From 797d6073ca0a8ec0ffba1f23da556beb9452f92b Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Apr 05 2017 10:09:04 +0000 Subject: framework: improve obtaining AVC object path There can be more than one PATH record accompanying an AVC. Try to choose the one corresponding to the AVC object (avoid PARENT type PATH record if possible and use path matching name field of the AVC record if it exists). Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1343641 Signed-off-by: Vit Mojzis --- diff --git a/framework/src/setroubleshoot/audit_data.py b/framework/src/setroubleshoot/audit_data.py index 1edaec0..61c7347 100644 --- a/framework/src/setroubleshoot/audit_data.py +++ b/framework/src/setroubleshoot/audit_data.py @@ -786,7 +786,7 @@ class AVC: ''' path = None - name = None + name = self.avc_record.get_field('name') # First try to get the path from the AVC record, new kernel # versions put it there rather than in AVC_PATH @@ -796,9 +796,19 @@ class AVC: path = path.strip('"') inodestr = self.avc_record.get_field("ino") if path is None: - avc_path_record = self.audit_event.get_record_of_type('PATH') - if avc_path_record: + # No path field in AVC record, try to get path from PATH records + avc_path_records = self.audit_event.get_records_of_type('PATH') + for avc_path_record in avc_path_records: + record_type = avc_path_record.get_field('objtype') + #Avoid PARENT records if possible + if path and record_type == "PARENT": + continue + path = avc_path_record.get_field('name') + # If there is more non-PARENT PATH records, use the one matching + # the name from AVC record... otherwise use the last one + if path and name and record_type != "PARENT" and path.endswith(name): + break if path is None: # No path field, so try and use the name field instead