<div dir="ltr"><div>Hi,</div><div><br></div><div>I'm using libauparse version 2.8.3. I am trying to experiment with auparse_feed() with records directly received from audit_get_reply() instead of from a log file.</div><div><br></div><div>My code is as follows:</div><div>(I have left out declarations and error handling for brevity)<br></div><div>/*******************************/</div><div> auditfd = audit_open();<br> <br></div><div> rc = audit_is_enabled(auditfd);<br> if (0 == rc)<br> {<br> rc = audit_set_enabled(auditfd, 1);<br> }<br> <br> rc = audit_set_pid(auditfd, getpid(), WAIT_YES);<br> <br> rule = (struct audit_rule_data *) malloc(sizeof(struct audit_rule_data));<br> memset(rule, 0, sizeof(struct audit_rule_data));<br><br> rc = audit_add_dir(&rule, "/home");<br> <br> rc = audit_update_watch_perms(rule, AUDIT_PERM_WRITE | AUDIT_PERM_ATTR);<br> <br> rc = audit_delete_rule_data(auditfd, rule, AUDIT_FILTER_EXIT, AUDIT_ALWAYS);<br> rc = audit_add_rule_data(auditfd, rule, AUDIT_FILTER_EXIT, AUDIT_ALWAYS);<br> <br> event_cnt = (int *) malloc(sizeof(int));<br> <br> au = auparse_init(AUSOURCE_FEED, NULL);<br> auparse_add_callback(au, on_audit_event, event_cnt, free); // callback function added here<br> auparse_set_escape_mode(au, AUPARSE_ESC_RAW);<br><br> pfd[0].fd = auditfd;<br> pfd[0].events = POLLIN;<br><br> while (1)<br> {<br> do<br> {<br> rc = poll(pfd, 1, 1000); // 1 sec<br> }<br> while (rc < 0 && EINTR == errno);<br><br> if (pfd[0].revents & POLLIN)<br> {<br> struct audit_reply reply;<br><br> pfd[0].revents = 0;<br><br> rc = audit_get_reply(auditfd, &reply, GET_REPLY_NONBLOCKING, 0);</div><div><br> if (rc > 0)<br> {<br> int rc = 0;<br> char type_name[50] = {0};<br><br> printf("type: %d: %s\n", reply.type, audit_msg_type_to_name(reply.type));<br> printf("len: %d\n", reply.len);<br><br> if (NULL != audit_msg_type_to_name(reply.type))<br> {<br> strncpy(type_name, audit_msg_type_to_name(reply.type), 49);<br> }<br> reply.message[reply.len] = '\0';<br> printf("message: %s\n", reply.message);<br><br> if (record_buffer_len < (reply.len + 10 + strlen(type_name)))<br> {<br> record_buffer_len = (reply.len + 10 + strlen(type_name));<br> record_buffer = realloc(record_buffer, record_buffer_len * sizeof(char));<br> }<br> memset(record_buffer, 0, record_buffer_len);<br><br> snprintf(record_buffer, (record_buffer_len - 1), "type=%s %.*s\n", type_name, reply.len, reply.message);<br><br> printf("to auparse: %s\n", record_buffer); // record_buffer is then passed to auparse_feed()<br> printf("=======================================\n\n");<br><br> rc = auparse_feed(au, record_buffer, record_buffer_len);<br> if (-1 == rc)<br> {<br> perror("auparse_feed ");<br> }<br> }<br> }<br> }<br> auparse_flush_feed(au);<br> auparse_destroy(au);</div><div>/*******************************/</div><div><br></div><div>The callback function on_audit_event() just goes through the records one by one and prints the fields and values. I have added a rule to watch for file edits in the /home folder. I see the records for file creation in this folder being received, however it looks like the callback function is not being called when an EOE record is received. Please let me know if I'm missing something.</div><div><br></div><div>Creating a file "test.txt" generates the following output:</div><div><br></div><div>type: 1300: SYSCALL<br>len: 305<br>message: audit(1560234865.559:6870): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7fffe4c1529a a2=941 a3=1b6 items=2 ppid=6374 pid=17381 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts4 ses=4 comm="touch" exe="/bin/touch" subj==unconfined key=(null)<br><b>to auparse:</b> type=SYSCALL audit(1560234865.559:6870): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7fffe4c1529a a2=941 a3=1b6 items=2 ppid=6374 pid=17381 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts4 ses=4 comm="touch" exe="/bin/touch" subj==unconfined key=(null)<br><br>=======================================<br><br>type: 1307: CWD<br>len: 45<br>message: audit(1560234865.559:6870): cwd="/home/tarun"<br><b>to auparse: </b>type=CWD audit(1560234865.559:6870): cwd="/home/tarun"<br><br>=======================================<br><br>type: 1302: PATH<br>len: 206<br>message: audit(1560234865.559:6870): item=0 name="/home/tarun" inode=14286851 dev=103:02 mode=040755 ouid=1000 ogid=1000 rdev=00:00 nametype=PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0<br><b>to auparse: </b>type=PATH audit(1560234865.559:6870): item=0 name="/home/tarun" inode=14286851 dev=103:02 mode=040755 ouid=1000 ogid=1000 rdev=00:00 nametype=PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0<br><br>=======================================<br><br>type: 1302: PATH<br>len: 204<br>message: audit(1560234865.559:6870): item=1 name="test.txt" inode=14309805 dev=103:02 mode=0100664 ouid=1000 ogid=1000 rdev=00:00 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0<br><b>to auparse:</b> type=PATH audit(1560234865.559:6870): item=1 name="test.txt" inode=14309805 dev=103:02 mode=0100664 ouid=1000 ogid=1000 rdev=00:00 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0<br><br>=======================================<br><br>type: 1327: PROCTITLE<br>len: 66<br>message: audit(1560234865.559:6870): proctitle=746F75636800746573742E747874<br><b>to auparse:</b> type=PROCTITLE audit(1560234865.559:6870): proctitle=746F75636800746573742E747874</div><div><br>=======================================<br><br>type: 1320: EOE<br>len: 28<br>message: audit(1560234865.559:6870): <br><b>to auparse:</b> type=EOE audit(1560234865.559:6870): <br><br>=======================================</div><div><br></div><div>The lines marked "to auparse" is the data I'm sending to auparse_feed().</div><div><br></div><div>Please let me know if I need to change the format of the buffer I need to pass to auparse_feed(), or if I'm missing something else.</div><div><br></div><div>Thanks in advance,</div><div>Tarun<br></div></div>