1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
|
#!/usr/bin/env python2
"""
This module is a bridge between low-level logging services and high level handling dependency logic
"""
import os
import sys
import time
import tempfile
import socket
import select
import re
import logger_hooklib
import logger_fusefs
def unescape(s):
s=re.sub(r'\\r', '\r', s)
s=re.sub(r'\\n', '\n', s)
s=re.sub(r'\\(.)', r'\1', s)
return s
def parse_message(message):
ret=re.split(r"(?<![\\]) ",message,6)
#for i in ret:
return map(unescape, ret)
# check if proccess is finished
def checkfinished(pid):
if not os.path.exists("/proc/%d/stat" % pid):
return (True,0)
try:
pid_child,exitcode = os.waitpid(pid, os.WNOHANG)
except OSError, e:
if e.errno == 10:
return (False,0)
else:
raise
if pid_child==0:
return (False,0)
return (True,exitcode)
# default access filter. Allow always
def defaultfilter(time, filename, pid):
return True
# run the program and get file access events
def getfsevents(prog_name,arguments,approach="hooklib",filterproc=defaultfilter):
events=[]
# generate a random socketname
tmpdir = tempfile.mkdtemp()
socketname = os.path.join(tmpdir, 'socket')
try:
sock_listen=socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
sock_listen.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
sock_listen.bind(socketname)
sock_listen.listen(1024)
except socket.error, e:
print "Failed to create a socket for exchange data with the logger: %s" % e
return []
else:
#print socketname
pid=os.fork()
if pid==0:
logger=None
if approach=="hooklib":
logger=logger_hooklib.logger(socketname)
elif approach=="fusefs":
logger=logger_fusefs.logger(socketname)
else:
print "Unknown logging approach"
sys.exit(1)
logger.execprog(prog_name,arguments)
# should not get here
print "Launch likely was unsuccessful"
sys.exit(1)
else:
input = [sock_listen]
connects = 0;
buffers = {}
while input:
inputready,outputready,exceptready = select.select(input,[],[],5)
for s in inputready:
#print "!! len: %d" % len(buffers)
if s == sock_listen:
ret = s.accept()
if ret is None:
pass
else:
(client,addr)=ret
connects+=1; # client accepted
input.append(client)
buffers[client]=''
else:
data=s.recv(65536)
buffers[s]+=data
if not data:
s.close()
input.remove(s)
buffers[s]=""
connects-=1;
if connects==0:
input.remove(sock_listen)
sock_listen.close()
continue
if not "\n" in buffers[s]:
continue
data,buffers[s] = buffers[s].rsplit("\n",1)
for record in data.split("\n"):
if len(record)==0:
continue
# TODO: check array
#print "!"+"%d"%len(record)+"?"
#print "datalen: %d" % len(data)
message=parse_message(record)
try:
if message[4]=="ASKING":
if filterproc(message[1],message[2],message[3]):
s.sendall("ALLOW\n"); # TODO: think about flush here
else:
print "Blocking an access to %s" % message[2]
s.sendall("DENY\n"); # TODO: think about flush here
else:
events.append([message[1],message[2]]);
except IndexError:
print "IndexError while parsing %s"%record
#print "!!"+data+"!!"
#print parse_message(data)
if len(input)==1 and connects==0:
# seems like there is no connect
print "It seems like a logger module was unable to start." + \
"Check that you are not launching a suid program under non-root user."
return []
os.wait()
return events
|
GitWeb