setroubleshoot

#28 framework: Handle sockets with abstract path properly
Closed by vmojzis. Opened by vmojzis.
vmojzis/setroubleshoot embeded  into  master

Download 28.patch

Abstract socket paths start with \0, which caused os.stat() to crash

Fixes:
# cat avc
type=AVC msg=audit(1574094303.139:1096): avc: denied { sendto } for pid=18278 comm="dcbtool" path=002F636F6D2F696E74656C2F6C6C64706164 scontext=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:lldpad_t:s0 tclass=unix_dgram_socket permissive=0
#sealert -a avc
99% doneTraceback (most recent call last):
File "/usr/lib64/python2.7/site-packages/setroubleshoot/analyze.py", line 676, in task
self.new_audit_record_handler(record_type, event_id, body_text, fields, line_number)
File "/usr/lib64/python2.7/site-packages/setroubleshoot/analyze.py", line 701, in new_audit_record_handler
self.avc_event_handler(audit_event)
File "/usr/lib64/python2.7/site-packages/setroubleshoot/analyze.py", line 689, in avc_event_handler
self.analyzer.analyze_avc(avc, self.report_receiver, False)
File "/usr/lib64/python2.7/site-packages/setroubleshoot/analyze.py", line 154, in analyze_avc
avc.update()
File "/usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.py", line 740, in update
self.derive_environmental_info()
File "/usr/lib64/python2.7/site-packages/setroubleshoot/audit_data.py", line 1008, in derive_environmental_info
rpm = get_rpm_nvr_by_file_path(self.tpath)
File "/usr/lib64/python2.7/site-packages/setroubleshoot/util.py", line 337, in get_rpm_nvr_by_file_path
return get_rpm_nvr_by_file_path_temporary(path)
File "/usr/lib64/python2.7/site-packages/setroubleshoot/util.py", line 300, in get_rpm_nvr_by_file_path_temporary
if not os.path.exists(name):
File "/usr/lib64/python2.7/genericpath.py", line 18, in exists
os.stat(path)

TypeError: must be encoded string without NULL bytes, not str

/usr/lib64/python2.7 ? Which version do you use?

Sorry, this was RHEL-7.8, but the issue appears on Fedora as well (albeit less verbose):
100% done
embedded null byte
100% done
found 0 alerts in avc
Edited by vmojzis

I was confused. master branch uses python3 for a long time. Is the change same for master and stable so it's worth to have one (slightly misleading) commit message?

It is, but you are right that it would be less confusing if I wrote separate commit descriptions.

rebased onto 3ec52cd8b4d23dae0f803c0dd18095dbf4a30798

General convention for abstract unix sockets is to replace '\0' with '@', see ss output. I'd follow that and use:

if path[0] == '\0':
    path[0] = '@'

See https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/misc/ss.c#n3758

rebased onto 0c202dea03b0272d0c870fa03f4ba816e4aa6039

Thank you, updated :)

:thumbsup: Acked-by: @plautrba

Please merge and push

Pull-Request has been closed by vmojzis
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.