blob: b76160df371058080b4942a14a07b9fb88036003 [file] [log] [blame]
William Roberts29d238d2013-02-08 09:45:26 +09001/*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#include <ctype.h>
Mark Salyzyn29eb5702015-03-03 16:21:27 -080018#include <endian.h>
William Roberts29d238d2013-02-08 09:45:26 +090019#include <errno.h>
Mark Salyzyne0fa2912014-04-28 16:39:04 -070020#include <limits.h>
William Roberts29d238d2013-02-08 09:45:26 +090021#include <stdarg.h>
22#include <stdlib.h>
Mark Salyzyn317bfb92016-02-23 08:55:43 -080023#include <string.h>
Mark Salyzyn8daa9af2014-04-28 14:07:23 -070024#include <sys/prctl.h>
Mark Salyzyne9bebd02014-04-03 09:55:26 -070025#include <sys/uio.h>
Mark Salyzyn7ee2aef2014-09-28 14:41:50 -070026#include <syslog.h>
William Roberts29d238d2013-02-08 09:45:26 +090027
Max Bires4214d132017-08-15 11:07:49 -070028#include <fstream>
29#include <sstream>
30
Mark Salyzync8d31942016-11-03 10:29:23 -070031#include <android-base/macros.h>
Max Bires4214d132017-08-15 11:07:49 -070032#include <log/log_properties.h>
Mark Salyzyne3aeeee2015-03-17 07:56:32 -070033#include <private/android_filesystem_config.h>
Mark Salyzyn29eb5702015-03-03 16:21:27 -080034#include <private/android_logger.h>
35
William Roberts29d238d2013-02-08 09:45:26 +090036#include "LogAudit.h"
Mark Salyzyn317bfb92016-02-23 08:55:43 -080037#include "LogBuffer.h"
Mark Salyzynae4d9282014-10-15 08:49:39 -070038#include "LogKlog.h"
Mark Salyzyn317bfb92016-02-23 08:55:43 -080039#include "LogReader.h"
Mark Salyzyna2c02222016-12-13 10:31:29 -080040#include "LogUtils.h"
Mark Salyzyn501c3732017-03-10 14:31:54 -080041#include "libaudit.h"
William Roberts29d238d2013-02-08 09:45:26 +090042
Mark Salyzyn501c3732017-03-10 14:31:54 -080043#define KMSG_PRIORITY(PRI) \
44 '<', '0' + LOG_MAKEPRI(LOG_AUTH, LOG_PRI(PRI)) / 10, \
45 '0' + LOG_MAKEPRI(LOG_AUTH, LOG_PRI(PRI)) % 10, '>'
Mark Salyzyn7ee2aef2014-09-28 14:41:50 -070046
Mark Salyzyn501c3732017-03-10 14:31:54 -080047LogAudit::LogAudit(LogBuffer* buf, LogReader* reader, int fdDmesg)
Jeff Vander Stoep54c7a5f2018-01-03 11:04:26 -080048 : SocketListener(getLogSocket(), false),
Mark Salyzyn501c3732017-03-10 14:31:54 -080049 logbuf(buf),
50 reader(reader),
51 fdDmesg(fdDmesg),
52 main(__android_logger_property_get_bool("ro.logd.auditd.main",
53 BOOL_DEFAULT_TRUE)),
54 events(__android_logger_property_get_bool("ro.logd.auditd.events",
Mark Salyzynce80da32016-12-29 15:16:06 -080055 BOOL_DEFAULT_TRUE)),
Jeff Vander Stoep54c7a5f2018-01-03 11:04:26 -080056 initialized(false) {
Sami Tolvanena742d102016-06-14 18:04:43 +000057 static const char auditd_message[] = { KMSG_PRIORITY(LOG_INFO),
Mark Salyzyn501c3732017-03-10 14:31:54 -080058 'l',
59 'o',
60 'g',
61 'd',
62 '.',
63 'a',
64 'u',
65 'd',
66 'i',
67 't',
68 'd',
69 ':',
70 ' ',
71 's',
72 't',
73 'a',
74 'r',
75 't',
76 '\n' };
Sami Tolvanena742d102016-06-14 18:04:43 +000077 write(fdDmesg, auditd_message, sizeof(auditd_message));
William Roberts29d238d2013-02-08 09:45:26 +090078}
79
Mark Salyzyn501c3732017-03-10 14:31:54 -080080bool LogAudit::onDataAvailable(SocketClient* cli) {
Mark Salyzyneb06de72014-10-13 09:59:37 -070081 if (!initialized) {
82 prctl(PR_SET_NAME, "logd.auditd");
83 initialized = true;
84 }
Mark Salyzyn8daa9af2014-04-28 14:07:23 -070085
William Roberts29d238d2013-02-08 09:45:26 +090086 struct audit_message rep;
87
Mark Salyzyne0fa2912014-04-28 16:39:04 -070088 rep.nlh.nlmsg_type = 0;
89 rep.nlh.nlmsg_len = 0;
90 rep.data[0] = '\0';
91
William Roberts29d238d2013-02-08 09:45:26 +090092 if (audit_get_reply(cli->getSocket(), &rep, GET_REPLY_BLOCKING, 0) < 0) {
93 SLOGE("Failed on audit_get_reply with error: %s", strerror(errno));
94 return false;
95 }
96
Mark Salyzyn247d6822017-01-03 14:00:19 -080097 logPrint("type=%d %.*s", rep.nlh.nlmsg_type, rep.nlh.nlmsg_len, rep.data);
William Roberts29d238d2013-02-08 09:45:26 +090098
99 return true;
100}
101
Max Bires4214d132017-08-15 11:07:49 -0700102static inline bool hasMetadata(char* str, int str_len) {
103 // need to check and see if str already contains bug metadata from
104 // possibility of stuttering if log audit crashes and then reloads kernel
105 // messages. Kernel denials that contain metadata will either end in
106 // "b/[0-9]+$" or "b/[0-9]+ duplicate messages suppressed$" which will put
107 // a '/' character at either 9 or 39 indices away from the end of the str.
108 return str_len >= 39 &&
109 (str[str_len - 9] == '/' || str[str_len - 39] == '/');
110}
111
112std::map<std::string, std::string> LogAudit::populateDenialMap() {
113 std::ifstream bug_file("/system/etc/selinux/selinux_denial_metadata");
114 std::string line;
115 // allocate a map for the static map pointer in logParse to keep track of,
116 // this function only runs once
117 std::map<std::string, std::string> denial_to_bug;
118 if (bug_file.good()) {
119 std::string scontext;
120 std::string tcontext;
121 std::string tclass;
122 std::string bug_num;
123 while (std::getline(bug_file, line)) {
124 std::stringstream split_line(line);
125 split_line >> scontext >> tcontext >> tclass >> bug_num;
126 denial_to_bug.emplace(scontext + tcontext + tclass, bug_num);
127 }
128 }
129 return denial_to_bug;
130}
131
132std::string LogAudit::denialParse(const std::string& denial, char terminator,
133 const std::string& search_term) {
134 size_t start_index = denial.find(search_term);
135 if (start_index != std::string::npos) {
136 start_index += search_term.length();
137 return denial.substr(
138 start_index, denial.find(terminator, start_index) - start_index);
139 }
140 return "";
141}
142
143void LogAudit::logParse(const std::string& string, std::string* bug_num) {
144 if (!__android_log_is_debuggable()) {
145 bug_num->assign("");
146 return;
147 }
148 static std::map<std::string, std::string> denial_to_bug =
149 populateDenialMap();
150 std::string scontext = denialParse(string, ':', "scontext=u:object_r:");
151 std::string tcontext = denialParse(string, ':', "tcontext=u:object_r:");
152 std::string tclass = denialParse(string, ' ', "tclass=");
153 if (scontext.empty()) {
154 scontext = denialParse(string, ':', "scontext=u:r:");
155 }
156 if (tcontext.empty()) {
157 tcontext = denialParse(string, ':', "tcontext=u:r:");
158 }
159 auto search = denial_to_bug.find(scontext + tcontext + tclass);
160 if (search != denial_to_bug.end()) {
161 bug_num->assign(" b/" + search->second);
162 } else {
163 bug_num->assign("");
164 }
165}
166
Mark Salyzyn501c3732017-03-10 14:31:54 -0800167int LogAudit::logPrint(const char* fmt, ...) {
William Roberts29d238d2013-02-08 09:45:26 +0900168 if (fmt == NULL) {
169 return -EINVAL;
170 }
171
172 va_list args;
173
Mark Salyzyn501c3732017-03-10 14:31:54 -0800174 char* str = NULL;
William Roberts29d238d2013-02-08 09:45:26 +0900175 va_start(args, fmt);
176 int rc = vasprintf(&str, fmt, args);
177 va_end(args);
178
179 if (rc < 0) {
180 return rc;
181 }
Mark Salyzyn501c3732017-03-10 14:31:54 -0800182 char* cp;
Nick Kralevich2e588672017-01-03 10:35:34 -0800183 // Work around kernels missing
184 // https://github.com/torvalds/linux/commit/b8f89caafeb55fba75b74bea25adc4e4cd91be67
185 // Such kernels improperly add newlines inside audit messages.
186 while ((cp = strchr(str, '\n'))) {
187 *cp = ' ';
188 }
189
Mark Salyzyne4369d62014-05-27 10:06:34 -0700190 while ((cp = strstr(str, " "))) {
191 memmove(cp, cp + 1, strlen(cp + 1) + 1);
192 }
Sami Tolvanena742d102016-06-14 18:04:43 +0000193 bool info = strstr(str, " permissive=1") || strstr(str, " policy loaded ");
Max Bires4214d132017-08-15 11:07:49 -0700194 static std::string bug_metadata;
Mark Salyzyneb06de72014-10-13 09:59:37 -0700195 if ((fdDmesg >= 0) && initialized) {
Max Bires4214d132017-08-15 11:07:49 -0700196 struct iovec iov[4];
Mark Salyzyn7ee2aef2014-09-28 14:41:50 -0700197 static const char log_info[] = { KMSG_PRIORITY(LOG_INFO) };
198 static const char log_warning[] = { KMSG_PRIORITY(LOG_WARNING) };
Mark Salyzyn4d205f82016-07-15 15:45:58 -0700199 static const char newline[] = "\n";
Mark Salyzyne9bebd02014-04-03 09:55:26 -0700200
Mark Salyzyn4d205f82016-07-15 15:45:58 -0700201 // Dedupe messages, checking for identical messages starting with avc:
202 static unsigned count;
Mark Salyzyn501c3732017-03-10 14:31:54 -0800203 static char* last_str;
Mark Salyzyn4d205f82016-07-15 15:45:58 -0700204 static bool last_info;
Mark Salyzyne9bebd02014-04-03 09:55:26 -0700205
Mark Salyzyn4d205f82016-07-15 15:45:58 -0700206 if (last_str != NULL) {
207 static const char avc[] = "): avc: ";
Mark Salyzyn501c3732017-03-10 14:31:54 -0800208 char* avcl = strstr(last_str, avc);
Mark Salyzyn4d205f82016-07-15 15:45:58 -0700209 bool skip = false;
210
211 if (avcl) {
Mark Salyzyn501c3732017-03-10 14:31:54 -0800212 char* avcr = strstr(str, avc);
Mark Salyzyn4d205f82016-07-15 15:45:58 -0700213
Mark Salyzyn501c3732017-03-10 14:31:54 -0800214 skip = avcr &&
215 !fastcmp<strcmp>(avcl + strlen(avc), avcr + strlen(avc));
Mark Salyzyn4d205f82016-07-15 15:45:58 -0700216 if (skip) {
217 ++count;
218 free(last_str);
219 last_str = strdup(str);
220 last_info = info;
221 }
222 }
223 if (!skip) {
224 static const char resume[] = " duplicate messages suppressed\n";
Mark Salyzyn501c3732017-03-10 14:31:54 -0800225 iov[0].iov_base = last_info ? const_cast<char*>(log_info)
226 : const_cast<char*>(log_warning);
227 iov[0].iov_len =
228 last_info ? sizeof(log_info) : sizeof(log_warning);
Mark Salyzyn4d205f82016-07-15 15:45:58 -0700229 iov[1].iov_base = last_str;
230 iov[1].iov_len = strlen(last_str);
Max Bires4214d132017-08-15 11:07:49 -0700231 iov[2].iov_base = const_cast<char*>(bug_metadata.c_str());
232 iov[2].iov_len = bug_metadata.length();
Mark Salyzyn4d205f82016-07-15 15:45:58 -0700233 if (count > 1) {
Max Bires4214d132017-08-15 11:07:49 -0700234 iov[3].iov_base = const_cast<char*>(resume);
235 iov[3].iov_len = strlen(resume);
Mark Salyzyn4d205f82016-07-15 15:45:58 -0700236 } else {
Max Bires4214d132017-08-15 11:07:49 -0700237 iov[3].iov_base = const_cast<char*>(newline);
238 iov[3].iov_len = strlen(newline);
Mark Salyzyn4d205f82016-07-15 15:45:58 -0700239 }
240
Mark Salyzync8d31942016-11-03 10:29:23 -0700241 writev(fdDmesg, iov, arraysize(iov));
Mark Salyzyn4d205f82016-07-15 15:45:58 -0700242 free(last_str);
243 last_str = NULL;
244 }
245 }
246 if (last_str == NULL) {
247 count = 0;
248 last_str = strdup(str);
249 last_info = info;
250 }
251 if (count == 0) {
Max Bires4214d132017-08-15 11:07:49 -0700252 logParse(str, &bug_metadata);
Mark Salyzyn501c3732017-03-10 14:31:54 -0800253 iov[0].iov_base = info ? const_cast<char*>(log_info)
254 : const_cast<char*>(log_warning);
255 iov[0].iov_len = info ? sizeof(log_info) : sizeof(log_warning);
Mark Salyzyn4d205f82016-07-15 15:45:58 -0700256 iov[1].iov_base = str;
257 iov[1].iov_len = strlen(str);
Max Bires4214d132017-08-15 11:07:49 -0700258 iov[2].iov_base = const_cast<char*>(bug_metadata.c_str());
259 iov[2].iov_len = bug_metadata.length();
260 iov[3].iov_base = const_cast<char*>(newline);
261 iov[3].iov_len = strlen(newline);
Mark Salyzyn4d205f82016-07-15 15:45:58 -0700262
Mark Salyzync8d31942016-11-03 10:29:23 -0700263 writev(fdDmesg, iov, arraysize(iov));
Mark Salyzyn4d205f82016-07-15 15:45:58 -0700264 }
Mark Salyzyne9bebd02014-04-03 09:55:26 -0700265 }
266
Mark Salyzynce80da32016-12-29 15:16:06 -0800267 if (!main && !events) {
268 free(str);
269 return 0;
270 }
271
William Roberts29d238d2013-02-08 09:45:26 +0900272 pid_t pid = getpid();
273 pid_t tid = gettid();
Mark Salyzyne3aeeee2015-03-17 07:56:32 -0700274 uid_t uid = AID_LOGD;
William Roberts29d238d2013-02-08 09:45:26 +0900275 log_time now;
276
277 static const char audit_str[] = " audit(";
Mark Salyzyn501c3732017-03-10 14:31:54 -0800278 char* timeptr = strstr(str, audit_str);
279 if (timeptr &&
280 ((cp = now.strptime(timeptr + sizeof(audit_str) - 1, "%s.%q"))) &&
281 (*cp == ':')) {
William Roberts29d238d2013-02-08 09:45:26 +0900282 memcpy(timeptr + sizeof(audit_str) - 1, "0.0", 3);
Mark Salyzyne4369d62014-05-27 10:06:34 -0700283 memmove(timeptr + sizeof(audit_str) - 1 + 3, cp, strlen(cp) + 1);
Mark Salyzynb6bee332015-09-08 08:56:32 -0700284 if (!isMonotonic()) {
285 if (android::isMonotonic(now)) {
286 LogKlog::convertMonotonicToReal(now);
287 }
288 } else {
289 if (!android::isMonotonic(now)) {
290 LogKlog::convertRealToMonotonic(now);
291 }
Mark Salyzynae4d9282014-10-15 08:49:39 -0700292 }
Mark Salyzynb6bee332015-09-08 08:56:32 -0700293 } else if (isMonotonic()) {
294 now = log_time(CLOCK_MONOTONIC);
William Roberts29d238d2013-02-08 09:45:26 +0900295 } else {
Mark Salyzynb6bee332015-09-08 08:56:32 -0700296 now = log_time(CLOCK_REALTIME);
William Roberts29d238d2013-02-08 09:45:26 +0900297 }
298
299 static const char pid_str[] = " pid=";
Mark Salyzyn501c3732017-03-10 14:31:54 -0800300 char* pidptr = strstr(str, pid_str);
William Roberts29d238d2013-02-08 09:45:26 +0900301 if (pidptr && isdigit(pidptr[sizeof(pid_str) - 1])) {
302 cp = pidptr + sizeof(pid_str) - 1;
303 pid = 0;
304 while (isdigit(*cp)) {
305 pid = (pid * 10) + (*cp - '0');
306 ++cp;
307 }
308 tid = pid;
Mark Salyzyn3c501b52017-04-18 14:09:45 -0700309 logbuf->wrlock();
William Roberts29d238d2013-02-08 09:45:26 +0900310 uid = logbuf->pidToUid(pid);
Mark Salyzyned777e92015-06-24 16:22:54 -0700311 logbuf->unlock();
Mark Salyzyne4369d62014-05-27 10:06:34 -0700312 memmove(pidptr, cp, strlen(cp) + 1);
William Roberts29d238d2013-02-08 09:45:26 +0900313 }
314
Mark Salyzyne4369d62014-05-27 10:06:34 -0700315 // log to events
316
Max Bires4214d132017-08-15 11:07:49 -0700317 size_t str_len = strnlen(str, LOGGER_ENTRY_MAX_PAYLOAD);
318 if (((fdDmesg < 0) || !initialized) && !hasMetadata(str, str_len))
319 logParse(str, &bug_metadata);
320 str_len = (str_len + bug_metadata.length() <= LOGGER_ENTRY_MAX_PAYLOAD)
321 ? str_len + bug_metadata.length()
322 : LOGGER_ENTRY_MAX_PAYLOAD;
323 size_t message_len = str_len + sizeof(android_log_event_string_t);
Mark Salyzyne4369d62014-05-27 10:06:34 -0700324
Hao Wangf6e22962017-12-04 14:10:40 +0800325 log_mask_t notify = 0;
William Roberts29d238d2013-02-08 09:45:26 +0900326
Mark Salyzyn501c3732017-03-10 14:31:54 -0800327 if (events) { // begin scope for event buffer
Max Bires4214d132017-08-15 11:07:49 -0700328 uint32_t buffer[(message_len + sizeof(uint32_t) - 1) / sizeof(uint32_t)];
Mark Salyzynddda2122015-10-02 09:22:52 -0700329
Mark Salyzyn501c3732017-03-10 14:31:54 -0800330 android_log_event_string_t* event =
331 reinterpret_cast<android_log_event_string_t*>(buffer);
Mark Salyzyn29eb5702015-03-03 16:21:27 -0800332 event->header.tag = htole32(AUDITD_LOG_TAG);
Nick Kralevich58ba58a2015-04-07 01:25:43 -0700333 event->type = EVENT_TYPE_STRING;
Max Bires4214d132017-08-15 11:07:49 -0700334 event->length = htole32(message_len);
335 memcpy(event->data, str, str_len - bug_metadata.length());
336 memcpy(event->data + str_len - bug_metadata.length(),
337 bug_metadata.c_str(), bug_metadata.length());
Mark Salyzyne4369d62014-05-27 10:06:34 -0700338
Max Bires4214d132017-08-15 11:07:49 -0700339 rc = logbuf->log(
340 LOG_ID_EVENTS, now, uid, pid, tid, reinterpret_cast<char*>(event),
341 (message_len <= USHRT_MAX) ? (unsigned short)message_len
342 : USHRT_MAX);
Mark Salyzyn202e1532015-02-09 08:21:05 -0800343 if (rc >= 0) {
Hao Wangf6e22962017-12-04 14:10:40 +0800344 notify |= 1 << LOG_ID_EVENTS;
Mark Salyzyn202e1532015-02-09 08:21:05 -0800345 }
Mark Salyzynddda2122015-10-02 09:22:52 -0700346 // end scope for event buffer
William Roberts29d238d2013-02-08 09:45:26 +0900347 }
348
Mark Salyzyne4369d62014-05-27 10:06:34 -0700349 // log to main
350
351 static const char comm_str[] = " comm=\"";
Mark Salyzyn501c3732017-03-10 14:31:54 -0800352 const char* comm = strstr(str, comm_str);
353 const char* estr = str + strlen(str);
354 const char* commfree = NULL;
Mark Salyzyne4369d62014-05-27 10:06:34 -0700355 if (comm) {
356 estr = comm;
357 comm += sizeof(comm_str) - 1;
358 } else if (pid == getpid()) {
359 pid = tid;
360 comm = "auditd";
Mark Salyzyned777e92015-06-24 16:22:54 -0700361 } else {
Mark Salyzyn3c501b52017-04-18 14:09:45 -0700362 logbuf->wrlock();
Mark Salyzyned777e92015-06-24 16:22:54 -0700363 comm = commfree = logbuf->pidToName(pid);
364 logbuf->unlock();
365 if (!comm) {
366 comm = "unknown";
367 }
Mark Salyzyne4369d62014-05-27 10:06:34 -0700368 }
369
Mark Salyzyn501c3732017-03-10 14:31:54 -0800370 const char* ecomm = strchr(comm, '"');
Mark Salyzyne4369d62014-05-27 10:06:34 -0700371 if (ecomm) {
372 ++ecomm;
Max Bires4214d132017-08-15 11:07:49 -0700373 str_len = ecomm - comm;
Mark Salyzyne4369d62014-05-27 10:06:34 -0700374 } else {
Max Bires4214d132017-08-15 11:07:49 -0700375 str_len = strlen(comm) + 1;
Mark Salyzyne4369d62014-05-27 10:06:34 -0700376 ecomm = "";
377 }
Max Bires4214d132017-08-15 11:07:49 -0700378 size_t prefix_len = estr - str;
379 if (prefix_len > LOGGER_ENTRY_MAX_PAYLOAD) {
380 prefix_len = LOGGER_ENTRY_MAX_PAYLOAD;
Mark Salyzynddda2122015-10-02 09:22:52 -0700381 }
Max Bires4214d132017-08-15 11:07:49 -0700382 size_t suffix_len = strnlen(ecomm, LOGGER_ENTRY_MAX_PAYLOAD - prefix_len);
383 message_len = str_len + prefix_len + suffix_len + bug_metadata.length() + 2;
Mark Salyzyne4369d62014-05-27 10:06:34 -0700384
Mark Salyzyn501c3732017-03-10 14:31:54 -0800385 if (main) { // begin scope for main buffer
Max Bires4214d132017-08-15 11:07:49 -0700386 char newstr[message_len];
Mark Salyzynddda2122015-10-02 09:22:52 -0700387
Mark Salyzyn6bdeee02014-09-19 11:59:42 -0700388 *newstr = info ? ANDROID_LOG_INFO : ANDROID_LOG_WARN;
Max Bires4214d132017-08-15 11:07:49 -0700389 strlcpy(newstr + 1, comm, str_len);
390 strncpy(newstr + 1 + str_len, str, prefix_len);
391 strncpy(newstr + 1 + str_len + prefix_len, ecomm, suffix_len);
392 strncpy(newstr + 1 + str_len + prefix_len + suffix_len,
393 bug_metadata.c_str(), bug_metadata.length());
Mark Salyzyne4369d62014-05-27 10:06:34 -0700394
Mark Salyzyn202e1532015-02-09 08:21:05 -0800395 rc = logbuf->log(LOG_ID_MAIN, now, uid, pid, tid, newstr,
Max Bires4214d132017-08-15 11:07:49 -0700396 (message_len <= USHRT_MAX) ? (unsigned short)message_len
397 : USHRT_MAX);
Mark Salyzyne4369d62014-05-27 10:06:34 -0700398
Mark Salyzyn202e1532015-02-09 08:21:05 -0800399 if (rc >= 0) {
Hao Wangf6e22962017-12-04 14:10:40 +0800400 notify |= 1 << LOG_ID_MAIN;
Mark Salyzyn202e1532015-02-09 08:21:05 -0800401 }
Mark Salyzynddda2122015-10-02 09:22:52 -0700402 // end scope for main buffer
Mark Salyzyne4369d62014-05-27 10:06:34 -0700403 }
404
Mark Salyzyn501c3732017-03-10 14:31:54 -0800405 free(const_cast<char*>(commfree));
William Roberts29d238d2013-02-08 09:45:26 +0900406 free(str);
407
Mark Salyzyne4369d62014-05-27 10:06:34 -0700408 if (notify) {
Hao Wangf6e22962017-12-04 14:10:40 +0800409 reader->notifyNewLog(notify);
Mark Salyzyn202e1532015-02-09 08:21:05 -0800410 if (rc < 0) {
Max Bires4214d132017-08-15 11:07:49 -0700411 rc = message_len;
Mark Salyzyn202e1532015-02-09 08:21:05 -0800412 }
Mark Salyzyne4369d62014-05-27 10:06:34 -0700413 }
William Roberts29d238d2013-02-08 09:45:26 +0900414
415 return rc;
416}
417
Mark Salyzyn501c3732017-03-10 14:31:54 -0800418int LogAudit::log(char* buf, size_t len) {
419 char* audit = strstr(buf, " audit(");
Mark Salyzyn151beac2015-09-04 11:37:42 -0700420 if (!audit || (audit >= &buf[len])) {
Mark Salyzynae4d9282014-10-15 08:49:39 -0700421 return 0;
William Roberts29d238d2013-02-08 09:45:26 +0900422 }
423
Mark Salyzyneb06de72014-10-13 09:59:37 -0700424 *audit = '\0';
William Roberts29d238d2013-02-08 09:45:26 +0900425
Mark Salyzyneb06de72014-10-13 09:59:37 -0700426 int rc;
Mark Salyzyn501c3732017-03-10 14:31:54 -0800427 char* type = strstr(buf, "type=");
Mark Salyzyn151beac2015-09-04 11:37:42 -0700428 if (type && (type < &buf[len])) {
Mark Salyzyneb06de72014-10-13 09:59:37 -0700429 rc = logPrint("%s %s", type, audit + 1);
430 } else {
431 rc = logPrint("%s", audit + 1);
William Roberts29d238d2013-02-08 09:45:26 +0900432 }
Mark Salyzyneb06de72014-10-13 09:59:37 -0700433 *audit = ' ';
434 return rc;
William Roberts29d238d2013-02-08 09:45:26 +0900435}
436
437int LogAudit::getLogSocket() {
438 int fd = audit_open();
439 if (fd < 0) {
440 return fd;
441 }
Nick Kralevichc234a1b2014-11-19 13:33:22 -0800442 if (audit_setup(fd, getpid()) < 0) {
William Roberts29d238d2013-02-08 09:45:26 +0900443 audit_close(fd);
444 fd = -1;
445 }
William Roberts29d238d2013-02-08 09:45:26 +0900446 return fd;
447}