Date:      2009-01-22 09:10
Subject:   Redesign of setroubleshooter.
Options:   preformatted
ItemID:    101

One of the things that I&nbsp;do not like about SELinux troubleshooter (setroubleshoot) is that when I&nbsp;run top and look at which applications are using the most memory, this is what I see:<br /><br /><br /><img src="http://people.fedoraproject.org/~dwalsh/SELinux/top.jpg" alt="" /><br /><br />Having setroubleshootd and sealert both in the top 7 memory processes on a Fedora 10 system, is not good.&nbsp; The livecd guys also complain about the amount of memory setroubleshoot is using.&nbsp; Anyone building small memory systems can not use setroubleshoot.&nbsp;&nbsp;&nbsp; To make things worse, both of these applications are sitting idle most of the time.&nbsp; setroubleshootd is waiting for AVCs from the audit system and sealert is waiting for setroubleshood to tell it to put up the star.<br /><br />These two programs use this much memory because they are written in Python.&nbsp; I did not want to rewrite the bulk of this code in C, especially since the plugins are all in python, I hate writing C, and rewriting setroubleshoot was not a priority.&nbsp; <br /><br /> I wanted to change the code so that the python code was running only when the user was actively using the browser or setroubleshootd was processing an AVC.&nbsp; <br /><br />First I wrote seapplet, which is just a C program that listens for DBus signals from setroubleshootd, and then puts up the star.&nbsp; &nbsp;If the user clicks on the star, seapplet launches the sealert browser, which talks to setroubleshootd, the same way it always has.&nbsp; This eliminated the need to run&nbsp; sealert all of the time, and used a fraction of the memory, but I&nbsp;still had setroubleshootd running.&nbsp;&nbsp;<br /><br />Next, I changed sealert to use DBus&nbsp; activation to launch setroubleshootd.&nbsp;&nbsp;&nbsp; I wrote a new audit plugin in C, sedispatch, with the help of Steve Grubb.&nbsp; This plugin gets all messages from the audit system and uses the audit library to search for AVC&nbsp;messages.&nbsp; When it finds an AVC&nbsp;message, it uses DBus to forward the AVC&nbsp;message to setroubleshootd.&nbsp; DBus starts setroubleshootd if it is not running. &nbsp;&nbsp;I added an alarm to setroubleshootd to shut it down if no one is connected to it and it has not received an AVC&nbsp;message for 10 seconds. &nbsp;This prevents setroubleshoot starting and stopping if a flood of AVC&nbsp;messages comes in.<br /><br />Fedora 11/Rawhide has the new version of setroubleshoot.&nbsp; <br /><br />On a freshly installed F11 system sedispatch will be running waiting for an AVC message, and if a user is logged in seapplet will be running in the task bar.&nbsp; <br /><br />Next I would like to make some GUI enhancements to setroubleshoot.&nbsp; M&aacute;ir&iacute;&shy;n Duffy has made some nice mock ups of a new GUI.&nbsp;&nbsp; If anyone wants to try their hand at python coding, patches will be gladly accepted.&nbsp;&nbsp; Volunteers???<br /><br /><a href="https://fedoraproject.org/wiki/Design/SETroubleshootUsabilityImprovements" class="moz-txt-link-freetext">https://fedoraproject.org/wiki/Design/SETroubleshootUsabilityImprovements</a> <br /><br />Finally I&nbsp;would like to get to the point where setroubleshoot could differentiate between harmless SELinux failures and AVCs that clearly indicate an intruder.&nbsp;&nbsp; For example, no confined domain should ever attempt to turn SELinux enforcing mode off.&nbsp; If the system ever sees this AVC, it should indicate with a red star that something really bad is happening and should advise the user to take immediate action.&nbsp; <br /><br />