Only Bytecode, No .py Files

[John Roth]

On Jul 27, 1:10 am, Thomas Rachel <nutznetz-0c1b6768-bfa9-48d5-
a470-7603bd3aa... at spamschutz.glglgl.de> wrote:
> Am 26.07.2011 17:19 schrieb Eldon Ziegler:
>
> > Is there a way to have the Python processor look only for bytecode
> > files, not .py files? We are seeing huge numbers of Linux audit messages
> > on production system on which only bytecode files are stored. The audit
> > subsystem is recording each open failure.
>
> Is that really a problem? AFAIK there are many failing open() calls on
> the start of every program.
>
> E.g.
>
> open("/lib/bash/4.1/tls/i686/sse2/libncurses.so.5", O_RDONLY) = -1
> ENOENT (No such file or directory)
> stat64("/lib/bash/4.1/tls/i686/sse2", 0xbfd3a350) = -1 ENOENT (No such
> file or directory)
> open("/lib/bash/4.1/tls/i686/libncurses.so.5", O_RDONLY) = -1 ENOENT (No
> such file or directory)
> stat64("/lib/bash/4.1/tls/i686", 0xbfd3a350) = -1 ENOENT (No such file
> or directory)
> open("/lib/bash/4.1/tls/sse2/libncurses.so.5", O_RDONLY) = -1 ENOENT (No
> such file or directory)
> stat64("/lib/bash/4.1/tls/sse2", 0xbfd3a350) = -1 ENOENT (No such file
> or directory)
> open("/lib/bash/4.1/tls/libncurses.so.5", O_RDONLY) = -1 ENOENT (No such
> file or directory)
> stat64("/lib/bash/4.1/tls", 0xbfd3a350) = -1 ENOENT (No such file or
> directory)
> open("/lib/bash/4.1/i686/sse2/libncurses.so.5", O_RDONLY) = -1 ENOENT
> (No such file or directory)
> stat64("/lib/bash/4.1/i686/sse2", 0xbfd3a350) = -1 ENOENT (No such file
> or directory)
> open("/lib/bash/4.1/i686/libncurses.so.5", O_RDONLY) = -1 ENOENT (No
> such file or directory)
> stat64("/lib/bash/4.1/i686", 0xbfd3a350) = -1 ENOENT (No such file or
> directory)
> open("/lib/bash/4.1/sse2/libncurses.so.5", O_RDONLY) = -1 ENOENT (No
> such file or directory)
> stat64("/lib/bash/4.1/sse2", 0xbfd3a350) = -1 ENOENT (No such file or
> directory)
> open("/lib/bash/4.1/libncurses.so.5", O_RDONLY) = -1 ENOENT (No such
> file or directory)
> stat64("/lib/bash/4.1", 0xbfd3a350)     = -1 ENOENT (No such file or
> directory)
> open("/lib/libncurses.so.5", O_RDONLY)  = 3
>
> is a part of what happens if I start the MySQL client,
>
> Even starting the bash results in
>
> open("/lib/bash/4.1/tls/i686/sse2/libreadline.so.6", O_RDONLY) = -1
> ENOENT (No such file or directory)
> stat64("/lib/bash/4.1/tls/i686/sse2", 0xbfe0c4d0) = -1 ENOENT (No such
> file or directory)
> open("/lib/bash/4.1/tls/i686/libreadline.so.6", O_RDONLY) = -1 ENOENT
> (No such file or directory)
> stat64("/lib/bash/4.1/tls/i686", 0xbfe0c4d0) = -1 ENOENT (No such file
> or directory)
> open("/lib/bash/4.1/tls/sse2/libreadline.so.6", O_RDONLY) = -1 ENOENT
> (No such file or directory)
> stat64("/lib/bash/4.1/tls/sse2", 0xbfe0c4d0) = -1 ENOENT (No such file
> or directory)
> open("/lib/bash/4.1/tls/libreadline.so.6", O_RDONLY) = -1 ENOENT (No
> such file or directory)
> stat64("/lib/bash/4.1/tls", 0xbfe0c4d0) = -1 ENOENT (No such file or
> directory)
> open("/lib/bash/4.1/i686/sse2/libreadline.so.6", O_RDONLY) = -1 ENOENT
> (No such file or directory)
> stat64("/lib/bash/4.1/i686/sse2", 0xbfe0c4d0) = -1 ENOENT (No such file
> or directory)
> open("/lib/bash/4.1/i686/libreadline.so.6", O_RDONLY) = -1 ENOENT (No
> such file or directory)
> stat64("/lib/bash/4.1/i686", 0xbfe0c4d0) = -1 ENOENT (No such file or
> directory)
> open("/lib/bash/4.1/sse2/libreadline.so.6", O_RDONLY) = -1 ENOENT (No
> such file or directory)
> stat64("/lib/bash/4.1/sse2", 0xbfe0c4d0) = -1 ENOENT (No such file or
> directory)
> open("/lib/bash/4.1/libreadline.so.6", O_RDONLY) = -1 ENOENT (No such
> file or directory)
> stat64("/lib/bash/4.1", 0xbfe0c4d0)     = -1 ENOENT (No such file or
> directory)
> open("/etc/ld.so.cache", O_RDONLY)      = 3
>
> So can it really be such a huge problem?
>
> Thomas

Two comments. First, your trace isn't showing attempts to open .py
files, it's showing attempts to open the Curses library in the bash
directory. Maybe you also have a problem with the .py files, but it
isn't documented in this trace. It's also not showing the program
that's causing the failing open.

Second, the audit program is an idiot. There are lots of programs
which use the "easier to ask forgiveness" pattern and test for the
existence of optional files by trying to open them. This may be what
Bash is doing.

John Roth