1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
|
#!/usr/bin/env python2
"""
This module is a bridge between low-level logging services and high level
handling dependency logic.
It can be used to launch a program and get all file events
"""
import os
import sys
import stat
import time
import tempfile
import socket
import select
import re
import signal
import logger_hooklib
import logger_fusefs
stop=False;
stoptime=0;
def parse_message(message):
ret=message.split("\0")
return ret
#check if process is zombie
def iszombie(pid):
try:
statfile=open("/proc/%d/stat" % pid,"r")
line=statfile.readline()
statfile.close()
line=line.rsplit(")")[1] # find last ")" char
line=line.strip()
match=re.match(r"^(\w)",line)
if match==None:
print "Failed to get check if process is zombie. Format of /proc/<pid>/stat is incorrect. Did you change a kernel?"
return False
return match.group(1)=="Z"
except IOError,e:
return True
# default access filter. Allow acess to all files
def defaultfilter(eventname, filename, stage):
return True
def getfsevents(prog_name,arguments,approach="hooklib",filterproc=defaultfilter):
"""
Launches a program and gets file access events
:param prog_name: name of program
:param arguments: list of program's arguments
:param approach: a logging approach('hooklib' or 'fusefs')
:param filterproc: filter function, this function should take 3 strings:
name of event, name of file and stage, and return a *True* if event is
allowed and *False* instead. Name of event is one of *'open'*, *'read'* or
*'write'*. Default function always returns *True*.
:returns: **list** with two elements - *success* events and *failed* events.
Each element is dictionary **stage->file information**.
File information is also a dictionary **filename->type of events**.
Type of events for success events is a 2-element tuple: *(was file readed,
was file writed)*. For failed events it is also 2-element tuple:
*(was file not found, was file blocked by filterproc)*. Each element of
tuple can be *True* or *False*. Both elements of tuple can be *False*.
Stage can be *'unknown'*
"""
events={}
# generate a random socketname
tmpdir = tempfile.mkdtemp()
socketname = os.path.join(tmpdir, 'socket')
try:
sock_listen=socket.socket(socket.AF_UNIX, socket.SOCK_SEQPACKET)
sock_listen.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
sock_listen.bind(socketname)
sock_listen.listen(64)
# enable connect a socket for anyone
os.chmod(tmpdir,stat.S_IRUSR|stat.S_IWUSR|stat.S_IXUSR|stat.S_IROTH|stat.S_IWOTH|stat.S_IXOTH)
os.chmod(socketname,stat.S_IRUSR|stat.S_IWUSR|stat.S_IXUSR|stat.S_IROTH|stat.S_IWOTH|stat.S_IXOTH)
except socket.error, e:
print "Failed to create a socket for exchange data with the logger: %s" % e
return []
else:
#print socketname
pid=os.fork()
if pid==0:
logger=None
if approach=="hooklib":
logger=logger_hooklib.logger(socketname)
elif approach=="fusefs":
logger=logger_fusefs.logger(socketname)
else:
print "Unknown logging approach"
sys.exit(1)
logger.execprog(prog_name,arguments)
# should not get here
print "Launch likely was unsuccessful"
sys.exit(1)
else:
def signal_handler(sig, frame):
print "You pressed Ctrl+C!"
global stoptime
if(time.time()-stoptime>5):
print "Sending SIGINT to child"
print "Press again in 5 seconds to force exit"
stoptime=time.time()
else:
print "Sending SIGKILL to child"
os.kill(pid,signal.SIGKILL)
os._exit(1)
import signal # signal must to be in this scope
# global signal not works
signal.signal(signal.SIGINT, signal_handler)
epoll=select.epoll()
epoll.register(sock_listen.fileno(), select.EPOLLIN)
connects = 0;
clients={}
was_first_connect=False
while True:
try:
sock_events = epoll.poll(3)
for fileno, sock_event in sock_events:
if fileno == sock_listen.fileno():
#print "\n\nEVENT\n\n"
ret = sock_listen.accept()
#print ret
if ret is None:
# print "\n\nPASS\n\n"
pass
else:
(client,addr)=ret
# print client
connects+=1; # client accepted
was_first_connect=True
epoll.register(client.fileno(), select.EPOLLIN)
clients[client.fileno()]=client
#print "opened %d" % client.fileno()
#elif sock_event & select.EPOLLHUP:
#epoll.unregister(fileno)
#clients[fileno].close()
#del clients[fileno]
#connects-=1
elif sock_event & select.EPOLLIN:
s=clients[fileno]
record=s.recv(8192)
if not record: # if connection was closed
epoll.unregister(fileno)
clients[fileno].close()
del clients[fileno]
connects-=1
#print "closed %d"%fileno
continue
message=record.split("\0")
#if message[3]=="compile": #and message[1]=="debug":
#print message
#print message
try:
if message[4]=="ASKING":
if filterproc(message[1],message[2],message[3]):
#print "Allowing an access to %s" % message[2]
s.sendall("ALLOW\0");
else:
#print "Blocking an access to %s" % message[2]
s.sendall("DENY\0");
else:
eventname,filename,stage,result=message[1:5]
if not stage in events:
events[stage]=[{},{}]
hashofsucesses=events[stage][0]
hashoffailures=events[stage][1]
if result=="DENIED":
print "Blocking an access to %s" % filename
if result=="OK":
if not filename in hashofsucesses:
hashofsucesses[filename]=[False,False]
readed_or_writed=hashofsucesses[filename]
if eventname=="read":
readed_or_writed[0]=True
elif eventname=="write":
readed_or_writed[1]=True
elif result[0:3]=="ERR" or result=="DENIED":
if not filename in hashoffailures:
hashoffailures[filename]=[False,False]
notfound_or_blocked=hashoffailures[filename]
if result=="ERR/2":
notfound_or_blocked[0]=True
elif result=="DENIED":
notfound_or_blocked[1]=True
else:
print "Error in logger module<->analyser protocol"
except IndexError:
print "IndexError while parsing %s"%record
except IOError, e:
if e.errno!=4: # handling "Interrupted system call" errors
raise
if was_first_connect and connects==0:
break
if len(sock_events)==0 and len(clients)==0:
# # seems like there is no connect
print "It seems like a logger module was unable to start or failed to finish\n" + \
"Check that you are not launching a suid program under non-root user."
return []
if len(clients)==0 and iszombie(pid):
break
epoll.unregister(sock_listen.fileno())
epoll.close()
sock_listen.close()
_, exit_status=os.waitpid(pid,0)
signal,exit_status=exit_status%256,exit_status/256
print "Signal: %s Exit status: %s" % (signal,exit_status)
return events
|