From 0c202dea03b0272d0c870fa03f4ba816e4aa6039 Mon Sep 17 00:00:00 2001
From: Vit Mojzis <vmojzis@redhat.com>
Date: Dec 10 2019 15:10:38 +0000
Subject: framework: Handle sockets with abstract path properly


Abstract socket paths start with \0, which caused os.stat() to crash
Replace the \0 symbol(s) with @ to denote this is not a filesystem path.

Fixes:
  # cat avc

  type=AVC msg=audit(1574094303.139:1096): avc:  denied  { sendto } for  pid=18278 comm="dcbtool" path=002F636F6D2F696E74656C2F6C6C64706164 scontext=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:lldpad_t:s0 tclass=unix_dgram_socket permissive=0
  #sealert -a avc
  100% done
  embedded null byte
  100% done
  found 0 alerts in avc

  AVC analysis is not generated!

---

diff --git a/framework/src/setroubleshoot/audit_data.py b/framework/src/setroubleshoot/audit_data.py
index 9185c85..746bc61 100644
--- a/framework/src/setroubleshoot/audit_data.py
+++ b/framework/src/setroubleshoot/audit_data.py
@@ -918,6 +918,10 @@ class AVC:
                 match = self.pipe_instance_path_re.search(path)
                 if match:
                     path = self.tclass
+                # abstract socket paths start with '\0'
+                if path[0] == '\0':
+                    path = "@" + path.strip('\0')
+
 
         self.tpath = path