int audit_rule_syscallbyname(struct audit_rule *rule,
const char *scall)
{
int nr, i;
int machine;
if (!strcmp(scall, "all")) {
for (i = 0; i < (AUDIT_BITMASK_SIZE-1); i++)
rule->mask[i] = ~0;
return 0;
}
if (!audit_elf)
machine = audit_detect_machine();
else
machine = audit_elf_to_machine(audit_elf);
if (machine < 0)
return -2;
nr = audit_name_to_syscall(scall, machine);
if (nr < 0) {
if (isdigit(scall[0]))
nr = strtol(scall, NULL, 0);
}
if (nr >= 0)
return audit_rule_syscall(rule, nr);
return -1;
}
int syscalltbl__id(struct syscalltbl *tbl, const char *name)
{
return audit_name_to_syscall(name, tbl->audit_machine);
}
int main(int argc, char *argv[])
{
int i, rc;
int machine=-1, syscall_num=-1, dump=0, exact=0;
const char *name = NULL;
if (argc > 4) {
fputs("Too many arguments\n", stderr);
usage();
} else if (argc < 2)
usage();
for (i=1; i<argc; i++) {
if (isdigit(argv[i][0])) {
if (syscall_num != -1) {
fputs("Two syscall numbers not allowed\n",
stderr);
usage();
}
syscall_num = strtol(argv[i], 0, 10);
} else if ((rc = audit_name_to_machine(argv[i])) != -1) {
if (machine != -1) {
fputs("Two machine types not allowed\n",stderr);
usage();
}
machine = rc;
} else if (strcmp("--dump", argv[i]) == 0) {
dump=1;
} else if (strcmp("--exact", argv[i]) == 0) {
exact=1;
#ifndef WITH_ALPHA
} else if (strcmp("alpha", argv[i]) == 0) {
fputs("Alpha processor support is not enabled\n",
stderr);
exit(1);
#endif
#ifndef WITH_ARMEB
} else if (strcmp("armeb", argv[i]) == 0) {
fputs("Arm eabi processor support is not enabled\n",
stderr);
exit(1);
#endif
} else {
if (name != NULL) {
fputs("Two syscall names not allowed\n",stderr);
usage();
}
name = argv[i];
}
}
if (machine == -1)
machine = audit_detect_machine();
if (machine == -1) {
fprintf(stderr, "Unable to detect machine type\n");
return 1;
}
if (dump) {
printf("Using %s syscall table:\n",
audit_machine_to_name(machine));
for (i=0; i<8192; i++) {
name = audit_syscall_to_name(i, machine);
if (name)
printf("%d\t%s\n", i, name);
}
return 0;
}
if (name) {
if (exact) {
rc = audit_name_to_syscall(name, machine);
if (rc < 0) {
fprintf(stderr,
"Unknown syscall %s using %s lookup table\n",
name, audit_machine_to_name(machine));
return 1;
} else
printf("%d\n", rc);
} else {
int found = 0;
for (i=0; i< LAST_SYSCALL; i++) {
const char *n = audit_syscall_to_name(i, machine);
if (n && strcasestr(n, name)) {
found = 1;
printf("%-18s %d\n", n, i);
}
}
if (!found) {
fprintf(stderr,
"Unknown syscall %s using %s lookup table\n",
name, audit_machine_to_name(machine));
return 1;
}
}
} else if (syscall_num != -1) {
name = audit_syscall_to_name(syscall_num, machine);
if (name == NULL) {
fprintf(stderr,
"Unknown syscall %d using %s lookup table\n",
syscall_num, audit_machine_to_name(machine));
return 1;
} else
printf("%s\n", name);
} else {
fputs("Error - either a syscall name or number must "
"be given with an optional arch\n", stderr);
return 1;
}
return 0;
}
/*
* This function examines the commandline parameters and sets various
* search options. It returns a 0 on success and < 0 on failure
*/
int check_params(int count, char *vars[])
{
int c = 1;
int retval = 0;
const char *optarg;
if (count < 2) {
usage();
return -1;
}
while (c < count && retval == 0) {
// Go ahead and point to the next argument
if (c+1 < count) {
if (vars[c+1][0] != '-')
optarg = vars[c+1];
else
optarg = NULL;
} else
optarg = NULL;
switch (audit_lookup_option(vars[c])) {
case S_EVENT:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_id = strtoul(optarg, NULL, 10);
if (errno) {
fprintf(stderr,
"Illegal value for audit event ID");
retval = -1;
}
c++;
} else {
fprintf(stderr,
"Audit event id must be a numeric value, was %s\n",
optarg);
retval = -1;
}
break;
case S_COMM:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
} else {
event_comm = strdup(optarg);
if (event_comm == NULL)
retval = -1;
c++;
}
break;
case S_FILENAME:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
event_filename = strdup(optarg);
if (event_filename == NULL)
retval = -1;
c++;
}
break;
case S_KEY:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
event_key = strdup(optarg);
if (event_key == NULL)
retval = -1;
c++;
}
break;
case S_ALL_GID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_gid = strtoul(optarg,NULL,10);
if (errno) {
fprintf(stderr,
"Numeric group ID conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else {
struct group *gr ;
gr = getgrnam(optarg) ;
if (gr == NULL) {
fprintf(stderr,
"Group ID is non-numeric and unknown (%s)\n",
optarg);
retval = -1;
break;
}
event_gid = gr->gr_gid;
}
event_egid = event_gid;
event_ga = 1;
c++;
break;
case S_EFF_GID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_egid = strtoul(optarg,NULL,10);
if (errno) {
fprintf(stderr,
"Numeric group ID conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else {
struct group *gr ;
gr = getgrnam(optarg) ;
if (gr == NULL) {
fprintf(stderr,
"Effective group ID is non-numeric and unknown (%s)\n",
optarg);
retval = -1;
break;
}
event_egid = gr->gr_gid;
}
c++;
break;
case S_GID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_gid = strtoul(optarg,NULL,10);
if (errno) {
fprintf(stderr,
"Numeric group ID conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else {
struct group *gr ;
gr = getgrnam(optarg) ;
if (gr == NULL) {
fprintf(stderr,
"Group ID is non-numeric and unknown (%s)\n",
optarg);
retval = -1;
break;
}
event_gid = gr->gr_gid;
}
c++;
break;
case S_HELP:
usage();
exit(0);
break;
case S_HOSTNAME:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
event_hostname = strdup(optarg);
if (event_hostname == NULL)
retval = -1;
c++;
}
break;
case S_INTERP:
if (report_format == RPT_DEFAULT)
report_format = RPT_INTERP;
else {
fprintf(stderr,
"Conflicting output format %s\n",
vars[c]);
retval = -1;
}
if (optarg) {
fprintf(stderr,
"Argument is NOT required for %s\n",
vars[c]);
retval = -1;
}
break;
case S_INFILE:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
user_file = strdup(optarg);
if (user_file == NULL)
retval = -1;
c++;
}
break;
case S_MESSAGE_TYPE:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
if (strcasecmp(optarg, "ALL") != 0) {
retval = parse_msg(optarg);
}
c++;
}
if (retval < 0) {
int i;
fprintf(stderr,
"Valid message types are: ALL ");
for (i=AUDIT_USER;i<=AUDIT_LAST_VIRT_MSG;i++){
const char *name;
if (i == AUDIT_WATCH_INS) // Skip a few
i = AUDIT_FIRST_USER_MSG;
name = audit_msg_type_to_name(i);
if (name)
fprintf(stderr, "%s ", name);
}
fprintf(stderr, "\n");
}
break;
case S_OBJECT:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
} else {
event_object = strdup(optarg);
if (event_object == NULL)
retval = -1;
c++;
}
break;
case S_PPID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_ppid = strtol(optarg,NULL,10);
if (errno)
retval = -1;
c++;
} else {
fprintf(stderr,
"Parent process id must be a numeric value, was %s\n",
optarg);
retval = -1;
}
break;
case S_PID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_pid = strtol(optarg,NULL,10);
if (errno)
retval = -1;
c++;
} else {
fprintf(stderr,
"Process id must be a numeric value, was %s\n",
optarg);
retval = -1;
}
break;
case S_RAW:
if (report_format == RPT_DEFAULT)
report_format = RPT_RAW;
else {
fprintf(stderr,
"Conflicting output format --raw\n");
retval = -1;
}
if (optarg) {
fprintf(stderr,
"Argument is NOT required for --raw\n");
retval = -1;
}
break;
case S_NODE:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
snode sn;
c++;
if (!event_node_list) {
event_node_list = malloc(sizeof (slist));
if (!event_node_list) {
retval = -1;
break;
}
slist_create(event_node_list);
}
sn.str = strdup(optarg);
sn.key = NULL;
sn.hits=0;
slist_append(event_node_list, &sn);
}
break;
case S_SYSCALL:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_syscall = (int)strtoul(optarg, NULL, 10);
if (errno) {
fprintf(stderr,
"Syscall numeric conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else {
int machine;
machine = audit_detect_machine();
if (machine < 0) {
fprintf(stderr,
"Error detecting machine type");
retval = -1;
break;
}
event_syscall = audit_name_to_syscall(optarg,
machine);
if (event_syscall == -1) {
fprintf(stderr,
"Syscall %s not found\n",
optarg);
retval = -1;
}
}
c++;
break;
case S_CONTEXT:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
} else {
event_subject = strdup(optarg);
if (event_subject == NULL)
retval = -1;
event_object = strdup(optarg);
if (event_object == NULL)
retval = -1;
event_se = 1;
c++;
}
break;
case S_SUBJECT:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
} else {
event_subject = strdup(optarg);
if (event_subject == NULL)
retval = -1;
c++;
}
break;
case S_OSUCCESS:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if ( (strstr(optarg, "yes")!=NULL) ||
(strstr(optarg, "no")!=NULL) ) {
if (strcmp(optarg, "yes") == 0)
event_success = S_SUCCESS;
else
event_success = S_FAILED;
} else {
fprintf(stderr,
"Success must be 'yes' or 'no'.\n");
retval = -1;
}
c++;
break;
case S_SESSION:
if (!optarg) {
if ((c+1 < count) && vars[c+1])
optarg = vars[c+1];
else {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
}
{
size_t len = strlen(optarg);
if (isdigit(optarg[0])) {
errno = 0;
event_session_id = strtol(optarg,NULL,10);
if (errno)
retval = -1;
c++;
} else if (len >= 2 && *(optarg)=='-' &&
(isdigit(optarg[1]))) {
errno = 0;
event_session_id = strtol(optarg, NULL, 0);
if (errno) {
retval = -1;
fprintf(stderr, "Error converting %s\n",
optarg);
}
c++;
} else {
fprintf(stderr,
"Session id must be a numeric value, was %s\n",
optarg);
retval = -1;
}
}
break;
case S_EXIT:
if (!optarg) {
if ((c+1 < count) && vars[c+1])
optarg = vars[c+1];
else {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
}
{
size_t len = strlen(optarg);
if (isdigit(optarg[0])) {
errno = 0;
event_exit = strtol(optarg, NULL, 0);
if (errno) {
retval = -1;
fprintf(stderr, "Error converting %s\n",
optarg);
}
} else if (len >= 2 && *(optarg)=='-' &&
(isdigit(optarg[1]))) {
errno = 0;
event_exit = strtol(optarg, NULL, 0);
if (errno) {
retval = -1;
fprintf(stderr, "Error converting %s\n",
optarg);
}
} else {
event_exit = audit_name_to_errno(optarg);
if (event_exit == 0) {
retval = -1;
fprintf(stderr,
"Unknown errno, was %s\n",
optarg);
}
}
c++;
if (retval != -1)
event_exit_is_set = 1;
}
break;
case S_TIME_END:
if (optarg) {
if ( (c+2 < count) && vars[c+2] &&
(vars[c+2][0] != '-') ) {
/* Have both date and time - check order*/
if (strchr(optarg, ':')) {
if (ausearch_time_end(vars[c+2],
optarg) != 0)
retval = -1;
} else {
if (ausearch_time_end(optarg,
vars[c+2]) != 0)
retval = -1;
}
c++;
} else {
// Check against recognized words
int t = lookup_time(optarg);
if (t >= 0) {
if (ausearch_time_end(optarg,
NULL) != 0)
retval = -1;
} else if ( (strchr(optarg, ':')) == NULL) {
/* Only have date */
if (ausearch_time_end(optarg,
NULL) != 0)
retval = -1;
} else {
/* Only have time */
if (ausearch_time_end(NULL,
optarg) != 0)
retval = -1;
}
}
c++;
break;
}
fprintf(stderr,
"%s requires either date and/or time\n",
vars[c]);
retval = -1;
break;
case S_TIME_START:
if (optarg) {
if ( (c+2 < count) && vars[c+2] &&
(vars[c+2][0] != '-') ) {
/* Have both date and time - check order */
if (strchr(optarg, ':')) {
if (ausearch_time_start(
vars[c+2], optarg) != 0)
retval = -1;
} else {
if (ausearch_time_start(optarg,
vars[c+2]) != 0)
retval = -1;
}
c++;
} else {
// Check against recognized words
int t = lookup_time(optarg);
if (t >= 0) {
if (ausearch_time_start(optarg,
"00:00:00") != 0)
retval = -1;
}
else if ( strchr(optarg, ':') == NULL) {
/* Only have date */
if (ausearch_time_start(optarg,
"00:00:00") != 0)
retval = -1;
} else {
/* Only have time */
if (ausearch_time_start(NULL,
optarg) != 0)
retval = -1;
}
}
c++;
break;
}
fprintf(stderr,
"%s requires either date and/or time\n",
vars[c]);
retval = -1;
break;
case S_TERMINAL:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
event_terminal = strdup(optarg);
if (event_terminal == NULL)
retval = -1;
c++;
}
break;
case S_UID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_uid = strtoul(optarg,NULL,10);
if (errno) {
fprintf(stderr,
"Numeric user ID conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else {
struct passwd *pw;
pw = getpwnam(optarg);
if (pw == NULL) {
fprintf(stderr,
"Effective user ID is non-numeric and unknown (%s)\n",
optarg);
retval = -1;
break;
}
event_uid = pw->pw_uid;
}
c++;
break;
case S_EFF_UID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_euid = strtoul(optarg,NULL,10);
if (errno) {
fprintf(stderr,
"Numeric user ID conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else {
struct passwd *pw ;
pw = getpwnam(optarg) ;
if (pw == NULL) {
fprintf(stderr,
"User ID is non-numeric and unknown (%s)\n",
optarg);
retval = -1;
break;
}
event_euid = pw->pw_uid;
}
c++;
break;
case S_ALL_UID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_uid = strtoul(optarg,NULL,10);
if (errno) {
fprintf(stderr,
"Numeric user ID conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else {
struct passwd *pw ;
pw = getpwnam(optarg) ;
if (pw == NULL) {
fprintf(stderr,
"User ID is non-numeric and unknown (%s)\n",
optarg);
retval = -1;
break;
}
event_uid = pw->pw_uid;
}
event_ua = 1;
event_euid = event_uid;
event_loginuid = event_uid;
c++;
break;
case S_LOGINID:
if (!optarg) {
if ((c+1 < count) && vars[c+1])
optarg = vars[c+1];
else {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
}
{
size_t len = strlen(optarg);
if (isdigit(optarg[0])) {
errno = 0;
event_loginuid = strtoul(optarg,NULL,10);
if (errno) {
fprintf(stderr,
"Numeric user ID conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else if (len >= 2 && *(optarg)=='-' &&
(isdigit(optarg[1]))) {
errno = 0;
event_loginuid = strtol(optarg, NULL, 0);
if (errno) {
retval = -1;
fprintf(stderr, "Error converting %s\n",
optarg);
}
} else {
struct passwd *pw ;
pw = getpwnam(optarg) ;
if (pw == NULL) {
fprintf(stderr,
"Login user ID is non-numeric and unknown (%s)\n",
optarg);
retval = -1;
break;
}
event_loginuid = pw->pw_uid;
}
}
c++;
break;
case S_UUID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
event_uuid = strdup(optarg);
if (event_uuid == NULL) {
retval = -1;
}
c++;
}
break;
case S_VMNAME:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
event_vmname= strdup(optarg);
if (event_vmname == NULL) {
retval = -1;
}
c++;
}
break;
case S_VERSION:
printf("ausearch version %s\n", VERSION);
exit(0);
break;
case S_EXACT_MATCH:
event_exact_match=1;
break;
case S_IN_LOGS:
force_logs = 1;
break;
case S_JUST_ONE:
just_one = 1;
break;
case S_EXECUTABLE:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
event_exe = strdup(optarg);
if (event_exe == NULL)
retval = -1;
c++;
}
break;
case S_LINEBUFFERED:
line_buffered = 1;
break;
default:
fprintf(stderr, "%s is an unsupported option\n",
vars[c]);
retval = -1;
break;
}
c++;
}
return retval;
}
