Re: audit_ftype_to_name?

[Stephen Quinney <squinney@inf.ed.ac.uk>]

On Tue, Oct 22, 2013 at 01:59:32PM -0400, Steve Grubb wrote:
> On Friday, October 18, 2013 12:47:23 PM Stephen Quinney wrote:
> 
> > I can't see any definition of the ftype_i2s function which is called
> > by audit_ftype_to_name so maybe this hasn't been implemented yet?
> 
> Yes, it has been. However, its over in lib/libaudit.
> 

I suspect I'm a little confused here, is libaudit provided separately
from the main audit code?

% tar zxf Downloads/audit-2.3.2.tar.gz
% grep -ri ftype_i2s audit-2.3.2/
audit-2.3.2/lib/lookup_table.c:   return ftype_i2s(ftype);

So, I don't see the function definition, just the call.


> It seems to work fin on my system:
> 
> #!/usr/bin/env python
> import sys
> import audit
> 
> name = audit.audit_ftype_to_name(0140000)
> print '%s\n' % (name,),
> sys.exit(0)
> 

So, I was trying to use it to translate the value returned by the
get_field_type function in auparse, should that work?


Stephen

-- 
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.