File: //proc/676643/root/lib/python3/dist-packages/apparmor/__pycache__/logparser.cpython-310.pyc
o
T��ej6 � @ sl d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZm Z m
Z
m Z d dl m
Z
e
� ZG dd� d�ZdS )� N)�AppArmorException� AppArmorBug�hasher�open_file_read�
split_name� DebugLogger)�init_translationc @ sf e Zd Ze�d�Zdd� Zdd� Zdd� Zdd � Z d
d � Z
d d
� Z dd� Z h d�Z
dd� Zdd� ZdS )�ReadLogz apparmor=|operation=|type=AVCc C sF || _ || _|| _i i i d�| _td�| _d | _d| _d | _d | _ d S )N)�
PERMITTING� REJECTING�AUDITr � )
�filename� profile_dir�active_profiles�hashlogr � debug_logger�LOG�logmark�seenmark�next_log_entry)�selfr r r � r �4/usr/lib/python3/dist-packages/apparmor/logparser.py�__init__ s
zReadLog.__init__c C sN || j | �� v r dS |i i i t� t� t� t� t� t� t� d� | j | |< dS )z< initialize self.hashlog[aamode][profile] for all rule typesN) �
final_name�
capability�
change_hat�change_profile�dbus�exec�network�path�ptrace�signal�mqueue)r �keysr )r �aamode�profiler r r � init_hashlog* s �zReadLog.init_hashlogc C s� | j r tj�d| j � | j�� | _ | j�| j �s?| jr"| j| j v sA| j�� | _ | j s-d S | j�| j �sC| jr"| j| j v r"d S d S d S d S )Nz A log entry already present: %s) r �sys�stderr�outr �readline�
RE_LOG_ALL�searchr )r r r r �prefetch_next_log_entry> s 0�z ReadLog.prefetch_next_log_entryc C s | j s| �� | j }d | _ |S )N)r r0 )r � log_entryr r r �get_next_log_entryG s
zReadLog.get_next_log_entryc C sl |� � }| j�d| � tjdk rt|�}t�|�}t� }|j|d< |j |d< |j
|d< |j |d< |j |d< |j
|d< |j|d < |j|d
< |j|d < |j|d < |j|d
< |j|d< |j|d< |j|d< |j|d< |j|d< |j|d< |j|d< |j|d< |j|d< |j|d< |j t � d�j kr�|j |d< |j |d< |d r�|d dkr�|j!|d< |j"|d < n4|d r�|d d kr�|j"|d < n$|d r�|d �#d �r�|j$|d < |j%|d < |j&|d!< |j'|d"< |j(|d#< t�)|� |d s�t*t+�+� �|d< |d �rd$d%d&d'd(d)d*d+�}z
||d |d< W n t,�y d,|d< Y nw |d d-k�r-|d d.k�r-d%|d< |d �r4|S d,S )/z-Parse the event from log into key value pairszparse_event: %s)� r �resource�
active_hatr' �time� operationr( �name�name2�attr�parent�pid�task�info�
error_code� denied_mask� request_mask� magic_token�family�protocol� sock_type�class����fsuid�ouidr$ �peerr# �dbus_� peer_profile�busr" � interface�member�UNKNOWN�ERRORr r
r �HINT�STATUS)r � � r3 � � � N�
z&Failed name lookup - disconnected path)-�stripr r> r* � version_info�str� LibAppArmor� parse_record�dictr5 �event�epochr7 r( r8 r9 � attributer; r< r= r? r@ �requested_maskrB �
net_family� net_protocol�
net_sock_type�_classrI �ctypes�c_ulong�valuerH r$ rJ �
startswithrL �dbus_bus� dbus_path�dbus_interface� dbus_member� free_record�intr6 �KeyError)r �msgr` �ev�mode_convertorr r r � parse_eventO s~
� �
zReadLog.parse_eventc C s |� dd�}|dkrtd|d ��|dv rd S |� dd�s d S |d }| �||� d|d v r4d |d< t|d �\}}|d krG| �|�sGd S |d
d krp|d sUtd
��|d s]d|d< d| j| | d |d |d < d S |d r�|d �d�r�|d �d�d }d| j| | d |d | |d < d S | � |�dk�r|d }|�
dd�}|�
dd�}d}d|v r�|� d�\} }
| r�|
r�td��| r�| }d}n|
}|� d �d ur�|d |d kr�d}|D ] } | d v r�d| j| | d |d | | < q�tt d �| ��d S |d
d!k�rd| j| | d" |d < d S | � |�d#k�r9d| j| | d$ |d% |d& |d' < d S |d
d(k�r_|d) d*k�rP|d+ d,k�rPd S d| j| | d( |d < d S |d
d-k�rud| j| | d- |d < d S |d
d.k�r�|d/ �s�| j
�d0� d S |d �s�| j
�d1� d S d| j| | d. |d/ |d < d S |d
d2k�r�d| j| | d2 |d/ |d |d2 < d S |d
�d3��r�d| j| | d4 |d |d5 |d |d |d6 |d7 |d8 < d S | j
�d9| � d S ):Nr' rP zaamode is UNKNOWN - %s�type)r rS rQ r( Fz//null-znull-complain-profiler7 r r8 z exec without executed binaryr9 r
TrF r% �_r r@ �file�c�w�dz::zOFound log event with both owner and other permissions. Please open a bugreport!rI rH �mrwalkr" z Log contains unknown mode %s�capabler �netr! rC rE rD r r? rT r> z unconfined can not change_hatr r# rJ z,ignored garbage ptrace event with empty peerz3ignored garbage ptrace event with empty denied_maskr$ rK r rM rN rO rL z
UNHANDLED: %s)�getr r) r �profile_existsr r �endswith� partition�op_type�replace�splitrx r �debugrk ) r �er' � full_profiler( �hat� mqueue_type�dmask�owner�owner_d�other_d�permr r r �parse_event_for_tree� s� "& $*
"*Jz ReadLog.parse_event_for_treec
C s� || _ d}| j r
d}zt| j�| _W n ty td| j ��w d}|rs| �� }|s,nG|�� }| j� d| � | j |v r?d}| j� d| � |sJq#| �
|�}|rqz| � |� W n typ } z d|j |d� }t
|��d }~ww |s%| j�� d| _ | jS ) NTFz Can not read AppArmor logfile: z read_log: %szread_log: seenmark = %sz;%(msg)s
This error was caused by the log line:
%(logline)s)rs �logliner
)r r r r �IOErrorr r2 rZ r r� rv r� rj r �closer )r r r �liner` r� �ex_msgr r r �read_log sH �
����
zReadLog.read_log> �bind�link�open�chmod�chown�mkdir�mknod�rmdir�xattr�accept�create�listen�sysctl�unlink�connect�getattr�recvmsg�sendmsg�setattr�symlink�truncate�
getsockopt�
rename_src�
setsockopt� getpeername� getsockname� post_create� rename_dest�
sock_shutdown�
socket_create�symlink_createc C s^ |d � d�s|d � d�s|d | jv r-|d r#|d r#|d r#dS |d r)d S td
��d S ) z5Returns the operation type if known, unkown otherwiser7 �file_�inode_rC rD rE r r@ ry z"unknown file or network event type�unknown)rk �OP_TYPE_FILE_OR_NETr )r r` r r r r� W s *zReadLog.op_typec C s | j �|�rdS dS )z/Returns True if profile exists, False otherwiseTF)r �filename_from_profile_name)r �programr r r r� g s zReadLog.profile_existsN)�__name__�
__module__� __qualname__�re�compiler. r r) r0 r2 rv r� r� r� r� r� r r r r r s
Mo)# r )rh r� r* r6 r] �apparmor.commonr r r r r r �apparmor.translationsr rx r r r r r �<module> s