mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-30 23:05:11 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(aa-log): add support for dbus log.

Browse source
This commit is contained in:
Alexandre Pujol 2022-06-03 19:09:03 +01:00
parent d9a0e24e40
commit 1ca1aa8892
Failed to generate hash of commit
1 changed files with 22 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
cmd/aa-log/main.go
View file

@ -28,9 +28,13 @@ const LogFile = "/var/log/audit/audit.log"
// Colors // Colors
const ( const (
Reset = "\033[0m" Reset = "\033[0m"
FgRed = "\033[31m"
FgGreen = "\033[32m"
FgYellow = "\033[33m" FgYellow = "\033[33m"
FgBlue = "\033[34m" FgBlue = "\033[34m"
FgMagenta = "\033[35m" FgMagenta = "\033[35m"
FgCian = "\033[36m"
FgWhite = "\033[37m"
BoldRed = "\033[1;31m" BoldRed = "\033[1;31m"
BoldGreen = "\033[1;32m" BoldGreen = "\033[1;32m"
BoldYellow = "\033[1;33m" BoldYellow = "\033[1;33m"
@ -100,10 +104,12 @@ func NewApparmorLogs(file io.Reader, profile string) AppArmorLogs {
} }
// Clean logs // Clean logs
regex := regexp.MustCompile(`type=(USER_|)AVC msg=audit(.*): (pid=.*msg='|)apparmor`)
log = regex.ReplaceAllLiteralString(log, "apparmor")
regexAppArmorLogs := map[*regexp.Regexp]string{ regexAppArmorLogs := map[*regexp.Regexp]string{
regexp.MustCompile(`type=AVC msg=audit(.*): apparmor`): "apparmor", regexp.MustCompile(`(peer_|)pid=[0-9]* `): "",
regexp.MustCompile(` fsuid.*`): "", regexp.MustCompile(` fsuid.*`): "",
regexp.MustCompile(`pid=.* comm`): "comm", regexp.MustCompile(` exe=.*`): "",
} }
for regex, value := range regexAppArmorLogs { for regex, value := range regexAppArmorLogs {
log = regex.ReplaceAllLiteralString(log, value) log = regex.ReplaceAllLiteralString(log, value)
@ -146,18 +152,28 @@ func (aaLogs AppArmorLogs) String() string {
} }
// Order of impression // Order of impression
keys := []string{ keys := []string{
"profile", "operation", "name", "info", "comm", "laddr", "profile", "peer_label", // Profile name
"lport", "faddr", "fport", "family", "sock_type", "protocol", "operation", "name",
"mask", "bus", "path", "interface", "member", // dbus
"info", "comm",
"laddr", "lport", "faddr", "fport", "family", "sock_type", "protocol",
"requested_mask", "denied_mask", "signal", "peer", // "fsuid", "ouid", "FSUID", "OUID", "requested_mask", "denied_mask", "signal", "peer", // "fsuid", "ouid", "FSUID", "OUID",
} }
// Optional colors template to use // Optional colors template to use
colors := map[string]string{ colors := map[string]string{
"profile": FgBlue, "profile": FgBlue,
"peer_label": FgBlue,
"operation": FgYellow, "operation": FgYellow,
"name": FgMagenta, "name": FgMagenta,
"mask": BoldRed,
"bus": FgCian + "bus=",
"path": "path=" + FgWhite,
"requested_mask": "requested_mask=" + BoldRed, "requested_mask": "requested_mask=" + BoldRed,
"denied_mask": "denied_mask=" + BoldRed, "denied_mask": "denied_mask=" + BoldRed,
"interface": "interface=" + FgWhite,
"member": "member=" + FgGreen,
} }
for _, log := range aaLogs { for _, log := range aaLogs {
seen := map[string]bool{"apparmor": true} seen := map[string]bool{"apparmor": true}
res += state[log["apparmor"]] res += state[log["apparmor"]]
@ -174,7 +190,7 @@ func (aaLogs AppArmorLogs) String() string {
} }
for key, value := range log { for key, value := range log {
if !seen[key] { if !seen[key] && value != "" {
res += " " + key + "=" + toQuote(value) res += " " + key + "=" + toQuote(value)
} }
} }