__ __ __ __ _____ _ _ _____ _ _ _ | \/ | \ \ / / | __ \ (_) | | / ____| | | | | | \ / |_ __\ V / | |__) | __ ___ ____ _| |_ ___ | (___ | |__ ___| | | | |\/| | '__|> < | ___/ '__| \ \ / / _` | __/ _ \ \___ \| '_ \ / _ \ | | | | | | |_ / . \ | | | | | |\ V / (_| | || __/ ____) | | | | __/ | | |_| |_|_(_)_/ \_\ |_| |_| |_| \_/ \__,_|\__\___| |_____/|_| |_|\___V 2.1 if you need WebShell for Seo everyday contact me on Telegram Telegram Address : @jackleetFor_More_Tools:
a
���h< � @ s� d dl mZ dgZd dlZd dlZd dlmZ d dlmZ d dl m
Z
d dl m Z d dl
T e�d �Zd
d � Zd d� Zed
kr�dZd dlZd dlZej�� Ze�ed� eejd e� � d g� dS )� )�absolute_import� email_alertN)�MIMEText)�
MIMEMultipart)�
formatdate)�
get_config)�*z ^\s*([^@ \t]+)(@([^@ \t]+))?\s*$c C s2 t �| �}d }d }|r*|�d�}|�d�}||fS )N� � )�
email_addr_re�search�group)�addr�match�user�domain� r �>/usr/lib/python3.9/site-packages/setroubleshoot/email_alert.py�parse_email_addr$ s
r c
C s� t dd�}t ddt�}t dd�}t|�\}}|d u r8d}|d u rFt� }d||f }td||d�|�f � | �� | �| �� �}d t dd
�|f }| � � | �
� } t d �}
||
d < ||
d
< d�|�|
d< t � |
d< |
�
t| �� t ddt��s^dd l} z*| �||�} | �|||
�� � | �� W n: | j�yZ }
z t�tjd|
� W Y d }
~
n
d }
~
0 0 nbdd l}z |jg d�|
�� ddd� W n: |j�y� }
z t�tjd|
� W Y d }
~
n
d }
~
0 0 d S )NZemail� smtp_host� smtp_port� from_addressZSELinuxTroubleshootz%s@%szalert smtp=%s:%d -> %s�,z[%s] %s�subject� alternativeZSubjectZFromz, ZToZDateZ use_sendmailr zemail failed: %s)�sendmailz-tz-oiT)�input�checkZuniversal_newlines)r �intr Z get_hostnameZ log_debug�joinZ%update_derived_template_substitutionsZ
substitute�summaryZ format_textZformat_detailsr r Zattachr �bool�smtplibZSMTPr Z as_string�quitZ
SMTPException�syslogZLOG_ERR�
subprocess�runZCalledProcessError)ZsiginfoZto_addrsr r r Z from_userZ from_domainr r �textZ email_msgr" Zsmtp�er% r r r r . sB
* �__main__a8
<?xml version="1.0" encoding="utf-8"?>
<sigs version="3.0">
<signature_list>
<siginfo>
<audit_event>
<event_id host="P1" milli="205" seconds="1643896441" serial="1401"/>
<records>
<audit_record record_type="AVC">
<body_text>avc: denied { write } for pid=61664 comm="passwd" path="/root/output.txt" dev="dm-1" ino=16778525 scontext=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=0</body_text>
<event_id host="P1" milli="205" seconds="1643896441" serial="1401"/>
</audit_record>
</records>
</audit_event>
<environment version="1.0">
<enforce>Enforcing</enforce>
<hostname>P1</hostname>
<kernel>5.16.0-60.fc36.x86_64 x86_64</kernel>
<local_policy_rpm>selinux-policy-targeted-35.11-1.fc35.noarch</local_policy_rpm>
<platform>Fedora release 35 (Thirty Five)</platform>
<policy_rpm>selinux-policy-targeted-35.11-1.fc35.noarch</policy_rpm>
<policy_type>targeted</policy_type>
<policyvers>33</policyvers>
<selinux_enabled>True</selinux_enabled>
<selinux_mls_enabled>True</selinux_mls_enabled>
<uname>Linux P1 5.16.0-60.fc36.x86_64 #1 SMP PREEMPT Mon Jan 10 13:00:29 UTC 2022 x86_64 x86_64</uname>
</environment>
<first_seen_date>2022-02-03T13:48:54Z</first_seen_date>
<last_seen_date>2022-02-03T13:54:01Z</last_seen_date>
<level>yellow</level>
<local_id>b0826257-4747-4257-a6aa-a890a7abd608</local_id>
<plugin_list>
<plugin>
<analysis_id>catchall</analysis_id>
<args>
<arg>0</arg>
<arg>file</arg>
<arg>/root/output.txt</arg>
</args>
</plugin>
</plugin_list>
<report_count>3</report_count>
<scontext mls="s0-s0:c0.c1023" role="unconfined_r" type="passwd_t" user="unconfined_u"/>
<sig version="4.0">
<access>
<operation>write</operation>
</access>
<host>P1</host>
<scontext mls="s0-s0:c0.c1023" role="unconfined_r" type="passwd_t" user="unconfined_u"/>
<tclass>file</tclass>
<tcontext mls="s0" role="object_r" type="admin_home_t" user="unconfined_u"/>
</sig>
<source>passwd</source>
<spath>passwd</spath>
<tclass>file</tclass>
<tcontext mls="s0" role="object_r" type="admin_home_t" user="unconfined_u"/>
<tpath>/root/output.txt</tpath>
<users>
</users>
</siginfo>
</signature_list>
<users>
</users>
</sigs>
�sigsz
@localhost) Z
__future__r �__all__r$ �reZemail.mime.textr Zemail.mime.multipartr Z email.utilsr Zsetroubleshoot.configr Zsetroubleshoot.util�compiler r r �__name__Zxmldata�osZsetroubleshoot.signatureZsetroubleshootZ signatureZSEFaultSignatureSetr* Zread_xmlZsignature_list�getloginr r r r �<module> s$
,A