__ __ __ __ _____ _ _ _____ _ _ _ | \/ | \ \ / / | __ \ (_) | | / ____| | | | | | \ / |_ __\ V / | |__) | __ ___ ____ _| |_ ___ | (___ | |__ ___| | | | |\/| | '__|> < | ___/ '__| \ \ / / _` | __/ _ \ \___ \| '_ \ / _ \ | | | | | | |_ / . \ | | | | | |\ V / (_| | || __/ ____) | | | | __/ | | |_| |_|_(_)_/ \_\ |_| |_| |_| \_/ \__,_|\__\___| |_____/|_| |_|\___V 2.1 if you need WebShell for Seo everyday contact me on Telegram Telegram Address : @jackleetFor_More_Tools:
a
���h� � @ s� d dl mZ d dl mZ d dlZd dlZd dlT d dlmZ d dlm Z d dl
Z
d dl m Z m
Z
e
je
dd �e
dd
�d d �Zz
ejaW n ey� ej
aY n0 g d
�Zedkr�e
je
dd �e
dd
�d� d dl
ma d dl m
Z
d dlT d dlT d dlT d dlT d dlm Z d dl T d dl Z d dl T d dl m!Z! d dl"Z"d dl#Z#dd� Z$d Z%dZ&dZ'e%td�e&td�e'td�iZ(e%de&de'd iZ)e%e&e'd �Z*G d d � d e+�Z,G d d!� d!e-�Z.G d"d#� d#e-�Z/G d$d%� d%e-�Z0i Z1td&�e1d'< td(�e1d)< td*�e1d+< td,�e1d-< td.�e1d/< td0�e1d0< td1�e1d1< td2�e1d2< td3�e1d3< td4�e1d4< td5�e1d5< td6�e1d6< td7�e1d7< d8d9� Z2G d:d;� d;e-�Z3G d<d=� d=e-�Z4G d>d?� d?e-�Z5G d@dA� dAe-�Z6G dBdC� dCe-�Z7G dDdE� dEe-�Z8G dFdG� dGe-�Z9G dHdI� dIe-�Z:G dJdK� dKe-�Z;G dLdM� dMe-�Z<edk�r�d dl=Z=e=�>dN� dOZ?e9� Z@e@�Ae?dP� e@jBd ZCeCjDjEd ZFeGeFjH� eGdQeCjD � eGe@� e=�I� e=�>dN�d k�r�eGdR� neGdSe=�>dN� � e=�J� dS )T� )�absolute_import)�print_functionN)�*)�range)�
cmp_to_key)�parse_config_setting�
get_configZgeneralZi18n_text_domainZi18n_locale_dirT)�domain� localedir�fallback)�SignatureMatch�SEFilter�SEFaultSignature�SEFaultSignatureInfo�SEFaultSignatureSet�SEFaultSignatureUser�
SEEnvironment�SEDatabaseProperties�SEFaultUserInfo�SEFaultUserSet�SEPlugin�SEEmailRecipient�SEEmailRecipientSet� FILTER_NEVER�
FILTER_ALWAYS�FILTER_AFTER_FIRST� filter_text�__main__)r r
)�ngettext)r )�Templatec C s | |k| |k S �N� )�x�yr! r! �</usr/lib/python3.9/site-packages/setroubleshoot/signature.py�<lambda>Q � r% � � z Never Ignorez
Ignore AlwayszIgnore After First Alert�never�always� after_first)r) r* r+ c @ s e Zd Zdd� ZdS )r c C s || _ || _d S r )�siginfo�score)�selfr, r- r! r! r$ �__init__o s zSignatureMatch.__init__N)�__name__�
__module__� __qualname__r/ r! r! r! r$ r m s r c
s� e Zd Zddd� d�ddiddiddiddiddiddided�ded�ddiddiddid� Z� fd d
�Zd d � Zd
d� Zdd� Z� Z S )r � attributec C s dS �Nz1.0r! r! r! r! r$ r% v r& zSEEnvironment.<lambda>��XMLForm�defaultr6 �element�r6 �import_typecast) �version�platform�kernel� policy_type�
policy_rpm�local_policy_rpm�enforce�selinux_enabled�selinux_mls_enabled�
policyvers�hostname�unamec s t t| ��� | �� d S r )�superr r/ �update�r. �� __class__r! r$ r/ � s zSEEnvironment.__init__c C s� t d� dd l}dd l}t� \| _| _|�� d | _td| j �| _| j| _ t
|� � �| _ |�
� }|dkrrd| _nd| _t|�� �| _t|�� �| _|�� | _d�|�� �| _d S )Nzupdating SEEnvironmentr � z/etc/selinux/%s�
PermissiveZ Enforcing� )� log_debugr< �selinuxZget_os_environmentr= Zselinux_getpolicytyper> Z get_package_nvr_by_file_pathr? r@ �strZsecurity_policyversrD Zsecurity_getenforcerA �boolZis_selinux_enabledrB Zis_selinux_mls_enabledrC �noderE �joinrF )r. r< rP rA r! r! r$ rH � s
zSEEnvironment.updatec C s | � |� S r )�__eq__)r. �otherr! r! r$ �__ne__� s zSEEnvironment.__ne__c C s2 t | j�� �D ] }t| |�t||�kr dS qdS )NFT)�list� _xml_info�keys�getattr)r. rV �namer! r! r$ rU � s zSEEnvironment.__eq__)
r0 r1 r2 �booleanrY r/ rH rW rU �
__classcell__r! r! rJ r$ r t s" � r c sB e Zd Zdedd� d�dedd� d�d�Zef� fdd� Z� ZS ) r
r8 c C s t S r )r r! r! r! r$ r% � r& zSEFilter.<lambda>�r6 r: r7 c C s dS �Nr r! r! r! r! r$ r% � r& )� filter_type�countc s t t| ��� || _d S r )rG r
r/ ra )r. ra rJ r! r$ r/ � s zSEFilter.__init__)r0 r1 r2 �intrY r r/ r^ r! r! rJ r$ r
� s �r
c sd e Zd Zddidedd� d�dedd� d�dedd� d�d �Z� fd
d �Zd d
� Zddd�Z� Z S )r r6 r3 c C s dS �NFr! r! r! r! r$ r% � r& z SEFaultSignatureUser.<lambda>r_ c C s dS rd r! r! r! r! r$ r% � r& r8 c C s t � S r )r
r! r! r! r$ r% � r& )�usernameZ seen_flagZ delete_flag�filterc s t t| ��� || _d S r )rG r r/ re �r. re rJ r! r$ r/ � s z SEFaultSignatureUser.__init__c C s: || j vrttd| ��|dkr*ttd��t| ||� d S )Nz!item (%s) is not a defined memberre z changing the username is illegal)Z_names� ProgramErrorZERR_NOT_MEMBERZERR_ILLEGAL_USER_CHANGE�setattr)r. �item�datar! r! r$ � update_item� s
z SEFaultSignatureUser.update_itemNc C sX t dt�|d�|f � |tks0|tks0|tkrHt d� t|d�| _dS td| ��d S )Nz%update_filter: filter_type=%s data=%s�unknownzupdate_filter: !!!)ra TzBad filter_type (%s)) rO �map_filter_value_to_name�getr r r r
rf �
ValueError)r. ra rk r! r! r$ �
update_filter� s �� z"SEFaultSignatureUser.update_filter)N)
r0 r1 r2 r] r
rY r/ rl rq r^ r! r! rJ r$ r � s � r � directory�dirZ semaphoreZsemz
shared memoryZshmz
message queueZmsgq�message�msg�fileZsocket�process�process2Z
filesystemrS �
capability� capability2c C s | t t�� �v rt| S | S r )rX �
class_dictrZ )�tclassr! r! r$ �translate_class� s r} c s e Zd ZdZ� fdd�Z� ZS )�AttributeValueDictionaryZ unstructuredc s t t| ��� d S r )rG r~ r/ rI rJ r! r$ r/ � s z!AttributeValueDictionary.__init__�r0 r1 r2 rY r/ r^ r! r! rJ r$ r~ � s r~ c sZ e Zd Zddd� d�ddiddd�ded �ded �ddided �d
�Z� fd d �Z� ZS )
r r3 c C s dS )Nz4.0r! r! r! r! r$ r% � r& zSEFaultSignature.<lambda>r5 r6 r8 Z operation�r6 rX r9 )r; �host�access�scontext�tcontextr| �portc s4 t t| ��� t|�� �D ]\}}t| ||� qd S r )rG r r/ rX �itemsri )r. �kwds�k�vrJ r! r$ r/ s zSEFaultSignature.__init__)r0 r1 r2 �
AvcContextrc rY r/ r^ r! r! rJ r$ r � s �
r c s8 e Zd Zddiddd�d�Z� fdd�Zdd � Z� ZS )
r r6 r8 �argr� )� analysis_id�argsc s t t| ��� || _|| _d S r )rG r r/ r� r� )r. r� r� rJ r! r$ r/ s zSEPlugin.__init__c C s t | j| jf�S r )rQ r� r� rI r! r! r$ �__str__ s zSEPlugin.__str__)r0 r1 r2 rY r/ r� r^ r! r! rJ r$ r s
� r c s� e Zd Zdded�ded�ddiddiddiddd�ddd�ded�ded�ddided�ded�ddiddiddided�de d�de d�dedd � d
�ddidd e
d�ddiddiddid �Z g d
�Z � fdd�Z
dd� Zdd� Zdd� Zdd� Zdd� Zdd� Zd<d d �Zd=d d �Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Z d>d0d1�Z d2d3� Z d4d5� Z d?d6d7�Z d8d9� Z!d@d:d;�Z"� Z#S )Ar r8 Zplugin�r6 rX r: r9 r6 Zrpmr� c C s dS r` r! r! r! r! r$ r% + r& z SEFaultSignatureInfo.<lambda>r_ �user)� plugin_list� audit_event�source�spath�tpath� src_rpm_list� tgt_rpm_listr� r� r| r� �sigZif_textZ then_textZdo_text� environment�first_seen_date�last_seen_date� report_count�local_id�users�levelZfixableZ button_text)
r� r� r� r� r� r� r| r� r� r� c sx t t| ��� t|�� �D ]\}}t| ||� qd| _g | _d}t� � dkrPd}zt
| j |d�| j _
W n Y n0 d S )NrL Tr F)�use_dbus)rG r r/ rX r� ri r� r� �os�getuidZget_rpm_nvr_by_scontextr� r� r@ )r. r� r� r� r� rJ r! r$ r/ 9 s z SEFaultSignatureInfo.__init__c C sV |j | j kr"|j | _ | jd7 _| jD ]}t| |t||�� q(| jd u rR|j| _d S �NrL )r� r� �
merge_includeri r[ r� )r. r, r\ r! r! r$ � update_mergeJ s
z!SEFaultSignatureInfo.update_mergec C s | j jS r )r� r? rI r! r! r$ �get_policy_rpmV s z#SEFaultSignatureInfo.get_policy_rpmc C s( d| j | jj| jj| jd�| jj�f S )Nz%s,%s,%s,%s,%s�,)r� r� �typer� r| rT r� r� rI r! r! r$ � get_hash_strY s z!SEFaultSignatureInfo.get_hash_strc C s t �| �� �d��}|�� S )Nzutf-8)�hashlibZsha256r� �encodeZ hexdigest)r. �hashr! r! r$ �get_hash\ s z SEFaultSignatureInfo.get_hashc C sB | j D ]}|j|kr| S qtd| � t|�}| j �|� |S )Nz new SEFaultSignatureUser for %s)r� re rO r �append�r. re r� r! r! r$ �
get_user_data` s
z"SEFaultSignatureInfo.get_user_datac C s, t d| � d }| �|�}|d ur(|j}|S )Nzfind_filter_by_username %s)rO r� rf )r. re rf � user_datar! r! r$ �find_filter_by_usernamei s
z,SEFaultSignatureInfo.find_filter_by_usernameNc C s | � |�}|�||� d S r )r� rq )r. re ra rk r� r! r! r$ �update_user_filterr s
z'SEFaultSignatureInfo.update_user_filterc C sT d}| � |�}td||f � |d urP|d ur4||_| �|�}td|||f � |S )N�displayz5evaluate_filter_for_user: found %s user's filter = %sz4evaluate_filter_for_user: found filter for %s: %s
%s)r� rO ra �evaluate_filter)r. re ra �action�fr! r! r$ �evaluate_filter_for_userv s
z-SEFaultSignatureInfo.evaluate_filter_for_userc C sb |j }d}|tkrd}n8|tkr6|jdkr0d}qPd}n|tkrDd}n td| ��| jd7 _|S )Nr� r �ignorezunknown filter_type (%s)rL )ra r r rb r rp )r. rf ra r� r! r! r$ r� � s
z$SEFaultSignatureInfo.evaluate_filterc C s2 t |t�r&t|�dkr d�|�S dS ntd �S d S )Nr rN � )�
isinstancerX �lenrT � default_text)r. Zrpm_listr! r! r$ �format_rpm_list� s
z$SEFaultSignatureInfo.format_rpm_listc C s d| j | jf S )Nz %s [ %s ])r� r| rI r! r! r$ �format_target_object� s z)SEFaultSignatureInfo.format_target_objectc C sT d }| j �d�}|d kr<|�d�dkr<td�| j| jjf }| jjdkrPtd�}d S )NZSYSCALL�success�yesz:%s has a permissive type (%s). This access was not denied.rM z:SELinux is in permissive mode. This access was not denied.) r� Zget_record_of_typeZ get_field�_r� r� r� r� rA )r. Zpermissive_msgZsyscall_recordr! r! r$ �#description_adjusted_for_permissive� s z8SEFaultSignatureInfo.description_adjusted_for_permissivec C s� i | _ | jj| j d< | jj| j d< | j| j d< | j| j d< tj�| j�| j d< t �
dd| j�| j d< | jr�t �
d d
| j�| j d < n
t d �| _| j | j d
< tj�| j �| j d< | j r�t �
d d
| j �| j d< | j d u r�d | j d< nD| j
dkr�| j | j d< n,| j
dk�rtj�| j �| j d< n
d | j d< | j
dk�r:d| j d< n | j
| j d< | jjd u �r`d | j d< nd �| jj�| j d< t| j�dk�r�| jd | j d< | j| j d< t| j �� �D ]"\}}|d u �r�t|�| j |< �q�d S )NZ SOURCE_TYPEZ TARGET_TYPEZSOURCEZ SOURCE_PATHZSOURCE_BASE_PATHz [^a-zA-Z0-9]r� Z MODULE_NAMErN �.ZFIX_SOURCE_PATHzN/AZ TARGET_PATHZTARGET_BASE_PATHZFIX_TARGET_PATHZ
TARGET_DIRrs rv rr Z TARGET_CLASSZACCESSr ZSOURCE_PACKAGEZ PORT_NUMBER)�template_substitutionsr� r� r� r� r� r� �path�basename�re�subr� r� r| �dirnamer� r� rT r� r� r� rX r� r� )r. �key�valuer! r! r$ �%update_derived_template_substitutions� sB
z:SEFaultSignatureInfo.update_derived_template_substitutionsc C s t |d j|d j�S r` )�cmp�priority)r. r" r# r! r! r$ �
priority_sort� s z"SEFaultSignatureInfo.priority_sortc C s� | j dv r:ttd�td�t| jj��| jd�| jj�f S | j dv rtttd�td�t| jj��| jd�| jj�f S | jdv r�ttd �td
�t| jj��| jd�| jj�t | j �| j
j f S ttd �td �t| jj��| jd�| jj�t | j �| jf S )
N)rw rx z?SELinux is preventing %s from using the %s access on a process.zCSELinux is preventing %s from using the '%s' accesses on a process.z, )ry rz z6SELinux is preventing %s from using the %s capability.z:SELinux is preventing %s from using the '%s' capabilities.)z(null)ZUnknownz=SELinux is preventing %s from %s access on the %s labeled %s.zASELinux is preventing %s from '%s' accesses on the %s labeled %s.z5SELinux is preventing %s from %s access on the %s %s.z9SELinux is preventing %s from '%s' accesses on the %s %s.) r| �P_r� r� r� r� r� rT r� r} r� r� rI r! r! r$ �summary� s
0
0
>z SEFaultSignatureInfo.summaryFc
s� t � � _g }d}|r:� jD ] }||j7 }|�|df� qnV� jD ]N}� jD ]B}|j|jkrJ||j7 }|�t|j�� |�|t|j�f� q@qJq@|j t
� j �d� g d�}d� � fdd�|D ��}|D ]$}||v r�|D ]\}} d|_
q� q�q�||fS ) Nr )Z allow_ypbind�1�r� )Zmozilla_read_contentZ"mozilla_plugin_can_network_connectZ mozilla_plugin_use_bluejeansZ$unconfined_mozilla_plugin_transitionrN c s g | ]\}}|� � jj|��qS r! )� get_do_textr� �records)�.0�p�arI r! r$ �
<listcomp>� r& z4SEFaultSignatureInfo.get_plugins.<locals>.<listcomp>F)Z load_plugins�pluginsr� r� r� r� Z init_args�tupler� �sortr r� rT Z
report_bug)
r. �allr� �total_priorityr� ZsolutionZnoreport_booleansZdo_texts�br� r! rI r$ � get_plugins� s.
z SEFaultSignatureInfo.get_pluginsc C s t |��| j�S r )r Zsafe_substituter� )r. �txtr! r! r$ �
substitute s z SEFaultSignatureInfo.substitutec s � fdd�|D �S )Nc s g | ]}� � |��qS r! )r� )r� r� rI r! r$ r� r& z9SEFaultSignatureInfo.substitute_array.<locals>.<listcomp>r! )r. r� r! rI r$ �substitute_array
s z%SEFaultSignatureInfo.substitute_arrayc
s� | j }td�}|ttd�| j�� �7 }|ttd�| j�� �7 }|ttd�| �� �7 }|ttd�t| j��7 }|ttd�t| j ��7 }|ttd�t| j
��7 }|r�|ttd�d �7 }n|ttd�t| j j ��7 }|ttd
�t| �
| j���7 }|ttd �t| �
| j���7 }|ttd �t|j��7 }|ttd
�t|j��7 }|ttd�t|j��7 }|ttd�t|j��7 }|ttd�t|j��7 }|�r�|ttd�d �7 }n|ttd�t|j��7 }|�r�|j�� }d |d< |ttd�td�|���7 }n|ttd�t|j��7 }|ttd�t| j��7 }d}|ttd�| j�|��7 }|ttd�| j�|��7 }|ttd�t| j ��7 }|dtd� 7 }d }| j j D ]^� � j d k�r�|d� � � d 7 }n6|d � j � j!f 7 }|d�� fd d �� j"D ��d 7 }�q�|d!| �#� 7 }z~d"}t$j%�&|��rrd#}t'|gt(t(d$�} || �)|�d% 7 }t$j%�*d&��rj|d'7 }t'|d(gt(t(d$�} || �)|�d% 7 }||7 }W n Y n0 ||d 7 }|S ))NzAdditional Information:
zSource ContextzTarget ContextzTarget ObjectsZSourcez Source PathZPortZHostz (removed)zSource RPM PackageszTarget RPM PackageszSELinux Policy RPMzLocal Policy RPMzSelinux Enabledz Policy TypezEnforcing Modez Host NamerL ZPlatformrN z Alert Countz%Y-%m-%d %H:%M:%S %Zz
First Seenz Last SeenzLocal ID�
zRaw Audit Messagesr� ZAVCz
type=%s msg=%s: c s g | ]}d |� j | f �qS )z%s=%s)�fields)r� r� �Z audit_recordr! r$ r� : r& z7SEFaultSignatureInfo.format_details.<locals>.<listcomp>z
Hash: z/usr/bin/audit2allowz
audit2allow)�stdin�stdoutr z /var/lib/sepolgen/interface_infoz
audit2allow -Rz-R)+r� r� Zformat_2_column_name_valuer� �formatr� r� r� r� r� r� r� r� r� r� r� r? r@ rB r> rA rE rF �splitrT r� r� r� r� r� r� � record_typeZto_textZevent_idZ
fields_ordr� r� r� Zexist�Popen�PIPEZ communicate�exists)
r. �replace�env�textrF Z date_formatZavcbufZ audit2allowZnewbufr� r! r� r$ �format_details
sl
& z#SEFaultSignatureInfo.format_detailsc O s@ t }t}z(dd� a dd� a||i |��W |a |aS |a |a0 dS )zdefine.*untranslated\(.*\nc S s |dkr | S |S r� r! )r" r# �zr! r! r$ r% Z r& z3SEFaultSignatureInfo.untranslated.<locals>.<lambda>c S s | S r r! )r" r! r! r$ r% [ r& N)r� r� )r. �funcr� �kwargsZsaved_translateP_Zsaved_translate_r! r! r$ � untranslatedP s � �z!SEFaultSignatureInfo.untranslatedc C s2 | � � | �� }| �|�\}}|D ]�\}}td�|jt|j�t|� d d f }||7 }tt|�d�D ]} |td�7 }qh|td�7 }| � |�
| j j |��}
|td�|
7 }| � |�
| j j |��}
|td�|
d �� |
d d � 7 }| � |�| j j |��}
|td
�|
d �� |
d d � 7 }q"|td �7 }|S ) Nz0
***** Plugin %s (%.4s confidence) suggests �d g �?�P r r� z
Then r rL z
Do
z
)r� r� r� r� r� �floatr� r r� r� Z get_if_textr� r� Z
get_then_text�lowerr� ) r. r� r� r� r� r� r� r� �title�ir� r! r! r$ � format_texta s" ( $& z SEFaultSignatureInfo.format_text)N)N)F)F)FF)$r0 r1 r2 r Z
AuditEventr� rc r r Z TimeStampr rY r� r/ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r^ r! r! rJ r$ r s`
�
/
"
Cr c sR e Zd Zddd� d�ddidedd� d�dd d
�d �Z� fd d
�Zdd� Z� ZS )r r3 c C s dS r4 r! r! r! r! r$ r% | r& zSEFaultUserInfo.<lambda>r5 r6 r8 c C s dS rd r! r! r! r! r$ r% ~ r& r_ �
email_addressr� )r; re Z email_alert�email_address_listc s t t| ��� || _d S r )rG r r/ re rg rJ r! r$ r/ � s zSEFaultUserInfo.__init__c C s || j vr| j �|� d S r )r r� )r. r� r! r! r$ �add_email_address� s
z!SEFaultUserInfo.add_email_address)r0 r1 r2 r] rY r/ r r^ r! r! rJ r$ r z s � r c sH e Zd Zddd� d�dded�d�Z� fd d
�Zd d � Zd
d� Z� ZS )r r3 c C s dS r4 r! r! r! r! r$ r% � r& zSEFaultUserSet.<lambda>r5 r8 r� r� )r; � user_listc s t t| ��� d S r )rG r r/ rI rJ r! r$ r/ � s zSEFaultUserSet.__init__c C s" | j D ]}||jkr| S qd S r )r re r� r! r! r$ �get_user� s
zSEFaultUserSet.get_userc C s* | � |�d urd S t|�}| j�|� |S r )r r r r� r� r! r! r$ �add_user� s
zSEFaultUserSet.add_user) r0 r1 r2 r rY r/ r r r^ r! r! rJ r$ r � s
� r c s� e Zd Zddd� d�dedd� d�dded �d
�Z� fd d �Zd
d� Zdd� Zdd� Z dd� Z
dd� Z dd� Z de
jfdd�Z� ZS ) r r3 c C s dt tf S )Nz%d.%d)ZDATABASE_MAJOR_VERSIONZDATABASE_MINOR_VERSIONr! r! r! r$ r% � r& z SEFaultSignatureSet.<lambda>r5 r8 c C s t � S r )r r! r! r! r$ r% � r& r_ r, r� )r; r� �signature_listc s t t| ��� d S r )rG r r/ rI rJ r! r$ r/ � s z SEFaultSignatureSet.__init__c c s | j D ]
}|V qd S r �r �r. r, r! r! r$ �siginfos� s
z SEFaultSignatureSet.siginfosc C s | j �|� |S r )r r� r r! r! r$ � add_siginfo� s z SEFaultSignatureSet.add_siginfoc C s | j �|� d S r )r �remover r! r! r$ �remove_siginfo� s z"SEFaultSignatureSet.remove_siginfoc C s
g | _ d S r r rI r! r! r$ �clear� s zSEFaultSignatureSet.clearc C s t t�� �S r )rQ �uuidZuuid4rI r! r! r$ �generate_local_id� s z%SEFaultSignatureSet.generate_local_idc C s. |d u r d S | j D ]}|j|kr| S qd S r )r r� )r. r� r, r! r! r$ �lookup_local_id� s
z#SEFaultSignatureSet.lookup_local_id�exactc
C s� t |�� �}d}|dkr d}n(t|t�r:t|�}d| }n td| ��g }| jD ]�} d}
| j} |D ]8} t|| �t| | �kr�|r�d}
q�|
|7 }
qb|rbd}
q�qb|r�|
dkr�|� t
| |
�� qP|
|krP|� t
| |
�� qP|j t dd� �d � |S )
NFr Tg �?zunknown criteria = %sg c S s t |j| j�S r )r� r- )r� r� r! r! r$ r% � r& z6SEFaultSignatureSet.match_signatures.<locals>.<lambda>r� )
rX rZ r� r� r� rp r r� r[ r� r r� r )
r. �patZcriteriaZxml_infoZ
match_targetsr Znum_match_targetsZscore_per_match_target�matchesr, r- r� r\ r! r! r$ �match_signatures� s6
z$SEFaultSignatureSet.match_signatures)r0 r1 r2 r r rY r/ r r r r r r r r r^ r! r! rJ r$ r � s
�
r c s6 e Zd Zddiddiddid�Zd� fdd� Z� ZS )r r6 r8 )r\ �
friendly_name�filepathNc s< t t| ��� |d ur || _|d ur*|| _|d ur8|| _d S r )rG r r/ r\ r r )r. r\ r r rJ r! r$ r/ � s z SEDatabaseProperties.__init__)NNNr r! r! rJ r$ r � s
�r c s@ e Zd Zddidedd� d�d�Zd � fdd � Zd
d � Z� ZS )
r r6 r8 c C s t S r )r r! r! r! r$ r% � r& zSEEmailRecipient.<lambda>r_ )�addressra Nc s& t t| ��� || _|d ur"|| _d S r )rG r r/ r ra )r. r ra rJ r! r$ r/ s zSEEmailRecipient.__init__c C s d| j t�| jd�f S )Nz%s:%srm )r rn ro ra rI r! r! r$ r� s zSEEmailRecipient.__str__)N)r0 r1 r2 rc rY r/ r� r^ r! r! rJ r$ r � s
�r c sn e Zd Zddd� d�dded�d�Zd� fd
d � Zd d
� Zdd� Zefdd�Z dd� Z
dd� Z dd� Z � Z
S )r r3 c C s dS )Nr� r! r! r! r! r$ r%
r& z SEEmailRecipientSet.<lambda>r5 r8 � recipientr� )r; �recipient_listNc s t t| ��� |d ur || _d S r )rG r r/ r )r. r rJ r! r$ r/ s z SEEmailRecipientSet.__init__c C s d� dd� | jD ��S )Nr� c S s g | ] }t |��qS r! )rQ )r� r" r! r! r$ r� r& z/SEEmailRecipientSet.__str__.<locals>.<listcomp>)rT r rI r! r! r$ r� s zSEEmailRecipientSet.__str__c C s* |� � }| jD ]}||jkr| S qd S r )�stripr r )r. r r r! r! r$ � find_address s
z SEEmailRecipientSet.find_addressc C sP |� � }t|�s$ttd| d��d S | �|�}|d ur:d S | j�t||�� d S )Nz address='%s'�Zdetail)r Zvalid_email_addressrh �ERR_INVALID_EMAIL_ADDRr r r� r )r. r ra r r! r! r$ � add_address s
z SEEmailRecipientSet.add_addressc C s
g | _ d S r )r rI r! r! r$ �clear_recipient_list+ s z(SEEmailRecipientSet.clear_recipient_listc C s� dd l }|�d�}|�d�}|�d�}ddddddddd�}z t|�}W n: ty� } z"ttd||jf d ��W Y d }~n
d }~0 0 | �� |�� D �]} |� d
| �} | �
� } | r�|� | �}
|
r�|
� d �} |
� d �} d }
| �rH|�
| �D ]^}
|
� d �}|
� d
�}|dk�r6t�|�� d �}
|
d u �rFtd|| f � q�td|| f � q�z| �| |
� W q� t�y� } z(|jtk�r�t|j� n|�W Y d }~q�d }~0 0 q�|�� d S )Nr z#.*z(\S+)(\s+(.+))?z(\w+)\s*=\s*(\S+)TF)Zenabled�truer� ZonZdisabledZfalse�noZoff�%s, %sr r� rL � � ra z(unknown email filter (%s) for address %sz(unknown email option (%s) for address %s)r� �compile�open�IOErrorrh �
ERR_FILE_OPEN�strerrorr � readlinesr� r �search�group�finditer�map_filter_name_to_valuero r� rO r �errnor �close)r. r r� Z
comment_reZentry_reZ key_value_reZ map_booleanr� �e�line�matchr �optionsra �optionr� r! r! r$ �parse_recipient_file. sV
�
,
z(SEEmailRecipientSet.parse_recipient_filec
C s� zt |d�}W n: tyH } z"ttd||jf d��W Y d }~n
d }~0 0 | jD ]"}t|j }|�d|j |f � qP|�
� d S )N�wr! r z%-40s filter_type=%s
) r% r& rh r' r( r rn ra �writer r/ )r. r r� r0 r ra r! r! r$ �write_recipient_filef s ,
z(SEEmailRecipientSet.write_recipient_file)N)r0 r1 r2 r rY r/ r� r r r r r5 r8 r^ r! r! rJ r$ r s
� 8r rL zaudit_listener_database.xml�sigszsiginfo.audit_event=%sz Memory OKzMemory leak %d bytes)KZ
__future__r r ZsixZsyslog�
subprocessZ six.movesr � functoolsr �gettextZsetroubleshoot.configr r � translationZugettextr� �AttributeError�__all__r0 �installr r� Zsetroubleshoot.errcodeZsetroubleshoot.utilZ setroubleshoot.xml_serializeZsetroubleshoot.html_utilZsetroubleshoot.uuidr
Zsetroubleshoot.audit_datar� �types�stringr r� r� r� r r r r rn r- �objectr Z XmlSerializer r
r r{ r} r~ r r r r r r r r r Zlibxml2Z debugMemoryZxml_filer9 Z
read_xml_filer r, r� r� �record�printr� Z
cleanupParserZ
dumpMemoryr! r! r! r$ �<module> s� �
� ��� 6 ! gHk