Re: An autrace that follows forks

John D. Ramsdell
2006-10-15T15:32:07Z

Steve Grubb <sgrubb@redhat.com> writes:

> It was using auditctl just for expedience when the program was
> written. I can add the code to switch it over.

I wrote code that uses libaudit to add rules. After performing "yum
install audit-libs-devel", I was pleased to find a manual page for
audit_add_rule, but the description of the return value says to refer
to audit_send. However, I found no manual page for audit_send.
Studying code made me realize the error condition is <= 0, not < 0, so
it's important not to guess.

John

static int audit_sys; /* File descriptor for socket to audit system */

static int /* Create a rule for a pid */
init_rule(struct audit_rule *r, pid_t pid)
{ /* Returns zero on success */
char field[PID_FIELD_SIZE];
if (snprintf(field, PID_FIELD_SIZE, "pid=%d", pid) >= PID_FIELD_SIZE) {
fprintf(stderr, "Internal error in init_rule\n");
exit(1);
}
memset(r, 0, sizeof(*r));
if (audit_rule_syscallbyname(r, "all") < 0) {
fprintf(stderr, "Illegal syscall name for audit rule for %d\n", pid);
return 1;
}
if (audit_rule_fieldpair(r, field, AUDIT_FILTER_ENTRY)) {
fprintf(stderr, "Cannot add field to audit rule for %d\n", pid);
return 1;
}
return 0;
}

/* Equivalent to '/sbin/auditctl -a entry,always -F pid=%d -S all' */
static int
add_rule(pid_t pid) /* Returns zero on success */
{
int i;
for (i = 0; i < nchildren; i++)
if (pid == children[i]) /* Rule already present */
return 0;
if (nchildren >= MAX_CHILDREN) {
fprintf(stderr, "Too many children\n");
return 1;
}
struct audit_rule r[1];
if (init_rule(r, pid))
return 1;
if (audit_add_rule(audit_sys, r, AUDIT_FILTER_ENTRY, AUDIT_ALWAYS) <= 0) {
fprintf(stderr, "Cannot add an audit rule for %d\n", pid);
return 1;
}
children[nchildren++] = pid;
return 0;
}