Bug 1475998

Summary: python audit crash if when using AUSOURCE_FILE_POINTER
Product: Red Hat Enterprise Linux 7 Reporter: Paulo Andrade <pandrade>
Component: auditAssignee: Steve Grubb <sgrubb>
Status: CLOSED ERRATA QA Contact: Ondrej Moriš <omoris>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.3CC: cww, omoris
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: audit-2.7.8 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-04-10 12:18:47 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1420851, 1476406    

Description Paulo Andrade 2017-07-27 18:38:46 UTC
Steps to reproduce:

"""
$ touch /tmp/ausearch.log
$ cat t.py
#!/bin/python
import auparse
aup = auparse.AuParser(auparse.AUSOURCE_FILE_POINTER,open('/tmp/ausearch.log', 'r'))
aup.reset()

$ python t.py
"""

It almost works if enclosing the script as:
with open('/tmp/ausearch.log', 'r') as logfile:
    aup = auparse.AuParser(auparse.AUSOURCE_FILE_POINTER,logfile)
    aup.reset()

but will crash in auparse_destroy due to double fclose call.

  The problem is that python does not know about the references
of the FILE object. For example:

$ gdb -q --args python t.py
Reading symbols from /usr/bin/python2.7...Reading symbols from /usr/lib/debug/usr/bin/python2.7.debug...done.
done.

(gdb) b AuParser_init
Function "AuParser_init" not defined.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 1 (AuParser_init) pending.
(gdb) r
Starting program: /usr/bin/python t.py
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".

Breakpoint 1, AuParser_init (self=0x7ffff7f5e138, args=(6, <file at remote 0x7ffff7f226f0>), kwds=0x0) at ../../../bindings/python/auparse_python.c:306
306	{
(gdb) p &self.au
$1 = (auparse_state_t **) 0x7ffff7f5e148
(gdb) watch *$1
Hardware watchpoint 2: *$1
(gdb) c
Continuing.
Hardware watchpoint 2: *$1

Old value = (auparse_state_t *) 0x0
New value = (auparse_state_t *) 0x6701e0
0x00007ffff05fa04d in AuParser_init (self=0x7ffff7f5e138, args=(6, <file at remote 0x7ffff7f226f0>), kwds=0x0) at ../../../bindings/python/auparse_python.c:439
439	        if ((self->au = auparse_init(source_type, fp)) == NULL) {
(gdb) p& self.au.in._fileno
$2 = (int *) 0x6b8980
Hardware watchpoint 3: *$2
(gdb) c
Continuing.
Hardware watchpoint 3: *$2

Old value = 7
New value = -1
_IO_new_file_close_it (fp=fp@entry=0x6b8910) at fileops.c:193
193	  fp->_offset = _IO_pos_BAD;
(gdb) bt
#0  _IO_new_file_close_it (fp=fp@entry=0x6b8910) at fileops.c:193
#1  0x00007ffff6d95b10 in _IO_new_fclose (fp=0x6b8910) at iofclose.c:59
#2  0x00007ffff7a76f79 in close_the_file (f=f@entry=0x7ffff7f226f0) at /usr/src/debug/Python-2.7.5/Objects/fileobject.c:456
#3  0x00007ffff7a77f78 in file_dealloc (f=0x7ffff7f226f0) at /usr/src/debug/Python-2.7.5/Objects/fileobject.c:619
#4  0x00007ffff7aab8c3 in tupledealloc (op=0x7ffff7eb7320) at /usr/src/debug/Python-2.7.5/Objects/tupleobject.c:238
#5  0x00007ffff7af4350 in do_call (nk=<optimized out>, na=<optimized out>, pp_stack=0x7fffffffdff0, func=<optimized out>) at /usr/src/debug/Python-2.7.5/Python/ceval.c:4628
#6  call_function (oparg=<optimized out>, pp_stack=0x7fffffffdff0) at /usr/src/debug/Python-2.7.5/Python/ceval.c:4431
#7  PyEval_EvalFrameEx (f=f@entry=Frame 0x6b8760, for file t.py, line 4, in <module> (), throwflag=throwflag@entry=0) at /usr/src/debug/Python-2.7.5/Python/ceval.c:3040
#8  0x00007ffff7af6e3d in PyEval_EvalCodeEx (co=co@entry=0x7ffff7f21e30, 
    globals=globals@entry={'auparse': <module at remote 0x7ffff7ed8bb0>, '__builtins__': <module at remote 0x7ffff7f9eb08>, '__file__': 't.py', '__package__': None, '__name__': '__main__', '__doc__': None}, 
    locals=locals@entry={'auparse': <module at remote 0x7ffff7ed8bb0>, '__builtins__': <module at remote 0x7ffff7f9eb08>, '__file__': 't.py', '__package__': None, '__name__': '__main__', '__doc__': None}, 
    args=args@entry=0x0, argcount=argcount@entry=0, kws=kws@entry=0x0, kwcount=kwcount@entry=0, defs=defs@entry=0x0, defcount=defcount@entry=0, closure=closure@entry=0x0)
    at /usr/src/debug/Python-2.7.5/Python/ceval.c:3640
#9  0x00007ffff7af6f42 in PyEval_EvalCode (co=co@entry=0x7ffff7f21e30, 
    globals=globals@entry={'auparse': <module at remote 0x7ffff7ed8bb0>, '__builtins__': <module at remote 0x7ffff7f9eb08>, '__file__': 't.py', '__package__': None, '__name__': '__main__', '__doc__': None}, 
    locals=locals@entry={'auparse': <module at remote 0x7ffff7ed8bb0>, '__builtins__': <module at remote 0x7ffff7f9eb08>, '__file__': 't.py', '__package__': None, '__name__': '__main__', '__doc__': None})
    at /usr/src/debug/Python-2.7.5/Python/ceval.c:689
#10 0x00007ffff7b1037f in run_mod (mod=<optimized out>, filename=filename@entry=0x7fffffffe6bb "t.py", 
    globals=globals@entry={'auparse': <module at remote 0x7ffff7ed8bb0>, '__builtins__': <module at remote 0x7ffff7f9eb08>, '__file__': 't.py', '__package__': None, '__name__': '__main__', '__doc__': None}, 
    locals=locals@entry={'auparse': <module at remote 0x7ffff7ed8bb0>, '__builtins__': <module at remote 0x7ffff7f9eb08>, '__file__': 't.py', '__package__': None, '__name__': '__main__', '__doc__': None}, 
    flags=flags@entry=0x7fffffffe290, arena=arena@entry=0x6b7e90) at /usr/src/debug/Python-2.7.5/Python/pythonrun.c:1374
[...]

Comment 2 Steve Grubb 2017-08-14 21:14:48 UTC
Should be fixed in upstream commit: ab2b97dcd52e414fd2470e4248d9f6ef65d80758

As far as I could tell, this only affected the python2 bindings.

Comment 3 Steve Grubb 2017-09-20 15:03:16 UTC
Built audit-2.7.8 to address this issue.

Comment 8 errata-xmlrpc 2018-04-10 12:18:47 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0760