setroubleshoot: syntax error...

[Daniel J Walsh]

Tom London wrote:
> On 7/21/06, Jay Cliburn <jacliburn at bellsouth.net> wrote:
>> Tom London wrote:
>> > Fixed spurrious '.' at end of line 35 in secure_mode_insmod.py.
>> >
>> > Now get:
>> >
>> > 2006-07-20 10:17:48,314 [plugin.DEBUG] importing
>> > /usr/share/setroubleshoot/plugins/secure_mode_policyload as
>> > plugins.secure_mode_policyload
>> > 2006-07-20 10:17:48,315 [avc.ERROR] Unexpected exception expected an
>> > indented block (secure_mode_policyload.py, line 45)
>> > Traceback (most recent call last):
>> >  File "/usr/lib/audit/setroubleshoot_dispatcher", line 96, in ?
>> >    analyze_thread = Analyze()
>> >  File "/usr/lib/audit/setroubleshoot_dispatcher", line 19, in __init__
>> >    self.plugins = LoadPlugins()
>> >  File "/usr/lib/python2.4/site-packages/setroubleshoot/util.py", line
>> > 175, in LoadPlugins
>> >    mod = imp.load_module(moduleName, *imp.find_module(pluginName,
>> > [plugin_dir]))
>> > IndentationError: expected an indented block
>> > (secure_mode_policyload.py, line 45)
>> > 2006-07-20 10:17:48,702 [avc.ERROR] Traceback (most recent call last):
>> >  File "/usr/lib/audit/setroubleshoot_dispatcher", line 96, in ?
>> >    analyze_thread = Analyze()
>> >  File "/usr/lib/audit/setroubleshoot_dispatcher", line 19, in __init__
>> >    self.plugins = LoadPlugins()
>> >  File "/usr/lib/python2.4/site-packages/setroubleshoot/util.py", line
>> > 175, in LoadPlugins
>> >    mod = imp.load_module(moduleName, *imp.find_module(pluginName,
>> > [plugin_dir]))
>> > IndentationError: expected an indented block
>> > (secure_mode_policyload.py, line 45)
>> > Traceback (most recent call last):
>> >  File "/usr/lib/audit/setroubleshoot_dispatcher", line 96, in ?
>> >    analyze_thread = Analyze()
>> >  File "/usr/lib/audit/setroubleshoot_dispatcher", line 19, in __init__
>> >    self.plugins = LoadPlugins()
>> >  File "/usr/lib/python2.4/site-packages/setroubleshoot/util.py", line
>> > 175, in LoadPlugins
>> >    mod = imp.load_module(moduleName, *imp.find_module(pluginName,
>> > [plugin_dir]))
>> > IndentationError: expected an indented block
>> > (secure_mode_policyload.py, line 45)
>> >
>>
>> I get a different error in setroubleshoot-0.9-1.  Where should these be
>> reported?
>>
>> [root at osprey setroubleshoot-0.9]# setroubleshoot /var/log/messages
>> Traceback (most recent call last):
>>    File "/usr/sbin/setroubleshoot", line 74, in ?
>>      if plugin.analyze(avc):
>>    File "/usr/share/setroubleshoot/plugins/allow_java_execstack.py",
>> line 52, in analyze
>>      if re.match("javaplugin_t$", avc.scontext.type) is not None \
>>    File "/usr/lib64/python2.4/sre.py", line 129, in match
>>      return _compile(pattern, flags).match(string)
>> TypeError: expected string or buffer
>>
>>
>>
>> Also, there appears to be a format bug in the Usage message:
>>
>> [root at osprey setroubleshoot-0.9]# setroubleshoot --help
>>
>>      sys.argv[0] file [file ...]
>>      -h --help
>>      -p glob --plugin=glob       load only plugin's whose name 
>> matches glob
>>
> Here's a new one, also with 0.9-1:
>
> 2006-07-21 09:20:14,722 [avc.DEBUG] snap read:
> 'audit(1153498814.721:15): user pid=2792 uid=0 auid=500
> subj=system_u:system_r:xdm_t:s0-s0:c0.c255 msg='uid=500:
> exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain,
> addr=2.0.0.0, terminal=:0 res=success)''
> 2006-07-21 09:20:14,723 [avc.ERROR] Unexpected exception too many
> values to unpack
> Traceback (most recent call last):
>  File "/usr/lib/audit/setroubleshoot_dispatcher", line 100, in ?
>    snap.run()
>  File "/usr/lib/audit/setroubleshoot_dispatcher", line 83, in run
>    self.process(msg.get_msg_type(), msg.get_body())
>  File "/usr/lib/audit/setroubleshoot_dispatcher", line 66, in process
>    var, val = i.split("=")
> ValueError: too many values to unpack
> 2006-07-21 09:20:14,726 [avc.ERROR] Traceback (most recent call last):
>  File "/usr/lib/audit/setroubleshoot_dispatcher", line 100, in ?
>    snap.run()
>  File "/usr/lib/audit/setroubleshoot_dispatcher", line 83, in run
>    self.process(msg.get_msg_type(), msg.get_body())
>  File "/usr/lib/audit/setroubleshoot_dispatcher", line 66, in process
>    var, val = i.split("=")
> ValueError: too many values to unpack
> Traceback (most recent call last):
>  File "/usr/lib/audit/setroubleshoot_dispatcher", line 100, in ?
>    snap.run()
>  File "/usr/lib/audit/setroubleshoot_dispatcher", line 83, in run
>    self.process(msg.get_msg_type(), msg.get_body())
>  File "/usr/lib/audit/setroubleshoot_dispatcher", line 66, in process
>    var, val = i.split("=")
> ValueError: too many values to unpack
Could you attach the /var/log/audit/audit.log?

Dan