[PATCH] auvirt: Add details to cgroup records

[PATCH] auvirt: Add details to cgroup records

[Marcelo Cerri]

With this patch, auvirt prints additional information for cgroup records when
the option "--all-events" is given. It adds the device class, the path or
category of the device which is being allowed or denied, and the ACL.
---
 tools/auvirt/auvirt.c |   31 ++++++++++++++++++++++++++++++-
 1 files changed, 30 insertions(+), 1 deletions(-)

diff --git a/tools/auvirt/auvirt.c b/tools/auvirt/auvirt.c
index a89b097..e5c5ef6 100644
--- a/tools/auvirt/auvirt.c
+++ b/tools/auvirt/auvirt.c
@@ -80,6 +80,10 @@ struct event {
 	char *reason;
 	char *res_type;
 	char *res;
+	/* Fields specific for cgroup resources */
+	char *cgroup_class;
+	char *cgroup_detail;
+	char *cgroup_acl;
 	/* Fields specific for machine id events: */
 	char *seclevel;
 	/* Fields specific for avc events: */
@@ -123,6 +127,9 @@ void event_free(struct event *event)
 		free(event->comm);
 		free(event->seresult);
 		free(event->seperms);
+		free(event->cgroup_class);
+		free(event->cgroup_detail);
+		free(event->cgroup_acl);
 		free(event);
 	}
 }
@@ -669,6 +676,22 @@ int add_resource(auparse_state_t *au, const char *uuid, uid_t uid, time_t time,
 	event->uid = uid;
 	event->start = time;
 	add_proof(event, au);
+
+	/* Get cgroup specific fields. */
+	if (strcmp("cgroup", res_type) == 0) {
+		event->cgroup_class = copy_str(auparse_find_field(au, "class"));
+		if (event->cgroup_class) {
+			const char *detail = NULL;
+			if (strcmp("path", event->cgroup_class) == 0) {
+				detail = auparse_find_field(au, "path");
+			} else if (strcmp("major", event->cgroup_class) == 0) {
+				detail = auparse_find_field(au, "category");
+			}
+			event->cgroup_detail = copy_str(detail);
+		}
+		event->cgroup_acl = copy_str(auparse_find_field(au, "acl"));
+	}
+
 	if (list_append(events, event) == NULL) {
 		event_free(event);
 		return 1;
@@ -1105,7 +1128,13 @@ void print_event(struct event *event)
 	if (event->type == ET_RES) {
 		printf("\t%-12.12s", N(event->res_type));
 		printf("\t%-10.10s", N(event->reason));
-		printf("\t%s", N(event->res));
+		if (strcmp("cgroup", event->res_type) != 0) {
+			printf("\t%s", N(event->res));
+		} else {
+			printf("\t%s\t%s\t%s", N(event->cgroup_class),
+					N(event->cgroup_acl),
+					N(event->cgroup_detail));
+		}
 	} else if (event->type == ET_MACHINE_ID) {
 		printf("\t%s", N(event->seclevel));
 	} else if (event->type == ET_AVC) {
-- 
1.7.1

Re: [PATCH] auvirt: Add details to cgroup records

[Steve Grubb]

On Friday, February 10, 2012 08:31:52 AM Marcelo Cerri wrote:
> With this patch, auvirt prints additional information for cgroup records
> when the option "--all-events" is given. It adds the device class, the
> path or category of the device which is being allowed or denied, and the
> ACL. ---

Applied.

-Steve