From e2138a22b89c64c30d0f17c369f204698c62cafb Mon Sep 17 00:00:00 2001
From: Vit Mojzis <vmojzis@redhat.com>
Date: Feb 05 2018 16:48:48 +0000
Subject: [PATCH 1/2] Fix summary and "if" text for AVCs with unknown target path


AVCs with unknown target path were described eg. as follows:

SELinux is preventing /usr/bin/dmesg from syslog_read access on the
system Unknown.

*****  Plugin catchall (100. confidence) suggests
**************************

If you believe that dmesg should be allowed syslog_read access on the
Unknown system by default.

Replace the confusing descriptions by:

SELinux is preventing /usr/bin/dmesg from syslog_read access on the
system labeled system_label_t.

*****  Plugin catchall (100. confidence) suggests
**************************

If you believe that dmesg should be allowed syslog_read access on the
system labeled system_label_t by default.

The requirement for 3-tuple (catchall.py: 53) guarantees backwards
compatibility with AVCs that are already in the setroubleshoot database.

Resolves: rhbz#1437772

---

diff --git a/framework/src/setroubleshoot/signature.py b/framework/src/setroubleshoot/signature.py
index ec7c934..df65123 100755
--- a/framework/src/setroubleshoot/signature.py
+++ b/framework/src/setroubleshoot/signature.py
@@ -446,10 +446,11 @@ class SEFaultSignatureInfo(XmlSerialize):
 
         if self.tclass in ["capability", "capability2"]:
             return P_(_("SELinux is preventing %s from using the %s capability."), _("SELinux is preventing %s from using the '%s' capabilities."), len(self.sig.access)) % (self.spath, ", ".join(self.sig.access))
-        if self.tpath == "(null)":
+        if self.tpath in ["(null)", "Unknown"] :
             return P_(_("SELinux is preventing %s from %s access on the %s labeled %s."), _("SELinux is preventing %s from '%s' accesses on the %s labeled %s."), len(self.sig.access)) % (self.spath, ", ".join(self.sig.access), translate_class(self.tclass), self.tcontext.type)
         return P_(_("SELinux is preventing %s from %s access on the %s %s."), _("SELinux is preventing %s from '%s' accesses on the %s %s."), len(self.sig.access)) % (self.spath, ", ".join(self.sig.access), translate_class(self.tclass), self.tpath)
 
+
     def get_plugins(self, all = False):
         self.plugins = load_plugins()
         plugins = []
diff --git a/plugins/src/catchall.py b/plugins/src/catchall.py
index 04b799b..649645f 100644
--- a/plugins/src/catchall.py
+++ b/plugins/src/catchall.py
@@ -50,6 +50,8 @@ class plugin(Plugin):
             return _('If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on processes labeled $TARGET_TYPE by default.')
         if args[1] in ["capability", "capability2"]:
             return _('If you believe that $SOURCE_BASE_PATH should have the $ACCESS capability by default.')
+        if (len(args) >= 3) and (args[2] in ["(null)", "Unknown"]):
+            return _('If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on $TARGET_CLASS labeled $TARGET_TYPE by default.')
         return _('If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on the $TARGET_BASE_PATH $TARGET_CLASS by default.')
 
     then_text = _('You should report this as a bug.\nYou can generate a local policy module to allow this access.')
@@ -68,4 +70,4 @@ class plugin(Plugin):
         else:
             summary = self.summary + "."
 
-        return self.report((0,avc.tclass))
+        return self.report((0, avc.tclass, avc.tpath))

From 8bba913d5d2b707eb1586d5d6858125e54060c44 Mon Sep 17 00:00:00 2001
From: Vit Mojzis <vmojzis@redhat.com>
Date: Feb 06 2018 15:14:40 +0000
Subject: [PATCH 2/2] plugins/bind_ports: Do not use when there are no allowed_target_types


Do not use this plugin when source domain is not allowed to name_bind
to any port type. This caused invalid command suggestion such as:

semanage port -a -t  -p udp 5382 (the type is missing)

This situation would require the user to add an allow rule or switch a
boolean, which is handled by the catchall and catchall_boolean plugins.

Resolves: rhbz#1255627

---

diff --git a/plugins/src/bind_ports.py b/plugins/src/bind_ports.py
index c2bb79e..8c5956e 100644
--- a/plugins/src/bind_ports.py
+++ b/plugins/src/bind_ports.py
@@ -64,6 +64,7 @@ class plugin(Plugin):
                 avc.has_any_access_in(['name_bind'])):
                 # MATCH
             target_types = ", ".join(avc.allowed_target_types())
-            return self.report((avc.tclass.split("_")[0], target_types))
+            if target_types != "":
+                return self.report((avc.tclass.split("_")[0], target_types))
 
         return None