audit_ftype_to_name?
Stephen Quinney
squinney at inf.ed.ac.uk
Tue Oct 22 20:58:05 UTC 2013
On Tue, Oct 22, 2013 at 01:59:32PM -0400, Steve Grubb wrote:
> On Friday, October 18, 2013 12:47:23 PM Stephen Quinney wrote:
>
> > I can't see any definition of the ftype_i2s function which is called
> > by audit_ftype_to_name so maybe this hasn't been implemented yet?
>
> Yes, it has been. However, its over in lib/libaudit.
>
I suspect I'm a little confused here, is libaudit provided separately
from the main audit code?
% tar zxf Downloads/audit-2.3.2.tar.gz
% grep -ri ftype_i2s audit-2.3.2/
audit-2.3.2/lib/lookup_table.c: return ftype_i2s(ftype);
So, I don't see the function definition, just the call.
> It seems to work fin on my system:
>
> #!/usr/bin/env python
> import sys
> import audit
>
> name = audit.audit_ftype_to_name(0140000)
> print '%s\n' % (name,),
> sys.exit(0)
>
So, I was trying to use it to translate the value returned by the
get_field_type function in auparse, should that work?
Stephen
--
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.
More information about the Linux-audit
mailing list