Add correctly generated testcase for parent=pid_t from Kenny Graunke

<kgraunke@novell.com>, as well as fixing the code to properly parse
messages containing them.

Alas, this resulted in a change in the returned structure.
This commit is contained in:
Steve Beattie 2007-09-17 22:38:22 +00:00
parent 7489640b82
commit 4d505d643e
13 changed files with 30 additions and 24 deletions

View file

@ -115,8 +115,8 @@ typedef struct
{
aa_record_syntax_version version;
aa_record_event_type event; /* Event type */
long pid; /* PID of the program logging the message */
long task;
unsigned long pid; /* PID of the program logging the message */
unsigned long task;
unsigned long magic_token;
long epoch; /* example: 12345679 */
unsigned int audit_sub_id; /* example: 12 */
@ -130,7 +130,7 @@ typedef struct
char *name;
char *name2;
char *attribute;
char *parent;
unsigned long parent;
char *info;
char *active_hat;
char *net_family;

View file

@ -386,8 +386,8 @@ key: TOK_KEY_OPERATION TOK_EQUALS TOK_QUOTED_STRING
{ ret_record->attribute = strdup($3); free($3);}
| TOK_KEY_TASK TOK_EQUALS TOK_DIGITS
{ ret_record->task = $3; }
| TOK_KEY_PARENT TOK_EQUALS TOK_QUOTED_STRING
{ ret_record->parent = strdup($3); free($3);}
| TOK_KEY_PARENT TOK_EQUALS TOK_DIGITS
{ ret_record->parent = $3; }
| TOK_KEY_MAGIC_TOKEN TOK_EQUALS TOK_DIGITS
{ ret_record->magic_token = $3;}
| TOK_KEY_INFO TOK_EQUALS TOK_QUOTED_STRING

View file

@ -35,8 +35,7 @@
#include "parser.h"
/* This is mostly just a wrapper around the code in grammar.y */
aa_log_record *
parse_record(char *str)
aa_log_record *parse_record(char *str)
{
if (str == NULL)
return NULL;
@ -44,8 +43,7 @@ parse_record(char *str)
return _parse_yacc(str);
}
void
free_record(aa_log_record *record)
void free_record(aa_log_record *record)
{
if (record != NULL)
{
@ -63,8 +61,6 @@ free_record(aa_log_record *record)
free(record->name2);
if (record->attribute != NULL)
free(record->attribute);
if (record->parent != NULL)
free(record->parent);
if (record->info != NULL)
free(record->info);
if (record->active_hat != NULL)
@ -84,8 +80,7 @@ free_record(aa_log_record *record)
}
/* Set all of the fields to appropriate values */
void
_init_log_record(aa_log_record *record)
void _init_log_record(aa_log_record *record)
{
if (record == NULL)
return;
@ -107,7 +102,7 @@ _init_log_record(aa_log_record *record)
record->name = NULL;
record->name2 = NULL;
record->attribute = NULL;
record->parent = NULL;
record->parent = 0;
record->info = NULL;
record->active_hat = NULL;
record->net_family = NULL;
@ -117,8 +112,7 @@ _init_log_record(aa_log_record *record)
}
/* convert a hex-encoded string to its char* version */
char *
hex_to_string(char *hexstring)
char *hex_to_string(char *hexstring)
{
char *ret = NULL;
char buf[3], *endptr;

View file

@ -133,9 +133,9 @@ int print_results(aa_log_record *record)
{
printf("Task: %ld\n", record->task);
}
if (record->parent != NULL)
if (record->parent != 0)
{
printf("Parent: %s\n", record->parent);
printf("Parent: %ld\n", record->parent);
}
if (record->magic_token != 0)
{

View file

@ -1 +1 @@
type=APPARMOR_DENIED msg=audit(1181057184.959:7): operation="exec" denied_mask="x" name="/bin/ping" pid=31938 profile="/bin/ping" name2="ping2" requested_mask="rwx" attribute="attr" task=1 parent="something" magic_token=29493 info="Information" protocol="tcp" family="family" sock_type="unknown(1234)"
type=APPARMOR_DENIED msg=audit(1181057184.959:7): operation="exec" denied_mask="x" name="/bin/ping" pid=31938 profile="/bin/ping" name2="ping2" requested_mask="rwx" attribute="attr" task=1 parent=1 magic_token=29493 info="Information" protocol="tcp" family="family" sock_type="unknown(1234)"

View file

@ -10,7 +10,7 @@ Name: /bin/ping
Name2: ping2
Attribute: attr
Task: 1
Parent: something
Parent: 1
Token: 29493
Info: Information
PID: 31938

View file

@ -1 +1 @@
type=APPARMOR_DENIED msg=audit(1181057184.959:7): type=1503 operation="exec" denied_mask="x" name="/bin/ping" pid=31938 profile="/bin/ping" name2="ping2" requested_mask="rwx" attribute="attr" task=09876543 parent="something" magic_token=29493 info="Information" protocol="tcp" family="family" sock_type="unknown(1234)"
type=APPARMOR_DENIED msg=audit(1181057184.959:7): type=1503 operation="exec" denied_mask="x" name="/bin/ping" pid=31938 profile="/bin/ping" name2="ping2" requested_mask="rwx" attribute="attr" task=09876543 parent=000000123 magic_token=29493 info="Information" protocol="tcp" family="family" sock_type="unknown(1234)"

View file

@ -10,7 +10,7 @@ Name: /bin/ping
Name2: ping2
Attribute: attr
Task: 9876543
Parent: something
Parent: 123
Token: 29493
Info: Information
PID: 31938

View file

@ -1 +1 @@
type=UNKNOWN[1503] msg=audit(1181057184.959:7): operation="exec" denied_mask="x" name="/bin/ping" pid=31938 profile="/bin/ping" name2="ping2" requested_mask="rwx" attribute="attr" task=123456789 parent="something" magic_token=29493 info="Information" protocol="tcp" family="family" sock_type="unknown(1234)"
type=UNKNOWN[1503] msg=audit(1181057184.959:7): operation="exec" denied_mask="x" name="/bin/ping" pid=31938 profile="/bin/ping" name2="ping2" requested_mask="rwx" attribute="attr" task=123456789 parent=123456788 magic_token=29493 info="Information" protocol="tcp" family="family" sock_type="unknown(1234)"

View file

@ -10,7 +10,7 @@ Name: /bin/ping
Name2: ping2
Attribute: attr
Task: 123456789
Parent: something
Parent: 123456788
Token: 29493
Info: Information
PID: 31938

View file

@ -0,0 +1 @@
type=APPARMOR_HINT msg=audit(1188599886.852:8780): operation="ptrace" task=8320 parent=8322 pid=8322 profile="null-complain-profile"

View file

@ -0,0 +1,11 @@
START
File: test_multi/testcase26.in
Event type: AA_RECORD_HINT
Audit ID: 1188599886.852:8780
Operation: ptrace
Profile: null-complain-profile
Task: 8320
Parent: 8322
PID: 8322
Epoch: 1188599886
Audit subid: 8780