From 25dd8cee2841d0be01756b6c600ea887fad0c67d Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Feb 28 2020 12:22:32 +0000
Subject: [PATCH 1/2] Use pydbus, a modern Python dbus API, for SetroubleshootPrivileged


According to https://wiki.python.org/moin/DbusExamples dbus-python is a legacy API.

---

diff --git a/framework/src/SetroubleshootPrivileged.py b/framework/src/SetroubleshootPrivileged.py
index 858115b..899e687 100644
--- a/framework/src/SetroubleshootPrivileged.py
+++ b/framework/src/SetroubleshootPrivileged.py
@@ -18,31 +18,35 @@
 # with this program; if not, write to the Free Software Foundation, Inc.,
 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 
-import dbus
-import dbus.service
-from dbus.mainloop.glib import DBusGMainLoop
 from gi.repository import GLib
+from pydbus import SystemBus
 import setroubleshoot.util
 import signal
 
-DBusGMainLoop(set_as_default=True)
-
-class Privileged(dbus.service.Object):
+loop = GLib.MainLoop()
+
+class Privileged(object):
+    """
+		<node>
+			<interface name='org.fedoraproject.SetroubleshootPrivileged'>
+				<method name='get_rpm_nvr_by_scontext'>
+					<arg type='s' name='scontext' direction='in'/>
+    				<arg type='s' name='rpmnvr' direction='out'/>
+				</method>
+				<method name='finish'/>
+			</interface>
+		</node>
+    """
 
     def __init__(self, timeout=10):
         self.timeout = timeout
         self.alarm(self.timeout)
 
-        bus = dbus.SystemBus()
-        bus.request_name("org.fedoraproject.SetroubleshootPrivileged")
-        bus_name = dbus.service.BusName("org.fedoraproject.SetroubleshootPrivileged", bus=bus)
-        dbus.service.Object.__init__(self, bus_name, "/org/fedoraproject/SetroubleshootPrivileged/object")
-
     def alarm(self, timeout=10):
         signal.alarm(timeout)
 
-    @dbus.service.method("org.fedoraproject.SetroubleshootPrivileged", in_signature='s', out_signature='s')
     def get_rpm_nvr_by_scontext(self, scontext):
+        """Finds an SELinux module which defines given SELinux context"""
         signal.alarm(self.timeout)
         rpmnvr = setroubleshoot.util.get_rpm_nvr_by_scontext(scontext)
         if rpmnvr is None:
@@ -50,8 +54,10 @@ class Privileged(dbus.service.Object):
 
         return rpmnvr
 
-if __name__ == "__main__":
-    privileged = Privileged()
+    def finish(self):
+        loop.quit()
 
-    loop = GLib.MainLoop()
+if __name__ == "__main__":
+    bus = SystemBus()
+    bus.publish("org.fedoraproject.SetroubleshootPrivileged", Privileged())
     loop.run()
diff --git a/framework/src/setroubleshoot/util.py b/framework/src/setroubleshoot/util.py
index 77b3668..4d18555 100755
--- a/framework/src/setroubleshoot/util.py
+++ b/framework/src/setroubleshoot/util.py
@@ -68,7 +68,7 @@ __all__ = [
 import bz2
 import six
 import datetime
-import dbus
+from pydbus import SystemBus
 import glob
 from gi.repository import GObject
 import os
@@ -484,18 +484,9 @@ Finds an SELinux module which defines given SELinux context
 
     """
     if use_dbus:
-        bus = dbus.SystemBus()
-
-        try:
-            remote_object = bus.get_object("org.fedoraproject.SetroubleshootPrivileged",
-                                       "/org/fedoraproject/SetroubleshootPrivileged/object")
-
-            return str(remote_object.get_rpm_nvr_by_scontext(str(scontext),
-                    dbus_interface = "org.fedoraproject.SetroubleshootPrivileged"))
-        except dbus.DBusException:
-            from traceback import print_exc
-            print_exc()
-            return None
+        bus = SystemBus()
+        remote_object = bus.get("org.fedoraproject.SetroubleshootPrivileged")
+        return str(remote_object.get_rpm_nvr_by_scontext(str(scontext)))
     else:
         context = selinux.context_new(str(scontext))
         return get_rpm_nvr_by_type(str(selinux.context_type_get(context)))

From 945838998d84dcd8f0aab147f228e244dc08a54e Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Feb 28 2020 12:25:59 +0000
Subject: [PATCH 2/2] root user doesn't need to use SetroubleshootPrivileged API


Fixes:
$ sudo sealert -a ./short.log 2>&1 | tee /tmp/tmp.956wzqmMcR, with 15 seconds timeout
ERROR:dbus.proxies:Introspect error on :1.38:/org/fedoraproject/SetroubleshootPrivileged/object: dbus.exceptions.DBusException: org.freedesktop.DBus.Error.AccessDenied: Sender is not authorized to send message
Traceback (most recent call last):
  File "/usr/lib/python3.7/site-packages/setroubleshoot/util.py", line 494, in get_rpm_nvr_by_scontext
    dbus_interface = "org.fedoraproject.SetroubleshootPrivileged"))
  File "/usr/lib64/python3.7/site-packages/dbus/proxies.py", line 70, in __call__
    return self._proxy_method(*args, **keywords)
  File "/usr/lib64/python3.7/site-packages/dbus/proxies.py", line 145, in __call__
    **keywords)
  File "/usr/lib64/python3.7/site-packages/dbus/connection.py", line 651, in call_blocking
    message, timeout)
dbus.exceptions.DBusException: org.freedesktop.DBus.Error.AccessDenied: Sender is not authorized to send message

---

diff --git a/framework/src/setroubleshoot/signature.py b/framework/src/setroubleshoot/signature.py
index 7287eec..bcc3740 100755
--- a/framework/src/setroubleshoot/signature.py
+++ b/framework/src/setroubleshoot/signature.py
@@ -314,7 +314,16 @@ class SEFaultSignatureInfo(XmlSerialize):
             setattr(self, k, v)
         self.report_count = 1
         self.plugin_list = []
-        self.environment.local_policy_rpm = get_rpm_nvr_by_scontext(self.scontext, use_dbus=True)
+
+        use_dbus=True
+        if os.getuid() == 0:
+            # root doesn't need to use dbus
+            use_dbus=False
+        try:
+            self.environment.local_policy_rpm = get_rpm_nvr_by_scontext(self.scontext, use_dbus=use_dbus)
+        except:
+            # leave it as it is
+            pass
 
     def update_merge(self, siginfo):
         if siginfo.last_seen_date != self.last_seen_date: