newrules.pl -o option

newrules.pl -o option

[Yuichi Nakamura]

The usage of newrules.pl 's -o option is "-o  append output to <outputfile>".
"-o" means "append", but <outputfile> is overwritten.
Is the following patch correct ? 
Thank you.

--- newrules.pl.orig    2003-10-08 18:48:50.000000000 +0900
+++ newrules.pl 2003-10-08 18:48:59.000000000 +0900
@@ -37,7 +37,7 @@
 elsif ($input)   { open (IN, "$input");      }
 else             { open (IN, "-");           }  # STDIN
  
-if ($output)     { open (OUT, ">$output");   }
+if ($output)     { open (OUT, ">>$output");   }
 else             { open (OUT, ">-");         }  # STDOUT

----
Yuichi Nakamura
ynakam@ori.hitachi-sk.co.jp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: newrules.pl -o option

[Yuichi Nakamura]

[-- Attachment #1: Type: text/plain, Size: 872 bytes --]

On Thu, 09 Oct 2003 14:14:40 -0400
Justin Smith <jsmith@drexel.edu> wrote:
> On Wed, 2003-10-08 at 21:24, Yuichi Nakamura wrote:
> > The usage of newrules.pl 's -o option is "-o  append output to <outputfile>".
> > "-o" means "append", but <outputfile> is overwritten.
> > Is the following patch correct ? 
....
> It looks good to me.

Thank you.
I'm also writing patch for newrules.pl.
Now, newrules.pl reads all input logs.
However, sometimes it is not convenient.
For example,
after we add new policies by newrules.pl and "load_policy" command,
the logs before using load_policy command may not be necessary.

I added new option "-l" to newrules.pl.
By "-l" option,logs only after last apperence of "load_policy"(avc:.*granted.*{.*load_policy.*}) are inputted.
The new option is very convenient for me.
Please consider applying this patch.

-----------
Yuichi Nakamura

[-- Attachment #2: newrules.pl.patch --]
[-- Type: application/octet-stream, Size: 2268 bytes --]

--- selinux_1001/selinux-usr/policy/newrules.pl	2003-09-15 23:03:58.000000000 +0900
+++ newrules.pl	2003-10-10 08:38:01.000000000 +0900
@@ -17,13 +17,19 @@
 #    along with this program; if not, write to the Free Software
 #    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA     
 #                                        02111-1307  USA
+#    2003 Sep 30: Add -l option by Yuichi Nakamura(ynakam@users.sourceforge.jp)
 
 
+
+$load_policy_pattern="avc:.*granted.*{.*load_policy.*}";
+$tmpfile="/tmp/newrules.tmp";
+
 while ($opt = shift @ARGV) {
         if ($opt eq "-d") { $read_dmesg++; }
         elsif ($opt eq "-v") { $verbose++; }
         elsif ($opt eq "-i") { $input = shift @ARGV; }
         elsif ($opt eq "-o") { $output= shift @ARGV; }
+	elsif ($opt eq "-l") { $load_policy++;  }
 	elsif ($opt eq "--help") { &printUsage; }
 		else  { print "unknown option, '$opt'\n\n"; &printUsage; }
 }
@@ -37,11 +43,37 @@
 elsif ($input)   { open (IN, "$input");      }
 else             { open (IN, "-");           }  # STDIN
 
-if ($output)     { open (OUT, ">$output");   }
+if ($output)     { open (OUT, ">>$output");   }
 else             { open (OUT, ">-");         }  # STDOUT
 
+if($load_policy){ #find the linenum of last "load_policy"
+    if($read_dmesg){
+	open(TMP,">$tmpfile");
+    }
+    $line_num=0;
+    while ($line = <IN>) {
+	$line_num++;
+	if($line=~/$load_policy_pattern/){
+	     $last_load=$line_num;
+	}
+	print TMP $line;
+    }
+    if($read_dmesg){
+	close(TMP);
+	close(IN);
+	open(IN,$tmpfile);
+    }
+    seek(IN,0,0);
+}
 
+$line_num=0;
 while ($line = <IN>) {
+    if($load_policy){
+	$line_num++;
+	if($line_num<$last_load){
+	    next;
+	}
+    }
     next unless ($line =~ m/avc:\s*denied\s*\{((\w|\s)*)\}/);
     @types=split /\ /,$line;
     $info="";
@@ -119,13 +151,19 @@
     print OUT "$occur{$k}\n" if ($verbose);
 }
 
+if( -e $tmpfile){
+    unlink($tmpfile);
+}
+
 exit;
 
 sub printUsage {
 	print "newrules [-d] [-v] [-i <inputfile> ] [-o <outputfile>]
         -d      read input from output of /bin/dmesg
         -v      verbose output
+        -l      read input only after last \"load_policy\"
         -i      read input from <inputfile>
         -o      append output to <outputfile>\n";
 	exit;
 }
+

Re: newrules.pl -o option

[Russell Coker]

On Fri, 10 Oct 2003 10:08, Yuichi Nakamura wrote:
> I added new option "-l" to newrules.pl.
> By "-l" option,logs only after last apperence of
> "load_policy"(avc:.*granted.*{.*load_policy.*}) are inputted. The new
> option is very convenient for me.

This new option is a great feature and will save a lot of people a lot of 
time.

However there is one minor problem, you use a fixed name for a temporary file 
under /tmp, which is a bad idea for several reasons.

Please make a new version which does not use a temporary file (sorting through 
it in an array should be easy enough) and I will gladly merge it.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: newrules.pl -o option

[Dale Amon]

Since the topic of newrules.pl has come up...

Russ made a point some time back that it may be
a bad idea for it to have the .pl extension as
it might someday be rewritten in C or whatever.
Not that it necessarily will, but it is generally
a bad idea to put extensions on "binaries" that
should end up in /sbin or /usr/sbin/.

Which also brings up the point, what is the most
appropriate place for it to install? Would it be
wise for it to be useable during early boot, thus in
/sbin, or just later in /usr/sbin? Or should it be
considered a user tool and be in /bin or /sbin?

I'd personally tend to /usr/sbin since autogen
of rule fixes during boot is not in general a 
good idea...

-- 
------------------------------------------------------
       IN MY NAME:            Dale Amon, CEO/MD
  No Mushroom clouds over     Islandone Society
    London and New York.      www.islandone.org
------------------------------------------------------

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: newrules.pl -o option

[Yuichi Nakamura]

[-- Attachment #1: Type: text/plain, Size: 677 bytes --]

On Fri, 10 Oct 2003 16:41:00 +1000
Russell Coker <russell@coker.com.au> wrote:
> On Fri, 10 Oct 2003 10:08, Yuichi Nakamura wrote:
> > I added new option "-l" to newrules.pl.
> This new option is a great feature and will save a lot of people a lot of 
> time.
> However there is one minor problem, you use a fixed name for a temporary file 
> under /tmp, which is a bad idea for several reasons.
> Please make a new version which does not use a temporary file (sorting through 
> it in an array should be easy enough) and I will gladly merge it.

Thank you for your interest.
I have fixed it. Temporary file has been removed.
This is a new patch. 

-----------
Yuichi Nakamura

[-- Attachment #2: newrules.pl.patch --]
[-- Type: application/octet-stream, Size: 2284 bytes --]

--- selinux_1001/selinux-usr/policy/newrules.pl	2003-09-15 23:03:58.000000000 +0900
+++ newrules.pl	2003-10-10 17:28:38.000000000 +0900
@@ -17,13 +17,17 @@
 #    along with this program; if not, write to the Free Software
 #    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA     
 #                                        02111-1307  USA
+#    2003 Oct 11: Add -l option by Yuichi Nakamura(ynakam@users.sourceforge.jp)
 
 
+$load_policy_pattern="avc:.*granted.*{.*load_policy.*}";
+
 while ($opt = shift @ARGV) {
         if ($opt eq "-d") { $read_dmesg++; }
         elsif ($opt eq "-v") { $verbose++; }
         elsif ($opt eq "-i") { $input = shift @ARGV; }
         elsif ($opt eq "-o") { $output= shift @ARGV; }
+	elsif ($opt eq "-l") { $load_policy++; }
 	elsif ($opt eq "--help") { &printUsage; }
 		else  { print "unknown option, '$opt'\n\n"; &printUsage; }
 }
@@ -37,11 +41,31 @@
 elsif ($input)   { open (IN, "$input");      }
 else             { open (IN, "-");           }  # STDIN
 
-if ($output)     { open (OUT, ">$output");   }
+if ($output)     { open (OUT, ">>$output");   }
 else             { open (OUT, ">-");         }  # STDOUT
 
+if($load_policy){ #find the linenum of last "load_policy"
+    $line_num=0;
+    while ($line = <IN>) {
+	$line_num++;
+	if($line=~/$load_policy_pattern/) {
+	     $last_load=$line_num;
+	}
+	if($read_dmesg) {
+	    push @dmesg_buf,$line;
+	}
+    }
+    seek(IN,0,0);
+}
 
-while ($line = <IN>) {
+$line_num=0;
+while ($line=&readNewline) {
+    if($load_policy){
+	$line_num++;
+	if($line_num<$last_load){
+	    next;
+	}
+    }
     next unless ($line =~ m/avc:\s*denied\s*\{((\w|\s)*)\}/);
     @types=split /\ /,$line;
     $info="";
@@ -121,10 +145,20 @@
 
 exit;
 
+sub readNewline {
+    if($read_dmesg&&$load_policy){
+	$newline=shift @dmesg_buf;
+    }else{
+	$newline=<IN>;
+    }
+    return $newline;
+}
+
 sub printUsage {
-	print "newrules [-d] [-v] [-i <inputfile> ] [-o <outputfile>]
+	print "newrules [-d] [-v] [-l] [-i <inputfile> ] [-o <outputfile>]
         -d      read input from output of /bin/dmesg
         -v      verbose output
+        -l      read input only after last \"load_policy\"
         -i      read input from <inputfile>
         -o      append output to <outputfile>\n";
 	exit;

Re: newrules.pl -o option

[Dale Amon]

On Fri, Oct 10, 2003 at 09:28:34AM +0100, Dale Amon wrote:
> considered a user tool and be in /bin or /sbin?

Oops.. I meant /bin or /usr/bin obviously!

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: newrules.pl -o option

[Russell Coker]

On Fri, 10 Oct 2003 18:28, Dale Amon wrote:
> Which also brings up the point, what is the most
> appropriate place for it to install? Would it be
> wise for it to be useable during early boot, thus in
> /sbin, or just later in /usr/sbin? Or should it be
> considered a user tool and be in /bin or /sbin?

It should be in /usr/bin.  sbin is the wrong place as it does not require any 
administrative access for full operation, scp'ing log files from a machine 
where you are administrator to another machine where you are only a user for 
analysis is reasonable and expected.  /bin is the wrong place as it is not 
required for system boot (and I could not imagine how it would be required), 
also on many (most?) systems Perl is under /usr so it can't be used before /
usr is mounted anyway.

Also "newrules" is not a good choice of name.  There are potentially hundreds 
of things on a Unix system that have rules and which may have new rules 
generated.  On Debian systems it is currently /usr/bin/newrules-selinux, I 
think that's an ideal name for it.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: newrules.pl -o option

[Stephen Smalley]

On Fri, 2003-10-10 at 07:16, Russell Coker wrote:
> Also "newrules" is not a good choice of name.  There are potentially hundreds 
> of things on a Unix system that have rules and which may have new rules 
> generated.  On Debian systems it is currently /usr/bin/newrules-selinux, I 
> think that's an ideal name for it.

Not clear you need a '-selinux' suffix for SELinux-related programs; we
certainly haven't done that for other SELinux utilities (e.g.
checkpolicy, load_policy).  Other possible names might be:
	genpol (generate policy)
	audit2allow (convert audit messages to allow rules)

If you feel the need to include some kind of SELinux distinguisher,
perhaps you can just use a 'sel' prefix, e.g.
	selnewrules
	selgenpol
	selaudit2allow

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: newrules.pl -o option

[Russell Coker]

On Fri, 10 Oct 2003 23:40, Stephen Smalley wrote:
> On Fri, 2003-10-10 at 07:16, Russell Coker wrote:
> > Also "newrules" is not a good choice of name.  There are potentially
> > hundreds of things on a Unix system that have rules and which may have
> > new rules generated.  On Debian systems it is currently
> > /usr/bin/newrules-selinux, I think that's an ideal name for it.
>
> Not clear you need a '-selinux' suffix for SELinux-related programs; we
> certainly haven't done that for other SELinux utilities (e.g.
> checkpolicy, load_policy).  Other possible names might be:
> 	genpol (generate policy)
> 	audit2allow (convert audit messages to allow rules)

audit2allow is a clearer explanation of what the program does, and is also 
less likely to be ambiguous.  I think that /usr/bin/audit2allow is a 
reasonable name.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: newrules.pl -o option

[Stephen Smalley]

On Fri, 2003-10-10 at 10:40, Russell Coker wrote:
> audit2allow is a clearer explanation of what the program does, and is also 
> less likely to be ambiguous.  I think that /usr/bin/audit2allow is a 
> reasonable name.

Ok.  Another question is whether we should leave it as part of the
policy package or whether it should be moved over to the policycoreutils
package.  

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: newrules.pl -o option

[Dale Amon]

On Fri, Oct 10, 2003 at 10:54:31AM -0400, Stephen Smalley wrote:
> Ok.  Another question is whether we should leave it as part of the
> policy package or whether it should be moved over to the policycoreutils
> package.  

I'd vote for policycoreutils myself.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

newrules.pl's -l option patch (Was: Re: newrules.pl -o option)

[Yuichi Nakamura]

[-- Attachment #1: Type: text/plain, Size: 361 bytes --]

On Fri, 10 Oct 2003 19:07:49 +0900
Yuichi Nakamura <ynakam@ori.hitachi-sk.co.jp> wrote:
> I have fixed it. Temporary file has been removed.
> This is a new patch. 

The previous version had bug when input is stdin.
Russell found it and fixed. I would like to thank him.
This is a fixed version of -l option patch.
Please merge this.

---------
Yuichi Nakamura


[-- Attachment #2: newrules.pl.patch --]
[-- Type: application/octet-stream, Size: 2128 bytes --]

--- newrules.pl	2003-09-15 23:03:58.000000000 +0900
+++ /home/ynakam/newrules.pl	2003-10-11 15:46:07.000000000 +0900
@@ -17,13 +17,17 @@
 #    along with this program; if not, write to the Free Software
 #    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA     
 #                                        02111-1307  USA
+#    2003 Oct 11: Add -l option by Yuichi Nakamura(ynakam@users.sourceforge.jp)
 
 
+$load_policy_pattern="avc:.*granted.*{.*load_policy.*}";
+
 while ($opt = shift @ARGV) {
         if ($opt eq "-d") { $read_dmesg++; }
         elsif ($opt eq "-v") { $verbose++; }
         elsif ($opt eq "-i") { $input = shift @ARGV; }
         elsif ($opt eq "-o") { $output= shift @ARGV; }
+	elsif ($opt eq "-l") { $load_policy++; }
 	elsif ($opt eq "--help") { &printUsage; }
 		else  { print "unknown option, '$opt'\n\n"; &printUsage; }
 }
@@ -37,11 +41,23 @@
 elsif ($input)   { open (IN, "$input");      }
 else             { open (IN, "-");           }  # STDIN
 
-if ($output)     { open (OUT, ">$output");   }
+if ($output)     { open (OUT, ">>$output");   }
 else             { open (OUT, ">-");         }  # STDOUT
 
+if($load_policy){ #store logs after last "load_policy" in @log_buf
+    while ($line = <IN>) {
+	if($line=~/$load_policy_pattern/) {
+	     #stored logs are unnecessary
+	     undef @log_buf;
+	}
+	else
+	{
+	    push @log_buf,$line;
+	}
+    }
+}
 
-while ($line = <IN>) {
+while ($line=&readNewline) {
     next unless ($line =~ m/avc:\s*denied\s*\{((\w|\s)*)\}/);
     @types=split /\ /,$line;
     $info="";
@@ -121,11 +137,22 @@
 
 exit;
 
+sub readNewline {
+    if($load_policy){
+	$newline=shift @log_buf;
+    }else{
+	$newline=<IN>;
+    }
+    return $newline;
+}
+
 sub printUsage {
-	print "newrules [-d] [-v] [-i <inputfile> ] [-o <outputfile>]
+	print "newrules [-d] [-v] [-l] [-i <inputfile> ] [-o <outputfile>]
         -d      read input from output of /bin/dmesg
         -v      verbose output
+        -l      read input only after last \"load_policy\"
         -i      read input from <inputfile>
         -o      append output to <outputfile>\n";
 	exit;
 }
+