feat(aa-log): show target in log, show access as owner too.
This commit is contained in:
Alexandre Pujol
parent
2307c536b3
commit
98c701f33d
3 changed files with 108 additions and 66 deletions
|
|
@ -13,6 +13,7 @@ import (
|
|||
"strings"
|
||||
|
||||
"github.com/roddhjav/apparmor.d/pkg/util"
|
||||
"golang.org/x/exp/slices"
|
||||
)
|
||||
|
||||
// Colors
|
||||
|
|
@ -40,9 +41,8 @@ var (
|
|||
repl string
|
||||
}{
|
||||
{regexp.MustCompile(`.*apparmor="`), `apparmor="`},
|
||||
{regexp.MustCompile(`(peer_|)pid=[0-9]* `), ""},
|
||||
{regexp.MustCompile(` fsuid.*`), ""},
|
||||
{regexp.MustCompile(` exe=.*`), ""},
|
||||
{regexp.MustCompile(`(peer_|)pid=[0-9]*\s`), " "},
|
||||
{regexp.MustCompile(`\x1d`), " "},
|
||||
}
|
||||
)
|
||||
|
||||
|
|
@ -154,18 +154,24 @@ func (aaLogs AppArmorLogs) String() string {
|
|||
// Print order of impression
|
||||
keys := []string{
|
||||
"profile", "label", // Profile name
|
||||
"operation", "name",
|
||||
"operation", "name", "target",
|
||||
"mask", "bus", "path", "interface", "member", // dbus
|
||||
"info", "comm",
|
||||
"laddr", "lport", "faddr", "fport", "family", "sock_type", "protocol",
|
||||
"requested_mask", "denied_mask", "signal", "peer", // "fsuid", "ouid", "FSUID", "OUID",
|
||||
}
|
||||
// Key to not print
|
||||
ignore := []string{
|
||||
"fsuid", "ouid", "FSUID", "OUID", "exe", "SAUID", "sauid", "terminal",
|
||||
"UID", "AUID", "hostname", "addr",
|
||||
}
|
||||
// Color template to use
|
||||
colors := map[string]string{
|
||||
"profile": fgBlue,
|
||||
"label": fgBlue,
|
||||
"operation": fgYellow,
|
||||
"name": fgMagenta,
|
||||
"target": "-> " + fgMagenta,
|
||||
"mask": boldRed,
|
||||
"bus": fgCian + "bus=",
|
||||
"path": "path=" + fgWhite,
|
||||
|
|
@ -178,9 +184,14 @@ func (aaLogs AppArmorLogs) String() string {
|
|||
for _, log := range aaLogs {
|
||||
seen := map[string]bool{"apparmor": true}
|
||||
res += state[log["apparmor"]]
|
||||
fsuid := log["fsuid"]
|
||||
ouid := log["ouid"]
|
||||
|
||||
for _, key := range keys {
|
||||
if log[key] != "" {
|
||||
if key == "name" && fsuid == ouid && !strings.Contains(log["operation"], "dbus") {
|
||||
res += colors[key] + " owner" + reset
|
||||
}
|
||||
if colors[key] != "" {
|
||||
res += " " + colors[key] + toQuote(log[key]) + reset
|
||||
} else {
|
||||
|
|
@ -191,6 +202,9 @@ func (aaLogs AppArmorLogs) String() string {
|
|||
}
|
||||
|
||||
for key, value := range log {
|
||||
if slices.Contains(ignore, key) {
|
||||
continue
|
||||
}
|
||||
if !seen[key] && value != "" {
|
||||
res += " " + key + "=" + toQuote(value)
|
||||
}
|
||||
|
|
|
|||
|
|
@ -11,32 +11,61 @@ import (
|
|||
"testing"
|
||||
)
|
||||
|
||||
var refKmod = AppArmorLogs{
|
||||
{
|
||||
"apparmor": "ALLOWED",
|
||||
"profile": "kmod",
|
||||
"operation": "file_inherit",
|
||||
"comm": "modprobe",
|
||||
"family": "unix",
|
||||
"sock_type": "stream",
|
||||
"protocol": "0",
|
||||
"requested_mask": "send receive",
|
||||
},
|
||||
}
|
||||
|
||||
var refMan = AppArmorLogs{
|
||||
{
|
||||
"apparmor": "ALLOWED",
|
||||
"profile": "man",
|
||||
"operation": "exec",
|
||||
"name": "/usr/bin/preconv",
|
||||
"info": "no new privs",
|
||||
"comm": "man",
|
||||
"requested_mask": "x",
|
||||
"denied_mask": "x",
|
||||
"error": "-1",
|
||||
},
|
||||
}
|
||||
var (
|
||||
refKmod = AppArmorLogs{
|
||||
{
|
||||
"apparmor": "ALLOWED",
|
||||
"profile": "kmod",
|
||||
"operation": "file_inherit",
|
||||
"comm": "modprobe",
|
||||
"family": "unix",
|
||||
"sock_type": "stream",
|
||||
"protocol": "0",
|
||||
"requested_mask": "send receive",
|
||||
},
|
||||
}
|
||||
refMan = AppArmorLogs{
|
||||
{
|
||||
"apparmor": "ALLOWED",
|
||||
"profile": "man",
|
||||
"operation": "exec",
|
||||
"name": "/usr/bin/preconv",
|
||||
"target": "man_groff",
|
||||
"info": "no new privs",
|
||||
"comm": "man",
|
||||
"requested_mask": "x",
|
||||
"denied_mask": "x",
|
||||
"error": "-1",
|
||||
"fsuid": "1000",
|
||||
"ouid": "0",
|
||||
"FSUID": "user",
|
||||
"OUID": "root",
|
||||
},
|
||||
}
|
||||
refPowerProfiles = AppArmorLogs{
|
||||
{
|
||||
"apparmor": "ALLOWED",
|
||||
"profile": "",
|
||||
"label": "power-profiles-daemon",
|
||||
"operation": "dbus_method_call",
|
||||
"name": "org.freedesktop.DBus",
|
||||
"mask": "send",
|
||||
"bus": "system",
|
||||
"path": "/org/freedesktop/DBus",
|
||||
"interface": "org.freedesktop.DBus",
|
||||
"member": "AddMatch",
|
||||
"peer_label": "dbus-daemon",
|
||||
"exe": "/usr/bin/dbus-daemon",
|
||||
"sauid": "102",
|
||||
"hostname": "?",
|
||||
"addr": "?",
|
||||
"terminal": "?",
|
||||
"UID": "messagebus",
|
||||
"AUID": "unset",
|
||||
"SAUID": "messagebus",
|
||||
},
|
||||
}
|
||||
)
|
||||
|
||||
func TestAppArmorEvents(t *testing.T) {
|
||||
tests := []struct {
|
||||
|
|
@ -57,6 +86,8 @@ func TestAppArmorEvents(t *testing.T) {
|
|||
"requested_mask": "wc",
|
||||
"denied_mask": "wc",
|
||||
"parent": "6974",
|
||||
"fsuid": "30",
|
||||
"ouid": "30",
|
||||
},
|
||||
},
|
||||
},
|
||||
|
|
@ -73,6 +104,8 @@ func TestAppArmorEvents(t *testing.T) {
|
|||
"requested_mask": "rw",
|
||||
"denied_mask": "rw",
|
||||
"parent": "16001",
|
||||
"fsuid": "0",
|
||||
"ouid": "1000",
|
||||
},
|
||||
},
|
||||
},
|
||||
|
|
@ -90,12 +123,14 @@ func TestAppArmorEvents(t *testing.T) {
|
|||
"requested_mask": "r",
|
||||
"denied_mask": "r",
|
||||
"error": "-13",
|
||||
"fsuid": "1002",
|
||||
"ouid": "0",
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "dbus_system",
|
||||
event: `type=USER_AVC msg=audit(1111111111.111:1111): pid=1780 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="ALLOWED" operation="dbus_method_call" bus="system" path="/org/freedesktop/PolicyKit1/Authority" interface="org.freedesktop.PolicyKit1.Authority" member="CheckAuthorization" mask="send" name="org.freedesktop.PolicyKit1" pid=1794 label="snapd" peer_pid=1790 peer_label="polkitd" exe="/usr/bin/dbus-daemon" sauid=102 hostname=? addr=? terminal=?' UID="messagebus" AUID="unset" SAUID="messagebus"`,
|
||||
event: `type=USER_AVC msg=audit(1111111111.111:1111): pid=1780 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="ALLOWED" operation="dbus_method_call" bus="system" path="/org/freedesktop/PolicyKit1/Authority" interface="org.freedesktop.PolicyKit1.Authority" member="CheckAuthorization" mask="send" name="org.freedesktop.PolicyKit1" pid=1794 label="snapd" peer_pid=1790 peer_label="polkitd" exe="/usr/bin/dbus-daemon" sauid=102 hostname=? addr=? terminal=? UID="messagebus" AUID="unset" SAUID="messagebus"`,
|
||||
want: AppArmorLogs{
|
||||
{
|
||||
"apparmor": "ALLOWED",
|
||||
|
|
@ -109,6 +144,14 @@ func TestAppArmorEvents(t *testing.T) {
|
|||
"interface": "org.freedesktop.PolicyKit1.Authority",
|
||||
"member": "CheckAuthorization",
|
||||
"peer_label": "polkitd",
|
||||
"exe": "/usr/bin/dbus-daemon",
|
||||
"sauid": "102",
|
||||
"hostname": "?",
|
||||
"addr": "?",
|
||||
"terminal": "?",
|
||||
"UID": "messagebus",
|
||||
"AUID": "unset",
|
||||
"SAUID": "messagebus",
|
||||
},
|
||||
},
|
||||
},
|
||||
|
|
@ -156,6 +199,10 @@ func TestNewApparmorLogs(t *testing.T) {
|
|||
"comm": "dnsmasq",
|
||||
"requested_mask": "r",
|
||||
"denied_mask": "r",
|
||||
"fsuid": "0",
|
||||
"ouid": "0",
|
||||
"FSUID": "root",
|
||||
"OUID": "root",
|
||||
},
|
||||
{
|
||||
"apparmor": "DENIED",
|
||||
|
|
@ -165,6 +212,10 @@ func TestNewApparmorLogs(t *testing.T) {
|
|||
"comm": "dnsmasq",
|
||||
"requested_mask": "r",
|
||||
"denied_mask": "r",
|
||||
"fsuid": "0",
|
||||
"ouid": "0",
|
||||
"FSUID": "root",
|
||||
"OUID": "root",
|
||||
},
|
||||
{
|
||||
"apparmor": "DENIED",
|
||||
|
|
@ -174,6 +225,10 @@ func TestNewApparmorLogs(t *testing.T) {
|
|||
"comm": "dnsmasq",
|
||||
"requested_mask": "r",
|
||||
"denied_mask": "r",
|
||||
"fsuid": "0",
|
||||
"ouid": "0",
|
||||
"FSUID": "root",
|
||||
"OUID": "root",
|
||||
},
|
||||
},
|
||||
},
|
||||
|
|
@ -190,21 +245,7 @@ func TestNewApparmorLogs(t *testing.T) {
|
|||
{
|
||||
name: "power-profiles-daemon",
|
||||
path: "../../tests/audit.log",
|
||||
want: AppArmorLogs{
|
||||
{
|
||||
"apparmor": "ALLOWED",
|
||||
"profile": "",
|
||||
"label": "power-profiles-daemon",
|
||||
"operation": "dbus_method_call",
|
||||
"name": "org.freedesktop.DBus",
|
||||
"mask": "send",
|
||||
"bus": "system",
|
||||
"path": "/org/freedesktop/DBus",
|
||||
"interface": "org.freedesktop.DBus",
|
||||
"member": "AddMatch",
|
||||
"peer_label": "dbus-daemon",
|
||||
},
|
||||
},
|
||||
want: refPowerProfiles,
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
|
|
@ -231,26 +272,12 @@ func TestAppArmorLogs_String(t *testing.T) {
|
|||
{
|
||||
name: "man",
|
||||
aaLogs: refMan,
|
||||
want: "\033[1;32mALLOWED\033[0m \033[34mman\033[0m \033[33mexec\033[0m \033[35m/usr/bin/preconv\033[0m info=\"no new privs\" comm=man requested_mask=\033[1;31mx\033[0m denied_mask=\033[1;31mx\033[0m error=-1\n",
|
||||
want: "\033[1;32mALLOWED\033[0m \033[34mman\033[0m \033[33mexec\033[0m \033[35m/usr/bin/preconv\033[0m -> \033[35mman_groff\033[0m info=\"no new privs\" comm=man requested_mask=\033[1;31mx\033[0m denied_mask=\033[1;31mx\033[0m error=-1\n",
|
||||
},
|
||||
{
|
||||
name: "power-profiles-daemon",
|
||||
aaLogs: AppArmorLogs{
|
||||
{
|
||||
"apparmor": "ALLOWED",
|
||||
"profile": "",
|
||||
"label": "power-profiles-daemon",
|
||||
"operation": "dbus_method_call",
|
||||
"name": "org.freedesktop.DBus",
|
||||
"mask": "send",
|
||||
"bus": "system",
|
||||
"path": "/org/freedesktop/DBus",
|
||||
"interface": "org.freedesktop.DBus",
|
||||
"member": "AddMatch",
|
||||
"peer_label": "dbus-daemon",
|
||||
},
|
||||
},
|
||||
want: "\033[1;32mALLOWED\033[0m \033[34mpower-profiles-daemon\033[0m \033[33mdbus_method_call\033[0m \033[35morg.freedesktop.DBus\033[0m \033[1;31msend\033[0m \033[36mbus=system\033[0m path=\033[37m/org/freedesktop/DBus\033[0m interface=\033[37morg.freedesktop.DBus\033[0m member=\033[32mAddMatch\033[0m peer_label=dbus-daemon\n",
|
||||
name: "power-profiles-daemon",
|
||||
aaLogs: refPowerProfiles,
|
||||
want: "\033[1;32mALLOWED\033[0m \033[34mpower-profiles-daemon\033[0m \033[33mdbus_method_call\033[0m \033[35morg.freedesktop.DBus\033[0m \033[1;31msend\033[0m \033[36mbus=system\033[0m path=\033[37m/org/freedesktop/DBus\033[0m interface=\033[37morg.freedesktop.DBus\033[0m member=\033[32mAddMatch\033[0m peer_label=dbus-daemon\n",
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue