public inbox for linux-audit@redhat.com
 help / color / mirror / Atom feed
From: "Abhishek Gupta" <abhikiki@gmail.com>
To: linux-audit@redhat.com
Subject: some problem with my event dispatcher
Date: Mon, 17 Dec 2007 13:40:46 +0530	[thread overview]
Message-ID: <18436f8f0712170010k59a65102kaf1cffb7c4566d35@mail.gmail.com> (raw)


[-- Attachment #1.1: Type: text/plain, Size: 3720 bytes --]

This is a just a sample real time event dispatcher program from
http://people.redhat.com/sgrubb/audit/audit-rt-events.txt.
I am just trying to write the data coming from daemon in some regular file
instead of syslog.But it seems that even the file is not getting
created.Isthere some kind of restriction that we can't call functions
like
fopen(),open(),etc ?
Please tell what's the problem and how it can be solved.
And if possible just give an sample example so that i can understand it
better.
The added lines of code i have marked with "+".

Here is the code..

#include <stdio.h>
#include <sys/types.h>
#include <sys/uio.h>
#include <unistd.h>
#include <stdlib.h>
#include <signal.h>
#include <fcntl.h>
#include <errno.h>
#include <string.h>
#include <locale.h>
#include "libaudit.h"


// Local data
static volatile int signaled = 0;
static int pipe_fd;
static const char *pgm = "skeleton";

// Local functions
static int event_loop(void);

// SIGTERM handler
static void term_handler( int sig )
{
    signaled = 1;
}


/*
 * main is started by auditd. See dispatcher in auditd.conf
 */
int main(int argc, char *argv[])
{
    struct sigaction sa;

    setlocale (LC_ALL, "");
    openlog(pgm, LOG_PID, LOG_DAEMON);
    syslog(LOG_NOTICE, "starting...");

#ifndef DEBUG
    // Make sure we are root
    if (getuid() != 0) {
        syslog(LOG_ERR, "You must be root to run this program.");
        return 4;
    }
#endif

    // register sighandlers
    sa.sa_flags = 0 ;
    sa.sa_handler = term_handler;
    sigemptyset( &sa.sa_mask ) ;
    sigaction( SIGTERM, &sa, NULL );
    sa.sa_handler = term_handler;
    sigemptyset( &sa.sa_mask ) ;
    sigaction( SIGCHLD, &sa, NULL );
    sa.sa_handler = SIG_IGN;
    sigaction( SIGHUP, &sa, NULL );
    (void)chdir("/");

    // change over to pipe_fd
    pipe_fd = dup(0);
    close(0);
    open("/dev/null", O_RDONLY);
    fcntl(pipe_fd, F_SETFD, FD_CLOEXEC);

    // Start the program
    return event_loop();
}

static int event_loop(void)
{
    void* data;
+    FILE* fp=NULL;
    struct iovec vec[2];
    struct audit_dispatcher_header hdr;

    // allocate data structures
    data = malloc(MAX_AUDIT_MESSAGE_LENGTH);
    if (data == NULL) {
        syslog(LOG_ERR, "Cannot allocate buffer");
        return 1;
    }
    memset(data, 0, MAX_AUDIT_MESSAGE_LENGTH);
    memset(&hdr, 0, sizeof(hdr));

    do {
        int rc;
        struct timeval tv;
        fd_set fd;

        tv.tv_sec = 1;
        tv.tv_usec = 0;
        FD_ZERO(&fd);
        FD_SET(pipe_fd, &fd);
        rc = select(pipe_fd+1, &fd, NULL, NULL, &tv);
        if (rc == 0)
            continue;
         else if (rc == -1)
            break;

        /* Get header first. it is fixed size */
        vec[0].iov_base = (void*)&hdr;
        vec[0].iov_len = sizeof(hdr);

            // Next payload
        vec[1].iov_base = data;
        vec[1].iov_len = MAX_AUDIT_MESSAGE_LENGTH;

        rc = readv(pipe_fd, vec, 2);
        if (rc == 0 || rc == -1) {
            syslog(LOG_ERR, "rc == %d(%s)", rc, strerror(errno));
            break;
        }

        // handle events here. Just for illustration, we print
        // to syslog, but you will want to do something else.


+        //I want to write the data in some regular file instead of syslog
but in doing that it seems that even
+        // the file doesn't get created or open.Given below is just a
simple code
+        fp=fopen("tempfile.txt","w+");
+        fwrite((char*)data,sizeof(char),30,fp);
+        fclose(fp);

        syslog(LOG_NOTICE,"type=%d, payload size=%d",
            hdr.type, hdr.size);
        syslog(LOG_NOTICE,"data=\"%.*s\"", hdr.size,
            (char *)data);

    } while(!signaled);

    return 0;
}

[-- Attachment #1.2: Type: text/html, Size: 6360 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]



             reply	other threads:[~2007-12-17  8:11 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-12-17  8:10 Abhishek Gupta [this message]
2007-12-17 13:46 ` some problem with my event dispatcher Steve Grubb

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=18436f8f0712170010k59a65102kaf1cffb7c4566d35@mail.gmail.com \
    --to=abhikiki@gmail.com \
    --cc=linux-audit@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox