v1.0.0-rc5

[jw3]

File Access Policy Analyzer v1.0.0-RC5

This release completes all features marked for v1.0.

Changes since the previous v1.0.0-rc4 release

• Build updates for epel8 (Build updates for epel8 #794)
• Rust logging (Rust logging #811)
• Allow relative path user guide images (Allow relative path user guide images #795)
• Customizable initial view (Customizable initial application view loading from the config file #789)
• Shareable Profiler Output (Shareable Profiler Output #813)
• Profiler fixes (Profiler fixes #809)
• Preserve state of Rule tree views (Preserve state of Rule tree views #799)
• Profiler v2 integration (Profiler v2 integration #770)
• Turn off rule validation toasters (Turn off rule validation toasters #805)
• Rust 1.62.1 (Rust 1.62.1 #806)
• Reorganizing Menus (Reorganizing Menus #800)
• Manual invocation of trust search (Manual invocation of trust search #738)
• Updating Debug Log menu item (Updating Debug Log menu item #790)
• Bindings for app config path (Bindings for app config path #788)
• Use Badgen CI badge (Use Badgen CI badge #785)
• Reduce trust sync thread count (Reduce trust sync thread count #783)
• Fix check of empty trust db (Fix check of empty trust db #782)
• Build updates (Build updates #772)

---

This discussion was created from the release v1.0.0-rc5.

[jw3]

Testing tips

• use MaxRuntimeSec and disable restarts to protect against fapolicyd lockouts
• script complex testing scenarios in single file and execute them in the profiler to observe behavior
• use --noautoremove when reinstalling the rpm

[egbicker]

Just found this discussion, the --noautoremove seems to work for me. What kind of testing scenarios were you thinking?

[jw3]

General use. Run through all functions of the application.

[jw3]

@tparchambault there are a few images you added in the wiki that need refreshed due to the menu rearrangement. If you have time while testing to snap those and upload it would be a welcomed addition.

[jw3]

I updated these this morning

[dorschs57]

@jw3 I'm seeing an issue where the logs are not loaded into the analyzer when I use the Analyze button after a profiler run. It switches to the analyzer view, but its empty.

1. run profiler with
   • Execution File: ls
   • Arguments: /tmp
2. after profiler finished click Analyze Output

[jw3]

Works for me, on rhel 8.6. Is there anything in the output view under the fapolicyd log? Anything in the file written to disk (the path is indicated beside the fapolicyd header).

[jw3]

@tparchambault @egbicker please try this test and report your results

[tparchambault]

Might have to set the log format in the fapolicyd config. From: John Wass ***@***.***> Sent: Tuesday, March 14, 2023 2:46 PM To: ctc-oss/fapolicy-analyzer ***@***.***> Cc: Archambault, Thomas ***@***.***>; Mention ***@***.***> Subject: Re: [ctc-oss/fapolicy-analyzer] v1.0.0-rc5 (Discussion #814) Works for me, on rhel 8.6. Is there anything in the output view under the fapolicyd log? Anything in the file written to disk (the path is indicated beside the fapolicyd header). — Reply to this email directly, view it on GitHub<#814 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AIY7NL474QVTGNMAQI7QAWDW4C4GLANCNFSM6AAAAAAVYGSFAY>. You are receiving this because you were mentioned.Message ID: ***@***.***> This message and any files transmitted within are intended solely for the addressee or its representative and may contain company sensitive information.  If you are not the intended recipient, notify the sender immediately and delete this message.  Publication, reproduction, forwarding, or content disclosure is prohibited without the consent of the original sender and may be unlawful. Concurrent Technologies Corporation and its Affiliates. www.ctc.com  1-800-282-4392

[dorschs57]

One other issue I'm seeing is when I go from Profiler to Analyze then back to Profiler, it keeps my Target Output from the previous run. However the Target section at the top of the output is zero'd out.

[jw3]

Ok, I didnt realize the syslog format drove the debug output.

[jw3]

However the Target section at the top of the output is zero'd out.

Confirmed here too.

Probably the order the dialog components are deserialized. Create a bug, v1.1

[tparchambault]

Unfortunately man fapolicyd.conf isn't more specific than:

syslog_format
        This option controls how the output from the access decision  is formatted...

[jw3]

Unfortunately man fapolicyd.conf isn't more specific than:

Maybe if the rule has syslog on the decision is uses the syslog format? I'd have to look at the code.

Doesnt have any impact on 1.0, just a setup issue. The notice to change that config is in the readme, known issues, and user guide (better check the guide...).

[jw3]

I added #817 for the backend on this. I've always disliked the readme notice, but it was never a priority. v1.1.

[dorschs57]

I added #818 for the issue with the lost Target info.

[egbicker]

I'm getting this when I try opening the User Guide. The window pops up with a blank area and then this error pops out.

[egbicker]

Also clicking the Help>About menu doesn't seem to let me close the pop up

[jw3]

The user guide is displaying for me. Seems sluggish, but complete.

Also clicking the Help>About menu doesn't seem to let me close the pop up

This is a golden oldie, on RHEL you have to press esc to close that

[egbicker]

This is a golden oldie, on RHEL you have to press esc to close that

That'll do it haha

[dorschs57]

Help working for me too. It does include this at the bottom so you know its good

[tparchambault]

Over RHEL8.6:

• User-Guide.html looks good here.

• Testing /tmp/my-ls with PATH env var set to search in the pwd populated Profiler args text block correctly:

[dorschs57]

Did you navigate to the Analysis view and then back to the Profiler?

[tparchambault]

I did not... Did not realize that you alternated tool views.

[tparchambault]

Ok. Duplicated @dorschs57 's issue. Redraws text block with all values = None on RHEL8.6.

[tparchambault]

I'm getting this when I try opening the User Guide. The window pops up with a blank area and then this error pops out.

@egbicker You are on Fedora it appears; Don't see it on RHEL86. What version? 37? I may be able to vagrant up and see if I can dup it.

[egbicker]

Yeah I'm on 37 but if no one else is seeing it and its an X error, I'm willing to bet its a local setup issue somewhere but a second pair of eyes probably not a bad idea

[tparchambault]

Well, it is a valid datapoint... I've got to vagrant up to capture some images so I'll try and dup it.

[tparchambault]

@egbicker, the first eror is related to the DBus

and its an X error

so maybe bad arg being passed to the WebKitWebProcess but I'm speculating.

[tparchambault]

User-Guide rendered correctly for me over vagrant FC37 instance.

[jw3]

All - It would be good to test on desktop environment to verify the .desktop file install and operation.

[jw3]

All- So far, so good. No blocking findings.

The docs have been updated with new images where needed, so I have prepared a v1.0.0 draft release.

Please start testing the rpms from the draft release here.

I will prepare the Fedora release and get a PR created on the RPM repo. We can test that PR prior to merging.

Then after merging it will go out to the testing repositories. Once that is ready we can test from there.

If something ends up needing fixed, we will rebuild and start over.

[jw3]

Fedora epel8 pr build available

https://koji.fedoraproject.org/koji/taskinfo?taskID=98720400

Please test

[tparchambault]

Fedora epel8 pr build available

https://koji.fedoraproject.org/koji/taskinfo?taskID=98720400

Please test

Installed https://koji.fedoraproject.org/koji/taskinfo?taskID=98720400 over RHEL8.6.

In general, installed and executed as expected. Help was good, profiler worked as expected. One idiosyncrasy that I've seen is when attempting to deploy a changeset when fapolicyd is not executing, the toaster notification states that an error has occurred. Upon restarting the application, the deployed changed is visible in the Ancillary Trust view indicating that the changeset was deployed w/o error. I'll retest tomorrow.

[jw3]

One idiosyncrasy that I've seen is when attempting to deploy a changeset when fapolicyd is not executing, the toaster notification states that an error has occurred.

I noticed something around this too. Didnt have time to drill into it. Anticipating a bug in the service control due to not considering a state of the service while transitioning. File a bug if you can nail it down.

[dorschs57]

One idiosyncrasy that I've seen is when attempting to deploy a changeset when fapolicyd is not executing, the toaster notification states that an error has occurred.

I have not been able to reproduce this but I did find issue #827

[egbicker]

I can reproduce Shawn's issue, haven't found Tom's yet. @tparchambault do you have a good way to reproduce?

[tparchambault]

I can reproduce Shawn's issue, haven't found Tom's yet. @tparchambault do you have a good way to reproduce?

I have seen it a number of times, but it is intermittent. I am modifying the Ancillary Trust dbase with fapolicyd stopped.. I don't know if the state of the fapolicyd being stopped is a prerequisite, that just happens to be the state of fapolicyd when I notice the issue.

[egbicker]

I didn't find anything new on the release RPM on FC37 today

[dorschs57]

but I did find issue #827

Found #828 when I was testing session saving and loading. Might be related to #827.

[egbicker]

Found #829 trying to replicate Tom's issue

[tparchambault]

On RHEL86, V1.0.0, the fapolicyd state is not maintained when loading a user session json file. #833

[tparchambault]

Issue #834 opened.

On RHEL86, V1.0.0, the yours-truly user, inadvertently connected to the target system via ssh however yours-truly omitted the -X X11 forwarding option. This resulted in a seg fault and some less than obvious error messaging. I don't consider this a high priority issue.

The console and journald messaging was non-obvious in terms of the cause of the issue or a potential solution. This was the closest that I can find to lead me to a graphics X11 problem:

Unable to init server: Could not connect: Connection refused
Unable to init server: Could not connect: Connection refused

along with the journald snippet, that got me to look at the gfx connection: error 4 in libgtk-3.so.0.2200.30

I don't know if this can be detected from the client side env and the user alerted appropriately.

[tparchambault]

On Rhel86 w/V1.0 from EPEL-testing:

Since the fapolicy-analyzer will always be executing w/the euid of the root user, internal links that invoke an external browser may not work consistently depending on which user is the owner of the graphics session.

Specifically, the non-root user toma ssh session that invokes fapolicy-analyzer via the CL, will need to authenticate to acquire superuser privileges. The user then invokes the Help > About menu items to bring up the About dialog, then attempts to navigate through either the fapolicy-analyzer wiki or the GNU General Public License links will be denied and/or met with messaging on the order of

Running Firefox as root in a regular user's session is not supported.  ($XAUTHORITY is /home/toma/.Xauthority which is owned by toma.)

[tparchambault]

Also sshing in as a non-root user and attempting to navigate any help (User-Guide) links, the help window appears to not respond any longer to user input with journalctl -f displaying:

Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 1   0x7f3c16f488fc
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 2   0x7f3c151fce60
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 3   0x7f3c1507c151
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 4   0x7f3c150702e0
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 5   0x7f3c1520b79e
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 6   0x7f3c1536eb98
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 7   0x7f3c1536fdbd
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 8   0x7f3c15371427
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 9   0x7f3c1291506c
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 10  0x7f3c129730ad
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 11  0x7f3c12973df3
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 12  0x7f3c0e65495d g_main_context_dispatch
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 13  0x7f3c0e654d18
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 14  0x7f3c0e655042 g_main_loop_run
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 15  0x7f3c129741d0 WTF::RunLoop::run()
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 16  0x7f3c15341717
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 17  0x7f3c0d1cbcf3 __libc_start_main
Mar 22 20:07:39 son-o-wimpy WebKitNetworkProcess[12789]: 18  0x56122a6da8be

selinux is in enforcing mode. Repeating the above in permissive` mode, there was no change in the symptoms.

The main application window however continues to remain active and appears to respond correctly to user interaction.

[tparchambault]

A ticket has not been opened wrt this observation, but it probably is worth a few minutes of discussion in the design meeting.

[tparchambault]

The fapolicyd daemon is being started when deploying an ATDB change-set although its pre-deployment state was stopped. Opened #836

[yashu1wwww]

GitHub Live Profile Visits Count & Followers Count Tool(Used Ai)
https://shorturl.at/jCPX3

👉GitHub Acc:15k+ Porfile Visits Count
50+ Projects
https://github.com/yashu1wwww