Bug 431768 - setroubleshoot - audit_listener_database.xml:3029: parser error in xmlParseDoc()
setroubleshoot - audit_listener_database.xml:3029: parser error in xmlParseDoc()
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: setroubleshoot (Show other bugs)
5.2
All Linux
low Severity low
: rc
: ---
Assigned To: John Dennis
:
Depends On: 430421
Blocks:
  Show dependency treegraph
 
Reported: 2008-02-06 16:17 EST by John Dennis
Modified: 2008-05-21 10:26 EDT (History)
0 users

See Also:
Fixed In Version: RHSA-2008-0061
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-05-21 10:26:01 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description John Dennis 2008-02-06 16:17:20 EST
+++ This bug was initially created as a clone of Bug #430421 +++

Description of problem:
Starting setroubleshoot service, the following messages appear and then service
after service start [ok] this occurs:

 - /var/lib/setroubleshoot/audit_listener_database.xml:3029: parser error :
Input is not proper UTF-8, indicate encoding !
Bytes: 0xDF 0x28 0x2F 0x62
    SELinux denied access requested by �(/bin/df). It is not


Running '/usr/bin/python -E /usr/bin/sealert -s' produces:
Entity: line 3031: parser error : Input is not proper UTF-8, indicate encoding !
Bytes: 0xDF 0x28 0x2F 0x62
    SELinux denied access requested by �(/bin/df). It is not

Both occur with selinux permissive.

Version-Release number of selected component (if applicable):
setroubleshoot-2.0.3-1.fc9.noarch
dbus-1.1.4-1.fc9.i386
dbus-python-0.82.4-1.fc9.i386
pygtk2-2.12.1-3.fc9.i386
libxml2-python-2.6.31-1.i386


/var/log/messages contains:

Jan 27 06:10:44 cirithungol setroubleshoot: [rpc.ERROR] exception parserError:
xmlParseDoc() failed#012Traceback (most recent call last):#012  File
"/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 940, in
handle_client_io#012    self.receiver.feed(data)#012  File
"/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 762, in feed#012
   self.process()#012  File
"/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 754, in
process#012    self.dispatchFunc(self.header, self.body)#012  File
"/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 972, in
default_request_handler#012    self.handle_return(type, rpc_id, body)#012  File
"/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 958, in
handle_return#012    interface, method, args = convert_rpc_xml_to_args(body)#012
 File "/usr/lib/python2.5/site-packages/setroubleshoot/rpc.py", line 143, in
convert_rpc_xml_to_args#012    doc = libxml2.parseDoc(cmd)#012  File
"/usr/lib/python2.5/site-packages/libxml2.py", line 1264, in parseDoc#012    if
ret is None:raise parserError('xmlParseDoc() failed')#012parserError:
xmlParseDoc() failed
Jan 27 06:10:44 cirithungol setroubleshoot: [rpc.ERROR] could not send data on
socket ({unix}/var/run/setroubleshoot/setroubleshoot_server socket=0xa34633c):
Broken pipe
Jan 27 06:10:58 cirithungol dbus: avc:  received setenforce notice (enforcing=1)
Jan 27 06:22:01 cirithungol setroubleshoot: [xml.ERROR] read_xml_file()
libxml2.parserError: xmlParseFile() failed

-- Additional comment from jdennis@redhat.com on 2008-01-28 10:46 EST --
Thank you for reporting this. I need some additional information.

1) what language is your system set to? If you're not sure then do this:
% set | grep LANG

2) Please *attach* your current
/var/lib/setroubleshoot/audit_listener_database.xml file

Thank you

-- Additional comment from lordmorgul@gmail.com on 2008-01-28 17:17 EST --
Created an attachment (id=293211)
audit_listener_database.xml


-- Additional comment from lordmorgul@gmail.com on 2008-01-28 17:18 EST --
System language is en_US.UTF-8 and has not changed (recent rawhide install,
20080121).

-- Additional comment from jdennis@redhat.com on 2008-01-31 13:06 EST --
This bug was caused by improperly decoding an audit field. Some audit fields are
encoded in hexadecimal if it's a string containing a special character. In this
particular instance the field was comm=df (exe=/uar/bin/df). The 'df' value was
interpreted as hex and decoded to produce the byte value 223 (0xDF) and inserted
into a string, which was then inserted into the xml. The xml is encoded in utf-8
and the 0xDF byte value was interpreted as starting a multi-byte character
sequence, but it wasn't and hence induced an xml decoding error.

The code used to decode audit fields has been rewritten to avoid incorrect decoding.
Comment 2 RHEL Product and Program Management 2008-02-06 16:27:18 EST
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.
Comment 6 errata-xmlrpc 2008-05-21 10:26:01 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2008-0061.html

Note You need to log in before you can comment on or make changes to this bug.