/usr/lib64/python2.6/site-packages/sepolgen
Edit: /usr/lib64/python2.6/site-packages/sepolgen/audit.pyo (20514B)
Ñò
Ô<*Xc @ s1 d d k Z d d k Z d d k Z d „ Z d „ Z d „ Z d „ Z d d d „ ƒ YZ d e f d „ ƒ YZ d
e f d „ ƒ YZ d d k
i Z h Z d e f d
„ ƒ YZ
d e f d „ ƒ YZ d e f d „ ƒ YZ d e f d „ ƒ YZ d d d „ ƒ YZ d d d „ ƒ YZ d d d „ ƒ YZ d S( iÿÿÿÿNc C s¿ d d k } d d k } t d d ƒ } t | i ƒ i ƒ d ƒ } | i | i | i ƒ | ƒ } | i d | ƒ } | i d | ƒ } | i d d d
d | | g d | i
ƒi ƒ d } | S(
s
Obtain all of the avc and policy load messages from the audit
log. This function uses ausearch and requires that the current
process have sufficient rights to run ausearch.
Returns:
string contain all of the audit messages returned by ausearch.
iÿÿÿÿNs /proc/uptimet ri s %xs %Ts /sbin/ausearchs -ms5 AVC,USER_AVC,MAC_POLICY_LOAD,DAEMON_START,SELINUX_ERRs -tst stdout( t
subprocesst timet opent floatt readt splitt closet localtimet strftimet Popent PIPEt communicate( R R t fdt offt st bootdatet boottimet output( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyt get_audit_boot_msgs s c C s; d d k } | i d d d g d | i ƒi ƒ d } | S( s
Obtain all of the avc and policy load messages from the audit
log. This function uses ausearch and requires that the current
process have sufficient rights to run ausearch.
Returns:
string contain all of the audit messages returned by ausearch.
iÿÿÿÿNs /sbin/ausearchs -ms5 AVC,USER_AVC,MAC_POLICY_LOAD,DAEMON_START,SELINUX_ERRR i ( R R R R
( R R ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyt get_audit_msgs. s c C s5 d d k } | i d g d | i ƒi ƒ d } | S( s• Obtain all of the avc and policy load messages from /bin/dmesg.
Returns:
string contain all of the audit messages returned by dmesg.
iÿÿÿÿNs
/bin/dmesgR i ( R R R R
( R R ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyt get_dmesg_msgs; s c C s; d d k } | i d d d g d | i ƒi ƒ d } | S( s¨ Obtain all of the avc and policy load messages from /var/log/messages.
Returns:
string contain all of the audit messages returned by /var/log/messages.
iÿÿÿÿNs /bin/grept avcs /var/log/messagesR i ( R R R R
( R R ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyt get_log_msgsF s t AuditMessagec B s e Z d Z d „ Z d „ Z RS( sã Base class for all objects representing audit messages.
AuditMessage is a base class for all audit messages and only
provides storage for the raw message (as a string) and a
parsing function that does nothing.
c C s | | _ d | _ d S( Nt ( t messaget header( t selfR ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyt __init__Z s c C s€ xy | D]q } | i d ƒ } t | ƒ d j o& | d d j o | | _ d Sq n | d d j o | d | _ d Sq Wd S( sà Parse a string that has been split into records by space into
an audit message.
This method should be overridden by subclasses. Error reporting
should be done by raise ValueError exceptions.
t =i i s audit(Ni t msgi ( R t lenR ( R t recsR t fields( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyt from_split_string^ s
( t __name__t
__module__t __doc__R R$ ( ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyR S s t InvalidMessagec B s e Z d Z d „ Z RS( sþ Class representing invalid audit messages. This is used to differentiate
between audit messages that aren't recognized (that should return None from
the audit message parser) and a message that is recognized but is malformed
in some way.
c C s t i | | ƒ d S( N( R R ( R R ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyR y s ( R% R& R' R ( ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyR( s s t PathMessagec B s e Z d Z d „ Z d „ Z RS( s! Class representing a path messagec C s t i | | ƒ d | _ d S( NR ( R R t path( R R ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyR ~ s c C sx t i | | ƒ xa | D]Y } | i d ƒ } t | ƒ d j o q n | d d j o | d d d !| _ d Sq Wd S( NR i i R* i iÿÿÿÿ( R R$ R R! R* ( R R" R R# ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyR$ ‚ s ( R% R& R' R R$ ( ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyR) | s t
AVCMessagec B s2 e Z d Z d „ Z d „ Z d „ Z d „ Z RS( sk AVC message representing an access denial or granted message.
This is a very basic class and does not represent all possible fields
in an avc message. Currently the fields are:
scontext - context for the source (process) that generated the message
tcontext - context for the target
tclass - object class for the target (only one)
comm - the process name
exe - the on-disc binary
path - the path of the target
access - list of accesses that were allowed or denied
denial - boolean indicating whether this was a denial (True) or granted
(False) message.
An example audit message generated from the audit daemon looks like (line breaks
added):
'type=AVC msg=audit(1155568085.407:10877): avc: denied { search } for
pid=677 comm="python" name="modules" dev=dm-0 ino=13716388
scontext=user_u:system_r:setroubleshootd_t:s0
tcontext=system_u:object_r:modules_object_t:s0 tclass=dir'
An example audit message stored in syslog (not processed by the audit daemon - line
breaks added):
'Sep 12 08:26:43 dhcp83-5 kernel: audit(1158064002.046:4): avc: denied { read }
for pid=2 496 comm="bluez-pin" name=".gdm1K3IFT" dev=dm-0 ino=3601333
scontext=user_u:system_r:bluetooth_helper_t:s0-s0:c0
tcontext=system_u:object_r:xdm_tmp_t:s0 tclass=file
c C s} t i | | ƒ t i ƒ | _ t i ƒ | _ d | _ d | _ d | _ d | _ g | _
t | _ t
i | _ g | _ d S( NR ( R R t refpolicyt SecurityContextt scontextt tcontextt tclasst commt exeR* t accessest Truet denialt audit2whyt TERULEt typet bools( R R ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyR s c C sµ t } | } | t | ƒ d j o t d | i ƒ ‚ n xR | t | ƒ j o> | | d j o t } Pn | i i | | ƒ | d } q= W| p t d | i ƒ ‚ n | d S( Ni s# AVC message in invalid format [%s]
t }( t FalseR! t
ValueErrorR R4 R3 t append( R R" t startt found_closet i( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyt __parse_accessº s c C så t i | | ƒ t } t } t } t } xut t | ƒ ƒ D]a} | | d j o# | i | | d ƒ } t } q; n | | d j o
t | _ n | | i d ƒ } t | ƒ d j o q; n | d d j o t i
| d ƒ | _ t } q; | d d j o t i
| d ƒ | _ t } q; | d d j o | d | _
t } q; | d d
j o | d d d !| _ q; | d d j o | d d d !| _ q; q; W| p | p | p | o t d
| i ƒ ‚ n | i ƒ d S( Nt {i t grantedR i i R. R/ R0 R1 iÿÿÿÿR2 s# AVC message in invalid format [%s]
( R R$ R; t rangeR! t _AVCMessage__parse_accessR4 R5 R R, R- R. R/ R0 R1 R2 R< R t analyze( R R" t found_srct found_tgtt found_classt found_accessR@ R# ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyR$ Ð s@
c C s¼ | i i ƒ } | i i ƒ } t | i ƒ } | | | i | f t i ƒ j o) t | | | i | f \ | _ | _ nAt
i | | | i | i ƒ \ | _ | _ | i t
i j o t
i
| _ n | i t
i j o t d | ƒ ‚ n | i t
i j o t d | ƒ ‚ n | i t
i j o t d | i ƒ ‚ n | i t
i j o t d d i | i ƒ ƒ ‚ n | i t
i j o t d ƒ ‚ n | i | i f t | | | i | f
} | p | i | ƒ o | i | i i | i i ƒ q q W| S( so Return RoleAllowSet statements matching the specified filter
Filter out types that match the filer, or all roles
Params:
role_filter - [optional] Filter object used to filter the
output.
Returns:
Access vector set representing the denied access in the
audit logs parsed by this object.
( t accesst RoleTypeSetRa t filtert addR[ R\ R8 ( R t role_filtert
role_typest cs( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyt to_roleÔ s
$c C sÛ t i ƒ } xÈ | i D]½ } | i t j o | o q n | oU | i | ƒ oA | i | i i | i i | i
| i | d | i d | i ƒqÓ q | i | i i | i i | i
| i | d | i d | i ƒq W| S( s‚ Convert the audit logs access into a an access vector set.
Convert the audit logs into an access vector set, optionally
filtering the restults with the passed in filter object.
Filter objects are object instances with a .filter method
that takes and access vector and returns True if the message
should be included in the final output and False otherwise.
Params:
avc_filter - [optional] Filter object used to filter the
output.
Returns:
Access vector set representing the denied access in the
audit logs parsed by this object.
t avc_typeR9 (
R} t AccessVectorSetR` R5 R4 R R€ R. R8 R/ R0 R3 R9 ( R t
avc_filtert only_denialst av_setR ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyt to_accessæ s
' #N( R% R& R' R; R R^ Rm Rv Rw Ry R| Rh R„ R4 RŠ ( ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyR] @ s ! %
t
AVCTypeFilterc B s e Z d „ Z d „ Z RS( c C s t i | ƒ | _ d S( N( t ret compilet regex( R RŽ ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyR s c C s@ | i i | i i ƒ o t S| i i | i i ƒ o t St S( N( RŽ t matchR. R8 R4 R/ R; ( R R ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyR s
( R% R& R R ( ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyR‹ s t ComputeSidTypeFilterc B s e Z d „ Z d „ Z RS( c C s t i | ƒ | _ d S( N( RŒ R RŽ ( R RŽ ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyR s c C s^ | i i | i i ƒ o t S| i i | i i ƒ o t S| i i | i i ƒ o t St S( N( RŽ R R[ R8 R4 R. R/ R; ( R R ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyR s ( R% R& R R ( ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyR s ( ( ( ( ( R, R} RŒ R R R R R R( R) t selinux.audit2whyR6 RN R+ RW RX RZ R] R‹ R ( ( ( s4 /usr/lib64/python2.6/site-packages/sepolgen/audit.pyt s$
} "Ä