[PATCH] multiple nodes patch
LC Bruzenak
lenny at magitekltd.com
Mon Jun 8 16:27:16 UTC 2009
On Sat, 2009-06-06 at 08:27 -0400, Steve Grubb wrote:
> On Friday 05 June 2009 05:52:52 pm LC Bruzenak wrote:
> > This seems to work fine with multiple nodes allowed.
> >
> > Signed-off-by: Lenny Bruzenak <lenny at magitekltd.com>
>
> Lenny, thanks for the patch. Ideally, I would like to have seen this use the
> string linked list code that's already in ausearch so that we don't have 2
> implementations of the same thing. The API for it is in ausearch-string.h and
> its already linked in.
>
> -Steve
OK, let's try this one.
Thanks,
LCB.
Signed-off-by: Lenny Bruzenak <lenny at magitekltd.com>
diff -up ./docs/aureport.8.orig ./docs/aureport.8
--- ./docs/aureport.8.orig 2009-06-05 16:15:58.000000000 -0500
+++ ./docs/aureport.8 2009-06-05 16:16:31.000000000 -0500
@@ -55,7 +55,7 @@ Report about account modifications
Report about Mandatory Access Control (MAC) events
.TP
.BR \-\-node \ \fInode-name\fP
-Only select events originating from \fInode name\fP string for processing in the reports. The default is to include all nodes.
+Only select events originating from \fInode name\fP string for processing in the reports. The default is to include all nodes. Multiple nodes are allowed.
.TP
.BR \-p ,\ \-\-pid
Report about processes
diff -up ./docs/ausearch.8.orig ./docs/ausearch.8
--- ./docs/ausearch.8.orig 2009-06-05 16:14:29.000000000 -0500
+++ ./docs/ausearch.8 2009-06-05 16:40:51.000000000 -0500
@@ -5,7 +5,7 @@ ausearch \- a tool to query audit daemon
.B ausearch
.RI [ options ]
.SH DESCRIPTION
-\fBausearch\fP is a tool that can query the audit daemon logs based for events based on different search criteria. The ausearch utility can also take input from stdin as long as the input is the raw log data. Each commandline option given forms an "and" statement. For example, searching with \fB\-m\fP and \fB\-ui\fP means return events that have both the requested type and match the user id given.
+\fBausearch\fP is a tool that can query the audit daemon logs based for events based on different search criteria. The ausearch utility can also take input from stdin as long as the input is the raw log data. Each commandline option given forms an "and" statement. For example, searching with \fB\-m\fP and \fB\-ui\fP means return events that have both the requested type and match the user id given. An exception is the \fB\-n\fP option; multiple nodes are allowed in a search which will return any matching node.
It should also be noted that each syscall excursion from user space into the kernel and back into user space has one event ID that is unique. Any auditable event that is triggered during this trip share this ID so that they may be correlated.
@@ -64,7 +64,7 @@ Flush output on every line. Most useful
Search for an event matching the given \fImessage type\fP. You may also enter a \fIcomma separated list of message types\fP. There is an \fBALL\fP message type that doesn't exist in the actual logs. It allows you to get all messages in the system. The list of valid messages types is long. The program will display the list whenever no message type is passed with this parameter. The message type can be either text or numeric. If you enter a list, there can be only commas and no spaces separating the list.
.TP
.BR \-n ,\ \-\-node \ \fInode-name\fP
-Search for events originating from \fInode name\fP string.
+Search for events originating from \fInode name\fP string. Multiple nodes are allowed, and if any nodes match, the event is matched.
.TP
.BR \-o ,\ \-\-object \ \fISE-Linux-context-string\fP
Search for event with \fItcontext\fP (object) matching the string.
diff -up ./src/aureport-options.c.orig ./src/aureport-options.c
--- ./src/aureport-options.c.orig 2009-02-24 15:11:36.000000000 -0600
+++ ./src/aureport-options.c 2009-06-08 11:06:50.000000000 -0500
@@ -40,7 +40,7 @@ int force_logs = 0;
/* These are for compatibility with parser */
unsigned int event_id = -1;
-const char *event_node = NULL;
+const slist *event_node_list = NULL;
const char *event_key = NULL;
const char *event_filename = NULL;
const char *event_exe = NULL;
@@ -573,10 +573,22 @@ int check_params(int count, char *vars[]
vars[c]);
retval = -1;
} else {
- event_node = strdup(optarg);
- if (event_node == NULL)
- retval = -1;
+ snode sn;
c++;
+
+ if (!event_node_list) {
+ event_node_list = malloc(sizeof (slist));
+ if (!event_node_list) {
+ retval = -1;
+ break;
+ }
+ slist_create(event_node_list);
+ }
+
+ sn.str = strdup(optarg);
+ sn.key = NULL;
+ sn.hits=0;
+ slist_append(event_node_list, &sn);
}
break;
case R_SUMMARY_DET:
diff -up ./src/aureport-scan.c.orig ./src/aureport-scan.c
--- ./src/aureport-scan.c.orig 2009-02-24 15:11:36.000000000 -0600
+++ ./src/aureport-scan.c 2009-06-08 11:16:07.000000000 -0500
@@ -199,12 +199,26 @@ int scan(llist *l)
// OK - do the heavier checking
int rc = extract_search_items(l);
if (rc == 0) {
- if (event_node) {
- if (l->e.node == NULL)
- return 0;
- if (strcasecmp(event_node, l->e.node))
- return 0;
- }
+ if (event_node_list) {
+ const snode *sn;
+ int found=0;
+ slist *sptr = event_node_list;
+
+ if (l->e.node == NULL)
+ return 0;
+
+ slist_first(sptr);
+ sn=slist_get_cur(sptr);
+ while (sn && !found) {
+ if (sn->str && (!strcmp(sn->str, l->e.node)))
+ found++;
+ else
+ sn=slist_next(sptr);
+ }
+
+ if (!found)
+ return 0;
+ }
if (classify_success(l) && classify_conf(l))
return 1;
return 0;
diff -up ./src/ausearch-common.h.orig ./src/ausearch-common.h
--- ./src/ausearch-common.h.orig 2009-02-24 15:11:36.000000000 -0600
+++ ./src/ausearch-common.h 2009-06-08 11:12:09.000000000 -0500
@@ -24,6 +24,8 @@
#ifndef AUREPORT_COMMON_H
#define AUREPORT_COMMON_H
+#include "ausearch-string.h"
+
/* Global variables that describe what search is to be performed */
extern time_t start_time, end_time;
extern unsigned int event_id;
@@ -31,7 +33,7 @@ extern gid_t event_gid, event_egid;
extern pid_t event_pid;
extern int event_exact_match;
extern uid_t event_uid, event_euid, event_loginuid;
-extern const char *event_node;
+const slist *event_node_list;
extern const char *event_comm;
extern const char *event_filename;
extern const char *event_hostname;
diff -up ./src/ausearch-match.c.orig ./src/ausearch-match.c
--- ./src/ausearch-match.c.orig 2009-02-24 15:11:36.000000000 -0600
+++ ./src/ausearch-match.c 2009-06-08 11:23:11.000000000 -0500
@@ -53,12 +53,24 @@ int match(llist *l)
}
// perform additional tests for the field
- if (event_node) {
+ if (event_node_list) {
+ const snode *sn;
+ int found=0;
+ slist *sptr = event_node_list;
+
if (l->e.node == NULL)
+ return 0;
+
+ slist_first(sptr);
+ sn=slist_get_cur(sptr);
+ while (sn && !found) {
+ if (sn->str && (!strcmp(sn->str, l->e.node)))
+ found++;
+ else
+ sn=slist_next(sptr);
+ }
+ if (!found)
return 0;
- if (strmatch(event_node,
- l->e.node) == 0)
- return 0;
}
if (user_match(l) == 0)
return 0;
diff -up ./src/ausearch-options.c.orig ./src/ausearch-options.c
--- ./src/ausearch-options.c.orig 2009-02-24 15:11:36.000000000 -0600
+++ ./src/ausearch-options.c 2009-06-08 11:08:20.000000000 -0500
@@ -53,7 +53,6 @@ int event_session_id = -1;
int event_exit = 0, event_exit_is_set = 0;
int line_buffered = 0;
const char *event_key = NULL;
-const char *event_node = NULL;
const char *event_filename = NULL;
const char *event_exe = NULL;
const char *event_comm = NULL;
@@ -63,6 +62,8 @@ const char *event_subject = NULL;
const char *event_object = NULL;
report_t report_format = RPT_DEFAULT;
+const slist *event_node_list = NULL;
+
struct nv_pair {
int value;
const char *name;
@@ -591,10 +592,22 @@ int check_params(int count, char *vars[]
vars[c]);
retval = -1;
} else {
- event_node = strdup(optarg);
- if (event_node == NULL)
- retval = -1;
+ snode sn;
c++;
+
+ if (!event_node_list) {
+ event_node_list = malloc(sizeof (slist));
+ if (!event_node_list) {
+ retval = -1;
+ break;
+ }
+ slist_create(event_node_list);
+ }
+
+ sn.str = strdup(optarg);
+ sn.key = NULL;
+ sn.hits=0;
+ slist_append(event_node_list, &sn);
}
break;
case S_SYSCALL:
--
LC (Lenny) Bruzenak
lenny at magitekltd.com
More information about the Linux-audit
mailing list