mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 08:24:42 +01:00
78cd88c56d
Acked-By: John Johansen (up to r2072)
Acked-by: Steve Beattie <sbeattie@ubuntu.com> (including r2088)
In detail, the changes are (bzr log from trunk):
------------------------------------------------------------
revno: 2088
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: apparmor
timestamp: Tue 2013-01-01 20:15:04 +0100
message:
speed up aa-decode by using a bash regex matching instead of calling egrep for each line.
Acked-by: Steve Beattie <sbeattie@ubuntu.com>
(Patch sent 2012-11-01, Acked-by from 2013-01-01)
------------------------------------------------------------
revno: 2072
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: apparmor
timestamp: Tue 2012-10-16 00:19:49 +0200
message:
Fix aa-decode handling of stdin
Handling stdin was totally broken (= no output) with the current log
format because aa-decode expected name= to be the last entry in the
log line.
This patch for stdin handling
- fixes the pattern to match the current log format (name= is NOT the
last part in the log entry)
- uses bash replacement to avoid some sed calls (which also means the
script now needs an explicit "#!/bin/bash")
- prints decoded filenames in double instead of single quotes to be
consistent with filenames that were not encoded
- also prints lines that do not contain an encoded filename (instead of
grepping them away)
- replace tr calls by perl's uc() (also for non-stdin mode)
- also handle encoded profile names (introduced by Steve)
- don't fail if a file or profile name contains a '
In other words: you can pipe your audit.log through aa-decode, and the
only difference to the raw audit.log is that filenames are decoded.
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
------------------------------------------------------------
revno: 2068
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: apparmor
timestamp: Mon 2012-09-17 23:55:28 +0200
message:
fix error handling in aa-decode
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
Looks-Good-By: ;-) Seth Arnold <seth.arnold@gmail.com>
------------------------------------------------------------
91 lines
2.5 KiB
Bash
Executable file
91 lines
2.5 KiB
Bash
Executable file
#!/bin/bash
|
|
#
|
|
# Copyright (C) 2009-2010, 2012 Canonical Ltd.
|
|
# Copyright (C) 2012 Christian Boltz
|
|
#
|
|
# This program is free software; you can redistribute it and/or
|
|
# modify it under the terms of version 2 of the GNU General Public
|
|
# License as published by the Free Software Foundation.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program; if not, contact Canonical, Ltd.
|
|
#
|
|
|
|
set -e
|
|
|
|
help() {
|
|
cat <<EOM
|
|
USAGE: aa-decode [OPTIONS] <encoded string>
|
|
Decode a hex-encoded string to ASCII. It will also take an audit log on
|
|
standard input and convert any hex-encoded AppArmor log entries and display
|
|
them on standard output.
|
|
|
|
OPTIONS:
|
|
--help display this help
|
|
|
|
EXAMPLES:
|
|
$ aa-decode 2F746D702F666F6F20626172
|
|
Decoded: /tmp/foo bar
|
|
$ cat /var/log/kern.log | aa-decode
|
|
... denied_mask="r::" fsuid=1000 ouid=1000 name=/tmp/foo bar
|
|
EOM
|
|
}
|
|
|
|
decode() {
|
|
decoded=`perl -le "\\$s = uc('$1') ; if (\\$s =~ /^[0-9A-F]*$/) { print pack 'H*', \\$s; }"`
|
|
echo "$decoded"
|
|
}
|
|
|
|
if [ "$1" = "-h" ] || [ "$1" = "--help" ]; then
|
|
help
|
|
exit
|
|
fi
|
|
|
|
# if have an argument, then use it, otherwise process stdin
|
|
if [ -n "$1" ]; then
|
|
e="$1"
|
|
if ! echo "$e" | egrep -q "^[0-9A-Fa-f]+$" ; then
|
|
echo "String should only contain hex characters (0-9, a-f, A-F)"
|
|
exit 1
|
|
fi
|
|
|
|
d=`decode $e`
|
|
if [ -z "$d" ]; then
|
|
echo "Could not decode string"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Decoded: $d"
|
|
exit 0
|
|
fi
|
|
|
|
# For now just look at 'name=...' and 'profile=...',
|
|
# so validate input against this and output based on it.
|
|
# TODO: better handle other cases too
|
|
while read line ; do
|
|
|
|
# check if line contains encoded name= or profile=
|
|
if [[ "$line" =~ \ (name|profile)=[0-9a-fA-F] ]]; then
|
|
|
|
# cut the encoded filename/profile name out of the line and decode it
|
|
ne=`echo "$line" | sed 's/.* name=\([^ ]*\).*$/\\1/g'`
|
|
nd="$(decode ${ne/\'/\\\'})"
|
|
|
|
pe=`echo "$line" | sed 's/.* profile=\([^ ]*\).*$/\\1/g'`
|
|
pd="$(decode ${pe/\'/\\\'})"
|
|
|
|
# replace encoded name and profile with its decoded counterparts (only if it was encoded)
|
|
test -n "$nd" && line="${line/name=$ne/name=\"$nd\"}"
|
|
test -n "$pd" && line="${line/profile=$pe/profile=\"$pd\"}"
|
|
|
|
fi
|
|
|
|
echo "$line"
|
|
|
|
done
|
|
|