refractor(aa-log): merge identical function together.
This commit is contained in:
parent
95c322d62a
commit
cd80a7d919
3 changed files with 30 additions and 54 deletions
|
|
@ -9,6 +9,7 @@ import (
|
||||||
"fmt"
|
"fmt"
|
||||||
"io"
|
"io"
|
||||||
"os"
|
"os"
|
||||||
|
"strings"
|
||||||
|
|
||||||
"github.com/roddhjav/apparmor.d/pkg/logs"
|
"github.com/roddhjav/apparmor.d/pkg/logs"
|
||||||
"golang.org/x/exp/slices"
|
"golang.org/x/exp/slices"
|
||||||
|
|
@ -59,7 +60,7 @@ func aaLog(logger string, path string, profile string) error {
|
||||||
}
|
}
|
||||||
|
|
||||||
if raw {
|
if raw {
|
||||||
fmt.Print(logs.Raw(file, profile))
|
fmt.Print(strings.Join(logs.GetApparmorLogs(file, profile), "\n"))
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -30,6 +30,33 @@ type systemdLog struct {
|
||||||
Message string `json:"MESSAGE"`
|
Message string `json:"MESSAGE"`
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// GetApparmorLogs return a list of cleaned apparmor logs from a file
|
||||||
|
func GetApparmorLogs(file io.Reader, profile string) []string {
|
||||||
|
res := ""
|
||||||
|
isAppArmorLog := isAppArmorLogTemplate.Copy()
|
||||||
|
if profile != "" {
|
||||||
|
exp := `apparmor=("DENIED"|"ALLOWED"|"AUDIT")`
|
||||||
|
exp = fmt.Sprintf(exp+`.* (profile="%s.*"|label="%s.*")`, profile, profile)
|
||||||
|
isAppArmorLog = regexp.MustCompile(exp)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Select Apparmor logs
|
||||||
|
scanner := bufio.NewScanner(file)
|
||||||
|
for scanner.Scan() {
|
||||||
|
line := scanner.Text()
|
||||||
|
if isAppArmorLog.MatchString(line) {
|
||||||
|
res += line + "\n"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Clean & remove doublon in logs
|
||||||
|
for _, aa := range regCleanLogs {
|
||||||
|
res = aa.Regex.ReplaceAllLiteralString(res, aa.Repl)
|
||||||
|
}
|
||||||
|
logs := strings.Split(res, "\n")
|
||||||
|
return util.RemoveDuplicate(logs)
|
||||||
|
}
|
||||||
|
|
||||||
// GetAuditLogs return a reader with the logs entries from Auditd
|
// GetAuditLogs return a reader with the logs entries from Auditd
|
||||||
func GetAuditLogs(path string) (io.Reader, error) {
|
func GetAuditLogs(path string) (io.Reader, error) {
|
||||||
file, err := os.Open(filepath.Clean(path))
|
file, err := os.Open(filepath.Clean(path))
|
||||||
|
|
@ -92,31 +119,3 @@ func SelectLogFile(path string) string {
|
||||||
}
|
}
|
||||||
return ""
|
return ""
|
||||||
}
|
}
|
||||||
|
|
||||||
func Raw(file io.Reader, profile string) string {
|
|
||||||
res := ""
|
|
||||||
isAppArmorLog := isAppArmorLogTemplate.Copy()
|
|
||||||
if profile != "" {
|
|
||||||
exp := `apparmor=("DENIED"|"ALLOWED"|"AUDIT")`
|
|
||||||
exp = fmt.Sprintf(exp+`.* (profile="%s.*"|label="%s.*")`, profile, profile)
|
|
||||||
isAppArmorLog = regexp.MustCompile(exp)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Select Apparmor logs
|
|
||||||
scanner := bufio.NewScanner(file)
|
|
||||||
for scanner.Scan() {
|
|
||||||
line := scanner.Text()
|
|
||||||
if isAppArmorLog.MatchString(line) {
|
|
||||||
res += line + "\n"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Clean & remove doublon in logs
|
|
||||||
for _, aa := range regCleanLogs {
|
|
||||||
res = aa.Regex.ReplaceAllLiteralString(res, aa.Repl)
|
|
||||||
}
|
|
||||||
logs := strings.Split(res, "\n")
|
|
||||||
logs = util.RemoveDuplicate(logs)
|
|
||||||
|
|
||||||
return strings.Join(logs, "\n")
|
|
||||||
}
|
|
||||||
|
|
|
||||||
|
|
@ -5,8 +5,6 @@
|
||||||
package logs
|
package logs
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"bufio"
|
|
||||||
"fmt"
|
|
||||||
"io"
|
"io"
|
||||||
"regexp"
|
"regexp"
|
||||||
"strings"
|
"strings"
|
||||||
|
|
@ -101,29 +99,7 @@ func toQuote(str string) string {
|
||||||
|
|
||||||
// NewApparmorLogs return a new ApparmorLogs list of map from a log file
|
// NewApparmorLogs return a new ApparmorLogs list of map from a log file
|
||||||
func NewApparmorLogs(file io.Reader, profile string) AppArmorLogs {
|
func NewApparmorLogs(file io.Reader, profile string) AppArmorLogs {
|
||||||
log := ""
|
logs := GetApparmorLogs(file, profile)
|
||||||
isAppArmorLog := isAppArmorLogTemplate.Copy()
|
|
||||||
if profile != "" {
|
|
||||||
exp := `apparmor=("DENIED"|"ALLOWED"|"AUDIT")`
|
|
||||||
exp = fmt.Sprintf(exp+`.* (profile="%s.*"|label="%s.*")`, profile, profile)
|
|
||||||
isAppArmorLog = regexp.MustCompile(exp)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Select Apparmor logs
|
|
||||||
scanner := bufio.NewScanner(file)
|
|
||||||
for scanner.Scan() {
|
|
||||||
line := scanner.Text()
|
|
||||||
if isAppArmorLog.MatchString(line) {
|
|
||||||
log += line + "\n"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Clean & remove doublon in logs
|
|
||||||
for _, aa := range regCleanLogs {
|
|
||||||
log = aa.Regex.ReplaceAllLiteralString(log, aa.Repl)
|
|
||||||
}
|
|
||||||
logs := strings.Split(log, "\n")
|
|
||||||
logs = util.RemoveDuplicate(logs)
|
|
||||||
|
|
||||||
// Parse log into ApparmorLog struct
|
// Parse log into ApparmorLog struct
|
||||||
aaLogs := make(AppArmorLogs, 0)
|
aaLogs := make(AppArmorLogs, 0)
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue