appending rsbac data to /proc/$pid/status
Javier Juan Martínez Cabezón <[email protected]> Tue, 13 Mar 2018 23:20:36 +0100
| Newsgroups | gmane.linux.rsbac |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format... ------------=_1521012784-32684-0 Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: 7bit WARNING: contains banned part ------------=_1521012784-32684-0 Content-Type: message/rfc822; x-spam-type=original; name="message.txt" Content-Disposition: attachment; filename="message.txt" Content-Transfer-Encoding: 8bit Content-Description: Original message Received: from www.rsbac.org (localhost [127.0.0.1]) by www.rsbac.org (Postfix) with ESMTP id 33FB04E014A; Wed, 14 Mar 2018 08:32:53 +0100 (CET) X-Original-To: [email protected] Delivered-To: [email protected] Received: from maia (localhost [127.0.0.1]) by www.rsbac.org (Postfix) with ESMTP id 3A7364E014A for <[email protected]>; Wed, 14 Mar 2018 08:32:52 +0100 (CET) Received: from [10.0.3.254] (unknown [90.168.252.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by www.rsbac.org (Postfix) with ESMTPSA id 15D8C4E015E for <[email protected]>; Tue, 13 Mar 2018 23:19:59 +0100 (CET) To: RSBAC Discussion and Announcements <[email protected]> From: =?UTF-8?Q?Javier_Juan_Mart=c3=adnez_Cabez=c3=b3n?= <[email protected]> Message-ID: <[email protected]> Date: Tue, 13 Mar 2018 23:20:36 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 X-Content-Filtered-By: Mailman/MimeDel 2.1.15 Subject: [rsbac] appending rsbac data to /proc/$pid/status X-BeenThere: [email protected] X-Mailman-Version: 2.1.15 Precedence: list Reply-To: RSBAC Discussion and Announcements <[email protected]> List-Id: RSBAC Discussion and Announcements <rsbac.rsbac.org> List-Unsubscribe: <https://www.rsbac.org/mailman/options/rsbac>, <mailto:[email protected]?subject=unsubscribe> List-Archive: <http://www.rsbac.org/pipermail/rsbac/> List-Post: <mailto:[email protected]> List-Help: <mailto:[email protected]?subject=help> List-Subscribe: <https://www.rsbac.org/mailman/listinfo/rsbac>, <mailto:[email protected]?subject=subscribe> Content-Type: multipart/mixed; boundary="===============1540768830==" Errors-To: [email protected] Sender: "rsbac" <[email protected]> This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============1540768830== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="aYQ3MWhRZ0a34I0rXCfQONh3jQBf12cmw" This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --aYQ3MWhRZ0a34I0rXCfQONh3jQBf12cmw From: =?UTF-8?Q?Javier_Juan_Mart=c3=adnez_Cabez=c3=b3n?= <[email protected]> To: RSBAC Discussion and Announcements <[email protected]> Message-ID: <[email protected]> Subject: appending rsbac data to /proc/$pid/status Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Amon, I think it would be useful to append rsbac data to /proc/$pid/status or make something like this under /proc/rsbac-info. It would help userspace development tools highly. For example rc_role of this process, rc_type of proc, w or x enabled or not, if jailed etc, the kind of data that we could retrieve from attr_get_process. Yesterday I just started with (it's only a prototype, I haven't even tested it xD) and enhanced ps rsbac enabled that parses /proc as other tools do. The problem is that I have to make use of popen calls and I think it is too costly. Below you can find the function that makes the hard work, next pass to print with colors and check term size and et voil=C3=A1 (Jens initially I= made it under bash, don't get angry with me, I started correcting my mistake xD). def scanproc(): try: from os import scandir except ImportError: raise ImportError('scandir not available in module os, change to python 3.5 or install it at hand :-)') from errno import ENOENT, EACCESS, EMFILE from subproccess import Popen, PIPE path=3D"/proc" """get procs and inner files of procs""" for object in scandir(path): if object.is_dir(follow_symlinks=3DFalse): name=3Dobject.name if name.isdigit(): newpath=3Dpath+name+"/status" try: statfile=3Dopen(newpath) except OSError as why: if why=3D=3DEACCESS: pass if why=3D=3DENOENT: raise ENOENT("=C2=BF/proc not mounted?") if why=3D=3DEMFILE: raise EMFILE("too many files opened") content=3Dstatfile.readlines data_collected=3D[] for line in content: part=3Dline.split(':') if part[0]=3D=3D"Name": name=3Dpart[1] elif part[0]=3D=3D"State": state=3Dpart[1] elif part[0]=3D=3D"Pid": pid=3Dpart[1] elif part[0]=3D=3D"PPid": PPid=3Dpart[1] elif part[0]=3D=3D"Uid": uid=3Dpart[1] statfile.close() try: cmd=3D['attr_get_process', 'RC', pid, 'rc_role= ' ] proc=3DPopen(cmd, STDOUT=3DPIPE, shell=3DFalse) rc_role_nr=3Dproc.communicate()[0] if proc.returncode !=3D 0: print ("something went wrong with attr_get_process RC %(pid) rc_role") cmd=3D['attr_get_process', 'RC', pid, 'rc_type= ' ] proc=3DPopen(cmd, STDOUT=3DPIPE, shell=3DFalse)= rc_type_nr=3Dproc.communicate()[0] if proc.returncode !=3D 0: print ("something went wrong with attr_get_process RC %(pid) rc_type") cmd=3D['attr_get_process', 'GEN', pid, 'allow_write_exec' ] proc=3DPopen('attr_get_process GEN %(pid) allow_write_exec', STDOUT=3DPIPE, shell=3DFalse) worx=3Dproc.communicate()[0] if worx=3D=3D0: worx=3D"forbidden" elif worx=3D=3D1: worx=3D"allowed" elif worx=3D=3D3: worx=3D"rel" if proc.returncode !=3D 0: print ("something went wrong with attr_get_process GEN %(pid) allow_write_exec") cmd=3D['attr_get_process', 'JAIL', pid, 'jail_= id' ] proc=3DPopen(cmd, STDOUT=3DPIPE, shell=3DFalse) jailed=3Dproc.communicate()[0] if jailed=3D=3D0: jailed=3D"no" elif jailed=3D=3D1: jailed=3D"yes" if proc.returncode !=3D 0: print ("something went wrong with attr_get_process JAIL %(pid) jail_id") cmd=3D['attr_get_process', 'CAP', pid, 'cap_ld_env' ] proc=3DPopen(cmd, STDOUT=3DPIPE, shell=3DFalse)= cap_ld_env=3Dproc.communicate()[0] if cap_ld_env=3D=3D0: cap_ld_env=3D"forbidden" if proc.returncode !=3D 0: print ("something went wrong with attr_get_process CAP %(pid) cap_ld_env") except: raise('something went wrong with popen') data_collected.add(pid, name, state, PPid, uid, rc_role_nr, rc_type_nr, worx, jailed, cap_ld_env, "\n" ) return (data_collected) --aYQ3MWhRZ0a34I0rXCfQONh3jQBf12cmw Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEvP6QGwCEwDC3+UanV+ZOC3/Dvt8FAlqoTtIACgkQV+ZOC3/D vt+UBA/7BM7yz3ljZnTlnokFIpNMkWqzRdLFXY3sApBX53+jSb2fAo3WN0SyYdke sYXy+WVmQaI4vSgL12e76mUgVUgzGmuawo08wCECokm4KWdmzBHtbJtD60AitX7/ I7QDZmQbidv5OwH3cy/+ze470XkzGZSXxtmNpa3mhNlLUs4V//WwPe6AiodAlJFu fY92eUYUv+UQ65qib0UP82AqKpGjBhuzr81S4RIJOKD3Ge7tqMoQJUW7+9n4i2vq irHjmYgc+lay7/kvJTK8/5B6y4Yvsb/HWoTrFyLJ8xnhjdKhV4Evnza/FjEufFU/ c7X+oRnft1/1oiP/P9vztB4C0t7vHMTJ/+DxdfxA4Ep9pQbrP3zyDjSH5X1nRKqT YMabvvWJUJwKzMdz48EmVHEHXnHyCee763dYX6KonX4uAnxPKHCsLBC7vmCX5HpZ 99zzZdlOgAFfffrusJC+I9J/taRE5j80Axm3BGqlnpHwcz86j88kG3e8E60u12cY zlTCAUG0J+zQS9HyzKljpaZneJD2itEG+ElDEth+yJxCGxPduiNbX90a6zxkEUW4 DoB96kLdFpSusrxmVH6vGYPNObPEaXvEUMCwciL+ToYg1y3hgUsU3hjTN7UW6LHK 6vZNpUJ/5DPy8MCrbRpRz5NcFAKWDv9tsaQ74mzarXH7c6FUQ/Y= =piEP -----END PGP SIGNATURE----- --aYQ3MWhRZ0a34I0rXCfQONh3jQBf12cmw-- --===============1540768830== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ rsbac mailing list [email protected] http://www.rsbac.org/mailman/listinfo/rsbac --===============1540768830==-- ------------=_1521012784-32684-0--