mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-09-01 06:45:38 +00:00
Code Issues Releases Wiki Activity

used perltidy to clean up the formatting for the perl scripts in the

Browse Source 
utils package and manually fixed some places where perltidy's
reformatting made it harder to read.  the options used were--

-i=4    # 4-space indentation
-l=0    # unlimited line length (for now)
-pt=2   # slightly tightened parens
-ce     # cuddled elses
-nolq   # don't outdent long quotes
-nsfs   # don't add spaces in front of semi-colons in for ( ) statements
-isbc   # only indent block comments that have whitespace in front of them
-otr    # don't place a break between a comma and an opening brace

the code will be refactored to make it possible to switch to using 
80-column line-breaks without resorting to really nasty formatting 
constructs.
This commit is contained in:
Jesse Michael
2007-03-20 21:58:38 +00:00
parent f29097e401
commit d8ae032328
11 changed files with 5115 additions and 4774 deletions
Download Patch File Download Diff File Expand all files Collapse all files

339
utils/Reports.pm
View File

@@ -44,10 +44,21 @@ my $eventDb = '/var/log/apparmor/events.db';
my $numEvents = 1000; my $numEvents = 1000;
sub month2Num { sub month2Num {
my $lexMon = shift; my $lexMon = shift;
my $months = { "Jan" =>'01', "Feb"=>'02', "Mar"=>'03', "Apr"=>'04', "May"=>'05', "Jun"=>'06', my $months = {
"Jul"=>'07', "Aug"=>'08', "Sep"=>'09', "Oct"=>'10', "Nov"=>'11', "Dec"=>'12' }; "Jan" => '01',
"Feb" => '02',
"Mar" => '03',
"Apr" => '04',
"May" => '05',
"Jun" => '06',
"Jul" => '07',
"Aug" => '08',
"Sep" => '09',
"Oct" => '10',
"Nov" => '11',
"Dec" => '12'
};
my $numMonth = $months->{$lexMon}; my $numMonth = $months->{$lexMon};
@@ -55,7 +66,6 @@ sub month2Num {
} }
sub num2Month { sub num2Month {
my $monthNum = shift; my $monthNum = shift;
my @months = ("Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"); my @months = ("Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec");
@@ -66,7 +76,6 @@ sub num2Month {
# Converts Epoch Time to Formatted Date String # Converts Epoch Time to Formatted Date String
sub getDate { sub getDate {
my $epTime = shift; my $epTime = shift;
my $date = localtime($epTime); my $date = localtime($epTime);
@@ -90,10 +99,8 @@ sub round {
return ("$num"); return ("$num");
} }
# round up # round up
sub pageRound { sub pageRound {
my $num = shift; my $num = shift;
my $pnum = int($num); my $pnum = int($num);
@@ -105,7 +112,6 @@ sub pageRound {
} }
sub checkFileExists { sub checkFileExists {
my $file = shift; my $file = shift;
if ($file && -e $file) { if ($file && -e $file) {
@@ -113,12 +119,10 @@ sub checkFileExists {
} else { } else {
return 0; return 0;
} }
} }
# Translate mode & sdmode for parsing # Translate mode & sdmode for parsing
sub rewriteModes { sub rewriteModes {
my $filts = shift; my $filts = shift;
# Mode wrangling - Rewrite for better matches # Mode wrangling - Rewrite for better matches
@@ -138,7 +142,6 @@ sub rewriteModes {
if ($tmpMode) { if ($tmpMode) {
$filts->{'mode'} = $tmpMode; $filts->{'mode'} = $tmpMode;
} }
} }
# Rewrite sdmode for more flexible matches # Rewrite sdmode for more flexible matches
@@ -158,12 +161,14 @@ sub rewriteModes {
} }
sub enableEventD { sub enableEventD {
# make sure the eventd is enabled before we do any reports # make sure the eventd is enabled before we do any reports
my $need_enable = 0; my $need_enable = 0;
if (open(SDCONF, "/etc/apparmor/subdomain.conf")) { if (open(SDCONF, "/etc/apparmor/subdomain.conf")) {
while (<SDCONF>) { while (<SDCONF>) {
if (/^\s*APPARMOR_ENABLE_AAEVENTD\s*=\s*(\S+)\s*$/) { if (/^\s*APPARMOR_ENABLE_AAEVENTD\s*=\s*(\S+)\s*$/) {
my $flag = lc($1); my $flag = lc($1);
# strip quotes from the value if present # strip quotes from the value if present
$flag = $1 if $flag =~ /^"(\S+)"$/; $flag = $1 if $flag =~ /^"(\S+)"$/;
$need_enable = 1 if $flag ne "yes"; $need_enable = 1 if $flag ne "yes";
@@ -221,7 +226,6 @@ sub enableEventD {
# Check that events db exists and is populated # Check that events db exists and is populated
# - Returns 1 for good db, 0 for bad db # - Returns 1 for good db, 0 for bad db
sub checkEventDb { sub checkEventDb {
my $count = undef; my $count = undef;
my $eventDb = '/var/log/apparmor/events.db'; my $eventDb = '/var/log/apparmor/events.db';
@@ -268,7 +272,6 @@ sub checkEventDb {
$dbh->disconnect(); $dbh->disconnect();
if ($count && $count > 0) { if ($count && $count > 0) {
return 1; return 1;
} else { } else {
@@ -278,8 +281,8 @@ sub checkEventDb {
# Called from ag_reports_parse # Called from ag_reports_parse
sub getNumPages { sub getNumPages {
my $args = shift; my $args = shift;
my $db = (); my $db = ();
my $numPages = 0; my $numPages = 0;
my $count = 0; my $count = 0;
@@ -324,7 +327,8 @@ sub getNumPages {
if ($type && $type eq 'db') { if ($type && $type eq 'db') {
my $start = undef; my $end = undef; my $start = undef;
my $end = undef;
if ($args->{'startTime'} && $args->{'startTime'} > 0) { if ($args->{'startTime'} && $args->{'startTime'} > 0) {
$start = $args->{'startTime'}; $start = $args->{'startTime'};
@@ -416,7 +420,6 @@ sub getNumPages {
} }
sub getEpochFromNum { sub getEpochFromNum {
my $date = shift; my $date = shift;
my $place = shift || undef; # Used to set default $sec if undef my $place = shift || undef; # Used to set default $sec if undef
@@ -446,10 +449,10 @@ sub getEpochFromNum {
} }
sub getEpochFromStr { sub getEpochFromStr {
my $lexDate = shift; my $lexDate = shift;
my ($lexMonth, $dateDay, $fullTime, $year) = split(/\s+/, $lexDate); my ($lexMonth, $dateDay, $fullTime, $year) = split(/\s+/, $lexDate);
#my ($lexDay, $lexMonth, $dateDay, $fullTime, $year) = split(/\s+/, $lexDate); #my ($lexDay, $lexMonth, $dateDay, $fullTime, $year) = split(/\s+/, $lexDate);
my ($hour, $min, $sec) = split(/\:/, $fullTime); my ($hour, $min, $sec) = split(/\:/, $fullTime);
@@ -464,7 +467,6 @@ sub getEpochFromStr {
# Replaces old files with new files # Replaces old files with new files
sub updateFiles { sub updateFiles {
my ($oldFile, $newFile) = @_; my ($oldFile, $newFile) = @_;
if (unlink("$oldFile")) { if (unlink("$oldFile")) {
@@ -485,7 +487,6 @@ sub updateFiles {
# This is a holder, that was originally part of exportLog() # This is a holder, that was originally part of exportLog()
# Used by /usr/bin/reportgen.pl # Used by /usr/bin/reportgen.pl
sub exportFormattedText { sub exportFormattedText {
my ($repName, $logFile, $db) = @_; my ($repName, $logFile, $db) = @_;
my $date = localtime; my $date = localtime;
@@ -501,12 +502,10 @@ sub exportFormattedText {
print LOG "$_->{'pid'},$_->{'severity'},$->{'mode'},$_->{'resource'},$_->{'sdmode'}\n"; print LOG "$_->{'pid'},$_->{'severity'},$->{'mode'},$_->{'resource'},$_->{'sdmode'}\n";
} }
close LOG; close LOG;
} }
sub exportLog { sub exportLog {
my ($exportLog, $db, $header) = @_; my ($exportLog, $db, $header) = @_;
if (open(LOG, ">$exportLog")) { if (open(LOG, ">$exportLog")) {
@@ -541,9 +540,10 @@ sub exportLog {
} }
print LOG "<hr><br><table border='1' cellpadding='2'>\n"; print LOG "<hr><br><table border='1' cellpadding='2'>\n";
#print LOG "<tr bgcolor='edefff'><th>Date</th><th>Profile</th><th>PID</th><th>Message</th></tr>\n"; #print LOG "<tr bgcolor='edefff'><th>Date</th><th>Profile</th><th>PID</th><th>Message</th></tr>\n";
print LOG "<tr bgcolor='edefff'><th>Host</th><th>Date</th><th>Program</th><th>Profile</th><th>PID</th>" . print LOG "<tr bgcolor='edefff'><th>Host</th><th>Date</th><th>Program</th><th>Profile</th><th>PID</th>"
"<th>Severity</th><th>Mode</th><th>Detail</th><th>Access Type</th></tr>\n"; . "<th>Severity</th><th>Mode</th><th>Detail</th><th>Access Type</th></tr>\n";
my $idx = 1; my $idx = 1;
@@ -553,27 +553,28 @@ sub exportLog {
if ($idx % 2 == 0) { if ($idx % 2 == 0) {
#"<td>&nbsp;$_->{'time'}&nbsp;</td>" . #"<td>&nbsp;$_->{'time'}&nbsp;</td>" .
print LOG "<tr><td>&nbsp;$_->{'host'}&nbsp;</td>" . print LOG "<tr><td>&nbsp;$_->{'host'}&nbsp;</td>"
"<td>&nbsp;$_->{'date'}&nbsp;</td>" . . "<td>&nbsp;$_->{'date'}&nbsp;</td>"
"<td>&nbsp;$_->{'prog'}&nbsp;</td>" . . "<td>&nbsp;$_->{'prog'}&nbsp;</td>"
"<td>&nbsp;$_->{'profile'}&nbsp;</td>" . . "<td>&nbsp;$_->{'profile'}&nbsp;</td>"
"<td>&nbsp;$_->{'pid'}&nbsp;</td>" . . "<td>&nbsp;$_->{'pid'}&nbsp;</td>"
"<td>&nbsp;$_->{'severity'}&nbsp;</td>" . . "<td>&nbsp;$_->{'severity'}&nbsp;</td>"
"<td>&nbsp;$_->{'mode'}&nbsp;</td>" . . "<td>&nbsp;$_->{'mode'}&nbsp;</td>"
"<td>&nbsp;$_->{'resource'}&nbsp;</td>" . . "<td>&nbsp;$_->{'resource'}&nbsp;</td>"
"<td>&nbsp;$_->{'sdmode'}&nbsp;</td></tr>\n"; . "<td>&nbsp;$_->{'sdmode'}&nbsp;</td></tr>\n";
} else { } else {
# Shade every other row # Shade every other row
print LOG "<tr='edefef'><td>&nbsp;$_->{'host'}&nbsp;</td>" . print LOG "<tr='edefef'><td>&nbsp;$_->{'host'}&nbsp;</td>"
"<td>&nbsp;$_->{'date'}&nbsp;</td>" . . "<td>&nbsp;$_->{'date'}&nbsp;</td>"
"<td>&nbsp;$_->{'prog'}&nbsp;</td>" . . "<td>&nbsp;$_->{'prog'}&nbsp;</td>"
"<td>&nbsp;$_->{'profile'}&nbsp;</td>" . . "<td>&nbsp;$_->{'profile'}&nbsp;</td>"
"<td>&nbsp;$_->{'pid'}&nbsp;</td>" . . "<td>&nbsp;$_->{'pid'}&nbsp;</td>"
"<td>&nbsp;$_->{'severity'}&nbsp;</td>" . . "<td>&nbsp;$_->{'severity'}&nbsp;</td>"
"<td>&nbsp;$_->{'mode'}&nbsp;</td>" . . "<td>&nbsp;$_->{'mode'}&nbsp;</td>"
"<td>&nbsp;$_->{'resource'}&nbsp;</td>" . . "<td>&nbsp;$_->{'resource'}&nbsp;</td>"
"<td>&nbsp;$_->{'sdmode'}&nbsp;</td></tr>\n"; . "<td>&nbsp;$_->{'sdmode'}&nbsp;</td></tr>\n";
} }
} }
@@ -585,15 +586,15 @@ sub exportLog {
} else { } else {
ycp::y2error(sprintf(gettext("Export Log Error: Couldn't open %s"), $exportLog)); ycp::y2error(sprintf(gettext("Export Log Error: Couldn't open %s"), $exportLog));
} }
# return($error); # return($error);
} }
# Pulls info on single report from apparmor xml file # Pulls info on single report from apparmor xml file
sub getXmlReport { sub getXmlReport {
my ($repName, $repConf) = @_; my ($repName, $repConf) = @_;
my $repFlag = 0;
my $repFlag = 0;
my %rep = (); my %rep = ();
if (defined($repName) && ref($repName)) { if (defined($repName) && ref($repName)) {
@@ -603,7 +604,6 @@ sub getXmlReport {
} elsif ($repName->{'name'}) { } elsif ($repName->{'name'}) {
$repName = $repName->{'name'}; $repName = $repName->{'name'};
} }
} }
if (!$repName) { if (!$repName) {
@@ -613,8 +613,16 @@ sub getXmlReport {
if (!$repConf || !-e $repConf) { if (!$repConf || !-e $repConf) {
$repConf = '/etc/apparmor/reports.conf'; $repConf = '/etc/apparmor/reports.conf';
if (!-e $repConf) { if (!-e $repConf) {
ycp::y2error(sprintf(gettext("Unable to get configuration info for %s. ycp::y2error(
Unable to find %s."), $repName, $repConf)); sprintf(
gettext(
"Unable to get configuration info for %s.
Unable to find %s."
),
$repName,
$repConf
)
);
exit 1; exit 1;
} }
} }
@@ -626,6 +634,7 @@ sub getXmlReport {
chomp; chomp;
if (/\<name\>/) { if (/\<name\>/) {
#my $name = (split(/\"/, $_))[1]; #my $name = (split(/\"/, $_))[1];
/\<name\>(.+)\<\/name\>/; /\<name\>(.+)\<\/name\>/;
my $name = $1; my $name = $1;
@@ -644,6 +653,7 @@ sub getXmlReport {
chomp($attrs); chomp($attrs);
my @attrlist = split(/\s+/, $attrs); my @attrlist = split(/\s+/, $attrs);
for (@attrlist) { for (@attrlist) {
#Match attributes #Match attributes
if (/\s*(\S+)=\"(\S+)\"/) { if (/\s*(\S+)=\"(\S+)\"/) {
$rep{$1} = $2 unless $2 eq '-'; $rep{$1} = $2 unless $2 eq '-';
@@ -721,7 +731,6 @@ sub getCfInfo {
# generate stats for ESS reports # generate stats for ESS reports
sub getEssStats { sub getEssStats {
my $args = shift; my $args = shift;
#my ($host, $targetDir, $startdate, $enddate) = @_; #my ($host, $targetDir, $startdate, $enddate) = @_;
@@ -759,9 +768,10 @@ sub getEssStats {
# Max Sev, Ave. Sev, Num. Rejects, Start Time, End Time # Max Sev, Ave. Sev, Num. Rejects, Start Time, End Time
my $ctQuery = "SELECT count(*) FROM events WHERE time >= $startdate AND time <= $enddate"; my $ctQuery = "SELECT count(*) FROM events WHERE time >= $startdate AND time <= $enddate";
my $query = "SELECT MAX(severity), AVG(severity), COUNT(id), MIN(time), " . my $query = "SELECT MAX(severity), AVG(severity), COUNT(id), MIN(time), "
"MAX(time) FROM events WHERE sdmode='REJECTING' AND " . . "MAX(time) FROM events WHERE sdmode='REJECTING' AND "
"time >= $startdate AND time <= $enddate"; . "time >= $startdate AND time <= $enddate";
# "MAX(time) FROM events join info WHERE sdmode='REJECTING' AND " . # "MAX(time) FROM events join info WHERE sdmode='REJECTING' AND " .
# Get list of hosts to scan # Get list of hosts to scan
@@ -783,6 +793,7 @@ sub getEssStats {
my $ess = undef; my $ess = undef;
my $ret = undef; my $ret = undef;
my $count = undef; my $count = undef;
#my $eventDb = '/var/log/apparmor/events.db'; #my $eventDb = '/var/log/apparmor/events.db';
my $dbh = DBI->connect("dbi:SQLite:dbname=$eventDb", "", "", { RaiseError => 1, AutoCommit => 1 }); my $dbh = DBI->connect("dbi:SQLite:dbname=$eventDb", "", "", { RaiseError => 1, AutoCommit => 1 });
@@ -817,9 +828,7 @@ sub getEssStats {
} }
# Get rest of stats # Get rest of stats
eval { eval { $ret = $dbh->selectall_arrayref("$query"); };
$ret = $dbh->selectall_arrayref("$query");
};
if ($@) { if ($@) {
ycp::y2error(sprintf(gettext("DBI Execution failed: %s"), $DBI::errstr)); ycp::y2error(sprintf(gettext("DBI Execution failed: %s"), $DBI::errstr));
@@ -868,11 +877,9 @@ sub getEssStats {
return \@hostDb; return \@hostDb;
} }
# get ESS stats for archived reports (warning -- this can be slow for large files # get ESS stats for archived reports (warning -- this can be slow for large files
# debug -- not fully functional yet # debug -- not fully functional yet
sub getArchEssStats { sub getArchEssStats {
my $args = shift; my $args = shift;
my $prevTime = '0'; my $prevTime = '0';
@@ -904,16 +911,24 @@ sub getArchEssStats {
if ($_->{'host'} eq $ev->{'host'}) { if ($_->{'host'} eq $ev->{'host'}) {
# Find earliest start date
if ($_->{'startdate'} > $ev->{'date'}) { if ($_->{'startdate'} > $ev->{'date'}) {
$_->{'startdate'} = $ev->{'date'}; # Find earliest start date $_->{'startdate'} = $ev->{'date'};
} }
$_->{'numEvents'}++; # tally all events reported for host # tally all events reported for host
$_->{'numEvents'}++;
if ($ev->{'sdmode'}) { if ($ev->{'sdmode'}) {
if ( $ev->{'sdmode'} =~ /PERMIT/ ) { $_->{'numPermits'}++; } if ($ev->{'sdmode'} =~ /PERMIT/) {
if ( $ev->{'sdmode'} =~ /REJECT/ ) { $_->{'numRejects'}++; } $_->{'numPermits'}++;
if ( $ev->{'sdmode'} =~ /AUDIT/ ) { $_->{'numAudits'}++; } }
if ($ev->{'sdmode'} =~ /REJECT/) {
$_->{'numRejects'}++;
}
if ($ev->{'sdmode'} =~ /AUDIT/) {
$_->{'numAudits'}++;
}
} }
# Add stats to host entry # Add stats to host entry
@@ -940,6 +955,7 @@ sub getArchEssStats {
$rec->{'host'} = $ev->{'host'}; $rec->{'host'} = $ev->{'host'};
$rec->{'startdate'} = $startDate; $rec->{'startdate'} = $startDate;
#$rec->{'startdate'} = $ev->{'date'}; #$rec->{'startdate'} = $ev->{'date'};
if ($endDate) { if ($endDate) {
@@ -957,10 +973,12 @@ sub getArchEssStats {
$rec->{'unknown'} = 0; $rec->{'unknown'} = 0;
} else { } else {
$rec->{'sevHi'} = 0; $rec->{'sevHi'} = 0;
$rec->{'sevTotal'} = 0; $rec->{'sevTotal'} = 0;
$rec->{'sevNum'} = 0; $rec->{'sevNum'} = 0;
$rec->{'unknown'} = 1; $rec->{'unknown'} = 1;
} }
# Start sdmode stats # Start sdmode stats
@@ -996,10 +1014,15 @@ sub getArchEssStats {
} }
# Convert dates # Convert dates
if ($_->{'startdate'} !~ /:/) {$_->{'startdate'} = getDate($startDate); } if ($_->{'startdate'} !~ /:/) {
if ($_->{'enddate'} !~ /:/) { $_->{'enddate'} = getDate($_->{'enddate'}); } $_->{'startdate'} = getDate($startDate);
}
if ($_->{'enddate'} !~ /:/) {
$_->{'enddate'} = getDate($_->{'enddate'});
}
# Delete stuff that we may use in later versions (YaST is a silly, silly data handler) # Delete stuff that we may use in later versions (YaST is a silly,
# silly data handler)
delete($_->{'sevTotal'}); delete($_->{'sevTotal'});
delete($_->{'sevNum'}); delete($_->{'sevNum'});
delete($_->{'numPermits'}); delete($_->{'numPermits'});
@@ -1013,8 +1036,8 @@ sub getArchEssStats {
# special version of getEvents() for /usr/bin/reportgen.pl # special version of getEvents() for /usr/bin/reportgen.pl
sub grabEvents { sub grabEvents {
my ($rep, $start, $end) = @_; my ($rep, $start, $end) = @_;
my $db = undef; my $db = undef;
my $prevDate = "0"; my $prevDate = "0";
my $prevTime = "0"; my $prevTime = "0";
@@ -1037,13 +1060,17 @@ sub grabEvents {
if ($rep->{'sev'} && ($rep->{'sev'} eq "-" || $rep->{'sev'} eq "All")) { if ($rep->{'sev'} && ($rep->{'sev'} eq "-" || $rep->{'sev'} eq "All")) {
delete($rep->{'sev'}); delete($rep->{'sev'});
} }
if ($rep->{'resource'} && $rep->{'resource'} eq "-") { delete($rep->{'resource'}); } if ($rep->{'resource'} && $rep->{'resource'} eq "-") {
delete($rep->{'resource'});
}
if ($rep->{'mode'} && ($rep->{'mode'} eq "-" || $rep->{'mode'} eq "All")) { if ($rep->{'mode'} && ($rep->{'mode'} eq "-" || $rep->{'mode'} eq "All")) {
delete($rep->{'mode'}); delete($rep->{'mode'});
} }
if ($rep->{'sdmode'} && ($rep->{'sdmode'} eq "-" || $rep->{'sdmode'} eq "All") ) { if ($rep->{'sdmode'}
&& ($rep->{'sdmode'} eq "-" || $rep->{'sdmode'} eq "All"))
{
delete($rep->{'sdmode'}); delete($rep->{'sdmode'});
} }
@@ -1066,7 +1093,6 @@ sub grabEvents {
} }
sub getQueryFilters { sub getQueryFilters {
my ($filts, $start, $end) = @_; my ($filts, $start, $end) = @_;
my $query = undef; my $query = undef;
@@ -1102,7 +1128,9 @@ sub getQueryFilters {
if ($filts->{'severity'}) { if ($filts->{'severity'}) {
if ($filts->{'severity'} eq "-" || $filts->{'severity'} eq "All") { if ($filts->{'severity'} eq "-" || $filts->{'severity'} eq "All") {
delete($filts->{'severity'}); delete($filts->{'severity'});
} elsif ( $filts->{'severity'} eq "-1" || $filts->{'severity'} eq "U" ) { } elsif ($filts->{'severity'} eq "-1"
|| $filts->{'severity'} eq "U")
{
if ($wFlag == 1) { if ($wFlag == 1) {
$query .= "AND events.severity = '-1' "; $query .= "AND events.severity = '-1' ";
} else { } else {
@@ -1180,9 +1208,7 @@ sub getQueryFilters {
return $query; return $query;
} }
sub getQuery { sub getQuery {
my ($filts, $page, $sortKey, $numEvents) = @_; my ($filts, $page, $sortKey, $numEvents) = @_;
if (!$page || $page < 1 || $page !~ /\d+/) { $page = 1; } if (!$page || $page < 1 || $page !~ /\d+/) { $page = 1; }
@@ -1209,8 +1235,8 @@ sub getQuery {
# - There may be a way to do this with a creative query statement generator # - There may be a way to do this with a creative query statement generator
sub queryPostProcess { sub queryPostProcess {
my $db = shift; my $db = shift;
my @newDb = (); my @newDb = ();
my $prevTime = 0; my $prevTime = 0;
my $prevDate = 0; my $prevDate = 0;
@@ -1224,8 +1250,10 @@ sub queryPostProcess {
if ($_->{'type'}) { if ($_->{'type'}) {
if ($_->{'type'} eq 'control_variable') { if ($_->{'type'} eq 'control_variable') {
# OWLSM gets special treatment # OWLSM gets special treatment
if ($_->{'variable'} eq 'owlsm') { if ($_->{'variable'} eq 'owlsm') {
#if ( $_->{'value'} ) {} #if ( $_->{'value'} ) {}
if ($_->{'value'} == '0') { if ($_->{'value'} == '0') {
$_->{'resource'} = "GLOBAL MODULE CHANGE: OWLSM DISABLED"; $_->{'resource'} = "GLOBAL MODULE CHANGE: OWLSM DISABLED";
@@ -1246,12 +1274,15 @@ sub queryPostProcess {
$_->{'resource'} = "AppArmor Started"; $_->{'resource'} = "AppArmor Started";
} elsif ($_->{'type'} eq 'subdomain_rmmod') { } elsif ($_->{'type'} eq 'subdomain_rmmod') {
$_->{'resource'} = "AppArmor Stopped"; $_->{'resource'} = "AppArmor Stopped";
# DROP logprof-hints # DROP logprof-hints
} elsif ($_->{'type'} eq 'unknown_hat') { } elsif ($_->{'type'} eq 'unknown_hat') {
next; next;
# DROP logprof-hints # DROP logprof-hints
} elsif ($_->{'type'} eq 'changing_profile') { } elsif ($_->{'type'} eq 'changing_profile') {
next; next;
# DROP logprof-hints # DROP logprof-hints
} elsif ($_->{'type'} eq 'fork') { } elsif ($_->{'type'} eq 'fork') {
next; next;
@@ -1271,6 +1302,7 @@ sub queryPostProcess {
} else { } else {
$_->{'date'} = "0000-00-00 00:00:00"; $_->{'date'} = "0000-00-00 00:00:00";
} }
# $_->{'time'} = undef; # Don't need 'time', only 'date' # $_->{'time'} = undef; # Don't need 'time', only 'date'
if (!$_->{'host'}) { $_->{'host'} = "-"; } if (!$_->{'host'}) { $_->{'host'} = "-"; }
if (!$_->{'date'}) { $_->{'date'} = "-"; } if (!$_->{'date'}) { $_->{'date'} = "-"; }
@@ -1294,13 +1326,12 @@ sub queryPostProcess {
} }
return \@newDb; return \@newDb;
} }
# Creates single hashref for the various filters # Creates single hashref for the various filters
sub setFormFilters { sub setFormFilters {
my $args = shift; my $args = shift;
my $filts = undef; my $filts = undef;
if ($args) { if ($args) {
@@ -1321,25 +1352,40 @@ sub setFormFilters {
# helper for getSirFilters() # helper for getSirFilters()
# Makes gui-centric filters querying-friendly # Makes gui-centric filters querying-friendly
sub rewriteFilters { sub rewriteFilters {
my $filts = shift; my $filts = shift;
# Clear unnecessary filters # Clear unnecessary filters
for (keys(%$filts)) { if ( $filts->{$_} eq "All" ) { delete($filts->{$_}); } } for (keys(%$filts)) {
if ($filts->{$_} eq "All") { delete($filts->{$_}); }
}
if ($filts->{'prog'} && ($filts->{'prog'} eq "-" || $filts->{'prog'} eq "All") ) { if ($filts->{'prog'}
&& ($filts->{'prog'} eq "-" || $filts->{'prog'} eq "All"))
{
delete($filts->{'prog'}); delete($filts->{'prog'});
} }
if ($filts->{'profile'} && ($filts->{'profile'} eq "-") ) { delete($filts->{'profile'}); } if ($filts->{'profile'} && ($filts->{'profile'} eq "-")) {
if ($filts->{'pid'} && ($filts->{'pid'} eq "-") ) { delete($filts->{'pid'}); } delete($filts->{'profile'});
if ($filts->{'severity'} && ($filts->{'severity'} eq "-") ) { delete($filts->{'severity'}); } }
if ($filts->{'resource'} && ($filts->{'resource'} eq "-") ) { delete($filts->{'resource'}); } if ($filts->{'pid'} && ($filts->{'pid'} eq "-")) {
delete($filts->{'pid'});
}
if ($filts->{'severity'} && ($filts->{'severity'} eq "-")) {
delete($filts->{'severity'});
}
if ($filts->{'resource'} && ($filts->{'resource'} eq "-")) {
delete($filts->{'resource'});
}
if ($filts->{'mode'} && ($filts->{'mode'} eq "-" || $filts->{'mode'} eq "All") ) { if ($filts->{'mode'}
&& ($filts->{'mode'} eq "-" || $filts->{'mode'} eq "All"))
{
delete($filts->{'mode'}); delete($filts->{'mode'});
} }
if ($filts->{'sdmode'} && ($filts->{'sdmode'} eq "-" || $filts->{'sdmode'} eq "All") ) { if ($filts->{'sdmode'}
&& ($filts->{'sdmode'} eq "-" || $filts->{'sdmode'} eq "All"))
{
delete($filts->{'sdmode'}); delete($filts->{'sdmode'});
} }
############################################################ ############################################################
@@ -1351,8 +1397,8 @@ sub rewriteFilters {
# returns ref to active filters for the specific SIR report # returns ref to active filters for the specific SIR report
sub getSirFilters { sub getSirFilters {
my $args = shift; my $args = shift;
my $repName = undef; my $repName = undef;
if ($args && $args->{'name'}) { if ($args && $args->{'name'}) {
@@ -1392,8 +1438,8 @@ sub getSirFilters {
# deprecated (pre-xml) # deprecated (pre-xml)
sub OldgetSirFilters { sub OldgetSirFilters {
my $args = shift; my $args = shift;
my $repName = undef; my $repName = undef;
if ($args && $args->{'name'}) { if ($args && $args->{'name'}) {
@@ -1424,12 +1470,13 @@ sub OldgetSirFilters {
$info =~ s/\s+//g; $info =~ s/\s+//g;
$name =~ s/^\s+//; $name =~ s/^\s+//;
$name =~ s/\s+$//; $name =~ s/\s+$//;
my ($mailtype, $filters, $email, $lastRun) = split(/\s*:\s*/, $info, 4); my ($mailtype, $filters, $email, $lastRun) =
split(/\s*:\s*/, $info, 4);
$rec->{'name'} = $name; $rec->{'name'} = $name;
$rec->{'name'} =~ s/\"//g; $rec->{'name'} =~ s/\"//g;
($rec->{'prog'}, $rec->{'profile'}, $rec->{'pid'}, $rec->{'resource'}, ($rec->{'prog'}, $rec->{'profile'}, $rec->{'pid'}, $rec->{'resource'}, $rec->{'severity'}, $rec->{'sdmode'}, $rec->{'mode'}) =
$rec->{'severity'}, $rec->{'sdmode'}, $rec->{'mode'}) = split(/\,/, $filters, 7); split(/\,/, $filters, 7);
} }
@@ -1457,8 +1504,8 @@ sub OldgetSirFilters {
# Main SIR report generator # Main SIR report generator
sub getEvents { sub getEvents {
my ($query, $start, $end, $dbFile) = @_; my ($query, $start, $end, $dbFile) = @_;
my @events = (); my @events = ();
my $prevTime = 0; my $prevTime = 0;
my $prevDate = '0'; my $prevDate = '0';
@@ -1481,9 +1528,7 @@ sub getEvents {
# Pull stuff from db # Pull stuff from db
my $dbh = DBI->connect("dbi:SQLite:dbname=$eventDb", "", "", { RaiseError => 1, AutoCommit => 1 }); my $dbh = DBI->connect("dbi:SQLite:dbname=$eventDb", "", "", { RaiseError => 1, AutoCommit => 1 });
my $all = undef; my $all = undef;
eval { eval { $all = $dbh->selectall_arrayref("$query"); };
$all = $dbh->selectall_arrayref("$query");
};
if ($@) { if ($@) {
ycp::y2error(sprintf(gettext("DBI Execution failed: %s."), $DBI::errstr)); ycp::y2error(sprintf(gettext("DBI Execution failed: %s."), $DBI::errstr));
@@ -1494,12 +1539,13 @@ sub getEvents {
for my $row (@$all) { for my $row (@$all) {
my $rec = undef; my $rec = undef;
($rec->{'id'}, $rec->{'time'}, $rec->{'counter'}, $rec->{'pid'}, $rec->{'sdmode'}, $rec->{'type'}, ($rec->{'id'}, $rec->{'time'}, $rec->{'counter'}, $rec->{'pid'}, $rec->{'sdmode'}, $rec->{'type'}, $rec->{'mode'}, $rec->{'resource'}, $rec->{'target'}, $rec->{'profile'}, $rec->{'prog'}, $rec->{'severity'}) = @$row;
$rec->{'mode'}, $rec->{'resource'}, $rec->{'target'}, $rec->{'profile'}, $rec->{'prog'}, $rec->{'severity'} ) = @$row;
# Give empty record values a default value # Give empty record values a default value
if (!$rec->{'host'}) { $rec->{'host'} = $hostName; } if (!$rec->{'host'}) { $rec->{'host'} = $hostName; }
for (keys(%$rec)) { if ( !$rec->{$_} ) { $rec->{$_} = '-'; } } for (keys(%$rec)) {
if (!$rec->{$_}) { $rec->{$_} = '-'; }
}
# Change 'time' to date # Change 'time' to date
if ($rec->{'time'} && $rec->{'time'} == $prevTime) { if ($rec->{'time'} && $rec->{'time'} == $prevTime) {
@@ -1529,8 +1575,8 @@ sub getEvents {
# Archived Reports Stuff -- Some of this would go away in an ideal world # Archived Reports Stuff -- Some of this would go away in an ideal world
################################################################################ ################################################################################
sub getArchReport { sub getArchReport {
my $args = shift; my $args = shift;
my @rec = (); my @rec = ();
my $eventRep = "/var/log/apparmor/reports/events.rpt"; my $eventRep = "/var/log/apparmor/reports/events.rpt";
@@ -1547,6 +1593,7 @@ sub getArchReport {
my $id = 1; my $id = 1;
my $slurp = 0; my $slurp = 0;
#my $numPages = 0; #my $numPages = 0;
my $prevTime = undef; my $prevTime = undef;
@@ -1558,6 +1605,7 @@ sub getArchReport {
# Why not get rid of page and just do divide by $i later? # Why not get rid of page and just do divide by $i later?
if (/Page/) { if (/Page/) {
# $numPages++; # $numPages++;
chomp; chomp;
if ($_ eq "Page $page") { if ($_ eq "Page $page") {
@@ -1569,8 +1617,7 @@ sub getArchReport {
chomp; chomp;
($db->{'host'}, $db->{'time'}, $db->{'prog'}, $db->{'profile'}, $db->{'pid'}, $db->{'severity'}, ($db->{'host'}, $db->{'time'}, $db->{'prog'}, $db->{'profile'}, $db->{'pid'}, $db->{'severity'}, $db->{'mode'}, $db->{'denyRes'}, $db->{'sdmode'}) = split(/\,/, $_);
$db->{'mode'}, $db->{'denyRes'}, $db->{'sdmode'} ) = split(/\,/, $_);
# Convert epoch time to date # Convert epoch time to date
if ($db->{'time'} == $prevTime) { if ($db->{'time'} == $prevTime) {
@@ -1588,7 +1635,6 @@ sub getArchReport {
} }
} }
close REP; close REP;
} else { } else {
@@ -1600,9 +1646,9 @@ sub getArchReport {
} }
sub writeEventReport { sub writeEventReport {
my ($db, $args) = @_; # Filters for date, && regexp my ($db, $args) = @_; # Filters for date, && regexp
# my $type = shift || undef; # my $type = shift || undef;
my $eventRep = "/var/log/apparmor/reports/events.rpt"; my $eventRep = "/var/log/apparmor/reports/events.rpt";
# Not sure if this is needed anymore, but it messes up archived SIR reports # Not sure if this is needed anymore, but it messes up archived SIR reports
@@ -1645,7 +1691,6 @@ sub writeEventReport {
} }
sub prepSingleLog { sub prepSingleLog {
my $args = shift; my $args = shift;
my $dir = '/var/log/apparmor/reports-archived'; my $dir = '/var/log/apparmor/reports-archived';
@@ -1668,6 +1713,7 @@ sub prepSingleLog {
if (open(RREP, "<$dir/$readFile")) { if (open(RREP, "<$dir/$readFile")) {
if (open(WREP, ">$eventRep")) { if (open(WREP, ">$eventRep")) {
# print WREP "Page $numPages\n"; # print WREP "Page $numPages\n";
$numPages++; $numPages++;
@@ -1706,7 +1752,6 @@ sub prepSingleLog {
# Cats files in specified directory for easier parsing # Cats files in specified directory for easier parsing
sub prepArchivedLogs { sub prepArchivedLogs {
my $args = shift; my $args = shift;
my $dir = '/var/log/apparmor/reports-archived'; my $dir = '/var/log/apparmor/reports-archived';
@@ -1727,32 +1772,46 @@ sub prepArchivedLogs {
} }
# Check to see if we need to use filters # Check to see if we need to use filters
if ( $args->{'mode'} && ( $args->{'mode'} =~ /All/ || $args->{'mode'} =~ /^\s*-\s*$/) ) { if ($args->{'mode'}
&& ($args->{'mode'} =~ /All/ || $args->{'mode'} =~ /^\s*-\s*$/))
{
delete($args->{'mode'}); delete($args->{'mode'});
} }
if ( $args->{'sdmode'} && ( $args->{'sdmode'} =~ /All/ || $args->{'sdmode'} =~ /^\s*-\s*$/) ) { if ($args->{'sdmode'}
&& ($args->{'sdmode'} =~ /All/ || $args->{'sdmode'} =~ /^\s*-\s*$/))
{
delete($args->{'sdmode'}); delete($args->{'sdmode'});
} }
if ( $args->{'resource'} && ( $args->{'resource'} =~ /All/ || $args->{'resource'} =~ /^\s*-\s*$/) ) { if ($args->{'resource'}
&& ($args->{'resource'} =~ /All/ || $args->{'resource'} =~ /^\s*-\s*$/))
{
delete($args->{'resource'}); delete($args->{'resource'});
} }
if ( $args->{'sevLevel'} && ( $args->{'sevLevel'} =~ /All/ || $args->{'sevLevel'} =~ /^\s*-\s*$/) ) { if ($args->{'sevLevel'}
&& ($args->{'sevLevel'} =~ /All/ || $args->{'sevLevel'} =~ /^\s*-\s*$/))
{
delete($args->{'sevLevel'}); delete($args->{'sevLevel'});
} }
if ( $args->{'prog'} || $args->{'profile'} || $args->{'pid'} || $args->{'denyRes'} || if ( $args->{'prog'}
$args->{'mode'} || $args->{'sdmode'} || ($args->{'startdate'} && $args->{'enddate'} ) ) { || $args->{'profile'}
|| $args->{'pid'}
|| $args->{'denyRes'}
|| $args->{'mode'}
|| $args->{'sdmode'}
|| ($args->{'startdate'} && $args->{'enddate'}))
{
$useFilters = 1; $useFilters = 1;
} }
############################################################ ############################################################
# Get list of files in archived report directory # Get list of files in archived report directory
if (opendir(RDIR, $dir)) { if (opendir(RDIR, $dir)) {
my @firstPass = grep(/csv/, readdir(RDIR)); my @firstPass = grep(/csv/, readdir(RDIR));
@repList = grep(!/Applications.Audit|Executive.Security.Summary/, @firstPass); @repList =
grep(!/Applications.Audit|Executive.Security.Summary/, @firstPass);
close RDIR; close RDIR;
} else { } else {
@@ -1831,8 +1890,8 @@ sub prepArchivedLogs {
# Similar to parseLog(), but expects @db to be passed # Similar to parseLog(), but expects @db to be passed
sub parseMultiDb { sub parseMultiDb {
my ($args, @db) = @_; my ($args, @db) = @_;
my @newDb = (); my @newDb = ();
my $error = undef; my $error = undef;
@@ -1863,9 +1922,7 @@ sub parseMultiDb {
if ($args->{'profile'}) { next unless /$args->{'profile'}/; } if ($args->{'profile'}) { next unless /$args->{'profile'}/; }
# Need (epoch) 'time' element here, do we want to store 'date' instead? # Need (epoch) 'time' element here, do we want to store 'date' instead?
($rec->{'host'},$rec->{'time'},$rec->{'prog'},$rec->{'profile'}, ($rec->{'host'}, $rec->{'time'}, $rec->{'prog'}, $rec->{'profile'}, $rec->{'pid'}, $rec->{'sevLevel'}, $rec->{'mode'}, $rec->{'resource'}, $rec->{'sdmode'}) = split(/\,/, $_);
$rec->{'pid'},$rec->{'sevLevel'},$rec->{'mode'}, $rec->{'resource'}, $rec->{'sdmode'})
= split(/\,/, $_);
# Make sure we get the time/date ref. name right. If it's $args->"time", # Make sure we get the time/date ref. name right. If it's $args->"time",
# the arg will be converted to a human-friendly "date" ref in writeEventReport(). # the arg will be converted to a human-friendly "date" ref in writeEventReport().
@@ -1878,7 +1935,10 @@ sub parseMultiDb {
if ($args->{'pid'} && $args->{'pid'} ne '-') { if ($args->{'pid'} && $args->{'pid'} ne '-') {
next unless ($args->{'pid'} eq $rec->{'pid'}); next unless ($args->{'pid'} eq $rec->{'pid'});
} }
if ( $args->{'sevLevel'} && $args->{'sevLevel'} ne "00" && $args->{'sevLevel'} ne '-' ) { if ( $args->{'sevLevel'}
&& $args->{'sevLevel'} ne "00"
&& $args->{'sevLevel'} ne '-')
{
if ($args->{'sevLevel'} eq "U") { $args->{'sevLevel'} = '-1'; } if ($args->{'sevLevel'} eq "U") { $args->{'sevLevel'} = '-1'; }
next unless ($args->{'sevLevel'} eq $rec->{'sevLevel'}); next unless ($args->{'sevLevel'} eq $rec->{'sevLevel'});
} }
@@ -1890,6 +1950,7 @@ sub parseMultiDb {
next unless ($args->{'denyRes'} eq $rec->{'denyRes'}); next unless ($args->{'denyRes'} eq $rec->{'denyRes'});
} }
if ($args->{'sdmode'} && $args->{'sdmode'} ne '-') { if ($args->{'sdmode'} && $args->{'sdmode'} ne '-') {
# Needs reversal of comparison for sdmode # Needs reversal of comparison for sdmode
next unless ($rec->{'sdmode'} =~ /$args->{'sdmode'}/); next unless ($rec->{'sdmode'} =~ /$args->{'sdmode'}/);
} }
@@ -1903,7 +1964,6 @@ sub parseMultiDb {
# Grab & filter events from archived reports (.csv files) # Grab & filter events from archived reports (.csv files)
sub parseLog { sub parseLog {
my $args = shift; my $args = shift;
my @db = (); my @db = ();
@@ -1926,16 +1986,24 @@ sub parseLog {
} }
#if ( $args->{'mode'} && ( $args->{'mode'} =~ /All/ || $args->{'mode'} =~ /\s*\-\s*/) ) {} #if ( $args->{'mode'} && ( $args->{'mode'} =~ /All/ || $args->{'mode'} =~ /\s*\-\s*/) ) {}
if ( $args->{'mode'} && ( $args->{'mode'} =~ /All/ || $args->{'mode'} =~ /^\s*-\s*$/) ) { if ($args->{'mode'}
&& ($args->{'mode'} =~ /All/ || $args->{'mode'} =~ /^\s*-\s*$/))
{
delete($args->{'mode'}); delete($args->{'mode'});
} }
if ( $args->{'sdmode'} && ( $args->{'sdmode'} =~ /All/ || $args->{'sdmode'} =~ /^\s*-\s*$/) ) { if ($args->{'sdmode'}
&& ($args->{'sdmode'} =~ /All/ || $args->{'sdmode'} =~ /^\s*-\s*$/))
{
delete($args->{'sdmode'}); delete($args->{'sdmode'});
} }
if ( $args->{'resource'} && ( $args->{'resource'} =~ /All/ || $args->{'resource'} =~ /^\s*-\s*$/) ) { if ($args->{'resource'}
&& ($args->{'resource'} =~ /All/ || $args->{'resource'} =~ /^\s*-\s*$/))
{
delete($args->{'resource'}); delete($args->{'resource'});
} }
if ( $args->{'sevLevel'} && ( $args->{'sevLevel'} =~ /All/ || $args->{'sevLevel'} =~ /^\s*-\s*$/) ) { if ($args->{'sevLevel'}
&& ($args->{'sevLevel'} =~ /All/ || $args->{'sevLevel'} =~ /^\s*-\s*$/))
{
delete($args->{'sevLevel'}); delete($args->{'sevLevel'});
} }
@@ -1959,9 +2027,7 @@ sub parseLog {
if ($args->{'profile'}) { next unless /$args->{'profile'}/; } if ($args->{'profile'}) { next unless /$args->{'profile'}/; }
# Need (epoch) 'time' element here, do we want to store 'date' instead? # Need (epoch) 'time' element here, do we want to store 'date' instead?
($rec->{'host'},$rec->{'time'},$rec->{'prog'},$rec->{'profile'}, ($rec->{'host'}, $rec->{'time'}, $rec->{'prog'}, $rec->{'profile'}, $rec->{'pid'}, $rec->{'sevLevel'}, $rec->{'mode'}, $rec->{'resource'}, $rec->{'sdmode'}) = split(/\,/, $_);
$rec->{'pid'},$rec->{'sevLevel'},$rec->{'mode'}, $rec->{'resource'}, $rec->{'sdmode'})
= split(/\,/, $_);
# Make sure we get the time/date ref. name right. If it's $args->"time", # Make sure we get the time/date ref. name right. If it's $args->"time",
# the arg will be converted to a human-friendly "date" ref in writeEventReport(). # the arg will be converted to a human-friendly "date" ref in writeEventReport().
@@ -1974,7 +2040,10 @@ sub parseLog {
if ($args->{'pid'} && $args->{'pid'} ne '-') { if ($args->{'pid'} && $args->{'pid'} ne '-') {
next unless ($args->{'pid'} eq $rec->{'pid'}); next unless ($args->{'pid'} eq $rec->{'pid'});
} }
if ( $args->{'sevLevel'} && $args->{'sevLevel'} ne "00" && $args->{'sevLevel'} ne '-' ) { if ( $args->{'sevLevel'}
&& $args->{'sevLevel'} ne "00"
&& $args->{'sevLevel'} ne '-')
{
next unless ($args->{'sevLevel'} eq $rec->{'sevLevel'}); next unless ($args->{'sevLevel'} eq $rec->{'sevLevel'});
} }
if ($args->{'mode'} && $args->{'mode'} ne '-') { if ($args->{'mode'} && $args->{'mode'} ne '-') {
@@ -1984,6 +2053,7 @@ sub parseLog {
next unless ($args->{'denyRes'} eq $rec->{'denyRes'}); next unless ($args->{'denyRes'} eq $rec->{'denyRes'});
} }
if ($args->{'sdmode'} && $args->{'sdmode'} ne '-') { if ($args->{'sdmode'} && $args->{'sdmode'} ne '-') {
# Needs reversal of comparison for sdmode # Needs reversal of comparison for sdmode
next unless ($rec->{'sdmode'} =~ /$args->{'sdmode'}/); next unless ($rec->{'sdmode'} =~ /$args->{'sdmode'}/);
} }
@@ -2036,7 +2106,6 @@ sub parseLog {
# deprecated -- replaced by better SQL queries # deprecated -- replaced by better SQL queries
sub OLDgetEssStats { sub OLDgetEssStats {
my $args = shift; my $args = shift;
my $prevTime = '0'; my $prevTime = '0';
@@ -2077,9 +2146,15 @@ sub OLDgetEssStats {
$hdb->{'numEvents'}++; # tally all events reported for host $hdb->{'numEvents'}++; # tally all events reported for host
if ($ev->{'sdmode'}) { if ($ev->{'sdmode'}) {
if ( $ev->{'sdmode'} =~ /PERMIT/ ) { $hdb->{'numPermits'}++; } if ($ev->{'sdmode'} =~ /PERMIT/) {
if ( $ev->{'sdmode'} =~ /REJECT/ ) { $hdb->{'numRejects'}++; } $hdb->{'numPermits'}++;
if ( $ev->{'sdmode'} =~ /AUDIT/ ) { $hdb->{'numAudits'}++; } }
if ($ev->{'sdmode'} =~ /REJECT/) {
$hdb->{'numRejects'}++;
}
if ($ev->{'sdmode'} =~ /AUDIT/) {
$hdb->{'numAudits'}++;
}
} }
# Add stats to host entry # Add stats to host entry
@@ -2106,6 +2181,7 @@ sub OLDgetEssStats {
$rec->{'host'} = $ev->{'host'}; $rec->{'host'} = $ev->{'host'};
$rec->{'startdate'} = $startDate; $rec->{'startdate'} = $startDate;
#$rec->{'startdate'} = $ev->{'date'}; #$rec->{'startdate'} = $ev->{'date'};
if ($endDate) { if ($endDate) {
@@ -2162,8 +2238,12 @@ sub OLDgetEssStats {
} }
# Convert dates # Convert dates
if ($_->{'startdate'} !~ /:/) {$_->{'startdate'} = Immunix::Reports::getDate($startDate); } if ($_->{'startdate'} !~ /:/) {
if ($_->{'enddate'} !~ /:/) { $_->{'enddate'} = Immunix::Reports::getDate($_->{'enddate'}); } $_->{'startdate'} = Immunix::Reports::getDate($startDate);
}
if ($_->{'enddate'} !~ /:/) {
$_->{'enddate'} = Immunix::Reports::getDate($_->{'enddate'});
}
# Delete stuff that we may use in later versions (YaST is a silly, silly data handler) # Delete stuff that we may use in later versions (YaST is a silly, silly data handler)
delete($_->{'sevTotal'}); delete($_->{'sevTotal'});
@@ -2177,6 +2257,5 @@ sub OLDgetEssStats {
return (\@hostDb); return (\@hostDb);
} }
1; 1;

33
utils/Severity.pm
View File

@@ -9,7 +9,6 @@
# #
# ------------------------------------------------------------------ # ------------------------------------------------------------------
package Immunix::Severity; package Immunix::Severity;
use strict; use strict;
use Data::Dumper; use Data::Dumper;
@@ -38,18 +37,24 @@ sub init ($;$) {
$self = shift; $self = shift;
$self->{DATABASENAME} = shift; $self->{DATABASENAME} = shift;
$self->{DEFAULT_RANK} = shift if defined $_[0]; $self->{DEFAULT_RANK} = shift if defined $_[0];
open(DATABASE, $self->{DATABASENAME}) or die "Could not open severity db $self->{DATABASENAME}: $!\n"; open(DATABASE, $self->{DATABASENAME})
or die "Could not open severity db $self->{DATABASENAME}: $!\n";
while (<DATABASE>) { while (<DATABASE>) {
chomp(); chomp();
next if m/^\s*#/; next if m/^\s*#/;
next if m/^\s*$/; next if m/^\s*$/;
# leading whitespace is fine; maybe it shouldn't be? # leading whitespace is fine; maybe it shouldn't be?
if (/^\s*\/(\S+)\s+(\d+)\s+(\d+)\s+(\d+)\s*$/) { if (/^\s*\/(\S+)\s+(\d+)\s+(\d+)\s+(\d+)\s*$/) {
my ($path, $read, $write, $execute) = ($1, $2, $3, $4); my ($path, $read, $write, $execute) = ($1, $2, $3, $4);
if (index($path, "*") == -1) { if (index($path, "*") == -1) {
$self->{FILES}{$path} = { r => $read, w => $write, x => $execute }; $self->{FILES}{$path} = {
r => $read,
w => $write,
x => $execute
};
} else { } else {
@@ -60,7 +65,11 @@ sub init ($;$) {
if (index($piece, "*") != -1) { if (index($piece, "*") != -1) {
my $path = join("/", $piece, @pieces); my $path = join("/", $piece, @pieces);
my $regexp = convert_regexp($path); my $regexp = convert_regexp($path);
$ptr->{$regexp}{SD_RANK} = { r => $read, w => $write, x => $execute }; $ptr->{$regexp}{SD_RANK} = {
r => $read,
w => $write,
x => $execute
};
last; last;
} else { } else {
$ptr->{$piece} = {} unless exists $ptr->{$piece}; $ptr->{$piece} = {} unless exists $ptr->{$piece};
@@ -125,10 +134,13 @@ sub check_subtree {
# does it match the rest of our path? # does it match the rest of our path?
if ($path =~ /^$chunk$/) { if ($path =~ /^$chunk$/) {
# if we've got a ranking, check if it's higher than current one, if any # if we've got a ranking, check if it's higher than
# current one, if any
if ($tree->{$chunk}->{SD_RANK}) { if ($tree->{$chunk}->{SD_RANK}) {
for my $m (split(//, $mode)) { for my $m (split(//, $mode)) {
if((! defined $sev) || $tree->{$chunk}->{SD_RANK}->{$m} > $sev) { if ((!defined $sev)
|| $tree->{$chunk}->{SD_RANK}->{$m} > $sev)
{
$sev = $tree->{$chunk}->{SD_RANK}->{$m}; $sev = $tree->{$chunk}->{SD_RANK}->{$m};
} }
} }
@@ -140,7 +152,6 @@ sub check_subtree {
return $sev; return $sev;
} }
sub handle_file ($$) { sub handle_file ($$) {
my ($self, $resource, $mode) = @_; my ($self, $resource, $mode) = @_;
@@ -173,9 +184,9 @@ sub handle_file ($$) {
return (defined $sev) ? $sev : $self->{DEFAULT_RANK}; return (defined $sev) ? $sev : $self->{DEFAULT_RANK};
} }
sub rank ($;$) { sub rank ($;$) {
my ($self, $resource, $mode) = @_; my ($self, $resource, $mode) = @_;
if (substr($resource, 0, 1) eq "/") { if (substr($resource, 0, 1) eq "/") {
return $self->handle_file($resource, $mode); return $self->handle_file($resource, $mode);
} elsif (substr($resource, 0, 3) eq "CAP") { } elsif (substr($resource, 0, 3) eq "CAP") {
@@ -187,16 +198,22 @@ sub rank ($;$) {
sub convert_regexp ($) { sub convert_regexp ($) {
my ($input) = shift; my ($input) = shift;
# we need to convert subdomain regexps to perl regexps # we need to convert subdomain regexps to perl regexps
my $regexp = $input; my $regexp = $input;
# escape + . [ and ] characters # escape + . [ and ] characters
$regexp =~ s/(\+|\.|\[|\])/\\$1/g; $regexp =~ s/(\+|\.|\[|\])/\\$1/g;
# convert ** globs to match anything # convert ** globs to match anything
$regexp =~ s/\*\*/.SDPROF_INTERNAL_GLOB/g; $regexp =~ s/\*\*/.SDPROF_INTERNAL_GLOB/g;
# convert * globs to match anything at current path level # convert * globs to match anything at current path level
$regexp =~ s/\*/[^\/]SDPROF_INTERNAL_GLOB/g; $regexp =~ s/\*/[^\/]SDPROF_INTERNAL_GLOB/g;
# convert {foo,baz} to (foo|baz) # convert {foo,baz} to (foo|baz)
$regexp =~ y/\{\}\,/\(\)\|/ if $regexp =~ /\{.*\,.*\}/; $regexp =~ y/\{\}\,/\(\)\|/ if $regexp =~ /\{.*\,.*\}/;
# twiddle the escaped * chars back # twiddle the escaped * chars back
$regexp =~ s/SDPROF_INTERNAL_GLOB/\*/g; $regexp =~ s/SDPROF_INTERNAL_GLOB/\*/g;
return $regexp; return $regexp;

495
utils/SubDomain.pm
View File

File diff suppressed because it is too large Load Diff

161
utils/aa-eventd
View File

@@ -53,9 +53,7 @@ my $syslogfile = "/var/log/messages";
# options variables # options variables
my $pidfile = ''; my $pidfile = '';
GetOptions( GetOptions('pidfile|p=s' => \$pidfile);
'pidfile|p=s' => \$pidfile
);
my $DEBUG = 0; my $DEBUG = 0;
@@ -207,7 +205,8 @@ sub connect_database ($) {
# create the events table # create the events table
unless ($existing_tables{events}) { unless ($existing_tables{events}) {
$dbh->do("CREATE TABLE events ( $dbh->do(
"CREATE TABLE events (
id INTEGER PRIMARY KEY AUTOINCREMENT, id INTEGER PRIMARY KEY AUTOINCREMENT,
time INTEGER NOT NULL, time INTEGER NOT NULL,
counter INTEGER NOT NULL, counter INTEGER NOT NULL,
@@ -220,7 +219,8 @@ sub connect_database ($) {
profile, profile,
prog, prog,
severity INTEGER severity INTEGER
)"); )"
);
# set up the indexes we want # set up the indexes we want
my @indexes = qw(time type sdmode mode resource profile prog severity); my @indexes = qw(time type sdmode mode resource profile prog severity);
@@ -270,6 +270,7 @@ sub verbose_notify_handler {
my $count = scalar @events; my $count = scalar @events;
errlog "[$count events] sending verbose notification to $email."; errlog "[$count events] sending verbose notification to $email.";
} }
# actually send out the notification... # actually send out the notification...
open(MAIL, "| sendmail -F 'AppArmor Security Notification' $email"); open(MAIL, "| sendmail -F 'AppArmor Security Notification' $email");
print MAIL "To: $email\n"; print MAIL "To: $email\n";
@@ -314,6 +315,7 @@ sub summary_notify_handler {
my $count = scalar @events; my $count = scalar @events;
errlog "[$count events] sending summary notification to $email."; errlog "[$count events] sending summary notification to $email.";
} }
# actually send out the notification... # actually send out the notification...
open(MAIL, "| sendmail -F 'AppArmor Security Notification' $email"); open(MAIL, "| sendmail -F 'AppArmor Security Notification' $email");
print MAIL "To: $email\n"; print MAIL "To: $email\n";
@@ -338,7 +340,6 @@ sub terse_notify_handler {
my $host = `hostname -f`; my $host = `hostname -f`;
chomp $host; chomp $host;
my @events; my @events;
my $count = 0; my $count = 0;
if (open(V, $file)) { if (open(V, $file)) {
@@ -426,6 +427,7 @@ sub process_event ($$) {
$lasttime = $time; $lasttime = $time;
} }
} else { } else {
# not one of ours, just return # not one of ours, just return
return; return;
} }
@@ -463,22 +465,25 @@ sub process_event ($$) {
# we only do notification for enforce mode events # we only do notification for enforce mode events
if ($config->{verbose_freq}) { if ($config->{verbose_freq}) {
if(($severity >= $config->{verbose_level}) || if ( ($severity >= $config->{verbose_level})
(($severity == -1) && $config->{verbose_unknown})) { || (($severity == -1) && $config->{verbose_unknown}))
{
push @verbose_buffer, [ $timestamp, $counter, $logmsg ]; push @verbose_buffer, [ $timestamp, $counter, $logmsg ];
} }
} }
if ($config->{summary_freq}) { if ($config->{summary_freq}) {
if(($severity >= $config->{summary_level}) || if ( ($severity >= $config->{summary_level})
(($severity == -1) && $config->{summary_unknown})) { || (($severity == -1) && $config->{summary_unknown}))
{
push @summary_buffer, [ $timestamp, $counter, "path", $prog, $mode, $resource ]; push @summary_buffer, [ $timestamp, $counter, "path", $prog, $mode, $resource ];
} }
} }
if ($config->{terse_freq}) { if ($config->{terse_freq}) {
if(($severity >= $config->{terse_level}) || if ( ($severity >= $config->{terse_level})
(($severity == -1) && $config->{terse_unknown})) { || (($severity == -1) && $config->{terse_unknown}))
{
push @terse_buffer, [ $timestamp, $counter, "dummy" ]; push @terse_buffer, [ $timestamp, $counter, "dummy" ];
} }
} }
@@ -499,22 +504,25 @@ sub process_event ($$) {
# we only do notification for enforce mode events # we only do notification for enforce mode events
if ($config->{verbose_freq}) { if ($config->{verbose_freq}) {
if(($severity >= $config->{verbose_level}) || if ( ($severity >= $config->{verbose_level})
(($severity == -1) && $config->{verbose_unknown})) { || (($severity == -1) && $config->{verbose_unknown}))
{
push @verbose_buffer, [ $timestamp, $counter, $logmsg ]; push @verbose_buffer, [ $timestamp, $counter, $logmsg ];
} }
} }
if ($config->{summary_freq}) { if ($config->{summary_freq}) {
if(($severity >= $config->{summary_level}) || if ( ($severity >= $config->{summary_level})
(($severity == -1) && $config->{summary_unknown})) { || (($severity == -1) && $config->{summary_unknown}))
{
push @summary_buffer, [ $timestamp, $counter, "link", $prog, $link, $target ]; push @summary_buffer, [ $timestamp, $counter, "link", $prog, $link, $target ];
} }
} }
if ($config->{terse_freq}) { if ($config->{terse_freq}) {
if(($severity >= $config->{terse_level}) || if ( ($severity >= $config->{terse_level})
(($severity == -1) && $config->{terse_unknown})) { || (($severity == -1) && $config->{terse_unknown}))
{
push @terse_buffer, [ $timestamp, $counter ]; push @terse_buffer, [ $timestamp, $counter ];
} }
} }
@@ -534,22 +542,25 @@ sub process_event ($$) {
# we only do notification for enforce mode events # we only do notification for enforce mode events
if ($config->{verbose_freq}) { if ($config->{verbose_freq}) {
if(($severity >= $config->{verbose_level}) || if ( ($severity >= $config->{verbose_level})
(($severity == -1) && $config->{verbose_unknown})) { || (($severity == -1) && $config->{verbose_unknown}))
{
push @verbose_buffer, [ $timestamp, $counter, $logmsg ]; push @verbose_buffer, [ $timestamp, $counter, $logmsg ];
} }
} }
if ($config->{summary_freq}) { if ($config->{summary_freq}) {
if(($severity >= $config->{summary_level}) || if ( ($severity >= $config->{summary_level})
(($severity == -1) && $config->{summary_unknown})) { || (($severity == -1) && $config->{summary_unknown}))
{
push @summary_buffer, [ $timestamp, $counter, "attrch", $prog, $resource, $attrch ]; push @summary_buffer, [ $timestamp, $counter, "attrch", $prog, $resource, $attrch ];
} }
} }
if ($config->{terse_freq}) { if ($config->{terse_freq}) {
if(($severity >= $config->{terse_level}) || if ( ($severity >= $config->{terse_level})
(($severity == -1) && $config->{terse_unknown})) { || (($severity == -1) && $config->{terse_unknown}))
{
push @terse_buffer, [ $timestamp, $counter ]; push @terse_buffer, [ $timestamp, $counter ];
} }
} }
@@ -571,22 +582,25 @@ sub process_event ($$) {
# we only do notification for enforce mode events # we only do notification for enforce mode events
if ($config->{verbose_freq}) { if ($config->{verbose_freq}) {
if(($severity >= $config->{verbose_level}) || if ( ($severity >= $config->{verbose_level})
(($severity == -1) && $config->{verbose_unknown})) { || (($severity == -1) && $config->{verbose_unknown}))
{
push @verbose_buffer, [ $timestamp, $counter, $logmsg ]; push @verbose_buffer, [ $timestamp, $counter, $logmsg ];
} }
} }
if ($config->{summary_freq}) { if ($config->{summary_freq}) {
if(($severity >= $config->{summary_level}) || if ( ($severity >= $config->{summary_level})
(($severity == -1) && $config->{summary_unknown})) { || (($severity == -1) && $config->{summary_unknown}))
{
push @summary_buffer, [ $timestamp, $counter, "path", $prog, $mode, $resource ]; push @summary_buffer, [ $timestamp, $counter, "path", $prog, $mode, $resource ];
} }
} }
if ($config->{terse_freq}) { if ($config->{terse_freq}) {
if(($severity >= $config->{terse_level}) || if ( ($severity >= $config->{terse_level})
(($severity == -1) && $config->{terse_unknown})) { || (($severity == -1) && $config->{terse_unknown}))
{
push @terse_buffer, [ $timestamp, $counter, "dummy" ]; push @terse_buffer, [ $timestamp, $counter, "dummy" ];
} }
} }
@@ -613,22 +627,25 @@ sub process_event ($$) {
# we only do notification for enforce mode events # we only do notification for enforce mode events
if ($config->{verbose_freq}) { if ($config->{verbose_freq}) {
if(($severity >= $config->{verbose_level}) || if ( ($severity >= $config->{verbose_level})
(($severity == -1) && $config->{verbose_unknown})) { || (($severity == -1) && $config->{verbose_unknown}))
{
push @verbose_buffer, [ $timestamp, $counter, $logmsg ]; push @verbose_buffer, [ $timestamp, $counter, $logmsg ];
} }
} }
if ($config->{summary_freq}) { if ($config->{summary_freq}) {
if(($severity >= $config->{summary_level}) || if ( ($severity >= $config->{summary_level})
(($severity == -1) && $config->{summary_unknown})) { || (($severity == -1) && $config->{summary_unknown}))
{
push @summary_buffer, [ $timestamp, $counter, "path", $prog, $mode, $resource ]; push @summary_buffer, [ $timestamp, $counter, "path", $prog, $mode, $resource ];
} }
} }
if ($config->{terse_freq}) { if ($config->{terse_freq}) {
if(($severity >= $config->{terse_level}) || if ( ($severity >= $config->{terse_level})
(($severity == -1) && $config->{terse_unknown})) { || (($severity == -1) && $config->{terse_unknown}))
{
push @terse_buffer, [ $timestamp, $counter, "dummy" ]; push @terse_buffer, [ $timestamp, $counter, "dummy" ];
} }
} }
@@ -649,22 +666,25 @@ sub process_event ($$) {
# we only do notification for enforce mode events # we only do notification for enforce mode events
if ($config->{verbose_freq}) { if ($config->{verbose_freq}) {
if(($severity >= $config->{verbose_level}) || if ( ($severity >= $config->{verbose_level})
(($severity == -1) && $config->{verbose_unknown})) { || (($severity == -1) && $config->{verbose_unknown}))
{
push @verbose_buffer, [ $timestamp, $counter, $logmsg ]; push @verbose_buffer, [ $timestamp, $counter, $logmsg ];
} }
} }
if ($config->{summary_freq}) { if ($config->{summary_freq}) {
if(($severity >= $config->{summary_level}) || if ( ($severity >= $config->{summary_level})
(($severity == -1) && $config->{summary_unknown})) { || (($severity == -1) && $config->{summary_unknown}))
{
push @summary_buffer, [ $timestamp, $counter, "capability", $prog, $capability ]; push @summary_buffer, [ $timestamp, $counter, "capability", $prog, $capability ];
} }
} }
if ($config->{terse_freq}) { if ($config->{terse_freq}) {
if(($severity >= $config->{terse_level}) || if ( ($severity >= $config->{terse_level})
(($severity == -1) && $config->{terse_unknown})) { || (($severity == -1) && $config->{terse_unknown}))
{
push @terse_buffer, [ $timestamp, $counter ]; push @terse_buffer, [ $timestamp, $counter ];
} }
} }
@@ -716,22 +736,25 @@ sub process_event ($$) {
# we only do notification for enforce mode events # we only do notification for enforce mode events
if ($config->{verbose_freq}) { if ($config->{verbose_freq}) {
if(($severity >= $config->{verbose_level}) || if ( ($severity >= $config->{verbose_level})
(($severity == -1) && $config->{verbose_unknown})) { || (($severity == -1) && $config->{verbose_unknown}))
{
push @verbose_buffer, [ $timestamp, $counter, $logmsg ]; push @verbose_buffer, [ $timestamp, $counter, $logmsg ];
} }
} }
if ($config->{summary_freq}) { if ($config->{summary_freq}) {
if(($severity >= $config->{summary_level}) || if ( ($severity >= $config->{summary_level})
(($severity == -1) && $config->{summary_unknown})) { || (($severity == -1) && $config->{summary_unknown}))
{
push @summary_buffer, [ $timestamp, $counter, "profile_replacement", $prog ]; push @summary_buffer, [ $timestamp, $counter, "profile_replacement", $prog ];
} }
} }
if ($config->{terse_freq}) { if ($config->{terse_freq}) {
if(($severity >= $config->{terse_level}) || if ( ($severity >= $config->{terse_level})
(($severity == -1) && $config->{terse_unknown})) { || (($severity == -1) && $config->{terse_unknown}))
{
push @terse_buffer, [ $timestamp, $counter ]; push @terse_buffer, [ $timestamp, $counter ];
} }
} }
@@ -826,6 +849,7 @@ sub check_timers ($) {
$inserts = 0; $inserts = 0;
if (@verbose_buffer) { if (@verbose_buffer) {
# if we've got verbose events, dump them # if we've got verbose events, dump them
dump_events("verbose", @verbose_buffer); dump_events("verbose", @verbose_buffer);
@@ -834,6 +858,7 @@ sub check_timers ($) {
} }
if (@terse_buffer) { if (@terse_buffer) {
# if we've got terse events, dump them # if we've got terse events, dump them
dump_events("terse", @terse_buffer); dump_events("terse", @terse_buffer);
@@ -954,12 +979,14 @@ sub get_last_event {
my $dbh = shift; my $dbh = shift;
my ($time, $counter); my ($time, $counter);
# get the oldest timestamp... # get the oldest timestamp...
my $sth = $dbh->prepare('SELECT MAX(time) FROM events'); my $sth = $dbh->prepare('SELECT MAX(time) FROM events');
$sth->execute; $sth->execute;
my @row = $sth->fetchrow_array || (0); my @row = $sth->fetchrow_array || (0);
$time = $row[0]; $time = $row[0];
if ($time) { if ($time) {
# get the highest counter for this timestamp... # get the highest counter for this timestamp...
$sth = $dbh->prepare("SELECT MAX(counter) FROM events WHERE time = $time"); $sth = $dbh->prepare("SELECT MAX(counter) FROM events WHERE time = $time");
$sth->execute; $sth->execute;
@@ -981,12 +1008,13 @@ sub sig_handler {
errlog("Caught signal '$signame'. Exiting..."); errlog("Caught signal '$signame'. Exiting...");
$finished = 1; $finished = 1;
}; }
# set up our error log without buffering # set up our error log without buffering
open(ERRLOG, ">>$dbdir/event-dispatch.log"); open(ERRLOG, ">>$dbdir/event-dispatch.log");
my $oldfd = select(ERRLOG); $| = 1; select($oldfd); my $oldfd = select(ERRLOG);
$| = 1;
select($oldfd);
errlog "Starting..."; errlog "Starting...";
@@ -1005,11 +1033,11 @@ $SIG{CHLD} = 'IGNORE';
# Sigh, portable dates in perl sucks # Sigh, portable dates in perl sucks
eval "use Date::Parse"; eval "use Date::Parse";
if (!$@) { if (!$@) {
$date_module = 'TimeDate' $date_module = 'TimeDate';
} else { } else {
eval "use Date::Manip"; eval "use Date::Manip";
if (!$@) { if (!$@) {
$date_module = 'DateManip' $date_module = 'DateManip';
} else { } else {
errlog "Unable to load Date module; use either TimeDate or Date::Manip"; errlog "Unable to load Date module; use either TimeDate or Date::Manip";
$finished = 1; $finished = 1;
@@ -1028,14 +1056,31 @@ my $dbh = connect_database($dbdir);
($last_inserted_time, $last_inserted_counter) = get_last_event($dbh); ($last_inserted_time, $last_inserted_counter) = get_last_event($dbh);
my $auditlog=File::Tail->new(name=>$logfile, debug=>1, tail=>-1, interval=>1, maxinterval=>5, adjustafter=>20, errmode=>"return", ignore_noexistant=>1); my $auditlog = File::Tail->new(
my $syslog=File::Tail->new(name=>$syslogfile, debug=>1, tail=>-1, interval=>1, maxinterval=>5, adjustafter=>20, errmode=>"return", ignore_noexistant=>1); name => $logfile,
debug => 1,
tail => -1,
interval => 1,
maxinterval => 5,
adjustafter => 20,
errmode => "return",
ignore_noexistant => 1
);
my $syslog = File::Tail->new(
name => $syslogfile,
debug => 1,
tail => -1,
interval => 1,
maxinterval => 5,
adjustafter => 20,
errmode => "return",
ignore_noexistant => 1
);
my $line = ''; my $line = '';
# process complete lines from the buffer... # process complete lines from the buffer...
while (not $finished) { while (not $finished) {
my ($nfound, $timeleft, @pending) = my ($nfound, $timeleft, @pending) = File::Tail::select(undef, undef, undef, $timeout, ($auditlog, $syslog));
File::Tail::select(undef, undef, undef, $timeout, ($auditlog, $syslog));
foreach (@pending) { foreach (@pending) {
process_event($dbh, $_->read); process_event($dbh, $_->read);
@@ -1043,7 +1088,7 @@ while (not $finished) {
# see if we should flush pending entries to disk and/or do notification # see if we should flush pending entries to disk and/or do notification
check_timers($dbh); check_timers($dbh);
}; }
# make sure we don't exit with any pending events not written to the db # make sure we don't exit with any pending events not written to the db
$dbh->commit || errlog "Error commiting changes: $!"; $dbh->commit || errlog "Error commiting changes: $!";

3
utils/audit
View File

@@ -103,7 +103,8 @@ for my $profiling (@profiling) {
print "\n"; print "\n";
setprofileflags($filename, "audit"); setprofileflags($filename, "audit");
system("cat $filename | $parser -I$profiledir -r >/dev/null 2>&1") if check_for_subdomain(); system("cat $filename | $parser -I$profiledir -r >/dev/null 2>&1")
if check_for_subdomain();
} else { } else {
if ($profiling =~ /^[^\/]+$/) { if ($profiling =~ /^[^\/]+$/) {
UI_Info(sprintf(gettext('Can\'t find %s in the system path list. If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling)); UI_Info(sprintf(gettext('Can\'t find %s in the system path list. If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling));

2
utils/autodep
View File

@@ -21,7 +21,6 @@
# you may find current contact information at www.novell.com. # you may find current contact information at www.novell.com.
# ---------------------------------------------------------------------- # ----------------------------------------------------------------------
use strict; use strict;
use FindBin; use FindBin;
use Getopt::Long; use Getopt::Long;
@@ -101,7 +100,6 @@ for my $profiling (@profiling) {
} }
} }
if (-e $fqdbin) { if (-e $fqdbin) {
if (-e getprofilefilename($fqdbin) && !$force) { if (-e getprofilefilename($fqdbin) && !$force) {
UI_Info(sprintf(gettext('Profile for %s already exists - skipping.'), $fqdbin)); UI_Info(sprintf(gettext('Profile for %s already exists - skipping.'), $fqdbin));

3
utils/complain
View File

@@ -103,7 +103,8 @@ for my $profiling (@profiling) {
print "\n"; print "\n";
setprofileflags($filename, "complain"); setprofileflags($filename, "complain");
system("cat $filename | $parser -I$profiledir -r >/dev/null 2>&1") if check_for_subdomain(); system("cat $filename | $parser -I$profiledir -r >/dev/null 2>&1")
if check_for_subdomain();
} else { } else {
if ($profiling =~ /^[^\/]+$/) { if ($profiling =~ /^[^\/]+$/) {
UI_Info(sprintf(gettext('Can\'t find %s in the system path list. If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling)); UI_Info(sprintf(gettext('Can\'t find %s in the system path list. If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling));

3
utils/enforce
View File

@@ -102,7 +102,8 @@ for my $profiling (@profiling) {
print "\n"; print "\n";
setprofileflags($filename, ""); setprofileflags($filename, "");
system("cat $filename | $parser -I$profiledir -r >/dev/null 2>&1") if check_for_subdomain(); system("cat $filename | $parser -I$profiledir -r >/dev/null 2>&1")
if check_for_subdomain();
} else { } else {
if ($profiling =~ /^[^\/]+$/) { if ($profiling =~ /^[^\/]+$/) {
UI_Info(sprintf(gettext('Can\'t find %s in the system path list. If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling)); UI_Info(sprintf(gettext('Can\'t find %s in the system path list. If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling));

5
utils/genprof
View File

@@ -66,7 +66,8 @@ unless(-d $profiledir) {
my $profiling = shift; my $profiling = shift;
unless ($profiling) { unless ($profiling) {
$profiling = UI_GetString(gettext("Please enter the program to profile: "), "") || exit 0; $profiling = UI_GetString(gettext("Please enter the program to profile: "), "")
|| exit 0;
} }
my $fqdbin; my $fqdbin;
@@ -101,7 +102,6 @@ if($qualifiers{$fqdbin}) {
} }
} }
# load all the include files # load all the include files
loadincludes(); loadincludes();
@@ -174,7 +174,6 @@ sub usage {
} }
sub last_audit_entry_time { sub last_audit_entry_time {
local $_ = `tail -1 /var/log/audit/audit.log`; local $_ = `tail -1 /var/log/audit/audit.log`;
my $logmark; my $logmark;
if (/^*msg\=audit\((\d+\.\d+\:\d+).*\).*$/) { if (/^*msg\=audit\((\d+\.\d+\:\d+).*\).*$/) {

9
utils/unconfined
View File

@@ -34,7 +34,6 @@ use POSIX;
setlocale(LC_MESSAGES, ""); setlocale(LC_MESSAGES, "");
textdomain("apparmor-utils"); textdomain("apparmor-utils");
# options variables # options variables
my $paranoid = ''; my $paranoid = '';
my $help = ''; my $help = '';
@@ -54,7 +53,8 @@ sub usage {
my $subdomainfs = check_for_subdomain(); my $subdomainfs = check_for_subdomain();
die gettext("SubDomain does not appear to be started. Please enable SubDomain and try again.")."\n" unless $subdomainfs; die gettext("SubDomain does not appear to be started. Please enable SubDomain and try again.") . "\n"
unless $subdomainfs;
my @pids; my @pids;
if ($paranoid) { if ($paranoid) {
@@ -65,7 +65,8 @@ if($paranoid) {
if (open(NETSTAT, "/bin/netstat -nlp |")) { if (open(NETSTAT, "/bin/netstat -nlp |")) {
while (<NETSTAT>) { while (<NETSTAT>) {
chomp; chomp;
push @pids, $5 if /^(tcp|udp)\s+\d+\s+\d+\s+\S+\:(\d+)\s+\S+\:(\*|\d+)\s+(LISTEN|\s+)\s+(\d+)\/(\S+)/; push @pids, $5
if /^(tcp|udp)\s+\d+\s+\d+\s+\S+\:(\d+)\s+\S+\:(\*|\d+)\s+(LISTEN|\s+)\s+(\d+)\/(\S+)/;
} }
close(NETSTAT); close(NETSTAT);
} }
@@ -83,6 +84,7 @@ for my $pid (sort { $a <=> $b } @pids) {
} }
if (not $attr) { if (not $attr) {
if ($prog =~ m/^(\/usr\/bin\/python|\/usr\/bin\/perl|\/bin\/bash)$/) { if ($prog =~ m/^(\/usr\/bin\/python|\/usr\/bin\/perl|\/bin\/bash)$/) {
#my $scriptname = (split(/\0/, `cat /proc/$pid/cmdline`))[1]; #my $scriptname = (split(/\0/, `cat /proc/$pid/cmdline`))[1];
my $cmdline = `cat /proc/$pid/cmdline`; my $cmdline = `cat /proc/$pid/cmdline`;
$cmdline =~ s/\0/ /g; $cmdline =~ s/\0/ /g;
@@ -94,6 +96,7 @@ for my $pid (sort { $a <=> $b } @pids) {
} }
} else { } else {
if ($prog =~ m/^(\/usr\/bin\/python|\/usr\/bin\/perl|\/bin\/bash)$/) { if ($prog =~ m/^(\/usr\/bin\/python|\/usr\/bin\/perl|\/bin\/bash)$/) {
#my $scriptname = (split(/\0/, `cat /proc/$pid/cmdline`))[1]; #my $scriptname = (split(/\0/, `cat /proc/$pid/cmdline`))[1];
my $cmdline = `cat /proc/$pid/cmdline`; my $cmdline = `cat /proc/$pid/cmdline`;
$cmdline =~ s/\0/ /g; $cmdline =~ s/\0/ /g;