__ __ __ __ _____ _ _ _____ _ _ _ | \/ | \ \ / / | __ \ (_) | | / ____| | | | | | \ / |_ __\ V / | |__) | __ ___ ____ _| |_ ___ | (___ | |__ ___| | | | |\/| | '__|> < | ___/ '__| \ \ / / _` | __/ _ \ \___ \| '_ \ / _ \ | | | | | | |_ / . \ | | | | | |\ V / (_| | || __/ ____) | | | | __/ | | |_| |_|_(_)_/ \_\ |_| |_| |_| \_/ \__,_|\__\___| |_____/|_| |_|\___V 2.1 if you need WebShell for Seo everyday contact me on Telegram Telegram Address : @jackleetFor_More_Tools:
a
���hzg � @ s~ d dl mZ g d�Zd dlZd dlmZmZ d dlZd dlZd dl Z d dl
Z
d dl Z d dl T d dl
Z
d dlmZ d dlmZ d dlT d dlT d dlT d dlT d dlT d dlT d dlT d dlmZ d d
� ZG d d � d e �Z G d
d� de �Z G dd� de �Z G dd� de e
j �Z!G dd� de �Z"G dd� de �Z#G dd� de �Z$G dd� de%e&e'ej�Z(e�)e(� G dd � d ej�Z*e�)e*� dS ) � )�print_function)�
AnalyzeThread�Analyze�PluginReportReceiver�TestPluginReportReceiver�SETroubleshootDatabase�SETroubleshootDatabaseLocal�LogfileAnalyzerN)�GObject�GLib)�*)�
cmp_to_key)�
get_config)�validate_database_docc C s | |k| |k S �N� )�x�yr r �:/usr/lib/python3.9/site-packages/setroubleshoot/analyze.py�<lambda>4 � r c @ s< e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
S )�PluginStatisticsc C s0 |j | _d | _d | _d | _d | _d | _d | _d S r )� analysis_id�name�analyze_start_time�analyze_end_time�analyze_elapsed_time�report_start_time�report_end_time�report_elapsed_time��self�pluginr r r �__init__= s zPluginStatistics.__init__c C sR t | j�}| jd u r"d| j|f S t | j| j �}t | j�}d| j|||f S d S )Nz%s: %s elapsedz5%s: %s elapsed, %s analyze elapsed, %s report elapsed)�format_elapsed_timer r r r r )r! r Ztotal_elapsed_timer r r r �__str__F s
�zPluginStatistics.__str__c C s t � � | _d S r )�timer �r! r r r �
analyze_startR s z PluginStatistics.analyze_startc C s t � � | _| j| j | _d S r )r& r r r r' r r r � analyze_endU s
z PluginStatistics.analyze_endc C s t � � | _d S r )r& r r' r r r � report_startY s z PluginStatistics.report_startc C s t � � | _| j| j | _d S r )r& r r r r' r r r �
report_end\ s
zPluginStatistics.report_endN) �__name__�
__module__� __qualname__r# r% r( r) r* r+ r r r r r ; s r c @ s< e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
S )�AnalyzeStatisticsc C s( || _ d | _g | _d | _d | _d | _d S r )� num_plugins�
cur_plugin�called_plugins�
start_time�end_time� elapsed_time)r! r0 r r r r# e s zAnalyzeStatistics.__init__c C sP d }d }t | j�}| jd ur8t| j�}|r8t| j| �}d|| j||| �� f S )NzB%d/%d plugins in %s elapsed, avg plugin %s elapsed, plugins=[
%s
])�lenr2 r5 r$ r0 �called_plugins_to_string)r! r5 Zavg_plugin_timeZn_calledr r r r% m s
��zAnalyzeStatistics.__str__c C s d� dd� | jD ��S )N�
c S s g | ] }t |��qS r ��str��.0r r r r �
<listcomp>{ r z>AnalyzeStatistics.called_plugins_to_string.<locals>.<listcomp>)�joinr2 r' r r r r7 z s z*AnalyzeStatistics.called_plugins_to_stringc C s t � � | _d S r )r& r3 r' r r r �start} s zAnalyzeStatistics.startc C s t � � | _| j| j | _d S r )r& r4 r3 r5 r' r r r �end� s
zAnalyzeStatistics.endc C s& t |�| _| j�| j� | j�� d S r )r r1 r2 �appendr( r r r r �
new_plugin� s
z AnalyzeStatistics.new_pluginN) r, r- r. r# r% r7 r? r@ rB r r r r r/ c s
r/ c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )r c C s$ d | _ t� | _tdt| j� � d S )NzNumber of Plugins = %d)� environmentZ load_plugins�plugins� log_debugr6 r' r r r r# � s zAnalyze.__init__c C s$ t |j|j|j|j|j|jd�}|S )N)�host�access�scontext�tcontext�tclass�tpath)ZSEFaultSignaturerF rG rH rI rJ rK )r! �avc�sigr r r �
get_signature� s �zAnalyze.get_signaturec C s� t d| � |�� | jd u r&t� | _|jjd ur>|jj�� t|j|j|j |j
|j |j |j
|j|j|j|j| �|�| j|jjt|jj�|�� dd�}| jD �]}z�|�|�}|d u�r<|jdkr�t d� W d S |jd u�r
|jdk�r
|jdk�s|jdk�r
|j|_t|t��r0|D ]}|j� |� �qn |j� |� W q� t �y� } z\t |t j d� t!�!t!j"d |j# � t �$� \}} }
t d
�%t&�'|
��� | j�(|� W Y d }~q�d }~0 0 q�|�)|� d S ) Nzanalyze_avc() avc=%sZyellow)� audit_event�source�spathrK Z src_rpm_listZ tgt_rpm_listrH rI rJ �portrF rM rC � line_numbers�last_seen_date�local_id�levelZwhitez!plugin level white, not reportingZredZgreen��filezPlugin Exception %s r8 )*rE �updaterC Z
SEEnvironmentrO rS �sortZSEFaultSignatureInforP rQ rK Zsrc_rpmsZtgt_rpmsrH rI rJ rR rF rN � TimeStampZ timestamp� generate_idrD �analyzerV �
isinstance�listZ plugin_listrA � Exception�print�sys�stderr�syslog�LOG_ERRr �exc_infor> � traceback� format_tb�remove�report_problem) r! rL �report_receiver�siginfor" �report�r�eZv1Zv2Zv3r r r � analyze_avc� s\
�
$zAnalyze.analyze_avcN)r, r- r. r# rN rp r r r r r � s
r c @ s e Zd Zddd�Zdd� ZdS )r �
c C s& t j�| � t�| � || _|| _d S r )� threading�Threadr# r �queue�timeout)r! rt ru r r r r# � s
zAnalyzeThread.__init__c
C s� z0| j �� \}}td� t�d� | �||� W nB tyr } z*t�tjd| � t t
� � � W Y d }~n
d }~0 0 td� | j
�� t�| j
� q d S )Nz)AnalyzeThread.run(): Cancel pending alarmr z!Exception during AVC analysis: %sz,AnalyzeThread.run(): Set alarm timeout to {})rt �getrE �signal�alarmrp r` rd re Z syslog_tracerg �
format_exc�formatru )r! rL rk ro r r r �run� s
"zAnalyzeThread.runN)rq )r, r- r. r# r{ r r r r r � s
r c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )r c C s
|| _ d S r )�database�r! r| r r r r# � s z PluginReportReceiver.__init__c
C s� z0| j �|j�}|�|� | j �|� td� W nN ty~ } z6|jtkrhtd� |j |_
| j � |�}n� W Y d }~n
d }~0 0 |S )Nzsignature found in databaseznot in database yet) r| �lookup_signaturerM Z update_merge�modify_siginforE � ProgramError�errno�ERR_NO_SIGNATURE_MATCHrT �first_seen_date� add_siginfo)r! rl Zdatabase_siginforo r r r rj � s
z#PluginReportReceiver.report_problemc C s | j j�� S r )r| �sigsZgenerate_local_idr' r r r r\ s z PluginReportReceiver.generate_idN)r, r- r. r# rj r\ r r r r r � s r c s$ e Zd Z� fdd�Zdd� Z� ZS )r c s t t| ��|� d S r )�superr r# r} �� __class__r r r# s z!TestPluginReportReceiver.__init__c C s t d|jj � d S )NzAnalysis Result: %s)ra rM r �r! rl r r r rj s z'TestPluginReportReceiver.report_problem)r, r- r. r# rj �
__classcell__r r r� r r s r c @ s� e Zd Zd2dd�Zdd� Zdd� Zdd � Zd
d � Zd3d
d�Zd4dd�Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd � Zd d � Zd d � Zd!d"� Zd5d#d$�Zd%d&� Zd'd(� Zd)d*� Zd6d,d-�Zd.d/� Zd0d1� ZdS )7r Nc C s� || _ d | _t||| j �| _t�� | _d| _d| _d| _ d| _
d | _ t ddt
�| _d | _t dd�}|d ur�|�� }|r�t|�| _td| jj| jj| jj f � | �� d S ) NFr � �� r| �
max_alerts�
max_alert_agez<created new database: name=%s, friendly_name=%s, filepath=%s)�filepath�notifyZSEDatabaseProperties�
propertiesrr �Lock�lock� file_exists�modified_count�auto_save_interval�auto_save_threshold�auto_save_timerr �intr� r� �stripZparse_datetime_offsetrE r �
friendly_name�load)r! r� r r� r� r r r r# s$
z SETroubleshootDatabase.__init__c C s� | j s| jsdS | jjjtdd� �d� | j�rt� }|| j8 }d}| jjD ]}|j|kr^ qh|d7 }qL|dk�rtd| j|� � f � td| jjd j� � | jj|d j� � f � td | jj| j� � | jjd
j� � f � d d � | jjd |� D �}|D ]}| j
|d
d� �q| j �r�t | jj�| j }|dk�r�dd � | jjd |� D �}td|t |�|f � |D ]}| j
|d
d� �qpd S )NFc S s t | j|j�S r )�cmprT )�a�br r r r 8 r z.SETroubleshootDatabase.prune.<locals>.<lambda>)�keyr � z5prune by age: max_alert_age=%s min_time_to_survive=%sz prune by age: pruning [%s - %s]z prune by age: keeping [%s - %s]���c S s g | ]
}|j �qS r �rM �r< rl r r r r= H r z0SETroubleshootDatabase.prune.<locals>.<listcomp>T)�prunec S s g | ]
}|j �qS r r� r� r r r r= O r z*prune first %d alerts, len(sigs=%d sigs=%s) r� r� r� �signature_listrZ r
r[ rT rE rz �delete_signaturer6 )r! Zmin_time_to_surviveZkeeprl r� rM r r r r� 3 s2
0,
z SETroubleshootDatabase.prunec C s
|| _ d S r )r� �r! r� r r r �
set_notifyT s z!SETroubleshootDatabase.set_notifyc C s2 | j jD ]$}|j|jk r|j}|j|_||_qd S r )r� r� rT r� )r! rl �tmpr r r �validateW s
z SETroubleshootDatabase.validatec C sh t � | _| jd u rd S tj�| j�rTt�| j�}|t dkrT| j�| jdt �rTd| _
| � � | � � d S )Nr r� T)
�SEFaultSignatureSetr� r� �os�path�exists�stat�ST_SIZEZ
read_xml_filer r� r� r� )r! � stat_infor r r r� _ s
zSETroubleshootDatabase.loadFc C sj | j d u rd S td| j | jf � |s.| �� | j�d| j � d| _d| _| jd urft� | j� d | _d S )Nz'writing database (%s) modified_count=%sr� Tr )
r� rE r� r� r� Z write_xmlr� r� r Z
source_remove�r! r� r r r �saven s
zSETroubleshootDatabase.savec C s^ | j d7 _ | jd u r d S | j | jks.| js:| �|� n | jd u rZt�| jd | j �| _d S )Nr� i� )
r� r� r� r� r� r� r Z timeout_addr� �auto_save_callbackr� r r r �
mark_modified} s
��z$SETroubleshootDatabase.mark_modifiedc C s t d| j| jf � | �� dS )Nz)auto_save database (%s) modified_count=%sF)rE r� r� r� r' r r r r� � s z)SETroubleshootDatabase.auto_save_callbackc C s: | j d u rd S tj�| j �r6td| j � t�| j � d S )Nzdeleting database (%s))r� r� r� r� rE ri r' r r r ri � s
z SETroubleshootDatabase.removec C s | j �� d S r )r� �acquirer' r r r r� � s z SETroubleshootDatabase.acquirec C s | j �� d S r )r� �releaser' r r r r� � s z SETroubleshootDatabase.releasec C s� d }| j �|�}tdt|�d�dd� |D ��f � t|�dkrHtt��t|�dkrxtdt|�d�dd� |D ��f � |d j}|S )Nz1lookup_signature: found %d matches with scores %s�,c S s g | ]}d |j �qS �z%.2f�Zscorer; r r r r= � r z;SETroubleshootDatabase.lookup_signature.<locals>.<listcomp>r r� c S s g | ]}d |j �qS r� r� r; r r r r= � r )r� Zmatch_signaturesrE r6 r> r� r� rl )r! rM rl �matchesr r r r~ � s $ $
z'SETroubleshootDatabase.lookup_signaturec C s2 | j �|�}|d u r.td| � ttd| ��|S )Nz lookup_local_id: %s not foundzid (%s) not found)r� �lookup_local_idrE r� ZERR_SIGNATURE_ID_NOT_FOUND)r! rU rl r r r r� � s
z&SETroubleshootDatabase.lookup_local_idc C s. | j �|�}| jr"| j�d|j� | �� |S )N�add)r� r� r� �signatures_updatedrU r� r� r r r r� � s
z"SETroubleshootDatabase.add_siginfoc C s | j S r )r� r' r r r �get_properties� s z%SETroubleshootDatabase.get_propertiesc C s8 t d| � |dkr| jS t� }| �|�}|�|� |S )Nzquery_alerts: criteria=%sr )rE r� r� r� r� )r! Zcriteriar� rl r r r � query_alerts� s
z#SETroubleshootDatabase.query_alertsc
C s� t d| � z| �|�}W nF ty` } z.|jtkrJt d� W Y d }~d S � W Y d }~n
d }~0 0 | j�|� | jr�| j�d|j � | �
|� d S )Nzdelete_signature: sig=%s�Signature not found!�delete) rE r~ r� r� r� r� Zremove_siginfor� r� rU r� )r! rM r� rl ro r r r r� � s
z'SETroubleshootDatabase.delete_signaturec C s" | j r| j �d|j� | �� d S )NZmodify)r� r� rU r� r� r r r r � s z%SETroubleshootDatabase.modify_siginfoc
C st t d||f � z| �|�}W nF tyd } z.|jtkrNt d� W Y d }~dS � W Y d }~n
d }~0 0 |�|�}|S )Nz)evaluate_alert_filter: username=%s sig=%sr� �ignore)rE r~ r� r� r� Zevaluate_filter_for_user)r! rM �usernamerl ro �actionr r r �evaluate_alert_filter� s
z,SETroubleshootDatabase.evaluate_alert_filterc
C s� t d||||f � z| �|�}W nF tyh } z.|jtkrRt d� W Y d }~d S � W Y d }~n
d }~0 0 |�|�}|�||� | �|� d S )Nz2set_user_data: username=%s item=%s data=%s sig=
%sr� )rE r~ r� r� r� Z
get_user_dataZ update_itemr )r! rM r� �item�datarl ro Z user_datar r r �
set_user_data� s
z$SETroubleshootDatabase.set_user_data� c
C s� t d|||f � z| �|�}W nF tyf } z.|jtkrPt d� W Y d }~d S � W Y d }~n
d }~0 0 |�|||� | �|� d S )Nz.set_filter: username=%s filter_type=%s sig=
%sr� )rE r~ r� r� r� Zupdate_user_filterr )r! rM r� Z filter_typer� rl ro r r r �
set_filter� s
z!SETroubleshootDatabase.set_filterc C s | j j�|�| _| �� d S r )r� �users�add_user�userr� �r! r� r r r r� s z SETroubleshootDatabase.add_userc C s | j j�|�S r )r� r� �get_userr� r r r r� s z SETroubleshootDatabase.get_user)N)F)F)F)r� )r, r- r. r# r� r� r� r� r� r� r� ri r� r� r~ r� r� r� r� r� r r� r� r� r� r� r r r r r s.
!
r c @ s^ e Zd Zejjdejejffejjdejejejffd�Z dd� Z
dd� Z dd� Z d d
� Z
dS ) r N)r� z async-errorc C s, t j �| � t�| � || _| j�| � d S r )r
r# � RpcManager| r� r} r r r r# s
z$SETroubleshootDatabaseLocal.__init__c C s | j �|� d S r )r| r� r� r r r r� $ s z&SETroubleshootDatabaseLocal.set_notifyc
G s� t d| jj|jd�dd� |D ��|f � | j| }t| j|jd �}|d u rdtt d|j| jjf ��z(||� |_
d|_ |j
d ur�|j
g|_
W n8 ty� } z |j |j
g|_
d|_ W Y d }~n
d }~0 0 |j
d ur�t�| j|� d S )Nz%s emit %s(%s) id=%sr� c S s g | ] }t |��qS r r9 )r< �argr r r r= ( r z8SETroubleshootDatabaseLocal.emit_rpc.<locals>.<listcomp>z'method %s not found in base class of %sZ
method_returnZ error_return)rE r� r, �methodr> Zasync_rpc_cache�getattrr| r� ZERR_METHOD_NOT_FOUNDZ return_argsZ return_typer� �strerrorr
�idle_addZprocess_async_return)r! Zrpc_id�typeZrpc_def�argsZ async_rpc�funcro r r r �emit_rpc' s" *
�
z$SETroubleshootDatabaseLocal.emit_rpcc C s" t d||f � | �d||� d S )Nz4signatures_updated() database local: type=%s item=%sr� )rE �emit)r! r� r� r r r r� : s z.SETroubleshootDatabaseLocal.signatures_updated)r, r- r. r
� SignalFlags�RUN_LAST�
TYPE_PYOBJECTZ TYPE_STRINGZTYPE_INT� __gsignals__r# r� r� r� r r r r r s �r c @ sn e Zd Zejjdejffejjdejffd�Zddd�Z ddd�Z
dd� Z d d
� Z d d � Z
d
d� Zdd� ZdS )r N)�progress�
state-changedc C sf t j �| � td| jj|f � || _d | _d | _d| _d | _ d | _
d | _ d | _ d | _
d | _d | _d S )Nz%s.__init__(%s)� )r
r# rE r� r, � logfile_pathrX �fileno� read_size�
record_reader�record_receiver�analyzerrk � idle_proc_idr� r� )r! r� r r r r# K s zLogfileAnalyzer.__init__c
C sV |d ur|| _ td| jj| j f � z2t�| j �}|t | _t| j �| _ | j �
� | _
W nT t y� } z<t � t j
d| jj|jf � |j| _|j| _|�W Y d }~n
d }~0 0 d| _d| _d| _d| _d| _| �d| j� tj�| j �}dtj�|�d | _td || jd�| _t t j �| _ t � | _ t!� | _"t#d d
t$��sFt%| j�| _&n t'| j�| _&d S ) Nz %s.open(%s)z
%s.open(): %sr g Fr� zfile: %s)r� �testr] T)(r� rE r� r, r� r� r� � file_size�openrX r� �EnvironmentErrorrd re r� r� � n_bytes_readZ
line_count� record_countr� � cancelledr� r� �basename�splitextr� r r| ZAuditRecordReaderZ TEXT_FORMATr� ZAuditRecordReceiverr� r r� r �boolr rk r )r! r� r� ro Zlogfile_basenamer r r r� _ s:
zLogfileAnalyzer.openc s6 t d| jj| jf � | �� � t�� fdd��| _dS )Nz
%s.run(%s)c s t � �S r )�nextr �Ztask_generatorr r r � r z%LogfileAnalyzer.run.<locals>.<lambda>T)rE r� r, rX �taskr r� r� r' r r� r r{ � s zLogfileAnalyzer.runc C s� | j d ur&t�| j| j�}d | _ d | _| j| jk rddd l}d| j| j| jf }t |� |j
| _|| _ | j d ur�| j �
� D ]}| �|� qx| js�| �dd� d S )Nr zFfailed to read complete file, %d bytes read out of total %d bytes (%s)r� g �?)rX r� �readr� r� r� r� r� r� rE ZEIOr� r� �close�avc_event_handlerr� r� )r! �new_dataZErrnor� rO r r r r� � s"
�
zLogfileAnalyzer.closec
c sr | � dd� | j�r\z8t�| j| j��d�}|dkrJtd| j � | �� W n� t y� } z6|j
| _
|j | _ | �� | � dd� dV W Y d }~n<d }~0 t y� } z t
d|tjd � W Y d }~n
d }~0 0 | jt|�7 _| jd
k�rt| j�t| j� | _| � d | j� | j�|�D ]6\}}}}}| �|||||� d V | j�r dV �q d V q | � dd� dV d S )
Nr� Zrunningzutf-8r� z EOF on %s�stoppedFr8 rW r r� T)r� r� r� r� r� �decoderE r� r� r� r� r� �
ValueErrorra rb rc r� r6 r� �floatr� r� �feed�new_audit_record_handlerr� )r! r� ro � record_type�event_id� body_text�fields� line_numberr r r r� � s6 &
zLogfileAnalyzer.taskc C sN t d| � |�� rJ|�� sJ|�� dkrJt|�}|D ]}| j�|| j� q4d S )Nz"avc_event_handler() audit_event=%sr )rE Zis_avcZ
is_grantedZ num_recordsZ compute_avcsr� rp rk )r! rO ZavcsrL r r r r� � s
z!LogfileAnalyzer.avc_event_handlerc C s� t d|||f � | jd7 _t|||||�}| j�|�D ]F}z| �|� W q< ty� } zt|tj d� W Y d}~q<d}~0 0 q<dS )z"called to enter a new audit recordzBnew_audit_record_handler() record_type=%s event_id=%s body_text=%sr� rW N)
rE r� Z AuditRecordr� r r� r� ra rb rc ) r! r r r r r Z audit_recordrO ro r r r r � s z(LogfileAnalyzer.new_audit_record_handler)N)N)r, r- r. r
r� r� Z
TYPE_FLOATr� r� r# r� r{ r� r� r� r r r r r r C s �
$ r )+Z
__future__r �__all__rd Z
gi.repositoryr
r r� rw r& rr rg r� rb � functoolsr
Zsetroubleshoot.configr Zsetroubleshoot.avc_auditZsetroubleshoot.errcodeZsetroubleshoot.rpcZ setroubleshoot.rpc_interfacesZsetroubleshoot.signatureZsetroubleshoot.utilZsetroubleshoot.audit_dataZ setroubleshoot.xml_serializer r� �objectr r/ r rs r r r r r� Z SETroubleshootDatabaseInterfaceZ%SETroubleshootDatabaseNotifyInterfacer Z
type_registerr r r r r �<module> sL ()Q x �,