mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 08:58:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(aa-log): add support for dbus log.

Browse source
This commit is contained in:
Alexandre Pujol 2022-06-03 19:09:03 +01:00
parent d9a0e24e40
commit 1ca1aa8892
Failed to generate hash of commit
1 changed files with 22 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
cmd/aa-log/main.go
View file

@ -28,9 +28,13 @@ const LogFile = "/var/log/audit/audit.log"
// Colors
const (
Reset = "\033[0m"
FgRed = "\033[31m"
FgGreen = "\033[32m"
FgYellow = "\033[33m"
FgBlue = "\033[34m"
FgMagenta = "\033[35m"
FgCian = "\033[36m"
FgWhite = "\033[37m"
BoldRed = "\033[1;31m"
BoldGreen = "\033[1;32m"
BoldYellow = "\033[1;33m"
@ -100,10 +104,12 @@ func NewApparmorLogs(file io.Reader, profile string) AppArmorLogs {
}
// Clean logs
regex := regexp.MustCompile(`type=(USER_|)AVC msg=audit(.*): (pid=.*msg='|)apparmor`)
log = regex.ReplaceAllLiteralString(log, "apparmor")
regexAppArmorLogs := map[*regexp.Regexp]string{
regexp.MustCompile(`type=AVC msg=audit(.*): apparmor`): "apparmor",
regexp.MustCompile(` fsuid.*`): "",
regexp.MustCompile(`pid=.* comm`): "comm",
regexp.MustCompile(`(peer_|)pid=[0-9]* `): "",
regexp.MustCompile(` fsuid.*`): "",
regexp.MustCompile(` exe=.*`): "",
}
for regex, value := range regexAppArmorLogs {
log = regex.ReplaceAllLiteralString(log, value)
@ -146,18 +152,28 @@ func (aaLogs AppArmorLogs) String() string {
}
// Order of impression
keys := []string{
"profile", "operation", "name", "info", "comm", "laddr",
"lport", "faddr", "fport", "family", "sock_type", "protocol",
"profile", "peer_label", // Profile name
"operation", "name",
"mask", "bus", "path", "interface", "member", // dbus
"info", "comm",
"laddr", "lport", "faddr", "fport", "family", "sock_type", "protocol",
"requested_mask", "denied_mask", "signal", "peer", // "fsuid", "ouid", "FSUID", "OUID",
}
// Optional colors template to use
colors := map[string]string{
"profile": FgBlue,
"peer_label": FgBlue,
"operation": FgYellow,
"name": FgMagenta,
"mask": BoldRed,
"bus": FgCian + "bus=",
"path": "path=" + FgWhite,
"requested_mask": "requested_mask=" + BoldRed,
"denied_mask": "denied_mask=" + BoldRed,
"interface": "interface=" + FgWhite,
"member": "member=" + FgGreen,
}
for _, log := range aaLogs {
seen := map[string]bool{"apparmor": true}
res += state[log["apparmor"]]
@ -174,7 +190,7 @@ func (aaLogs AppArmorLogs) String() string {
}
for key, value := range log {
if !seen[key] {
if !seen[key] && value != "" {
res += " " + key + "=" + toQuote(value)
}
}