Hello,

While diagnosing avc messages, I found the log message too spread-out to form a mental picture,

since the lack of some rules often result in several domain domains barking. This reminds me of

unforgiving Ada compilers spilling out loads of messages. I did not want to use audit2allow

too quickly until I understood what the machine is not happy with. So, I needed a message

format that let me to that.

Here is a simple perl script to parse log files for avc denial messages, index, sort them, and print them

in tree (single depth) view, which I hastily put together last night. I hope it will help others as it did

for me. Please feel free to modify it for your own use.

You can index the message by any key, for example scontext, tcontext, action, name and etc. You can

also specify the log files to parse. By default, the script trim the context string of the _u, _r and _t, which

are good for rule readability in source files, but clutter diagnostic print out. However, if this bothers you,

disable trimming by --trim=no option. To get help and condition of usage, avctree --help. It is

best to pipe the output to less so that you can navigate.

A typical partial print out is as follows (this one indexed by tcontext):

# --------------------------------------------------------------------------------[tcontext]

+-[root-object-default ]

| +<- system-system-initrc_su su(1753) : dir : search : home : dm-0 : 49182

+-[root-object-selinux_config]

| +<- root-system-semanage semodule(3584) : dir : rename : active : sdb1 : 49833

+-[root-object-user_home ]

| +<- root-system-semanage semodule(10359) : lnk_file : read : targeted : sdb1 : 98758

| +<- root-system-semanage semodule(11006) : lnk_file : read : policy : sdb1 : 98764

| +<- root-system-semanage semodule(3584) : lnk_file : read : targeted : sdb1 : 98758

+-[system-object-default ]

| +<- system-system-initrc_su su(1753) : dir : search : / : dm-0 : 2

| +<- system-system-hald hald(1958) : dir : getattr : / : dm-0 : 2

No PP module for this script yet. This script use basic Perl features, so, as along you have base Perl package installed, it should work.

Be happy to hear any comments or suggestion for improving this.

/ks

#------------------------------------------- cut here -----------------------------------------

#!/usr/bin/perl -w

sub lmsg

{

print <<LMSG;;

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License as

# published by the Free Software Foundation; either version 2 of

# the License, or (at your option) any later version.

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

# GNU General Public License for more details.

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA

# 02111-1307 USA

LMSG

}

my $version='1.0.0';

use strict;

use warnings;

my $thisScript = $0;

$thisScript =~ s#([^/]+[/]|)(\w+)#$2#;

# ----------------------------------------------------------------------------------------------

use Getopt::Long;

sub usage

{

lmsg;

print "Usage:\n";

print <<USAGETXT;

Utility to format avc messages for readability

--------------------------------------------------------------------------------------------

$thisScript [[options] ...]

Options:

--log=[ all | file,...] : List log files to parse, delimited by comma.

no argument or all => /var/log/messages, /var/log/kernel

--tags : Show time and audit tags

--key=key,... : List messages indexed-sorted by specified key

no argument or all => all keys

Not specified => scontext,tcontext,action,comm,name

--trim=yes|no|1|0 : Trim context string. Default: yes

--help

--------------------------------------------------------------------------------------------

Examples:

a. $thisScript --key=scontext

Print avc messages indexed-sorted by source context.

b. $thisScript --key=tcontext

Print avc messages indexed-sorted by target context.

c. $thisScript --key=comm

Print avc messages indexed-sorted by command executed.

d. $thisScript --key=name

Print avc messages indexed-sorted by target object's name.

e. $thisScript --key=all or $thisScript --key

Print avc messages indexed-sorted by all keys.

f. $thisScript

Print avc messages indexed-sorted by scontext, tcontext, comm, name (default)

g. $thisScript --trim=no

Print avc messages without trimming context string.

h. $thisScript --log=/var/log/messages,/var/log/messages.1,/var/log/messages.2

Print avc messages from log files listed (delimited by comma).

i. $thisScript --tags

Print avc messages, including in each message the log time tag and audit tag.

USAGETXT

exit -1;

}

my $logARG; # Log files to parse

my $tagsARG; # Show time and audit tags

my $catARG; # Categories to print

my $helpARG; # Help

my $trimARG; # Trim context string for readability

usage(), exit unless GetOptions(

'log:s' => \$logARG,

'tags!' => \$tagsARG,

'key:s' => \$catARG,

'trim:s' => \$trimARG,

'help!' => \$helpARG

);

usage() if (defined($helpARG));

## ----------------------------------------------------------------------------------------------

## Option: skip tags

my $skiptags = defined($tagsARG)?0:1;

## Option: log files

my @logOPT = grep -d $_, split /,|\n|\r/, $logARG if (defined($logARG));

@logOPT = ('/var/log/messages','/var/log/kernel','/var/log/debug')

if (defined($logARG) && ((!scalar @logOPT) || grep /all/, @logOPT));

@logOPT = ('/var/log/kernel') if (!scalar @logOPT && -d '/var/log/kernel');

@logOPT = ('/var/log/messages') if (!scalar @logOPT);

## Option: Category

my @catOPT = split /,|\n|\r/, $catARG if (defined($catARG));

my @catDEF = ('scontext','tcontext','comm','name');

## Option: Trim

my $trimOPT = defined($trimARG) ? ($trimARG =~ /no|0|/i ? 0 : 1 ) : 1;

## ----------------------------------------------------------------------------------------------

## Regular expression for parsing avc's 'denied' messages

my $avcRE = qr/^(\w{3}\s+\d{2}\s+\d{2}:\d{2}:\d{2})[\s\w]+:\s*audit$([\d.:]+)$\s*:\s*avc\s*:\s*denied\s+\{\s+(\w+)\s+}\s+for\s+(.*)/;

## Holds indexed avc message records

my %avc;

## ----------------------------------------------------------------------------------------------

## contextFMT

# Format context string for readability

sub contextFMT

{

my $ctxt = shift;

my ($u,$r,$t,$l) = split /:/, $ctxt;

$u =~ s/(.*)_./$1/;

$r =~ s/(.*)_./$1/;

$t =~ s/(.*)_./$1/;

return $u . '-' . $r . '-' . $t;

}

## ----------------------------------------------------------------------------------------------

## readLOG log-file-name

# Reads the specified log file

sub readLOG

{

my $avc = shift;

my $logfile = shift;

my $logsn = ($logfile =~ /.*\/(.*)$/)[0];

my $tmax = defined($avc->{'_tcontext_max_'})?$avc->{'_tcontext_max_'}:0;

my $smax = defined($avc->{'_scontext_max_'})?$avc->{'_scontext_max_'}:0;

open LOGF, '<' . $logfile || die "Cannot open input file: $logfile";

while (<LOGF>) {

s/\r|\n//g;

next if (!$_);

next if (!/\s+avc:\s+/);

my ($timetag, $audit, $action, $detail) = ($_ =~ /$avcRE/);

next if (!defined($action)||!defined($detail)||!defined($timetag)||!defined($audit));

# okay, we have a avc 'denied' message

my %this; # this hash will keep the message's key=value

my @fields = split /\s|\r|\n/, $detail;

foreach (@fields) {

next if (!$_);

my ($key,$val) = split/=/;

next if (!$key||!$val);

$val =~ s/[\"\']*([^\"\']*)[\"\']*/$1/;

$this{"$key"} = $val;

}

next if (!defined($this{'scontext'}) || !defined($this{'tcontext'}));

$this{'action'} = $action;

$this{'timetag'} = $timetag;

$this{'audit'} = $audit;

$this{'file'}= $logsn;

if ($trimOPT) {

$this{'scontext'} = contextFMT($this{'scontext'});

$this{'tcontext'} = contextFMT($this{'tcontext'});

}

$smax = length($this{'scontext'}) if ($smax < length($this{'scontext'}));

$tmax = length($this{'tcontext'}) if ($tmax < length($this{'tcontext'}));

# Okay, let's index the records with various keys

foreach (keys %this) {

next if (/audit|timetag|file/);

$avc->{$_} = {} if (!defined($avc->{$_}));

$avc->{$_}->{$this{$_}} = [()] if (!defined($avc->{$_}->{$this{$_}}));

push @{$avc->{$_}->{$this{$_}}}, \%this;

}

close LOGF;

$avc->{'_scontext_max_'} = $smax;

$avc->{'_tcontext_max_'} = $tmax;

}

## ----------------------------------------------------------------------------------------------

# keyTREE key

# Show selected key in a tree view

sub keyTREE

{

my $avc = shift;

my $kcat = shift;

my $showfile = shift;

my $hcat = $avc->{$kcat};

my $lvl = 1;

my $isSctx = ($kcat =~ /scontext/);

my $isTctx = ($kcat =~ /tcontext/);

my $smax = $isSctx ? 0 : $avc->{'_scontext_max_'};

my $tmax = $isTctx ? 0 : $avc->{'_tcontext_max_'};

return if (/_scontext_max_|_tcontext_max_/);

print "\n# "; for ($_=0; $_ < 80; $_++) {print "-";}

print "[", $kcat, "]\n";

foreach my $kmsg (sort keys %$hcat) {

printf "|\n+-[%-*s]\n", $smax, $hcat->{$kmsg}[0]->{$kcat};

$lvl++;

my $buf;

my $i;

my $cnt = scalar @{$hcat->{$kmsg}};

foreach my $hmsg (@{$hcat->{$kmsg}}) {

$buf .= sprintf "%s %-*s %s %-*s %s%s(%s) : %s : %s %s%s%s\n",

$isTctx? '+<-' : '+->',

$smax, $isSctx?'':$hmsg->{'scontext'},

$isTctx||$isSctx ? '' : '-+->',

$tmax, $isTctx?'':$hmsg->{'tcontext'},

defined($showfile)? $hmsg->{'file'}.'> ':'',

$hmsg->{'comm'}, $hmsg->{'pid'}, $hmsg->{'tclass'},

$hmsg->{'action'},

defined($hmsg->{'name'})?': '.$hmsg->{'name'}:'',

defined($hmsg->{'key'})?' : '.$hmsg->{'key'}:'',

defined($hmsg->{'dev'})?' : '.$hmsg->{'dev'} . (defined($hmsg->{'ino'})?' : '.$hmsg->{'ino'}:'') : ''

;

$i = $lvl; $buf = '| ' . $buf while (--$i); print $buf; $buf = "";

foreach my $kmsg (sort keys %$hmsg) {

next if ($skiptags && $kmsg =~ /timetag|audit/);

$buf .= sprintf "%s=%s ", $kmsg, $hmsg->{$kmsg};

}

if ($buf) {

$buf = sprintf "%*s%s\n", ($cnt==1)?$smax+$tmax+10+2:$smax+$tmax+10, ,"", $buf;

$i = (--$cnt)? $lvl:$lvl-1; $buf = '| ' . $buf while ($i--); print $buf; $buf = "";

}

$lvl--;

}

$lvl--;

}

## ----------------------------------------------------------------------------------------------

# Parse log files

readLOG(\%avc, $_) foreach (@logOPT);

# Decide which category to print

@catOPT = (sort keys %avc) if (defined($catARG) && (! scalar @catOPT) || grep /all/,@catOPT ) ;

@catOPT = @catDEF if (!defined($catARG));

print "\n> Notice: get help and condition of usage inforamtion regarding this script: $thisScript --help\n";

keyTREE(\%avc, $_,scalar @logOPT > 1?1:undef) foreach (@catOPT);

## ----------------------------------------------------------------------------------------------

# vim :ts=4:sw=4: