#!/usr/bin/bash

. /usr/share/restraint/plugins/helpers

AVC_FILE=/var/lib/restraint/avc_since
PLUGIN=$(basename $0)

if [ -z "$RSTRNT_RESULT_URL" ]; then
    rstrnt_crit "RSTRNT_RESULT_URL is not defined!"
    exit 1
fi

if [ -x /usr/sbin/selinuxenabled ] && ! selinuxenabled; then
   rstrnt_info "selinux disabled, no avc check.."
   exit
fi

TMPDIR=$(mktemp -d)
# report selinux status
sestatus >$TMPDIR/avc.log
# report selinux policy rpm
rpm -q selinux-policy >>$TMPDIR/avc.log

if [ -e "$AVC_FILE" ]; then
    SECONDS=$(stat -c%Y $AVC_FILE)
    # MM/DD/YYYY may not be correct if non en_* locale is used. Always
    # use en_US for consistency:
    AVC_SINCE=$(LC_ALL=en_US.UTF-8 date "+-ts %m/%d/%Y %H:%M:%S" --date="@$SECONDS")
fi

ausearch -m AVC -m USER_AVC -m SELINUX_ERR -sv no $AVC_SINCE >>$TMPDIR/avc.log
RC=$?
if [ $RC == 0 ]; then
    rstrnt-report-result --no-plugins -o $TMPDIR/avc.log $TEST/$PLUGIN FAIL $RC
else
    rstrnt-report-log --server $RSTRNT_RESULT_URL -l $TMPDIR/avc.log
fi

rm -rf $TMPDIR
