdS(Nsaudit socket (%s) connecteds4attempt to open audit socket (%s) failed, error='%s's:could not open any audit sockets (%s), retry in %d secondss, s9audit socket (%s) failed, error='%s', retry in %d secondsi
(RRURWRtderive_record_formattAuditRecordReadert
record_readertSockettsockettAF_UNIXtSOCK_STREAMtaudit_sockettfcntltfilenotF_SETFDt
FD_CLOEXECtconnecttmakefiletaudit_socket_fdR'terrortget_error_from_socket_exceptiontjoinRItOSErrorttimetsleep(Rt
record_formatt
eterrnotstrerror((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pyRd
s.
	







"






"'

 
%cCsPt|
||||�}|j
�
x'|jj|�
D]}|j|�

q5Wd
S(s"called to enter a new audit recordN(tAuditRecordtaudispd_rectifyRNREtnew_audit_event_handler(RR*R!t	body_texttfieldstline_numbertaudit_recordR((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pytnew_audit_record_handler)
s



cCsf|
j�rb|
j
�rb|
j�d
krbt|
�
}t|�
rb|jj||jf�

qbndS(Ni(tis_avct
is_grantedtnum_recordsR>RRLtputRM(RRR((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pyRs1
s
+


c
Cs/|j�
|j
}
xtr*tj|jg
gg|
�\}}}yD
|j|kr1
d
dl}|j|jj�d�}|dkr�t	d�

|j�
q�
t	d|j
j��

|js�|j
}
nx�|j
j|�
D]L\}}}	}
}|dkr
t|_d}
n|j|||	|
|�
q�WnUx4|j
jtj�|j
�
D]}|j|�

qQ
W|j
j�dkr�
d}
nWqtk
r�

}

t	d|jj�

tj�
qtk
r�

}

t	d	|jj�

tj�
qtk
r&
}

tjtjd
|
jjt|
�
f�
dSXqWdS(Ni����itsaudit socket connection droppedscached audit event count = %dR&is!KeyboardInterrupt exception in %ssSystemExit exception in %ssexception %s: %s(RdRQRtselectR_tostreadRfRaR'RNRRRRZRERRxR<RkRstKeyboardInterruptR(R)tthreadtinterrupt_maint
SystemExitt	ExceptionRR
R (RttimeouttinListtoutListterrListRtnew_dataR*R!RtRuRvRRn((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pytrun8
s@

	
	
'









	

(

	
	
 &










)
(R)RFRRPRdRxRsR�(((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pyR�s
						((t__all__RRHR~tselinuxR\R[R`R�RJRktsetroubleshoot.configRtsetroubleshoot.errcodetsetroubleshoot.utiltsetroubleshoot.audit_datatgetattrtAttributeErrorRt
AvcContexttgetconRRR
RKR(((s>/usr/lib64/python2.7/site-packages/setroubleshoot/avc_audit.pyt<module>s.

	



















	�