Compare commits
No commits in common. 'i8c-beta' and 'c9' have entirely different histories.
@ -1 +1 @@
|
||||
SOURCES/setroubleshoot-3.3.26.tar.gz
|
||||
SOURCES/setroubleshoot-3.3.32.tar.gz
|
||||
|
||||
@ -1 +1 @@
|
||||
dab49dd85f3d8489fef60d2b94c4931cc9c473ea SOURCES/setroubleshoot-3.3.26.tar.gz
|
||||
6ee4101312b8c2b98ea7d007eccd62918f59c4f3 SOURCES/setroubleshoot-3.3.32.tar.gz
|
||||
|
||||
@ -1,45 +0,0 @@
|
||||
From 78840f4e0bd41d3ba1b3c90b909e6c2cf7ef4ea7 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Wed, 14 Apr 2021 17:03:39 +0200
|
||||
Subject: [PATCH] Stop SetroubleshootFixit after 10 seconds of inactivity
|
||||
|
||||
---
|
||||
src/SetroubleshootFixit.py | 9 +++++++++
|
||||
1 file changed, 9 insertions(+)
|
||||
|
||||
diff --git a/framework/src/SetroubleshootFixit.py b/framework/src/SetroubleshootFixit.py
|
||||
index 15c6cab..f7cbf95 100644
|
||||
--- a/framework/src/SetroubleshootFixit.py
|
||||
+++ b/framework/src/SetroubleshootFixit.py
|
||||
@@ -7,6 +7,7 @@ from gi.repository import GLib
|
||||
import slip.dbus.service
|
||||
from slip.dbus import polkit
|
||||
import os
|
||||
+import signal
|
||||
|
||||
|
||||
class RunFix(slip.dbus.service.Object):
|
||||
@@ -14,12 +15,20 @@ class RunFix(slip.dbus.service.Object):
|
||||
|
||||
def __init__(self, *p, **k):
|
||||
super(RunFix, self).__init__(*p, **k)
|
||||
+ self.timeout = 10
|
||||
+ self.alarm(self.timeout)
|
||||
+
|
||||
+ def alarm(self, timeout=10):
|
||||
+ signal.alarm(timeout)
|
||||
+
|
||||
|
||||
@dbus.service.method("org.fedoraproject.SetroubleshootFixit", in_signature='ss', out_signature='s')
|
||||
def run_fix(self, local_id, analysis_id):
|
||||
import subprocess
|
||||
+ self.alarm(0)
|
||||
command = ["sealert", "-f", local_id, "-P", analysis_id]
|
||||
return subprocess.check_output(command, universal_newlines=True)
|
||||
+ self.alarm(self.timeout)
|
||||
|
||||
if __name__ == "__main__":
|
||||
mainloop = GLib.MainLoop()
|
||||
--
|
||||
2.30.2
|
||||
|
||||
@ -0,0 +1,71 @@
|
||||
From 2f9e575333af7c7798956f211c29a46a338155e5 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <lautrbach@redhat.com>
|
||||
Date: Mon, 24 Jul 2023 17:33:17 +0200
|
||||
Subject: [PATCH] 'imp' module is deprecated in favor of 'importlib'
|
||||
Content-type: text/plain
|
||||
|
||||
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2224393
|
||||
---
|
||||
src/setroubleshoot/util.py | 26 ++++++++------------------
|
||||
1 file changed, 8 insertions(+), 18 deletions(-)
|
||||
|
||||
diff --git a/src/setroubleshoot/util.py b/src/setroubleshoot/util.py
|
||||
index 0e02f12de682..828a598ef1c2 100755
|
||||
--- a/src/setroubleshoot/util.py
|
||||
+++ b/src/setroubleshoot/util.py
|
||||
@@ -73,6 +73,7 @@ import datetime
|
||||
from dasbus.connection import SystemMessageBus
|
||||
import glob
|
||||
from gi.repository import GObject
|
||||
+import importlib
|
||||
import os
|
||||
import pwd
|
||||
import re
|
||||
@@ -771,37 +772,26 @@ def load_plugins(filter_glob=None):
|
||||
|
||||
# load the parent (e.g. the package containing the submodules), required for python 2.5 and above
|
||||
module_name = plugin_base
|
||||
- plugin_name = '__init__'
|
||||
if module_name not in sys.modules:
|
||||
try:
|
||||
- import imp
|
||||
- mod_fp, mod_path, mod_description = imp.find_module(plugin_name, [plugin_dir])
|
||||
- mod = imp.load_module(module_name, mod_fp, mod_path, mod_description)
|
||||
+ mod_spec = importlib.util.spec_from_file_location(plugin_base, plugin_dir + "/__init__.py")
|
||||
+ mod = importlib.util.module_from_spec(mod_spec)
|
||||
+ mod_spec.loader.exec_module(mod)
|
||||
except Exception as e:
|
||||
syslog.syslog(syslog.LOG_ERR, "failed to initialize plugins in %s: %s" % (plugin_dir, str(e)))
|
||||
return []
|
||||
|
||||
- if mod_fp:
|
||||
- mod_fp.close()
|
||||
-
|
||||
for plugin_name in plugin_names:
|
||||
module_name = "%s.%s" % (plugin_base, plugin_name)
|
||||
- mod = sys.modules.get(module_name)
|
||||
- if mod is not None:
|
||||
- log_debug("load_plugins() %s previously imported" % module_name)
|
||||
- plugins.append(mod.plugin())
|
||||
- continue
|
||||
+
|
||||
try:
|
||||
- import imp
|
||||
- mod_fp, mod_path, mod_description = imp.find_module(plugin_name, [plugin_dir])
|
||||
- mod = imp.load_module(module_name, mod_fp, mod_path, mod_description)
|
||||
+ mod_spec = importlib.util.spec_from_file_location(module_name, plugin_dir + "/" + plugin_name + ".py")
|
||||
+ mod = importlib.util.module_from_spec(mod_spec)
|
||||
+ mod_spec.loader.exec_module(mod)
|
||||
plugins.append(mod.plugin())
|
||||
except Exception as e:
|
||||
syslog.syslog(syslog.LOG_ERR, "failed to load %s plugin: %s" % (plugin_name, str(e)))
|
||||
|
||||
- if mod_fp:
|
||||
- mod_fp.close()
|
||||
-
|
||||
plugins.sort(key=cmp_to_key(sort_plugins))
|
||||
return plugins
|
||||
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -0,0 +1,29 @@
|
||||
From 659f10a0ab422251f4d6857fb34ddf1c25b21b37 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <lautrbach@redhat.com>
|
||||
Date: Wed, 3 May 2023 09:35:28 +0200
|
||||
Subject: [PATCH] Always reset pending alarms when alarm(0)
|
||||
Content-type: text/plain
|
||||
|
||||
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2112573
|
||||
|
||||
Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
|
||||
---
|
||||
src/setroubleshoot/server.py | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/setroubleshoot/server.py b/src/setroubleshoot/server.py
|
||||
index fd89a5448912..2b1b0b1c30d0 100755
|
||||
--- a/src/setroubleshoot/server.py
|
||||
+++ b/src/setroubleshoot/server.py
|
||||
@@ -703,7 +703,7 @@ Deletes an alert from the database.
|
||||
return ""
|
||||
|
||||
def alarm(self, timeout=10):
|
||||
- if self.conn_ctr == 0:
|
||||
+ if self.conn_ctr == 0 or timeout == 0:
|
||||
signal.alarm(timeout)
|
||||
|
||||
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -1,103 +0,0 @@
|
||||
From e9def2b8b0098842d0223d0951f41e2106821a88 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Wed, 14 Apr 2021 17:04:59 +0200
|
||||
Subject: [PATCH] Do not use Python slip package
|
||||
|
||||
It's not maintained anymore and it allows us to drop dependency on
|
||||
Python slip package
|
||||
|
||||
Use DBUS polkit interface instead -
|
||||
https://www.freedesktop.org/software/polkit/docs/latest/eggdbus-interface-org.freedesktop.PolicyKit1.Authority.html
|
||||
---
|
||||
src/SetroubleshootFixit.py | 35 +++++++++++++++++++++++++----------
|
||||
src/setroubleshoot/browser.py | 3 ---
|
||||
2 files changed, 25 insertions(+), 13 deletions(-)
|
||||
|
||||
diff --git a/framework/src/SetroubleshootFixit.py b/framework/src/SetroubleshootFixit.py
|
||||
index f7cbf95..ab0ad2b 100644
|
||||
--- a/framework/src/SetroubleshootFixit.py
|
||||
+++ b/framework/src/SetroubleshootFixit.py
|
||||
@@ -4,13 +4,11 @@ import dbus
|
||||
import dbus.service
|
||||
import dbus.mainloop.glib
|
||||
from gi.repository import GLib
|
||||
-import slip.dbus.service
|
||||
-from slip.dbus import polkit
|
||||
import os
|
||||
import signal
|
||||
+import subprocess
|
||||
|
||||
-
|
||||
-class RunFix(slip.dbus.service.Object):
|
||||
+class RunFix(dbus.service.Object):
|
||||
default_polkit_auth_required = "org.fedoraproject.setroubleshootfixit.write"
|
||||
|
||||
def __init__(self, *p, **k):
|
||||
@@ -21,14 +19,32 @@ class RunFix(slip.dbus.service.Object):
|
||||
def alarm(self, timeout=10):
|
||||
signal.alarm(timeout)
|
||||
|
||||
-
|
||||
- @dbus.service.method("org.fedoraproject.SetroubleshootFixit", in_signature='ss', out_signature='s')
|
||||
- def run_fix(self, local_id, analysis_id):
|
||||
- import subprocess
|
||||
+ def is_authorized(self, sender):
|
||||
+ bus = dbus.SystemBus()
|
||||
+
|
||||
+ proxy = bus.get_object('org.freedesktop.PolicyKit1', '/org/freedesktop/PolicyKit1/Authority')
|
||||
+ authority = dbus.Interface(proxy, dbus_interface='org.freedesktop.PolicyKit1.Authority')
|
||||
+ subject = ('system-bus-name', {'name' : sender})
|
||||
+ action_id = 'org.fedoraproject.setroubleshootfixit.write'
|
||||
+ details = {}
|
||||
+ flags = 1 # AllowUserInteraction flag
|
||||
+ cancellation_id = '' # No cancellation id
|
||||
+ result = authority.CheckAuthorization(subject, action_id, details, flags, cancellation_id)
|
||||
+ return result[0]
|
||||
+
|
||||
+ @dbus.service.method("org.fedoraproject.SetroubleshootFixit", sender_keyword="sender", in_signature='ss', out_signature='s')
|
||||
+ def run_fix(self, local_id, analysis_id, sender):
|
||||
self.alarm(0)
|
||||
command = ["sealert", "-f", local_id, "-P", analysis_id]
|
||||
- return subprocess.check_output(command, universal_newlines=True)
|
||||
+
|
||||
+ if self.is_authorized(sender):
|
||||
+ result = subprocess.check_output(command, universal_newlines=True)
|
||||
+ else:
|
||||
+ result = "Authorization failed"
|
||||
+
|
||||
self.alarm(self.timeout)
|
||||
+ return result
|
||||
+
|
||||
|
||||
if __name__ == "__main__":
|
||||
mainloop = GLib.MainLoop()
|
||||
@@ -36,5 +52,4 @@ if __name__ == "__main__":
|
||||
system_bus = dbus.SystemBus()
|
||||
name = dbus.service.BusName("org.fedoraproject.SetroubleshootFixit", system_bus)
|
||||
object = RunFix(system_bus, "/org/fedoraproject/SetroubleshootFixit/object")
|
||||
- slip.dbus.service.set_mainloop(mainloop)
|
||||
mainloop.run()
|
||||
diff --git a/framework/src/setroubleshoot/browser.py b/framework/src/setroubleshoot/browser.py
|
||||
index 2d37bb4..3203f75 100644
|
||||
--- a/framework/src/setroubleshoot/browser.py
|
||||
+++ b/framework/src/setroubleshoot/browser.py
|
||||
@@ -65,8 +65,6 @@ from setroubleshoot.util import *
|
||||
from setroubleshoot.html_util import html_to_text
|
||||
import re
|
||||
import dbus
|
||||
-import slip.dbus.service
|
||||
-from slip.dbus import polkit
|
||||
import report
|
||||
import report.io
|
||||
import report.io.GTKIO
|
||||
@@ -933,7 +931,6 @@ class DBusProxy (object):
|
||||
self.bus = dbus.SystemBus()
|
||||
self.dbus_object = self.bus.get_object("org.fedoraproject.SetroubleshootFixit", "/org/fedoraproject/SetroubleshootFixit/object")
|
||||
|
||||
- @polkit.enable_proxy
|
||||
def run_fix(self, local_id, plugin_name):
|
||||
return self.dbus_object.run_fix(local_id, plugin_name, dbus_interface="org.fedoraproject.SetroubleshootFixit")
|
||||
|
||||
--
|
||||
2.30.2
|
||||
|
||||
@ -1,82 +0,0 @@
|
||||
From f6a21742b2531f5dfd0fa68400848ca4314f972f Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Mon, 6 Dec 2021 12:14:04 +0100
|
||||
Subject: [PATCH] Fix typos in --help, man pages and developer's guide
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
TODO | 2 +-
|
||||
doc/sealert.8 | 2 +-
|
||||
src/config.py.in | 2 +-
|
||||
src/sealert | 2 +-
|
||||
src/setroubleshoot/server.py | 2 +-
|
||||
5 files changed, 5 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/framework/TODO b/framework/TODO
|
||||
index 6c2f375..25072ea 100644
|
||||
--- a/framework/TODO
|
||||
+++ b/framework/TODO
|
||||
@@ -22,7 +22,7 @@ return plain text (to be used for plaintext email and writing to
|
||||
stdout).
|
||||
|
||||
(John) Add log file scanning support (I'm currently working on this).
|
||||
-We could use a better parser for AVC's in log file or other "stream",
|
||||
+We could use a better parser for AVCs in log file or other "stream",
|
||||
should work by accepting data via a feed() method and invoke a
|
||||
callback when it finds an AVC returning an AVC class and a range
|
||||
(start,end) where it was located (question: should the range be line
|
||||
diff --git a/framework/doc/sealert.8 b/framework/doc/sealert.8
|
||||
index 89f4dff..d3e81e3 100644
|
||||
--- a/framework/doc/sealert.8
|
||||
+++ b/framework/doc/sealert.8
|
||||
@@ -102,7 +102,7 @@ Start sealert without dbus service as stand alone app
|
||||
Lookup alert by id, if id is wildcard * then return all alerts
|
||||
.TP
|
||||
.B \-a \-\-analyze file
|
||||
-Scan a log file, analyze its AVC's
|
||||
+Scan a log file, analyze its AVCs
|
||||
.TP
|
||||
.B \-u \-\-user
|
||||
logon as user
|
||||
diff --git a/framework/src/config.py.in b/framework/src/config.py.in
|
||||
index cbb0542..daf9a68 100644
|
||||
--- a/framework/src/config.py.in
|
||||
+++ b/framework/src/config.py.in
|
||||
@@ -184,7 +184,7 @@ the alert's last seen date will be purged first. Zero implies no limit''',
|
||||
'max_alert_age': {
|
||||
'value': '',
|
||||
'description' : '''
|
||||
-Purge any alerts whose age based on it's last seen date exceeds this threshold.
|
||||
+Purge any alerts whose age based on its last seen date exceeds this threshold.
|
||||
Age may be specified as a sequence of integer unit pairs. Units may be one of
|
||||
year,month,week,day,hour,minute,second and may optionally be plural.
|
||||
Example: '2 weeks 1 day' sets the threshold at 15 days.
|
||||
diff --git a/framework/src/sealert b/framework/src/sealert
|
||||
index bae0c81..2663a21 100755
|
||||
--- a/framework/src/sealert
|
||||
+++ b/framework/src/sealert
|
||||
@@ -598,7 +598,7 @@ if __name__ == '__main__':
|
||||
parser.add_option("-l", "--lookupid", dest="lookupid", default=False,
|
||||
help="Lookup alert by id, id may be wildcard * to lookup all alerts")
|
||||
parser.add_option("-a", "--analyze", dest="analyze", default=False,
|
||||
- help="Scan a log file, analyze it's AVC's", metavar="FILE")
|
||||
+ help="Scan a log file, analyze its AVCs", metavar="FILE")
|
||||
parser.add_option("-u", "--user", dest="user", default=False,
|
||||
help="logon user name")
|
||||
parser.add_option("-p", "--password", dest="password", default=False,
|
||||
diff --git a/framework/src/setroubleshoot/server.py b/framework/src/setroubleshoot/server.py
|
||||
index aef0346..771ea15 100755
|
||||
--- a/framework/src/setroubleshoot/server.py
|
||||
+++ b/framework/src/setroubleshoot/server.py
|
||||
@@ -764,7 +764,7 @@ def RunFaultServer(timeout=10):
|
||||
try:
|
||||
# FIXME: should this be using our logging objects in log.py?
|
||||
# currently syslog is only used for putting an alert into
|
||||
- # the syslog with it's id
|
||||
+ # the syslog with its id
|
||||
|
||||
global pkg_name
|
||||
syslog.openlog(pkg_name)
|
||||
--
|
||||
2.30.2
|
||||
|
||||
@ -1,174 +0,0 @@
|
||||
From e0cf9f2e50e8da856ffd511cbbab7ee36a31bb74 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Fri, 10 Dec 2021 15:04:21 +0100
|
||||
Subject: [PATCH] Revert "Replace pydbus with dasbus"
|
||||
|
||||
dasbus is not available in rhel8.
|
||||
|
||||
This reverts commit 5290ca0ee06d69102bf2b756e2decc0f8c5b770f.
|
||||
---
|
||||
configure.ac | 6 +++---
|
||||
src/SetroubleshootPrivileged.py | 32 ++++++++++++++------------------
|
||||
src/seapplet | 21 +++++++++++++--------
|
||||
src/setroubleshoot/util.py | 9 +++------
|
||||
4 files changed, 33 insertions(+), 35 deletions(-)
|
||||
|
||||
diff --git a/framework/configure.ac b/framework/configure.ac
|
||||
index d1d0176..e3b7b5a 100644
|
||||
--- a/framework/configure.ac
|
||||
+++ b/framework/configure.ac
|
||||
@@ -65,13 +65,13 @@ else
|
||||
$python_module_result])
|
||||
fi
|
||||
|
||||
-AC_MSG_CHECKING([for the dasbus python3 module])
|
||||
-python_module_result=`$PYTHON -c "import dasbus" 2>&1`
|
||||
+AC_MSG_CHECKING([for the pydbus python3 module])
|
||||
+python_module_result=`$PYTHON -c "import pydbus" 2>&1`
|
||||
if test -z "$python_module_result"; then
|
||||
AC_MSG_RESULT([yes])
|
||||
else
|
||||
AC_MSG_RESULT([no])
|
||||
- AC_MSG_ERROR([cannot import Python3 module dasbus.
|
||||
+ AC_MSG_ERROR([cannot import Python3 module pydbus.
|
||||
Please check your Python3 installation. The error was:
|
||||
$python_module_result])
|
||||
fi
|
||||
diff --git a/framework/src/SetroubleshootPrivileged.py b/framework/src/SetroubleshootPrivileged.py
|
||||
index d2a9ea4..899e687 100644
|
||||
--- a/framework/src/SetroubleshootPrivileged.py
|
||||
+++ b/framework/src/SetroubleshootPrivileged.py
|
||||
@@ -19,23 +19,23 @@
|
||||
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
|
||||
from gi.repository import GLib
|
||||
-from dasbus.connection import SystemMessageBus
|
||||
+from pydbus import SystemBus
|
||||
import setroubleshoot.util
|
||||
import signal
|
||||
|
||||
loop = GLib.MainLoop()
|
||||
|
||||
class Privileged(object):
|
||||
- __dbus_xml__ = """
|
||||
- <node>
|
||||
- <interface name='org.fedoraproject.SetroubleshootPrivileged'>
|
||||
- <method name='get_rpm_nvr_by_scontext'>
|
||||
- <arg type='s' name='scontext' direction='in'/>
|
||||
- <arg type='s' name='rpmnvr' direction='out'/>
|
||||
- </method>
|
||||
- <method name='finish'/>
|
||||
- </interface>
|
||||
- </node>
|
||||
+ """
|
||||
+ <node>
|
||||
+ <interface name='org.fedoraproject.SetroubleshootPrivileged'>
|
||||
+ <method name='get_rpm_nvr_by_scontext'>
|
||||
+ <arg type='s' name='scontext' direction='in'/>
|
||||
+ <arg type='s' name='rpmnvr' direction='out'/>
|
||||
+ </method>
|
||||
+ <method name='finish'/>
|
||||
+ </interface>
|
||||
+ </node>
|
||||
"""
|
||||
|
||||
def __init__(self, timeout=10):
|
||||
@@ -58,10 +58,6 @@ class Privileged(object):
|
||||
loop.quit()
|
||||
|
||||
if __name__ == "__main__":
|
||||
- bus = SystemMessageBus()
|
||||
- try:
|
||||
- bus.publish_object("/org/fedoraproject/SetroubleshootPrivileged", Privileged())
|
||||
- bus.register_service("org.fedoraproject.SetroubleshootPrivileged")
|
||||
- loop.run()
|
||||
- finally:
|
||||
- bus.disconnect()
|
||||
+ bus = SystemBus()
|
||||
+ bus.publish("org.fedoraproject.SetroubleshootPrivileged", Privileged())
|
||||
+ loop.run()
|
||||
diff --git a/framework/src/seapplet b/framework/src/seapplet
|
||||
index b5f65d1..79b5ef2 100644
|
||||
--- a/framework/src/seapplet
|
||||
+++ b/framework/src/seapplet
|
||||
@@ -26,7 +26,7 @@ from gi.repository import Gtk
|
||||
gi.require_version('Notify', '0.7')
|
||||
from gi.repository import Notify
|
||||
|
||||
-from dasbus.connection import SystemMessageBus
|
||||
+from pydbus import SystemBus
|
||||
|
||||
import selinux
|
||||
import sys
|
||||
@@ -52,14 +52,13 @@ class SEApplet(GObject.Object):
|
||||
|
||||
def __init__(self):
|
||||
|
||||
- bus = SystemMessageBus()
|
||||
- Setroubleshootd = bus.get_proxy(
|
||||
- 'org.fedoraproject.Setroubleshootd',
|
||||
- '/org/fedoraproject/Setroubleshootd'
|
||||
+ bus = SystemBus()
|
||||
+ self.bus_signal = bus.subscribe(
|
||||
+ iface='org.fedoraproject.SetroubleshootdIface',
|
||||
+ signal='alert',
|
||||
+ signal_fired=self.send_notification
|
||||
)
|
||||
|
||||
- Setroubleshootd.alert.connect(self.send_notification)
|
||||
-
|
||||
super(SEApplet, self).__init__()
|
||||
Notify.init("seapplet")
|
||||
# lets initialise with the application name
|
||||
@@ -81,6 +80,11 @@ class SEApplet(GObject.Object):
|
||||
except:
|
||||
pass
|
||||
|
||||
+ Setroubleshootd = bus.get(
|
||||
+ 'org.fedoraproject.Setroubleshootd',
|
||||
+ '/org/fedoraproject/Setroubleshootd'
|
||||
+ )
|
||||
+
|
||||
(count, red) = Setroubleshootd.check_for_new(last_id)
|
||||
|
||||
if count > 0:
|
||||
@@ -115,7 +119,8 @@ class SEApplet(GObject.Object):
|
||||
launcher.launch(None, context)
|
||||
self.status_icon.set_visible(False)
|
||||
|
||||
- def send_notification(self, *params):
|
||||
+ def send_notification(self, sender, dobject, iface, signal, params):
|
||||
+
|
||||
status_icon = self.__init_status_icon()
|
||||
status_icon.set_visible(True)
|
||||
|
||||
diff --git a/framework/src/setroubleshoot/util.py b/framework/src/setroubleshoot/util.py
|
||||
index 02c4f75..657c882 100755
|
||||
--- a/framework/src/setroubleshoot/util.py
|
||||
+++ b/framework/src/setroubleshoot/util.py
|
||||
@@ -69,7 +69,7 @@ __all__ = [
|
||||
import bz2
|
||||
import six
|
||||
import datetime
|
||||
-from dasbus.connection import SystemMessageBus
|
||||
+from pydbus import SystemBus
|
||||
import glob
|
||||
from gi.repository import GObject
|
||||
import os
|
||||
@@ -522,11 +522,8 @@ Finds an SELinux module which defines given SELinux context
|
||||
|
||||
"""
|
||||
if use_dbus:
|
||||
- bus = SystemMessageBus()
|
||||
- remote_object = bus.get_proxy(
|
||||
- "org.fedoraproject.SetroubleshootPrivileged",
|
||||
- "/org/fedoraproject/SetroubleshootPrivileged"
|
||||
- )
|
||||
+ bus = SystemBus()
|
||||
+ remote_object = bus.get("org.fedoraproject.SetroubleshootPrivileged")
|
||||
return str(remote_object.get_rpm_nvr_by_scontext(str(scontext)))
|
||||
else:
|
||||
context = selinux.context_new(str(scontext))
|
||||
--
|
||||
2.30.2
|
||||
|
||||
@ -1,40 +0,0 @@
|
||||
From 73d60acf9d4d7ae740d450f9c9a9566dac1c3111 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Thu, 3 Feb 2022 18:14:05 +0100
|
||||
Subject: [PATCH] Improve after_first email filter behavior
|
||||
|
||||
after_first used to send 2 emails before it started to filter. The
|
||||
problem was in the email users were not saved into database when a new
|
||||
signature was created.
|
||||
|
||||
Also we need to skip email users when we evaluated whether send a
|
||||
desktop notification or not.
|
||||
---
|
||||
src/setroubleshoot/server.py | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/framework/src/setroubleshoot/server.py b/framework/src/setroubleshoot/server.py
|
||||
index 771ea15..10ef215 100755
|
||||
--- a/framework/src/setroubleshoot/server.py
|
||||
+++ b/framework/src/setroubleshoot/server.py
|
||||
@@ -220,6 +220,7 @@ class AlertPluginReportReceiver(PluginReportReceiver):
|
||||
if len(to_addrs):
|
||||
from setroubleshoot.email_alert import email_alert
|
||||
email_alert(siginfo, to_addrs)
|
||||
+ self.database.mark_modified()
|
||||
|
||||
log_debug("sending alert to all clients")
|
||||
|
||||
@@ -234,6 +235,9 @@ class AlertPluginReportReceiver(PluginReportReceiver):
|
||||
systemd.journal.send(siginfo.format_text(), OBJECT_PID=pid, SYSLOG_IDENTIFIER=pkg_name)
|
||||
|
||||
for u in siginfo.users:
|
||||
+ if u.username[0:6] == "email:":
|
||||
+ # skip email users - they were evaluated before
|
||||
+ continue
|
||||
action = siginfo.evaluate_filter_for_user(u.username)
|
||||
if action == "ignore":
|
||||
return siginfo
|
||||
--
|
||||
2.30.2
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,70 +0,0 @@
|
||||
From a2102cb35cd45852fc508b2f62400be098050d7a Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Mon, 4 Jul 2022 16:20:30 +0200
|
||||
Subject: [PATCH] Decrease setroubleshootd priority and limit RAM utilization
|
||||
to 1GB
|
||||
|
||||
This should help with system responsiveness in case of large amount of
|
||||
AVCs. The memory limit ensures the process cannot indefinitely hog
|
||||
memory in case it is running continuously. My testing showed normal
|
||||
memory consumption not to exceed 350MB, so 1GB should not limit normal
|
||||
operation.
|
||||
|
||||
Note: Limiting memory using systemd service file was chosen to make it easier
|
||||
for users to adjust the limits.
|
||||
|
||||
Related:
|
||||
https://bugzilla.redhat.com/show_bug.cgi?id=2064727
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
Makefile.am | 3 +++
|
||||
org.fedoraproject.Setroubleshootd.service | 3 ++-
|
||||
setroubleshootd.service | 10 ++++++++++
|
||||
3 files changed, 15 insertions(+), 1 deletion(-)
|
||||
create mode 100644 setroubleshootd.service
|
||||
|
||||
diff --git a/framework/Makefile.am b/framework/Makefile.am
|
||||
index f330b7c..93c6a06 100644
|
||||
--- a/framework/Makefile.am
|
||||
+++ b/framework/Makefile.am
|
||||
@@ -28,6 +28,9 @@ polkit_systemdir = $(datadir)/polkit-1/actions
|
||||
polkit_system_DATA = \
|
||||
org.fedoraproject.setroubleshootfixit.policy
|
||||
|
||||
+systemd_systemunitdir = $(prefix)/lib/systemd/system/
|
||||
+systemd_systemunit_DATA = setroubleshootd.service
|
||||
+
|
||||
autostartdir = $(sysconfdir)/xdg/autostart
|
||||
autostart_DATA = sealertauto.desktop
|
||||
|
||||
diff --git a/framework/org.fedoraproject.Setroubleshootd.service b/framework/org.fedoraproject.Setroubleshootd.service
|
||||
index 05c2c39..2c52499 100644
|
||||
--- a/framework/org.fedoraproject.Setroubleshootd.service
|
||||
+++ b/framework/org.fedoraproject.Setroubleshootd.service
|
||||
@@ -1,4 +1,5 @@
|
||||
[D-BUS Service]
|
||||
Name=org.fedoraproject.Setroubleshootd
|
||||
-Exec=/usr/sbin/setroubleshootd -f
|
||||
+SystemdService=setroubleshootd.service
|
||||
+Exec=/bin/false
|
||||
User=setroubleshoot
|
||||
diff --git a/framework/setroubleshootd.service b/framework/setroubleshootd.service
|
||||
new file mode 100644
|
||||
index 0000000..81c75b1
|
||||
--- /dev/null
|
||||
+++ b/framework/setroubleshootd.service
|
||||
@@ -0,0 +1,10 @@
|
||||
+[Unit]
|
||||
+Description=SETroubleshoot daemon for processing new SELinux denial logs
|
||||
+
|
||||
+[Service]
|
||||
+Type=dbus
|
||||
+BusName=org.fedoraproject.Setroubleshootd
|
||||
+ExecStart=/usr/sbin/setroubleshootd -f
|
||||
+User=setroubleshoot
|
||||
+LimitAS=1G
|
||||
+Nice=5
|
||||
--
|
||||
2.35.3
|
||||
|
||||
@ -1,45 +0,0 @@
|
||||
From eed06d0f11867c1019fee4fb1a80be775a60d74e Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Mon, 11 Jul 2022 18:20:47 +0200
|
||||
Subject: [PATCH] doc: Document performance related changes
|
||||
|
||||
- Setroubleshootd is now executed using setroubleshootd.service
|
||||
- ^^ is limited to 1GB of RAM and has a lower than normal priority
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
doc/setroubleshootd.8 | 9 +++++++--
|
||||
1 file changed, 7 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/framework/doc/setroubleshootd.8 b/framework/doc/setroubleshootd.8
|
||||
index bed6713..f1f04d8 100644
|
||||
--- a/framework/doc/setroubleshootd.8
|
||||
+++ b/framework/doc/setroubleshootd.8
|
||||
@@ -23,9 +23,14 @@ components, sealert and setroubleshootd.
|
||||
setroubleshootd is a system daemon which runs under setroubleshoot user and
|
||||
listens for audit events emitted from the kernel related to SELinux. When the
|
||||
setroubleshootd daemon sees an SELinux AVC denial it runs a series of analysis
|
||||
-plugins which examines the audit data related to the AVC. It records the
|
||||
+plugins which examine the audit data related to the AVC. It records the
|
||||
results of the analysis and signals any clients which have attached to the
|
||||
setroubleshootd daemon that a new alert has been seen.
|
||||
+.P
|
||||
+setroubleshootd is not persistent and only runs when there are new AVCs to be
|
||||
+analyzed. It is executed using setroubleshootd.service, which also limits its
|
||||
+priority and maximum RAM utilization to 1GB, in order to help with system
|
||||
+responsiveness in case of large amounts of AVCs.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
@@ -33,7 +38,7 @@ setroubleshootd daemon that a new alert has been seen.
|
||||
Do not fork the daemon
|
||||
.TP
|
||||
.B \-d \-\-debug
|
||||
-Do not exit after 10 seconds
|
||||
+Do not exit after 10 seconds of inactivity
|
||||
.TP
|
||||
.B \-h \-\-help
|
||||
Show this message
|
||||
--
|
||||
2.35.3
|
||||
|
||||
@ -1,56 +0,0 @@
|
||||
From 2fbc58c26359989894dfb54daaca2ff4b537f4fe Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
|
||||
Date: Fri, 22 Apr 2022 16:27:30 +0200
|
||||
Subject: [PATCH] setroubleshoot/server: shutdown RunFaultServer nicely
|
||||
|
||||
systemd[1]: dbus-:1.2-org.fedoraproject.Setroubleshootd@2.service: Main process exited, code=killed, status=14/ALRM
|
||||
systemd[1]: dbus-:1.2-org.fedoraproject.Setroubleshootd@2.service: Failed with result 'signal'.
|
||||
audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:systemd_t:s0 msg='unit=dbus-:1.2-org.fedoraproject.Setroubleshootd@2 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
|
||||
---
|
||||
src/setroubleshoot/server.py | 14 +++++++++++---
|
||||
1 file changed, 11 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/framework/src/setroubleshoot/server.py b/framework/src/setroubleshoot/server.py
|
||||
index 10ef215..8f16993 100755
|
||||
--- a/framework/src/setroubleshoot/server.py
|
||||
+++ b/framework/src/setroubleshoot/server.py
|
||||
@@ -733,9 +733,17 @@ def goodbye(database):
|
||||
audit2why.finish()
|
||||
|
||||
|
||||
+main_loop = GLib.MainLoop()
|
||||
+
|
||||
+
|
||||
+def alarm_handler(signum, frame):
|
||||
+ log_debug("SIGALRM raised in RunFaultServer")
|
||||
+ main_loop.quit()
|
||||
+
|
||||
+
|
||||
def RunFaultServer(timeout=10):
|
||||
signal.alarm(timeout)
|
||||
- sigalrm_handler = signal.signal(signal.SIGALRM, polling_failed_handler)
|
||||
+ signal.signal(signal.SIGALRM, polling_failed_handler)
|
||||
# polling for /sys/fs/selinux/policy file
|
||||
while True:
|
||||
try:
|
||||
@@ -760,7 +768,7 @@ def RunFaultServer(timeout=10):
|
||||
|
||||
global host_database, analysis_queue, email_recipients
|
||||
|
||||
- signal.signal(signal.SIGALRM, sigalrm_handler)
|
||||
+ signal.signal(signal.SIGALRM, alarm_handler)
|
||||
signal.signal(signal.SIGHUP, sighandler)
|
||||
|
||||
#interface_registry.dump_interfaces()
|
||||
@@ -856,7 +864,7 @@ def RunFaultServer(timeout=10):
|
||||
|
||||
dbus.glib.init_threads()
|
||||
setroubleshootd_dbus = SetroubleshootdDBus(analysis_queue, alert_receiver, timeout)
|
||||
- main_loop = GLib.MainLoop()
|
||||
+
|
||||
main_loop.run()
|
||||
|
||||
except KeyboardInterrupt as e:
|
||||
--
|
||||
2.35.3
|
||||
|
||||
@ -1,48 +0,0 @@
|
||||
From 9e2753d241bf0bccaf0b05984e7562a2ac2a70e6 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Thu, 24 Aug 2023 19:02:24 +0200
|
||||
Subject: [PATCH] Check that SELinux is enabled before running
|
||||
|
||||
Setroubleshootd will fail to run when selinux is disabled. Check that
|
||||
SELinux is enabled in setroubleshootd service file and in sealert (so
|
||||
that it does not wait for setroubleshootd to start).
|
||||
|
||||
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2178950
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
setroubleshootd.service | 1 +
|
||||
src/sealert | 6 ++++++
|
||||
2 files changed, 7 insertions(+)
|
||||
|
||||
diff --git a/framework/setroubleshootd.service b/framework/setroubleshootd.service
|
||||
index 81c75b1..7fc2ffb 100644
|
||||
--- a/framework/setroubleshootd.service
|
||||
+++ b/framework/setroubleshootd.service
|
||||
@@ -1,5 +1,6 @@
|
||||
[Unit]
|
||||
Description=SETroubleshoot daemon for processing new SELinux denial logs
|
||||
+ConditionSecurity=selinux
|
||||
|
||||
[Service]
|
||||
Type=dbus
|
||||
diff --git a/framework/src/sealert b/framework/src/sealert
|
||||
index 2663a21..5ce6463 100755
|
||||
--- a/framework/src/sealert
|
||||
+++ b/framework/src/sealert
|
||||
@@ -576,6 +576,12 @@ if __name__ == '__main__':
|
||||
setup_sighandlers()
|
||||
log_debug("main() args=%s" % sys.argv)
|
||||
|
||||
+ # Exit if selinux is disabled - setroubleshootd cannot start
|
||||
+ if not selinux.is_selinux_enabled():
|
||||
+ log_debug("SELinux not enabled, sealert will not run on non SELinux systems")
|
||||
+ print("SELinux not enabled, sealert will not run on non SELinux systems", file=sys.stderr)
|
||||
+ sys.exit(3)
|
||||
+
|
||||
def validate_invocation_style(opt, opts_instance, conflict_opts):
|
||||
global invocation_style
|
||||
conflict_opts.remove(opt)
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -0,0 +1 @@
|
||||
u setroubleshoot - "SELinux troubleshoot server" /var/lib/setroubleshoot
|
||||
@ -1 +1,2 @@
|
||||
d /run/setroubleshoot 711 setroubleshoot setroubleshoot -
|
||||
Z /var/lib/setroubleshoot - setroubleshoot setroubleshoot -
|
||||
|
||||
Loading…
Reference in new issue