#33 sealert to report a bug on a component which own's SELinux domain reported in AVC
Merged by plautrba. Opened by plautrba.
https://gitlab.com/bachradsusi/setroubleshoot.git master

Download 33.patch
no initial comment

There's a raising number of packages which ship their own policies and it could be useful to report bugs related to AVC denials to them instead of to selinux-policy. This PR adds:

  • dbus interface org.fedoraproject.SetroubleshootPrivileged which is run as root and allows setroubleshoot to do privileged operations
  • org.fedoraproject.SetroubleshootPrivileged.get_rpm_nvr_by_scontext DBUS method which detects where an SELinux type used in SELinux context is defined
  • Report in sealert browser sends a bug report to owning component

This code is built at https://copr.fedorainfracloud.org/coprs/plautrba/setroubleshoot/build/1251922/

it's requested at https://pagure.io/setroubleshoot/issue/18

F30:

sudo -u setroubleshoot dbus-send --system --print-reply --dest=org.fedoraproject.SetroubleshootPrivileged \                                         
/org/fedoraproject/SetroubleshootPrivileged/object \
org.fedoraproject.SetroubleshootPrivileged.get_rpm_nvr_by_scontext \
string:"system_u:system_r:mysqld_log_t:s0"
Error org.freedesktop.DBus.Python.UnicodeDecodeError: Traceback (most recent call last):
  File "/usr/lib64/python3.7/site-packages/dbus/service.py", line 707, in _message_cb
    retval = candidate_method(self, *args, **keywords)
  File "/usr/share/setroubleshoot/SetroubleshootPrivileged.py", line 47, in get_rpm_nvr_by_scontext
    rpmnvr = setroubleshoot.util.get_rpm_nvr_by_scontext(scontext)
  File "/usr/lib/python3.7/site-packages/setroubleshoot/util.py", line 487, in get_rpm_nvr_by_scontext
    return get_rpm_nvr_by_type(str(selinux.context_type_get(context)))
  File "/usr/lib/python3.7/site-packages/setroubleshoot/util.py", line 440, in get_rpm_nvr_by_type
    if typedef in open("{}/cil".format(dirpath)):
  File "/usr/lib64/python3.7/codecs.py", line 322, in decode
    (result, consumed) = self._buffer_decode(data, self.errors, final)
UnicodeDecodeError: 'utf-8' codec can't decode byte 0x9a in position 13: invalid start byte

The issue is present on vanilla F30 and I believe it is caused by the fact that the code is trying to read a "utf-8" text from a binary file....
I managed to reproduce the issue for example with /var/lib/selinux/targeted/active/modules/100/openshift-origin/cil

open("/var/lib/selinux/targeted/active/modules/100/openshift-origin/cil").readlines()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib64/python3.7/codecs.py", line 322, in decode
    (result, consumed) = self._buffer_decode(data, self.errors, final)
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xb4 in position 10: invalid start byte

rebased onto 0ee1fc96e0c00517cb0d97f38ddf54e80c7cbe25

https://copr.fedorainfracloud.org/coprs/plautrba/setroubleshoot/build/1254724/

Bug example https://bugzilla.redhat.com/show_bug.cgi?id=1807847

I think this should be tried in the opposite order -- first try to read it as a bzip file (which should check the magic string and fail quickly if the file is uncompressed) and only if that fails try searching directly in the file. Right now you rely on the fact that the utf-8 codec will fail to read any bzip file, which, even if it happened to be true in practice, is a hidden indirect assumption and will confuse the readers of the code.

rebased onto 9fe3ac2862a8c175520a0f275f39f548c2cf9d1e

Good point, updated and rebased

Ack - Tested on rawhide, works as expected (even when there is no rpm package for given type, the line behaves the same as "Source/Target RPM Packages" field -- empty string).

Pull-Request has been merged by plautrba

Metadata