Bug 431768

+++ This bug was initially created as a clone of Bug #430421 +++

Description of problem:
Starting setroubleshoot service, the following messages appear and then service
after service start [ok] this occurs:

 - /var/lib/setroubleshoot/audit_listener_database.xml:3029: parser error :
Input is not proper UTF-8, indicate encoding !
Bytes: 0xDF 0x28 0x2F 0x62
    SELinux denied access requested by �(/bin/df). It is not


Running '/usr/bin/python -E /usr/bin/sealert -s' produces:
Entity: line 3031: parser error : Input is not proper UTF-8, indicate encoding !
Bytes: 0xDF 0x28 0x2F 0x62
    SELinux denied access requested by �(/bin/df). It is not

Both occur with selinux permissive.

Version-Release number of selected component (if applicable):
setroubleshoot-2.0.3-1.fc9.noarch
dbus-1.1.4-1.fc9.i386
dbus-python-0.82.4-1.fc9.i386
pygtk2-2.12.1-3.fc9.i386
libxml2-python-2.6.31-1.i386


/var/log/messages contains:

Jan 27 06:10:44 cirithungol setroubleshoot: [rpc.ERROR] exception parserError:
xmlParseDoc() failed#012Traceback (most recent call last):#012  File
"/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 940, in
handle_client_io#012    self.receiver.feed(data)#012  File
"/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 762, in feed#012
   self.process()#012  File
"/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 754, in
process#012    self.dispatchFunc(self.header, self.body)#012  File
"/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 972, in
default_request_handler#012    self.handle_return(type, rpc_id, body)#012  File
"/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 958, in
handle_return#012    interface, method, args = convert_rpc_xml_to_args(body)#012
 File "/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 143, in
convert_rpc_xml_to_args#012    doc = libxml2.parseDoc(cmd)#012  File
"/usr/lib/python2.5/site-packages/libxml2.py", line 1264, in parseDoc#012    if
ret is None:raise parserError('xmlParseDoc() failed')#012parserError:
xmlParseDoc() failed
Jan 27 06:10:44 cirithungol setroubleshoot: [rpc.ERROR] could not send data on
socket ({unix}/var/run/setroubleshoot/setroubleshoot_server socket=0xa34633c):
Broken pipe
Jan 27 06:10:58 cirithungol dbus: avc:  received setenforce notice (enforcing=1)
Jan 27 06:22:01 cirithungol setroubleshoot: [xml.ERROR] read_xml_file()
libxml2.parserError: xmlParseFile() failed

-- Additional comment from jdennis on 2008-01-28 10:46 EST --
Thank you for reporting this. I need some additional information.

1) what language is your system set to? If you're not sure then do this:
% set | grep LANG

2) Please *attach* your current
/var/lib/setroubleshoot/audit_listener_database.xml file

Thank you

-- Additional comment from lordmorgul on 2008-01-28 17:17 EST --
Created an attachment (id=293211)
audit_listener_database.xml


-- Additional comment from lordmorgul on 2008-01-28 17:18 EST --
System language is en_US.UTF-8 and has not changed (recent rawhide install,
20080121).

-- Additional comment from jdennis on 2008-01-31 13:06 EST --
This bug was caused by improperly decoding an audit field. Some audit fields are
encoded in hexadecimal if it's a string containing a special character. In this
particular instance the field was comm=df (exe=/uar/bin/df). The 'df' value was
interpreted as hex and decoded to produce the byte value 223 (0xDF) and inserted
into a string, which was then inserted into the xml. The xml is encoded in utf-8
and the 0xDF byte value was interpreted as starting a multi-byte character
sequence, but it wasn't and hence induced an xml decoding error.

The code used to decode audit fields has been rewritten to avoid incorrect decoding.