audit 2.3.6 released

123 lines not on this page · raw message

diff -Npru audit-2.3.6/src/ausearch-checkpt.h audit-2.3.6_checkpoint_mods/src/ausearch-checkpt.h
@@ -31,6 +31,7 @@ int load_ChkPt(const char *fn);
 #define	CP_STATFAILED	0x0002	/* stat() call on last log file failed */
 #define	CP_STATUSIO	0x0004	/* cannot open/read/write checkpoint file */
 #define	CP_STATUSBAD	0x0008	/* malformed status checkpoint entries */
+#define	CP_CORRUPTED	0x0010	/* corrupted times in checkpoint file */
 
 extern unsigned checkpt_failure;
 

diff -Npru audit-2.3.6/src/ausearch-common.h audit-2.3.6_checkpoint_mods/src/ausearch-common.h
@@ -28,6 +28,16 @@
 
 #include "ausearch-string.h"
 
+/*
+ * MAX_EVENT_DELTA_SECS is the maximum number of seconds it would take for auditd
+ * and the kernel to emit all an events records.  Thus, when scanning a list of
+ * audit records without any End of Event marker, we can determine if all an event's
+ * records have been collected if we compare that event's time with the time of the
+ * event we are currently scanning. If MAX_EVENT_DELTA_SECS have passed, then the 
+ * event is deamed to be complete and we have all it's records.
+ */
+#define	MAX_EVENT_DELTA_SECS	2
+
 /* Global variables that describe what search is to be performed */
 extern time_t start_time, end_time;
 extern unsigned int event_id;

diff -Npru audit-2.3.6/src/ausearch-lol.c audit-2.3.6_checkpoint_mods/src/ausearch-lol.c
@@ -195,8 +195,8 @@ static void check_events(lol *lo, time_t
 	for(i=0;i<=lo->maxi; i++) {
 		lolnode *cur = &lo->array[i];
 		if (cur->status == L_BUILDING) {
-			// If 2 seconds have elapsed, we are done
-			if (cur->l->e.sec + 2 < sec) { 
+			// If MAX_EVENT_DELTA_SECS seconds have elapsed, we are done
+			if (cur->l->e.sec + MAX_EVENT_DELTA_SECS < sec) { 
 				cur->status = L_COMPLETE;
 				ready++;
 			} else if (cur->l->e.type < AUDIT_FIRST_EVENT ||

diff -Npru audit-2.3.6/src/ausearch-options.c audit-2.3.6_checkpoint_mods/src/ausearch-options.c
@@ -56,6 +56,11 @@ int event_session_id = -2;
 int event_exit = 0, event_exit_is_set = 0;
 int line_buffered = 0;
 int event_debug = 0;
+/*
+ * Holds command line flag options. See ausearch-options.h
+ */
+unsigned	control_options = 0;
+
 const char *event_key = NULL;
 const char *event_filename = NULL;
 const char *event_exe = NULL;

@@ -83,7 +88,7 @@ S_HOSTNAME, S_INTERP, S_INFILE, S_MESSAG
 S_TIME_END, S_TIME_START, S_TERMINAL, S_ALL_UID, S_EFF_UID, S_UID, S_LOGINID,
 S_VERSION, S_EXACT_MATCH, S_EXECUTABLE, S_CONTEXT, S_SUBJECT, S_OBJECT,
 S_PPID, S_KEY, S_RAW, S_NODE, S_IN_LOGS, S_JUST_ONE, S_SESSION, S_EXIT,
-S_LINEBUFFERED, S_UUID, S_VMNAME, S_DEBUG, S_CHECKPOINT, S_ARCH };
+S_LINEBUFFERED, S_UUID, S_VMNAME, S_DEBUG, S_CHECKPOINT, S_ARCH, S_CHECKPOINT_TIME_ONLY };
 
 static struct nv_pair optiontab[] = {
 	{ S_EVENT, "-a" },

@@ -92,6 +97,7 @@ static struct nv_pair optiontab[] = {
 	{ S_COMM, "-c" },
 	{ S_COMM, "--comm" },
 	{ S_CHECKPOINT, "--checkpoint" },
+	{ S_CHECKPOINT_TIME_ONLY, "--checkpoint-time-only" },
 	{ S_DEBUG, "--debug" },
 	{ S_EXIT, "-e" },
 	{ S_EXIT, "--exit" },

@@ -183,6 +189,7 @@ static void usage(void)
 	"\t--arch <CPU>\t\t\tsearch based on the CPU architecture\n"
 	"\t-c,--comm  <Comm name>\t\tsearch based on command line name\n"
 	"\t--checkpoint <checkpoint file>\tsearch from last complete event\n"
+	"\t--checkpoint-time-only\tonly use saved time for comparisions when checkpointing\n"
 	"\t--debug\t\t\tWrite malformed events that are skipped to stderr\n"
 	"\t-e,--exit  <Exit code or errno>\tsearch based on syscall exit code\n"
 	"\t-f,--file  <File name>\t\tsearch based on file name\n"

@@ -1154,6 +1161,9 @@ int check_params(int count, char *vars[]
 			}
 			c++;
 			break;
+		case S_CHECKPOINT_TIME_ONLY:
+			control_options |= OPT_CHKPT_TIME_ONLY;
+			break;
 		default:
 			fprintf(stderr, "%s is an unsupported option\n", 
 				vars[c]);

diff -Npru audit-2.3.6/src/ausearch-options.h audit-2.3.6_checkpoint_mods/src/ausearch-options.h
@@ -47,5 +47,12 @@ extern report_t report_format;
 /* Function to process commandline options */
 extern int check_params(int count, char *vars[]);
 
+extern unsigned	control_options;
+
+/*
+ * Flags for control_options
+ */
+#define	OPT_CHKPT_TIME_ONLY	0x0001	/* when checkpointing, only use time for comparisons */
+
 #endif
 

82 lines not on this page · raw message

diff -Npru audit-2.3.6/src/ausearch-checkpt.h audit-2.3.6_checkpt_1/src/ausearch-checkpt.h
@@ -31,6 +31,7 @@ int load_ChkPt(const char *fn);
 #define	CP_STATFAILED	0x0002	/* stat() call on last log file failed */
 #define	CP_STATUSIO	0x0004	/* cannot open/read/write checkpoint file */
 #define	CP_STATUSBAD	0x0008	/* malformed status checkpoint entries */
+#define	CP_CORRUPTED	0x0010	/* corrupted times in checkpoint file */
 
 extern unsigned checkpt_failure;
 

diff -Npru audit-2.3.6/src/ausearch-common.h audit-2.3.6_checkpt_1/src/ausearch-common.h
@@ -28,6 +28,17 @@
 
 #include "ausearch-string.h"
 
+/*
+ * MAX_EVENT_DELTA_SECS is the maximum number of seconds it would take for
+ * auditd and the kernel to emit all of an events' records. Thus, when scanning
+ * a list of audit records without any End of Event marker, we can determine if
+ * all an event's records have been collected if we compare that event's time
+ * with the time of the event we are currently scanning. If
+ * MAX_EVENT_DELTA_SECS have passed, then the event is deamed to be complete
+ * and we have all it's records.
+ */
+#define	MAX_EVENT_DELTA_SECS	2
+
 /* Global variables that describe what search is to be performed */
 extern time_t start_time, end_time;
 extern unsigned int event_id;

diff -Npru audit-2.3.6/src/ausearch.c audit-2.3.6_checkpt_2/src/ausearch.c
@@ -236,8 +236,15 @@ static int process_logs(void)
 			 */
 			if (	(sbuf.st_dev == chkpt_input_dev) &&
 				(sbuf.st_ino == chkpt_input_ino) ) {
-				found_chkpt_file = num++;
-				break;
+
+				/*
+ 				 * If we are only using the checkpoint file's time, then
+ 				 * we always want to find the 'oldest' file. Thus we only break if we are NOT using the checkpoint files time only.
+ 				 */
+				if (!((control_options & OPT_CHKPT_TIME_ONLY) == OPT_CHKPT_TIME_ONLY)) {
+					found_chkpt_file = num++;
+					break;
+				}
 			}
 		}
 

@@ -245,8 +252,10 @@ static int process_logs(void)
 		snprintf(filename, len, "%s.%d", config.log_file, num);
 	} while (1);
 
-	/* If a checkpoint is loaded but can't find it's file, error */
-	if (checkpt_filename && have_chkpt_data && found_chkpt_file == -1) {
+	/* If a checkpoint is loaded but can't find it's file, and
+ 	 * we are not only checking time, we need to error */
+	if (checkpt_filename && have_chkpt_data && found_chkpt_file == -1
+	&& !((control_options & OPT_CHKPT_TIME_ONLY) == OPT_CHKPT_TIME_ONLY)) {
 		free(filename);
 		free_config(&config);
 		return 10;

@@ -329,6 +338,25 @@ static int chkpt_output_decision(event *
 		return 1;	/* can output on this event */
 	}
 
+	/*
+	 * If we are ignoring all but event time, then we output if the current
+	 * event's time is greater than or equal to the checkpoint time.
+	 */
+	if ((control_options & OPT_CHKPT_TIME_ONLY) == OPT_CHKPT_TIME_ONLY) {
+		if (
+			(chkpt_input_levent.sec < e->sec)
+		||
+			(
+				(chkpt_input_levent.sec == e->sec)
+			&&
+				(chkpt_input_levent.milli <= e->milli)
+			)
+		) {
+			can_output = 1;
+			return 1;   /* can output on this event */
+		}
+	}
+
 	if ( chkpt_input_levent.sec == e->sec &&
 		chkpt_input_levent.milli == e->milli &&
 		chkpt_input_levent.serial == e->serial &&

diff -Npru audit-2.3.6/src/ausearch-options.c audit-2.3.6_checkpt_2/src/ausearch-options.c
@@ -72,6 +72,11 @@ ilist *event_type;
 
 slist *event_node_list = NULL;
 
+/*
+ * Bitmap for command line options. See ausearch-options.h for values.
+ */
+unsigned	control_options	= 0x0;
+
 struct nv_pair {
     int        value;
     const char *name;

@@ -83,7 +88,8 @@ S_HOSTNAME, S_INTERP, S_INFILE, S_MESSAG
 S_TIME_END, S_TIME_START, S_TERMINAL, S_ALL_UID, S_EFF_UID, S_UID, S_LOGINID,
 S_VERSION, S_EXACT_MATCH, S_EXECUTABLE, S_CONTEXT, S_SUBJECT, S_OBJECT,
 S_PPID, S_KEY, S_RAW, S_NODE, S_IN_LOGS, S_JUST_ONE, S_SESSION, S_EXIT,
-S_LINEBUFFERED, S_UUID, S_VMNAME, S_DEBUG, S_CHECKPOINT, S_ARCH };
+S_LINEBUFFERED, S_UUID, S_VMNAME, S_DEBUG, S_CHECKPOINT, S_ARCH,
+S_CHECKPOINT_TIME_ONLY };
 
 static struct nv_pair optiontab[] = {
 	{ S_EVENT, "-a" },

@@ -92,6 +98,7 @@ static struct nv_pair optiontab[] = {
 	{ S_COMM, "-c" },
 	{ S_COMM, "--comm" },
 	{ S_CHECKPOINT, "--checkpoint" },
+	{ S_CHECKPOINT_TIME_ONLY, "--checkpoint-time-only" },
 	{ S_DEBUG, "--debug" },
 	{ S_EXIT, "-e" },
 	{ S_EXIT, "--exit" },

@@ -183,6 +190,7 @@ static void usage(void)
 	"\t--arch <CPU>\t\t\tsearch based on the CPU architecture\n"
 	"\t-c,--comm  <Comm name>\t\tsearch based on command line name\n"
 	"\t--checkpoint <checkpoint file>\tsearch from last complete event\n"
+	"\t--checkpoint-time-only\tuse only checkpoint time for comparisions when deciding to display output\n"
 	"\t--debug\t\t\tWrite malformed events that are skipped to stderr\n"
 	"\t-e,--exit  <Exit code or errno>\tsearch based on syscall exit code\n"
 	"\t-f,--file  <File name>\t\tsearch based on file name\n"

@@ -1154,6 +1162,9 @@ int check_params(int count, char *vars[]
 			}
 			c++;
 			break;
+		case S_CHECKPOINT_TIME_ONLY:
+			control_options |= OPT_CHKPT_TIME_ONLY;
+			break;
 		default:
 			fprintf(stderr, "%s is an unsupported option\n", 
 				vars[c]);

diff -Npru audit-2.3.6/src/ausearch-options.h audit-2.3.6_checkpt_2/src/ausearch-options.h
@@ -47,5 +47,15 @@ extern report_t report_format;
 /* Function to process commandline options */
 extern int check_params(int count, char *vars[]);
 
+/*
+ * Bitmap for command line options
+ */
+extern unsigned	control_options;
+
+/*
+ * Flags for control_options
+ */
+#define	OPT_CHKPT_TIME_ONLY	0x0001	/* when checkpointing, only use event time for comparisons */ 
+
 #endif