Esempio n. 1
0
func EventCallback(ae *audit.AuditEvent, ce chan error, args ...interface{}) {
	pid, _ := ae.GetValueInt("pid", 10)
	syscallid, _ := ae.GetValueInt("syscall", 10)
	a0, _ := ae.GetValueInt("a0", 16)
	a1, _ := ae.GetValueInt("a1", 16)
	a2, _ := ae.GetValueInt("a2", 16)
	a3, _ := ae.GetValueInt("a3", 16)
	a4, _ := ae.GetValueInt("a4", 16)
	a5, _ := ae.GetValueInt("a5", 16)
	exit, _ := ae.GetValueInt("exit", 10)

	at, _ := args[0].(*Atrace)

	at.l_processes.Lock()
	process := at.processes[pid]
	at.l_processes.Unlock()

	// TODO: Review "task" auditd messages.
	switch syscallid {
	case syscall.SYS_EXIT:
		at.l_processes.Lock()
		delete(at.processes, pid)
		at.l_processes.Unlock()
	case syscall.SYS_CLONE, syscall.SYS_FORK, syscall.SYS_VFORK:
		fmt.Println(process)
		if process.recursive {
			at.AddProcess(exit, process.syscalls, process.recursive)
		}
	}

	scRes := syscallinfo.NewResolver(linux_amd64.SyscallTable)
	sc, _ := scRes.SyscallN(syscallid)
	scc, _ := syscallinfo.NewSyscallCall(sc, exit, a0, a1, a2, a3, a4, a5)
	fmt.Printf("[%d] %s\n", pid, scc)
	fmt.Printf("[%d] %s\n", pid, str)
	os.Stdout.Sync()
}
Esempio n. 2
0
func EventCallback(ae *audit.AuditEvent, ce chan error, args ...interface{}) {
	at, _ := args[0].(*Atrace)

	pid, _ := ae.GetValueInt("pid", 10)
	scNR, _ := ae.GetValueInt("syscall", 10)
	a0, _ := ae.GetValueInt("a0", 16)
	a1, _ := ae.GetValueInt("a1", 16)
	a2, _ := ae.GetValueInt("a2", 16)
	a3, _ := ae.GetValueInt("a3", 16)
	a4, _ := ae.GetValueInt("a4", 16)
	a5, _ := ae.GetValueInt("a5", 16)
	exit, _ := ae.GetValueInt("exit", 10)

	r := syscallinfo.NewResolver(linux_amd64.SyscallTable)
	sc, err := r.SyscallN(scNR)
	if err != nil {
		return
	}

	scc, err := syscallinfo.NewSyscallCall(sc, uint64(exit), uint64(a0), uint64(a1), uint64(a2), uint64(a3), uint64(a4), uint64(a5))
	if err != nil {
		return
	}

	at.l_processes.Lock()
	process := at.processes[pid]
	process.sccList = append(process.sccList, scc)
	//fmt.Println(">", process.sccList)
	at.l_processes.Unlock()

	switch scNR {
	case syscall.SYS_EXIT:
		at.l_processes.Lock()
		//delete(at.processes, pid)
		at.l_processes.Unlock()
	case syscall.SYS_CLONE, syscall.SYS_FORK, syscall.SYS_VFORK:
		//if process.recursive {
		at.AddProcess(exit, process.scList, process.recursive)
		//}
	}

	fmt.Printf("[%v] %v\n", pid, scc)
	os.Stdout.Sync()
}