From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stephen Quinney Subject: Re: audit_ftype_to_name? Date: Tue, 22 Oct 2013 21:58:05 +0100 Message-ID: <20131022205805.GA2143@hogwood.inf.ed.ac.uk> References: <20131018114722.GA14660@columba.inf.ed.ac.uk> <22306526.QMWnzUdp8j@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <22306526.QMWnzUdp8j@x2> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tue, Oct 22, 2013 at 01:59:32PM -0400, Steve Grubb wrote: > On Friday, October 18, 2013 12:47:23 PM Stephen Quinney wrote: > > > I can't see any definition of the ftype_i2s function which is called > > by audit_ftype_to_name so maybe this hasn't been implemented yet? > > Yes, it has been. However, its over in lib/libaudit. > I suspect I'm a little confused here, is libaudit provided separately from the main audit code? % tar zxf Downloads/audit-2.3.2.tar.gz % grep -ri ftype_i2s audit-2.3.2/ audit-2.3.2/lib/lookup_table.c: return ftype_i2s(ftype); So, I don't see the function definition, just the call. > It seems to work fin on my system: > > #!/usr/bin/env python > import sys > import audit > > name = audit.audit_ftype_to_name(0140000) > print '%s\n' % (name,), > sys.exit(0) > So, I was trying to use it to translate the value returned by the get_field_type function in auparse, should that work? Stephen -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.