Bug 430421

Summary: setroubleshoot - audit_listener_database.xml:3029: parser error in xmlParseDoc()
Product: [Fedora] Fedora Reporter: Andrew Farris <lordmorgul>
Component: setroubleshootAssignee: John Dennis <jdennis>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: low    
Version: rawhide   
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: setroubleshoot-2.0.4 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-01-31 18:06:15 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 431768    
Attachments:
Description Flags
audit_listener_database.xml none

Description Andrew Farris 2008-01-27 22:31:57 UTC
Description of problem:
Starting setroubleshoot service, the following messages appear and then service
after service start [ok] this occurs:

 - /var/lib/setroubleshoot/audit_listener_database.xml:3029: parser error :
Input is not proper UTF-8, indicate encoding !
Bytes: 0xDF 0x28 0x2F 0x62
    SELinux denied access requested by �(/bin/df). It is not


Running '/usr/bin/python -E /usr/bin/sealert -s' produces:
Entity: line 3031: parser error : Input is not proper UTF-8, indicate encoding !
Bytes: 0xDF 0x28 0x2F 0x62
    SELinux denied access requested by �(/bin/df). It is not

Both occur with selinux permissive.

Version-Release number of selected component (if applicable):
setroubleshoot-2.0.3-1.fc9.noarch
dbus-1.1.4-1.fc9.i386
dbus-python-0.82.4-1.fc9.i386
pygtk2-2.12.1-3.fc9.i386
libxml2-python-2.6.31-1.i386


/var/log/messages contains:

Jan 27 06:10:44 cirithungol setroubleshoot: [rpc.ERROR] exception parserError:
xmlParseDoc() failed#012Traceback (most recent call last):#012  File
"/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 940, in
handle_client_io#012    self.receiver.feed(data)#012  File
"/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 762, in feed#012
   self.process()#012  File
"/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 754, in
process#012    self.dispatchFunc(self.header, self.body)#012  File
"/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 972, in
default_request_handler#012    self.handle_return(type, rpc_id, body)#012  File
"/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 958, in
handle_return#012    interface, method, args = convert_rpc_xml_to_args(body)#012
 File "/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 143, in
convert_rpc_xml_to_args#012    doc = libxml2.parseDoc(cmd)#012  File
"/usr/lib/python2.5/site-packages/libxml2.py", line 1264, in parseDoc#012    if
ret is None:raise parserError('xmlParseDoc() failed')#012parserError:
xmlParseDoc() failed
Jan 27 06:10:44 cirithungol setroubleshoot: [rpc.ERROR] could not send data on
socket ({unix}/var/run/setroubleshoot/setroubleshoot_server socket=0xa34633c):
Broken pipe
Jan 27 06:10:58 cirithungol dbus: avc:  received setenforce notice (enforcing=1)
Jan 27 06:22:01 cirithungol setroubleshoot: [xml.ERROR] read_xml_file()
libxml2.parserError: xmlParseFile() failed

Comment 1 John Dennis 2008-01-28 15:46:27 UTC
Thank you for reporting this. I need some additional information.

1) what language is your system set to? If you're not sure then do this:
% set | grep LANG

2) Please *attach* your current
/var/lib/setroubleshoot/audit_listener_database.xml file

Thank you

Comment 2 Andrew Farris 2008-01-28 22:17:19 UTC
Created attachment 293211 [details]
audit_listener_database.xml

Comment 3 Andrew Farris 2008-01-28 22:18:25 UTC
System language is en_US.UTF-8 and has not changed (recent rawhide install,
20080121).

Comment 4 John Dennis 2008-01-31 18:06:15 UTC
This bug was caused by improperly decoding an audit field. Some audit fields are
encoded in hexadecimal if it's a string containing a special character. In this
particular instance the field was comm=df (exe=/uar/bin/df). The 'df' value was
interpreted as hex and decoded to produce the byte value 223 (0xDF) and inserted
into a string, which was then inserted into the xml. The xml is encoded in utf-8
and the 0xDF byte value was interpreted as starting a multi-byte character
sequence, but it wasn't and hence induced an xml decoding error.

The code used to decode audit fields has been rewritten to avoid incorrect decoding.

Comment 5 Fedora Update System 2008-02-13 16:23:40 UTC
setroubleshoot-2.0.5-1.fc8,setroubleshoot-plugins-2.0.4-1.fc8 has been submitted as an update for Fedora 8

Comment 6 Fedora Update System 2008-02-26 02:18:39 UTC
setroubleshoot-plugins-2.0.4-3.fc8,setroubleshoot-2.0.5-2.fc8 has been submitted as an update for Fedora 8

Comment 7 Fedora Update System 2008-02-28 21:42:48 UTC
setroubleshoot-plugins-2.0.4-3.fc8, setroubleshoot-2.0.5-2.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.