EVOLUTION-MANAGER
Edit File: analyze.cpython-36.pyc
3 ��n`�h � @ s� d dl mZ dddddddgZd d lZd d lmZmZ d d lZd d lZd d l Z d d l Z d d l Z d d l T d d l Z d d lmZ d d lmZ d d lT d d lT d d lT d d lT d d lT d d lT d d lT d dlmZ dd� ZG dd� de �Z G dd� de �Z G dd� de �Z G dd� de e j �Z!G dd� de �Z"G dd� de �Z#G dd� de �Z$G dd� de%e&e'ej�Z(ej)e(� G dd� dej�Z*ej)e*� d S ) � )�print_function� AnalyzeThread�Analyze�PluginReportReceiver�TestPluginReportReceiver�SETroubleshootDatabase�SETroubleshootDatabaseLocal�LogfileAnalyzerN)�GObject�GLib)�*)� cmp_to_key)� get_config)�validate_database_docc C s | |k| |k S )N� )�x�yr r � /usr/lib/python3.6/analyze.py�<lambda>4 s r c @ s< e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd S )�PluginStatisticsc C s0 |j | _d | _d | _d | _d | _d | _d | _d S )N)� analysis_id�name�analyze_start_time�analyze_end_time�analyze_elapsed_time�report_start_time�report_end_time�report_elapsed_time)�self�pluginr r r �__init__= s zPluginStatistics.__init__c C sR t | j�}| jd kr"d| j|f S t | j| j �}t | j�}d| j|||f S d S )Nz%s: %s elapsedz5%s: %s elapsed, %s analyze elapsed, %s report elapsed)�format_elapsed_timer r r r r )r r Ztotal_elapsed_timer r r r �__str__F s zPluginStatistics.__str__c C s t j � | _d S )N)�timer )r r r r � analyze_startR s z PluginStatistics.analyze_startc C s t j � | _| j| j | _d S )N)r# r r r )r r r r � analyze_endU s z PluginStatistics.analyze_endc C s t j � | _d S )N)r# r )r r r r � report_startY s z PluginStatistics.report_startc C s t j � | _| j| j | _d S )N)r# r r r )r r r r � report_end\ s zPluginStatistics.report_endN) �__name__� __module__� __qualname__r r" r$ r% r& r' r r r r r ; s r c @ s< e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd S )�AnalyzeStatisticsc C s( || _ d | _g | _d | _d | _d | _d S )N)� num_plugins� cur_plugin�called_plugins� start_time�end_time� elapsed_time)r r, r r r r e s zAnalyzeStatistics.__init__c C sP d }d }t | j�}| jd k r8t| j�}|r8t| j| �}d|| j||| j� f S )NzB%d/%d plugins in %s elapsed, avg plugin %s elapsed, plugins=[ %s ])�lenr. r1 r! r, �called_plugins_to_string)r r1 Zavg_plugin_timeZn_calledr r r r" m s zAnalyzeStatistics.__str__c C s dj dd� | jD ��S )N� c S s g | ] }t |��qS r )�str)�.0r r r r � <listcomp>{ s z>AnalyzeStatistics.called_plugins_to_string.<locals>.<listcomp>)�joinr. )r r r r r3 z s z*AnalyzeStatistics.called_plugins_to_stringc C s t j � | _d S )N)r# r/ )r r r r �start} s zAnalyzeStatistics.startc C s t j � | _| j| j | _d S )N)r# r0 r/ r1 )r r r r �end� s zAnalyzeStatistics.endc C s& t |�| _| jj| j� | jj� d S )N)r r- r. �appendr$ )r r r r r � new_plugin� s z AnalyzeStatistics.new_pluginN) r( r) r* r r" r3 r9 r: r< r r r r r+ c s r+ c @ s. e Zd Zdd� Zdd� Zdd� Zd dd �Zd S ) r c C s t � | _tdt| j� � d S )NzNumber of Plugins = %d)Z load_plugins�plugins� log_debugr2 )r r r r r � s zAnalyze.__init__c C s t � }|r|j� |S )N)Z SEEnvironment�update)r �query_environment� environmentr r r �get_environment� s zAnalyze.get_environmentc C s$ t |j|j|j|j|j|jd�}|S )N)�host�access�scontext�tcontext�tclass�tpath)ZSEFaultSignaturerC rD rE rF rG rH )r �avcrA �sigr r r � get_signature� s zAnalyze.get_signatureTc C s� t d| � |j� | j|j�}ddlm} |jjd k rD|jjj� t |j|j |j |j |j |j|j|j|j|j|j| j||�||jjt|jj�|j� dd�}�x | jD �]}y�|j|�}|d k �rD|jdkr�t d� d S |jd k o�|jdk�r|jdk�s|jd k�r|j|_t|t ��r8x(|D ]} |j j | � �q W n |j j |� W q� t k �r� } zVt | t!j"d � t#j#t#j$d |j% � t!j&� \} } } t d j't(j)| ��� | jj*|� W Y d d } ~ X q�X q�W |j+|� d S ) Nzanalyze_avc() avc=%sr )�TemplateZyellow)� audit_event�source�spathrH Z src_rpm_listZ tgt_rpm_listrE rF rG �portrC rJ rA � line_numbers�last_seen_date�local_id�levelZwhitez!plugin level white, not reportingZredZgreen)�filezPlugin Exception %s r4 ),r> r? rB r@ �stringrL rM rQ �sortZSEFaultSignatureInforN rO rH Zsrc_rpmsZtgt_rpmsrE rF rG rP rC rK � TimeStampZ timestamp� generate_idr= �analyzerT � isinstance�listZ plugin_listr; � Exception�print�sys�stderr�syslog�LOG_ERRr �exc_infor8 � traceback� format_tb�remove�report_problem)r rI �report_receiverr@ rA rL �siginfor Zreport�r�eZv1Zv2Zv3r r r � analyze_avc� sZ "zAnalyze.analyze_avcN)T)r( r) r* r rB rK rl r r r r r � s c @ s e Zd Zddd�Zdd� ZdS )r � c C s& t jj| � tj| � || _|| _d S )N)� threading�Threadr r �queue�timeout)r rp rq r r r r � s zAnalyzeThread.__init__c C s� x�y6| j j� \}}tjtjd� tjd� | j||� W nf tk rl } ztjtjd| � W Y d d }~X n4 t k r� } ztjtjd| � W Y d d }~X nX tjtjdj | j �� tj| j � qW d S )Nz)AnalyzeThread.run(): Cancel pending alarmr z!Exception during AVC analysis: %sz,AnalyzeThread.run(): Set alarm timeout to {}) rp �getra Z LOG_DEBUG�signal�alarmrl r] rb � ValueError�formatrq )r rI rh rk r r r �run� s "$zAnalyzeThread.runN)rm )r( r) r* r rw r r r r r � s c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )r c C s || _ d S )N)�database)r rx r r r r s z PluginReportReceiver.__init__c C s� y0| j j|j�}|j|� | j j|� td� W nL tk r| } z0|jtkrjtd� |j |_ | j j |�}n� W Y d d }~X nX |S )Nzsignature found in databaseznot in database yet) rx �lookup_signaturerJ Z update_merge�modify_siginfor> � ProgramError�errno�ERR_NO_SIGNATURE_MATCHrR �first_seen_date� add_siginfo)r ri Zdatabase_siginfork r r r rg s z#PluginReportReceiver.report_problemc C s | j jj� S )N)rx �sigsZgenerate_local_id)r r r r rY s z PluginReportReceiver.generate_idN)r( r) r* r rg rY r r r r r � s c s$ e Zd Z� fdd�Zdd� Z� ZS )r c s t t| �j|� d S )N)�superr r )r rx )� __class__r r r s z!TestPluginReportReceiver.__init__c C s t d|jj � d S )NzAnalysis Result: %s)r^ rJ r )r ri r r r rg s z'TestPluginReportReceiver.report_problem)r( r) r* r rg � __classcell__r r )r� r r s c @ s� e Zd Zd2dd�Zdd� Zdd� Zdd � Zd d � Zd3d d�Zd4dd�Z dd� Z dd� Z dd� Z dd� Z dd� Zdd � Zd d � Zd d � Zd!d"� Zd5d#d$�Zd%d&� Zd'd(� Zd)d*� Zd6d,d-�Zd.d/� Zd0d1� ZdS )7r Nc C s� || _ d | _t||| j �| _tj� | _d| _d| _d| _ d| _ d | _ t ddt �| _d | _t dd�}|d k r�|j� }|r�t|�| _td| jj| jj| jj f � | j� d S ) NFr � �� rx � max_alerts� max_alert_agez<created new database: name=%s, friendly_name=%s, filepath=%s)�filepath�notifyZSEDatabaseProperties� propertiesrn ZLock�lock� file_exists�modified_count�auto_save_interval�auto_save_threshold�auto_save_timerr �intr� r� �stripZparse_datetime_offsetr> r � friendly_name�load)r r� r r� r� r r r r $ s$ z SETroubleshootDatabase.__init__c C s� | j p | jsdS | jjjtdd� �d� | j�r t� }|| j8 }d}x$| jjD ]}|j|kr^P |d7 }qNW |dk�r td| j|j � f � td| jjd jj � | jj|d jj � f � td | jj| jj � | jjd jj � f � d d � | jjd |� D �}x |D ]}| j |d d � �qW | j �r�t | jj�| j }|dk�r�dd � | jjd |� D �}td|t |�|f � x |D ]}| j |d d � �qxW d S )NFc S s t | j|j�S )N)�cmprR )�a�br r r r ? s z.SETroubleshootDatabase.prune.<locals>.<lambda>)�keyr � z5prune by age: max_alert_age=%s min_time_to_survive=%sz prune by age: pruning [%s - %s]z prune by age: keeping [%s - %s]c S s g | ] }|j �qS r )rJ )r6 ri r r r r7 O s z0SETroubleshootDatabase.prune.<locals>.<listcomp>T)�prunec S s g | ] }|j �qS r )rJ )r6 ri r r r r7 V s z*prune first %d alerts, len(sigs=%d sigs=%s���) r� r� r� �signature_listrW r rX rR r> rv �delete_signaturer2 )r Zmin_time_to_surviveZkeepri r� rJ r r r r� : s2 0, z SETroubleshootDatabase.prunec C s || _ d S )N)r� )r r� r r r � set_notify[ s z!SETroubleshootDatabase.set_notifyc C s6 x0| j jD ]$}|j|jk r |j}|j|_||_q W d S )N)r� r� rR r~ )r ri Ztmpr r r �validate^ s z SETroubleshootDatabase.validatec C sh t � | _| jd krd S tjj| j�rTtj| j�}|t dkrT| jj| jdt �rTd| _ | j � | j � d S )Nr r� T) �SEFaultSignatureSetr� r� �os�path�exists�stat�ST_SIZEZ read_xml_filer r� r� r� )r � stat_infor r r r� f s zSETroubleshootDatabase.loadFc C sj | j d krd S td| j | jf � |s.| j� | jjd| j � d| _d| _| jd k rftj | j� d | _d S )Nz'writing database (%s) modified_count=%sr� Tr ) r� r> r� r� r� Z write_xmlr� r� r Z source_remove)r r� r r r �saveu s zSETroubleshootDatabase.savec C s` | j d7 _ | jd kr d S | j | jks0| j r<| j|� n | jd kr\tj| jd | j �| _d S )Nr� i� ) r� r� r� r� r� r� r Z timeout_addr� �auto_save_callback)r r� r r r � mark_modified� s z$SETroubleshootDatabase.mark_modifiedc C s t d| j| jf � | j� dS )Nz)auto_save database (%s) modified_count=%sF)r> r� r� r� )r r r r r� � s z)SETroubleshootDatabase.auto_save_callbackc C s: | j d krd S tjj| j �r6td| j � tj| j � d S )Nzdeleting database (%s))r� r� r� r� r> rf )r r r r rf � s z SETroubleshootDatabase.removec C s | j j� d S )N)r� �acquire)r r r r r� � s z SETroubleshootDatabase.acquirec C s | j j� d S )N)r� �release)r r r r r� � s z SETroubleshootDatabase.releasec C s� d }| j j|�}tdt|�djdd� |D ��f � t|�dkrHtt��t|�dkrxtdt|�djdd� |D ��f � |d j}|S )Nz1lookup_signature: found %d matches with scores %s�,c S s g | ]}d |j �qS )z%.2f)�score)r6 r r r r r7 � s z;SETroubleshootDatabase.lookup_signature.<locals>.<listcomp>r r� c S s g | ]}d |j �qS )z%.2f)r� )r6 r r r r r7 � s )r� Zmatch_signaturesr> r2 r8 r{ r} ri )r rJ ri Zmatchesr r r ry � s $ $ z'SETroubleshootDatabase.lookup_signaturec C s2 | j j|�}|d kr.td| � ttd| ��|S )Nz lookup_local_id: %s not foundzid (%s) not found)r� �lookup_local_idr> r{ ZERR_SIGNATURE_ID_NOT_FOUND)r rS ri r r r r� � s z&SETroubleshootDatabase.lookup_local_idc C s. | j j|�}| jr"| jjd|j� | j� |S )N�add)r� r r� �signatures_updatedrS r� )r ri r r r r � s z"SETroubleshootDatabase.add_siginfoc C s | j S )N)r� )r r r r �get_properties� s z%SETroubleshootDatabase.get_propertiesc C s8 t d| � |dkr| jS t� }| j|�}|j|� |S )Nzquery_alerts: criteria=%sr )r> r� r� r� r )r Zcriteriar� ri r r r � query_alerts� s z#SETroubleshootDatabase.query_alertsc C s� t d| � y| j|�}W n: tk rT } z |jtkrBt d� d S � W Y d d }~X nX | jj|� | jrx| jjd|j � | j |� d S )Nzdelete_signature: sig=%szSignature not found!�delete) r> ry r{ r| r} r� Zremove_siginfor� r� rS r� )r rJ r� ri rk r r r r� � s z'SETroubleshootDatabase.delete_signaturec C s" | j r| j jd|j� | j� d S )NZmodify)r� r� rS r� )r ri r r r rz � s z%SETroubleshootDatabase.modify_siginfoc C sh t d||f � y| j|�}W n: tk rX } z |jtkrFt d� dS � W Y d d }~X nX |j|�}|S )Nz)evaluate_alert_filter: username=%s sig=%szSignature not found!�ignore)r> ry r{ r| r} Zevaluate_filter_for_user)r rJ �usernameri rk �actionr r r �evaluate_alert_filter� s z,SETroubleshootDatabase.evaluate_alert_filterc C s� t d||||f � y| j|�}W n: tk r\ } z |jtkrJt d� d S � W Y d d }~X nX |j|�}|j||� | j|� d S )Nz2set_user_data: username=%s item=%s data=%s sig= %szSignature not found!)r> ry r{ r| r} Z get_user_dataZ update_itemrz )r rJ r� �item�datari rk Z user_datar r r � set_user_data� s z$SETroubleshootDatabase.set_user_data� c C sx t d|||f � y| j|�}W n: tk rZ } z |jtkrHt d� d S � W Y d d }~X nX |j|||� | j|� d S )Nz.set_filter: username=%s filter_type=%s sig= %szSignature not found!)r> ry r{ r| r} Zupdate_user_filterrz )r rJ r� Z filter_typer� ri rk r r r � set_filter s z!SETroubleshootDatabase.set_filterc C s | j jj|�| _| j� d S )N)r� �users�add_user�userr� )r r� r r r r� s z SETroubleshootDatabase.add_userc C s | j jj|�S )N)r� r� �get_user)r r� r r r r� s z SETroubleshootDatabase.get_user)N)F)F)F)r� )r( r) r* r r� r� r� r� r� r� r� rf r� r� ry r� r r� r� r� rz r� r� r� r� r� r r r r r " s. ! c @ s^ e Zd Zejjdejejffejjdejejejffd�Z dd� Z dd� Z dd� Z d d � Z dS ) r N)r� z async-errorc C s, t j j| � tj| � || _| jj| � d S )N)r r � RpcManagerx r� )r rx r r r r % s z$SETroubleshootDatabaseLocal.__init__c C s | j j|� d S )N)rx r� )r r� r r r r� + s z&SETroubleshootDatabaseLocal.set_notifyc G s� t d| jj|jdjdd� |D ��|f � | j| }t| j|jd �}|d krdtt d|j| jjf ��y(||� |_ d|_ |j d k r�|j g|_ W n6 tk r� } z|j |j g|_ d|_ W Y d d }~X nX |j d k r�tj| j|� d S )Nz%s emit %s(%s) id=%sr� c S s g | ] }t |��qS r )r5 )r6 �argr r r r7 / s z8SETroubleshootDatabaseLocal.emit_rpc.<locals>.<listcomp>z'method %s not found in base class of %sZ method_returnZ error_return)r> r� r( �methodr8 Zasync_rpc_cache�getattrrx r{ ZERR_METHOD_NOT_FOUNDZ return_argsZ return_typer| �strerrorr �idle_addZprocess_async_return)r Zrpc_id�typeZrpc_def�argsZ async_rpc�funcrk r r r �emit_rpc. s * z$SETroubleshootDatabaseLocal.emit_rpcc C s" t d||f � | jd||� d S )Nz4signatures_updated() database local: type=%s item=%sr� )r> �emit)r r� r� r r r r� A s z.SETroubleshootDatabaseLocal.signatures_updated)r( r) r* r � SignalFlags�RUN_LAST� TYPE_PYOBJECTZ TYPE_STRINGZTYPE_INT� __gsignals__r r� r� r� r r r r r s c @ sn e Zd Zejjdejffejjdejffd�Zddd�Z ddd�Z dd� Z d d � Z d d � Z d d� Zdd� ZdS )r N)�progressz state-changedc C sf t j j| � td| jj|f � || _d | _d | _d| _d | _ d | _ d | _ d | _ d | _ d | _d | _d S )Nz%s.__init__(%s)� )r r r> r� r( � logfile_pathrU �fileno� read_size� record_reader�record_receiver�analyzerrh � idle_proc_idr| r� )r r� r r r r R s zLogfileAnalyzer.__init__c C sT |d k r|| _ td| jj| j f � y2tj| j �}|t | _t| j �| _ | j j � | _ W nR t k r� } z6t j t j d| jj|jf � |j| _|j| _|�W Y d d }~X nX d| _d| _d| _d| _d| _| jd| j� tjj| j �}dtjj|�d | _td || jd�| _t t j �| _ t � | _ t!� | _"t#d d t$��sDt%| j�| _&n t'| j�| _&d S ) Nz %s.open(%s)z %s.open(): %sr g Fr� zfile: %s)r� ZtestrZ T)(r� r> r� r( r� r� r� � file_size�openrU r� �EnvironmentErrorra rb r� r| � n_bytes_readZ line_count� record_countr� � cancelledr� r� �basename�splitextr� r rx ZAuditRecordReaderZ TEXT_FORMATr� ZAuditRecordReceiverr� r r� r �boolr rh r )r r� r� rk Zlogfile_basenamer r r r� f s: zLogfileAnalyzer.openc s6 t d| jj| jf � | j� � tj� fdd��| _dS )Nz %s.run(%s)c s t � �S )N)�nextr )�task_generatorr r r � s z%LogfileAnalyzer.run.<locals>.<lambda>T)r> r� r( rU �taskr r� r� )r r )r� r rw � s zLogfileAnalyzer.runc C s� | j d k r&tj| j| j�}d | _ d | _| j| jk rddd l}d| j| j| jf }t |� |j | _|| _ | j d k r�x | j j � D ]}| j|� qzW | js�| jdd� d S )Nr zFfailed to read complete file, %d bytes read out of total %d bytes (%s)r� g �?)rU r� �readr� r� r� r� r| r� r> ZEIOr� r� �close�avc_event_handlerr� r� )r �new_dataZErrnor� rM r r r r� � s zLogfileAnalyzer.closec c sx | j dd� �xR| j�r`y8tj| j| j�jd�}|dkrNtd| j � | j� W n| t k r� } z0|j | _ |j | _ | j� | j dd� dV W Y d d }~X n2 t k r� } zt d|tjd � W Y d d }~X nX | jt|�7 _| jd k�rt| j�t| j� | _| j d | j� xF| jj|�D ]6\}}}}}| j|||||� d V | j�r dV �q W d V qW | j dd� dV d S ) Nz state-changedZrunningzutf-8r� z EOF on %sZstoppedFr4 )rU r r� T)r� r� r� r� r� �decoder> r� r� r� r| r� ru r^ r_ r` r� r2 r� �floatr� r� �feed�new_audit_record_handlerr� )r r� rk � record_type�event_id� body_text�fields� line_numberr r r r� � s6 " zLogfileAnalyzer.taskc C sH t d| � |j� rD|j� rD|j� dkrDt|�}| jj|| jd� d S )Nz"avc_event_handler() audit_event=%sr F)r> Zis_avcZ is_grantedZ num_recordsZAVCr� rl rh )r rM rI r r r r� � s z!LogfileAnalyzer.avc_event_handlerc C s� t d|||f � | jd7 _t|||||�}xT| jj|�D ]D}y| j|� W q> tk r� } zt|tj d� W Y dd}~X q>X q>W dS )z"called to enter a new audit recordzBnew_audit_record_handler() record_type=%s event_id=%s body_text=%sr� )rU N) r> r� Z AuditRecordr� r� r� ru r^ r_ r` ) r r� r� r� r� r� Z audit_recordrM rk r r r r� � s z(LogfileAnalyzer.new_audit_record_handler)N)N)r( r) r* r r� r� Z TYPE_FLOATr� r� r r� rw r� r� r� r� r r r r r J s $ )+Z __future__r �__all__ra Z gi.repositoryr r r� rs r# rn rd r� r_ � functoolsr Zsetroubleshoot.configr Zsetroubleshoot.avc_auditZsetroubleshoot.errcodeZsetroubleshoot.rpcZ setroubleshoot.rpc_interfacesZsetroubleshoot.signatureZsetroubleshoot.utilZsetroubleshoot.audit_dataZ setroubleshoot.xml_serializer r� �objectr r+ r ro r r r r r� Z SETroubleshootDatabaseInterfaceZ%SETroubleshootDatabaseNotifyInterfacer Z type_registerr r r r r �<module> sV ()W x )