felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(aa-log): show target in log, show access as owner too.

Browse source
This commit is contained in:
Alexandre Pujol 2023-07-20 23:45:14 +01:00
parent 2307c536b3
commit 98c701f33d
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
3 changed files with 108 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

22
pkg/logs/logs.go
View file

@ -13,6 +13,7 @@ import (
"strings"
"github.com/roddhjav/apparmor.d/pkg/util"
"golang.org/x/exp/slices"
)
// Colors
@ -40,9 +41,8 @@ var (
repl string
}{
{regexp.MustCompile(`.*apparmor="`), `apparmor="`},
{regexp.MustCompile(`(peer_|)pid=[0-9]* `), ""},
{regexp.MustCompile(` fsuid.*`), ""},
{regexp.MustCompile(` exe=.*`), ""},
{regexp.MustCompile(`(peer_|)pid=[0-9]*\s`), " "},
{regexp.MustCompile(`\x1d`), " "},
}
)
@ -154,18 +154,24 @@ func (aaLogs AppArmorLogs) String() string {
// Print order of impression
keys := []string{
"profile", "label", // Profile name
"operation", "name",
"operation", "name", "target",
"mask", "bus", "path", "interface", "member", // dbus
"info", "comm",
"laddr", "lport", "faddr", "fport", "family", "sock_type", "protocol",
"requested_mask", "denied_mask", "signal", "peer", // "fsuid", "ouid", "FSUID", "OUID",
}
// Key to not print
ignore := []string{
"fsuid", "ouid", "FSUID", "OUID", "exe", "SAUID", "sauid", "terminal",
"UID", "AUID", "hostname", "addr",
}
// Color template to use
colors := map[string]string{
"profile": fgBlue,
"label": fgBlue,
"operation": fgYellow,
"name": fgMagenta,
"target": "-> " + fgMagenta,
"mask": boldRed,
"bus": fgCian + "bus=",
"path": "path=" + fgWhite,
@ -178,9 +184,14 @@ func (aaLogs AppArmorLogs) String() string {
for _, log := range aaLogs {
seen := map[string]bool{"apparmor": true}
res += state[log["apparmor"]]
fsuid := log["fsuid"]
ouid := log["ouid"]
for _, key := range keys {
if log[key] != "" {
if key == "name" && fsuid == ouid && !strings.Contains(log["operation"], "dbus") {
res += colors[key] + " owner" + reset
}
if colors[key] != "" {
res += " " + colors[key] + toQuote(log[key]) + reset
} else {
@ -191,6 +202,9 @@ func (aaLogs AppArmorLogs) String() string {
}
for key, value := range log {
if slices.Contains(ignore, key) {
continue
}
if !seen[key] && value != "" {
res += " " + key + "=" + toQuote(value)
}