Description of problem: Starting setroubleshoot service, the following messages appear and then service after service start [ok] this occurs: - /var/lib/setroubleshoot/audit_listener_database.xml:3029: parser error : Input is not proper UTF-8, indicate encoding ! Bytes: 0xDF 0x28 0x2F 0x62 SELinux denied access requested by �(/bin/df). It is not Running '/usr/bin/python -E /usr/bin/sealert -s' produces: Entity: line 3031: parser error : Input is not proper UTF-8, indicate encoding ! Bytes: 0xDF 0x28 0x2F 0x62 SELinux denied access requested by �(/bin/df). It is not Both occur with selinux permissive. Version-Release number of selected component (if applicable): setroubleshoot-2.0.3-1.fc9.noarch dbus-1.1.4-1.fc9.i386 dbus-python-0.82.4-1.fc9.i386 pygtk2-2.12.1-3.fc9.i386 libxml2-python-2.6.31-1.i386 /var/log/messages contains: Jan 27 06:10:44 cirithungol setroubleshoot: [rpc.ERROR] exception parserError: xmlParseDoc() failed#012Traceback (most recent call last):#012 File "/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 940, in handle_client_io#012 self.receiver.feed(data)#012 File "/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 762, in feed#012 self.process()#012 File "/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 754, in process#012 self.dispatchFunc(self.header, self.body)#012 File "/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 972, in default_request_handler#012 self.handle_return(type, rpc_id, body)#012 File "/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 958, in handle_return#012 interface, method, args = convert_rpc_xml_to_args(body)#012 File "/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 143, in convert_rpc_xml_to_args#012 doc = libxml2.parseDoc(cmd)#012 File "/usr/lib/python2.5/site-packages/libxml2.py", line 1264, in parseDoc#012 if ret is None:raise parserError('xmlParseDoc() failed')#012parserError: xmlParseDoc() failed Jan 27 06:10:44 cirithungol setroubleshoot: [rpc.ERROR] could not send data on socket ({unix}/var/run/setroubleshoot/setroubleshoot_server socket=0xa34633c): Broken pipe Jan 27 06:10:58 cirithungol dbus: avc: received setenforce notice (enforcing=1) Jan 27 06:22:01 cirithungol setroubleshoot: [xml.ERROR] read_xml_file() libxml2.parserError: xmlParseFile() failed
Thank you for reporting this. I need some additional information. 1) what language is your system set to? If you're not sure then do this: % set | grep LANG 2) Please *attach* your current /var/lib/setroubleshoot/audit_listener_database.xml file Thank you
Created attachment 293211 [details] audit_listener_database.xml
System language is en_US.UTF-8 and has not changed (recent rawhide install, 20080121).
This bug was caused by improperly decoding an audit field. Some audit fields are encoded in hexadecimal if it's a string containing a special character. In this particular instance the field was comm=df (exe=/uar/bin/df). The 'df' value was interpreted as hex and decoded to produce the byte value 223 (0xDF) and inserted into a string, which was then inserted into the xml. The xml is encoded in utf-8 and the 0xDF byte value was interpreted as starting a multi-byte character sequence, but it wasn't and hence induced an xml decoding error. The code used to decode audit fields has been rewritten to avoid incorrect decoding.
setroubleshoot-2.0.5-1.fc8,setroubleshoot-plugins-2.0.4-1.fc8 has been submitted as an update for Fedora 8
setroubleshoot-plugins-2.0.4-3.fc8,setroubleshoot-2.0.5-2.fc8 has been submitted as an update for Fedora 8
setroubleshoot-plugins-2.0.4-3.fc8, setroubleshoot-2.0.5-2.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.