AnonymousFox

//usr/bin/sealert

#!/usr/bin/python3 -Es
#
# Authors: John Dennis <jdennis@redhat.com>
# Authors: Dan Walsh <dwalsh@redhat.com>
#
# Copyright (C) 2006-2010 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
#

from __future__ import print_function
import syslog

import gi
GTK_VERSION = '3.0'
from gi.repository import GObject, GLib
GLib.set_prgname('setroubleshoot')

import dbus
import dbus.service
import errno as Errno
import gettext
import os
import re
import signal
import selinux
import socket as Socket
import fcntl
import sys

from dbus.mainloop.glib import DBusGMainLoop
DBusGMainLoop(set_as_default=True)

from setroubleshoot.config import parse_config_setting, get_config
domain = get_config('general', 'i18n_text_domain')
kwargs = {}
if sys.version_info < (3,):
    kwargs['unicode'] = True
gettext.install(domain=domain,
                localedir=get_config('general', 'i18n_locale_dir'),
                **kwargs)

syslog.openlog(sys.argv[0])
from setroubleshoot.errcode import *
from setroubleshoot.util import get_identity, load_plugins, log_init, log_debug
from setroubleshoot.rpc import *

#------------------------------------------------------------------------------
invocation_style = None
status_icon = None
dbus_system_bus_name = get_config('system_dbus', 'bus_name')
dbus_system_object_path = get_config('system_dbus', 'object_path')
dbus_system_interface = get_config('system_dbus', 'interface')

dbus_session_bus_name = get_config('session_dbus', 'bus_name')
dbus_session_object_path = get_config('session_dbus', 'object_path')
dbus_session_interface = get_config('session_dbus', 'interface')
app = None
default_status_icon_tooltip = _("SELinux AVC denial, click to view")

log_init("sealert_log")

#------------------------------------------------------------------------------

def sighandler(signum, frame):
    log_debug("exiting on signal %s" % signum)
    sys.exit()

def get_server_socket_address():
    addr_list = get_socket_list_from_config('client_connect_to')
    if len(addr_list) == 0:
        return None
    return addr_list[0]

def setup_sighandlers():
    signal.signal(signal.SIGHUP, sighandler)
    signal.signal(signal.SIGQUIT, sighandler)
    signal.signal(signal.SIGTERM, sighandler)

def run_app(user):
    global app

from setroubleshoot.serverconnection import ServerConnectionHandler
    GObject.type_register(ServerConnectionHandler)

app = SEAlert(user)
    return app.main()

def error(message):
    dlg = Gtk.MessageDialog(modal=True,
                            message_type=Gtk.MessageType.ERROR,
                            buttons=Gtk.ButtonsType.CLOSE,
                            text=message)
    dlg.set_position(Gtk.WindowPosition.CENTER)
    dlg.show_all()
    dlg.run()
    dlg.destroy()

def run_as_dbus_service(user):
    global app
#-----------------------------------------------------------------------------
    if not selinux.is_selinux_enabled():
        log_debug("SELinux not enabled, sealert will not run on non SELinux systems")
        error(_("SELinux not enabled, sealert will not run on non SELinux systems"))
        sys.exit(3)

try:
        log_debug('starting service')
        dbus_service = DBusSessionService(dbus_session_bus_name)
        app = SEAlert(user, dbus_service.presentation_manager, watch_setroubleshootd=True)
        return app.main()
    except dbus.DBusException as e:
        syslog.syslog(syslog.LOG_ERR, 'could not start dbus: %s' % str(e))
        return False

def ask_dbus_to_show_browser():
    try:
        bus = dbus.SessionBus()
        proxy_obj = bus.get_object(dbus_session_bus_name, dbus_session_object_path)
        iface = dbus.Interface(proxy_obj, dbus_session_interface)
        return True
    except dbus.DBusException as e:
        syslog.syslog(syslog.LOG_ERR, 'could not start dbus: %s' % str(e))
        return False

def ask_dbus_to_quit_app():
    try:
        bus = dbus.SessionBus()
        proxy_obj = bus.get_object(dbus_session_bus_name, dbus_session_object_path)
        iface = dbus.Interface(proxy_obj, dbus_session_interface)
        iface.quit_app()
        return True
    except dbus.DBusException as e:
        syslog.syslog(syslog.LOG_ERR, 'could not start dbus: %s' % str(e))
        return False

def fix_lookup_id(local_id, analysis_id):
    def lookup_local_id():
        log_debug("calling server to lookup id (%s)" % local_id)
        async_rpc = cl.alert_client.query_alerts(local_id)
        async_rpc.add_callback(query_alerts_callback)
        async_rpc.add_errback(query_alerts_error)

def query_alerts_callback(sigs):
        import subprocess
        for siginfo in sigs.signature_list:
            for plugin in siginfo.plugin_list:
                if analysis_id == plugin.analysis_id:
                    p = load_plugins(analysis_id)[0]
                    if p.fixable is False:
                        print(_("Not fixable."))
                        cl.main_loop.quit()
                        return
                    siginfo.update_derived_template_substitutions()
                    command = siginfo.substitute_array(p.get_fix_cmd(siginfo.audit_event, plugin.args).split())
                    try:
                        output = subprocess.check_output(command, universal_newlines=True)
                        print(_("Successfully ran %s" % ' '.join(command)))
                    except subprocess.CalledProcessError as e:
                        print((e.output))
                    except Exception:
                        pass
                    cl.main_loop.quit()
                    return
        print(_("Plugin %s not valid for %s id") % (analysis_id, local_id))
        cl.main_loop.quit()

def query_alerts_error(method, errno, strerror):
        print("%s error (%d): %s" % (method, errno, strerror), file=sys.stderr)
        cl.main_loop.quit()

cl = SECommandLine(lookup_local_id)
    cl.run()

def command_line_lookup_id(local_id, html=False):
    global err
    err = None

def lookup_local_id():
        log_debug("calling server to lookup id (%s)" % local_id)
        async_rpc = cl.alert_client.query_alerts(local_id)
        async_rpc.add_callback(query_alerts_callback)
        async_rpc.add_errback(query_alerts_error)

def query_alerts_callback(sigs):
        for siginfo in sigs.signature_list:
            print(siginfo.format_text())
            print(siginfo.format_details())
        cl.main_loop.quit()

def query_alerts_error(method, errno, strerror):
        global err
        cl.main_loop.quit()
        err = "%s error (%d): %s" % (method, errno, strerror)

cl = SECommandLine(lookup_local_id)
    cl.run()
    if err:
        print("Error")
        raise ValueError(err)

#-----------------------------------------------------------------------------

class PresentationManager(GObject.GObject):
    __gsignals__ = {
        'show_browser':
        (GObject.SignalFlags.RUN_LAST, GObject.TYPE_NONE, (GObject.TYPE_PYOBJECT,)),
        'quit_app':
        (GObject.SignalFlags.RUN_LAST, GObject.TYPE_NONE, ()),
    }

def __init__(self):
        GObject.GObject.__init__(self)

def show_browser(self, data_name=None):
        self.emit('show_browser', data_name)

def quit_app(self):
        self.emit('quit_app')

GObject.type_register(PresentationManager)

#-----------------------------------------------------------------------------

class SETroubleshootdDBus(GObject.GObject):
    __gsignals__ = {
        'state_change':
        (GObject.SignalFlags.RUN_LAST, GObject.TYPE_NONE, (GObject.TYPE_PYOBJECT,)),
        'restart_request':
        (GObject.SignalFlags.RUN_LAST, GObject.TYPE_NONE, (GObject.TYPE_PYOBJECT,)),
    }

def __init__(self):
        GObject.GObject.__init__(self)

self.bus = dbus.SystemBus()

proxy_obj = self.bus.get_object(dbus_system_bus_name, dbus_system_object_path)
        self.iface = dbus.Interface(proxy_obj, dbus_system_interface)
        s = self.iface.start()
        log_debug("starting setroubleshootd service")

self.bus.add_signal_receiver(self.on_dbus_name_owner_change, 'NameOwnerChanged',
                                     'org.freedesktop.DBus', 'org.freedesktop.DBus', '/org/freedesktop/DBus',
                                     arg0=dbus_system_bus_name)

# Note: this signal can be emitted from the command line via
        # dbus-send --system $dbus_system_object_path $dbus_system_interface.restart string:"reason"
        self.bus.add_signal_receiver(self.do_restart, 'restart', dbus_system_interface, None, dbus_system_object_path)

def finish(self):
        log_debug("exiting dbus")
        s = self.iface.finish()

def __del__(self):
        log_debug("exiting dbus")
        s = self.iface.finish()

def on_dbus_name_owner_change(self, name, old_owner, new_owner):
        log_debug("on_dbus_name_owner_change: name=%s old_owner=%s new_owner=%s" % (name, old_owner, new_owner))
        if not old_owner and new_owner:
            log_debug("setroubleshootd: came on line")
            self.emit('state_change', 'run')
        elif old_owner and not new_owner:
            log_debug("setroubleshootd: went off line")
            self.emit('state_change', 'stop')
        elif not old_owner and not new_owner:
            log_debug("setroubleshootd: no connection")
            self.emit('state_change', 'stop')
        elif old_owner and new_owner:
            log_debug("setroubleshootd: owner change")
        else:
            log_debug("don't know how to parse old_owner(%s) new_owner(%s)" % (old_owner, new_owner))

def do_restart(self, reason):
        log_debug("do_restart(%s)" % reason)
        self.emit('restart_request', reason)

GObject.type_register(SETroubleshootdDBus)

#-----------------------------------------------------------------------------

class DBusSessionService(dbus.service.Object):

def __init__(self, bus_name):
        bus = dbus.SessionBus()
        bus_name = dbus.service.BusName(dbus_session_bus_name, bus=bus)
        dbus.service.Object.__init__(self, bus_name, dbus_session_object_path)

self.presentation_manager = PresentationManager()

@dbus.service.method(dbus_session_interface)
    def start(self):
        return _("Started")

@dbus.service.method(dbus_session_interface)
    def show_browser(self):
        log_debug('dbus iface show_browser() called',)
        self.presentation_manager.show_browser()
        return ""

@dbus.service.method(dbus_session_interface)
    def quit_app(self):
        log_debug('quit_app() called')
        self.presentation_manager.quit_app()

#-----------------------------------------------------------------------------

class SEAlert():
    """
    The SEAlert object represents a gui client for setroubleshoot. It
    processes alerts and presents the user with an appropriate user
    interface for handling the alert. Most of the interface code
    is in BrowserApplet and StatusIcon. This class is mainly a central
    hub for processing the alerts.
    """

def __init__(self, username, presentation_manager=None, watch_setroubleshootd=False):
        from setroubleshoot.serverconnection import ServerConnectionHandler
        GObject.type_register(ServerConnectionHandler)

try:
            self.username = username
            from setroubleshoot.browser import BrowserApplet

if presentation_manager is None:
                self.presentation_manager = PresentationManager()
                GObject.idle_add(self.show_browser_at_startup)
            else:
                self.presentation_manager = presentation_manager

self.browser = None

self.alert_siginfo = None

if watch_setroubleshootd:
                self.setroubleshootd_dbus = SETroubleshootdDBus()
                self.setroubleshootd_dbus.connect('state_change', self.on_setroubleshootd_state_change)
            else:
                self.setroubleshootd_dbus = None

self.alert_client = ServerConnectionHandler(self.username)
            self.alert_client.open(get_server_socket_address())
            self.browser = BrowserApplet(self.username, self.alert_client, domain=domain)
            self.presentation_manager.connect('show_browser', self.on_show_browser)
            self.presentation_manager.connect('quit_app', self.on_quit)

self.alert_client.connect('alert', self.alert)

# If there is no presentation manager make sure when the
            # user closes the window the whole application exits. When running
            # in "alert" mode we want the application to persist in the background
            self.browser.window_delete_hides = False

except ProgramError as e:
            syslog.syslog(syslog.LOG_ERR, e.strerror)
            sys.exit(1)

def finish(self):
        if self.setroubleshootd_dbus is not None:
            self.setroubleshootd_dbus.finish()

def main(self):
        log_debug('creating main GUI application')
        try:
            Gtk.main()
            self.finish()
        except IOError as e:
            syslog.syslog(syslog.LOG_ERR, str(e))
            print(e, file=sys.stderr)
            sys.exit(1)

except KeyboardInterrupt as e:
            log_debug("got KeyboardInterrupt, exiting ...")
            self.alert_client.close_connection(ConnectionState.HUP)
            self.finish()
            sys.exit()

def alert(self, alert_client, siginfo):
        log_debug("evaluating alert")

def alert_filter_result(result):
            pass

self.alert_siginfo = siginfo
        async_rpc = self.browser.server.evaluate_alert_filter(siginfo.sig, self.username)
        async_rpc.add_callback(alert_filter_result)

def show_browser_at_startup(self):
        self.presentation_manager.show_browser()
        return False

def show_browser(self, data_name):
        if data_name is not None:
            self.browser.do_visit(data_name)

log_debug("SEAlert.show_browser(): data_name=%s" % data_name)
        self.browser.show()
        return True

def on_quit(self, widget):
        if self.alert_client is not None:
            self.alert_client.close_connection(ConnectionState.HUP)
        Gtk.main_quit()

def on_show_browser(self, widget, data_name):
        self.show_browser(data_name)

def on_setroubleshootd_state_change(self, setroubleshootd_dbus, state):
        log_debug('setroubleshootd state change (%s)' % state)
        if state == 'run':
            self.alert_client.open()

def on_restart_request(self, setroubleshootd_dbus, reason):
        log_debug('restart request: reason = %s' % reason)
        do_restart()
        return False

def do_restart():
    log_debug("restarting application...)")
    window_state = None
    geometry = None
    if app is not None:
        if app.browser is not None:
            window_state, visibility_state = app.browser.get_window_state()
            geometry = app.browser.get_geometry()
            os.environ['SEALERT_WINDOW_STATE'] = window_state
            os.environ['SEALERT_WINDOW_GEOMETRY'] = geometry
    log_debug("restarting %s: args=%s window_state=%s geometry=%s" % (sys.argv[0], sys.argv[1:], window_state, geometry))
    os.execv(sys.argv[0], sys.argv)

#-----------------------------------------------------------------------------

class SECommandLine(object):

def __init__(self, func):
        from setroubleshoot.serverconnection import ServerConnectionHandler
        self.username = get_identity()
        self.func = func

self.alert_client = ServerConnectionHandler(self.username)
        self.alert_client.connect('connection_state_changed', self.on_connection_state_change)
        self.main_loop = GLib.MainLoop()

def async_error_callback(self, method, errno, strerror):
        print("%s error (%d): %s" % (method, errno, strerror), file=sys.stderr)
        sys.exit(1)

def do_logon(self):
        def logon_callback(pkg_version, rpc_version):
            log_debug("logon_callback(): pkg_version=%s rpc_version=%s" % (pkg_version, rpc_version))
            self.alert_client.connection_state.update(ConnectionState.AUTHENTICATED)

log_debug("logon: %s" % self.username)

self.alert_client.channel_name = self.username
        async_rpc = self.alert_client.logon(self.alert_client.channel_type, self.username, 'passwd')
        async_rpc.add_callback(logon_callback)
        async_rpc.add_errback(self.async_error_callback)

def on_connection_state_change(self, connection, connection_state, flags, flags_added, flags_removed):
        log_debug("%s.on_connection_state_change: connection_state=%s flags_added=%s flags_removed=%s address=%s" % (self.__class__.__name__, connection_state, connection_state.flags_to_string(flags_added), connection_state.flags_to_string(flags_removed), connection.socket_address))

if (flags_added & (ConnectionState.ERROR | ConnectionState.HUP)) or (flags_removed & ConnectionState.OPEN):
            errno, strerror = connection_state.get_result()
            print("failed to connect to server: %s" % (strerror), file=sys.stderr)
            sys.exit(1)

if flags_added & ConnectionState.OPEN:
            self.do_logon()

if flags_added & ConnectionState.AUTHENTICATED:
            self.func()

def run(self):
        log_debug('executing command line application')
        self.alert_client.open(get_server_socket_address())
        try:
            self.main_loop.run()
        except KeyboardInterrupt as e:
            sys.exit()

#-----------------------------------------------------------------------------

class ScanLogfile:

def __init__(self, logfile_path):
        from setroubleshoot.analyze import LogfileAnalyzer
        self.analyzer = LogfileAnalyzer(logfile_path)
        self.main_loop = GLib.MainLoop()
        if sys.stdout.isatty():
            self.analyzer.connect('progress', self.on_progress)
        self.analyzer.connect('state-changed', self.on_analyzer_state_change)

def on_progress(self, analyzer, progress):
        output = "\r%3d%% done" % (progress * 100)
        sys.stdout.write(output)
        sys.stdout.flush()

def on_analyzer_state_change(self, analyzer, state):
        if state == 'stopped':
            if analyzer.strerror:
                print("ERROR: %s" % analyzer.strerror, file=sys.stderr)
            log_debug("analyzer stopped")
            self.main_loop.quit()
            self.output_results()

def scan_file(self):
        self.analyzer.cancelled = False
        self.analyzer.open()
        self.analyzer.run()
        self.main_loop.run()

def output_results(self):
        sigs = self.analyzer.database.query_alerts('*')
        separator = '-' * 80 + '\n'
        print("\nfound %d alerts in %s" % (len(sigs.signature_list), self.analyzer.logfile_path))
        for siginfo in sigs.signature_list:
            print(separator)
            print(siginfo.format_text())
            print(siginfo.format_details())

def do_analyze_logfile(logfile_path):
    from selinux import audit2why
    audit2why.init()
    scanner = ScanLogfile(logfile_path)
    scanner.scan_file()
    audit2why.finish()

#-----------------------------------------------------------------------------

def display_terminal_traceback(who):
    import traceback
    stacktrace = traceback.format_exc()
    print(_("Oops, %s hit an error!" % who) + '\n\n' + stacktrace)

try:
    from setroubleshoot.gui_utils import display_traceback
except ImportError:
    def display_traceback(who):
        display_terminal_traceback(who)

# -- Main --
if __name__ == '__main__':
    use_terminal = False
    setup_sighandlers()
    log_debug("main() args=%s" % sys.argv)

# Exit if selinux is disabled - setroubleshootd cannot start
    if not selinux.is_selinux_enabled():
        log_debug("SELinux not enabled, sealert will not run on non SELinux systems")
        print("SELinux not enabled, sealert will not run on non SELinux systems", file=sys.stderr)
        sys.exit(3)

def validate_invocation_style(opt, opts_instance, conflict_opts):
        global invocation_style
        conflict_opts.remove(opt)
        invocation_style = opt
        for i in conflict_opts:
            if getattr(opts_instance, i):
                print("cannot run as %s with other option" % (opt), file=sys.stderr)
                sys.exit(3)

try:
        from optparse import OptionParser
        parser = OptionParser()

parser.add_option("-b", "--browser", action="store_true", dest="browser", default=False,
                          help="Launch the browser")
        parser.add_option("-s", "--service", action="store_true", dest="service", default=False,
                          help="Start sealert as a dbus service")
        parser.add_option("-S", "--noservice", action="store_true", dest="noservice", default=False,
                          help="Start sealert without dbus service as stand alone app")
        parser.add_option("-l", "--lookupid", dest="lookupid", default=False,
                          help="Lookup alert by id, id may be wildcard * to lookup all alerts")
        parser.add_option("-a", "--analyze", dest="analyze", default=False,
                          help="Scan a log file, analyze its AVCs", metavar="FILE")
        parser.add_option("-u", "--user", dest="user", default=False,
                          help="logon user name")
        parser.add_option("-p", "--password", dest="password", default=False,
                          help="logon user password")
        parser.add_option("-P", "--plugin", dest="plugin", default=False,
                          help="Plugin Name Required for -f")
        parser.add_option("-f", "--fix", dest="fix", default=False,
                          help="fix avc with the given uuid, requires plugin")

conflict_opts = ["analyze", "browser", "fix", "lookupid", "noservice", "service"]
        username = None
        password = None
        plugin_name = None

(options, args) = parser.parse_args()

if options.user:
            username = options.user
        else:
            username = get_identity()

if options.password:
            password = options.password
        else:
            password = 'passwd'

if options.browser:
            validate_invocation_style("browser", options, conflict_opts)

if options.service:
            validate_invocation_style("service", options, conflict_opts)

if options.noservice:
            validate_invocation_style("noservice", options, conflict_opts)

if options.lookupid:
            validate_invocation_style("lookupid", options, conflict_opts)
            local_id = options.lookupid

if options.analyze:
            validate_invocation_style("analyze", options, conflict_opts)
            use_terminal = True
            logfile = options.analyze

if options.plugin:
            plugin_name = options.plugin

if options.fix:
            validate_invocation_style("fix", options, conflict_opts)
            local_id = options.fix
            if options.plugin:
                plugin_name = options.plugin
            else:
                print("-P plugin_name required for fix", file=sys.stderr)
                sys.exit(3)

# Attempt to communicate with the service.  DBus should start it if it is not
        # running, otherwise we will become the service
        if invocation_style is None:
            log_debug("invocation style not set, asking dbus to start us")
            try:
                bus = dbus.SessionBus()
                proxy_obj = bus.get_object(dbus_session_bus_name, dbus_session_object_path)
                iface = dbus.Interface(proxy_obj, dbus_session_interface)
                s = iface.start()
            except dbus.DBusException:
                print("could not attach to desktop process", file=sys.stderr)
                sys.exit(1)
            sys.exit()

log_debug("invocation style = '%s'" % invocation_style)

if invocation_style == 'browser':
            ask_dbus_to_show_browser()
            sys.exit()
        elif invocation_style == 'service':
            try:
                # This import must come before importing gtk to silence warnings
                gi.require_version('Gtk', GTK_VERSION)
                from gi.repository import Gtk
                run_as_dbus_service(username)
            except RuntimeError as e:
                print(e)
                sys.exit(3)
            sys.exit()
        elif invocation_style == 'noservice':
            # This import must come before importing gtk to silence warnings
            gi.require_version('Gtk', GTK_VERSION)
            from gi.repository import Gtk
            run_app(username)
            sys.exit()
        elif invocation_style == 'lookupid':
            use_terminal = True

from setroubleshoot.signature import *
            try:
                # make sure setroubleshoot is running
                bus = dbus.SystemBus()
                proxy_obj = bus.get_object(dbus_system_bus_name, dbus_system_object_path)
                iface = dbus.Interface(proxy_obj, dbus_system_interface)
                iface.start()
                command_line_lookup_id(local_id)
                iface.finish()
            except ValueError as e:
                print(e, file=sys.stderr)
                iface.finish()
                sys.exit(3)
            except dbus.exceptions.DBusException as e:
                print("Unable to establish connection to setroubleshoot daemon!\n" +
                      "Check output of 'journalctl -t setroubleshootd' for more details.")
                sys.exit(3)

sys.exit()
        elif invocation_style == 'analyze':
            use_terminal = True

try:
                do_analyze_logfile(logfile)
            except OSError as e:
                print(e)
                sys.exit(3)
            except ProgramError as e:
                print(e.strerror, file=sys.stderr)
                sys.exit(3)
            except Exception as e:
                print("SELinux is disabled or we can't open a policy file")
                sys.exit(3)

elif invocation_style == 'fix':
            use_terminal = True

from setroubleshoot.signature import *
            try:
                bus = dbus.SystemBus()
                proxy_obj = bus.get_object(dbus_system_bus_name, dbus_system_object_path)
                iface = dbus.Interface(proxy_obj, dbus_system_interface)
                iface.start()

fix_lookup_id(local_id, plugin_name)
                iface.finish()
            except dbus.DBusException as e:
                print("could not attach to desktop process", file=sys.stderr)
                sys.exit(3)

sys.exit()
        else:
            print("unknown invocation style (%s)" % invocation_style, file=sys.stderr)
            sys.exit(3)
    except Exception as e:
        syslog.syslog(syslog.LOG_ERR, "exception %s: %s" % (e.__class__.__name__, str(e)))
        if use_terminal:
            display_terminal_traceback('sealert')
        else:
            display_traceback('sealert')

sys.exit(3)