summaryrefslogtreecommitdiffstats
path: root/framework/src/audit/tools/ausyscall
diff options
context:
space:
mode:
authorAshlee Young <ashlee@wildernessvoice.com>2016-01-20 01:10:01 +0000
committerAshlee Young <ashlee@wildernessvoice.com>2016-01-20 01:10:11 +0000
commit19d701ddf07d855128ded0cf2b573ce468e3bdd6 (patch)
tree0edcd3461ca903c76e431bb7c6348c42a0f12488 /framework/src/audit/tools/ausyscall
parentfac6fbefbfad1cf837ddd88bc0d330559c8eb6f9 (diff)
Removing Suricata and Audit from source repo, and updated build.sh to avoid building suricata. Will re-address this in C release via tar balls.
Change-Id: I3710076f8b7f3313cb3cb5260c4eb0a6834d4f6e Signed-off-by: Ashlee Young <ashlee@wildernessvoice.com>
Diffstat (limited to 'framework/src/audit/tools/ausyscall')
-rw-r--r--framework/src/audit/tools/ausyscall/Makefile.am32
-rw-r--r--framework/src/audit/tools/ausyscall/ausyscall.834
-rw-r--r--framework/src/audit/tools/ausyscall/ausyscall.c155
3 files changed, 0 insertions, 221 deletions
diff --git a/framework/src/audit/tools/ausyscall/Makefile.am b/framework/src/audit/tools/ausyscall/Makefile.am
deleted file mode 100644
index 6ad983e5..00000000
--- a/framework/src/audit/tools/ausyscall/Makefile.am
+++ /dev/null
@@ -1,32 +0,0 @@
-# Makefile.am --
-# Copyright 2008,2015 Red Hat Inc., Durham, North Carolina.
-# All Rights Reserved.
-#
-# This library is free software; you can redistribute it and/or
-# modify it under the terms of the GNU Lesser General Public
-# License as published by the Free Software Foundation; either
-# version 2.1 of the License, or (at your option) any later version.
-#
-# This library is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-# Lesser General Public License for more details.
-#
-# You should have received a copy of the GNU Lesser General Public
-# License along with this library; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
-#
-# Authors:
-# Steve Grubb <sgrubb@redhat.com>
-#
-
-CONFIG_CLEAN_FILES = *.loT *.rej *.orig
-AUTOMAKE_OPTIONS = no-dependencies
-EXTRA_DIST = $(man_MANS)
-AM_CPPFLAGS = -I${top_srcdir} -I${top_srcdir}/lib
-LIBS = -L${top_builddir}/lib -laudit
-bin_PROGRAMS = ausyscall
-man_MANS = ausyscall.8
-
-ausyscall_SOURCES = ausyscall.c
-ausyscall_CFLAGS = -g -D_GNU_SOURCE
diff --git a/framework/src/audit/tools/ausyscall/ausyscall.8 b/framework/src/audit/tools/ausyscall/ausyscall.8
deleted file mode 100644
index 16f9196e..00000000
--- a/framework/src/audit/tools/ausyscall/ausyscall.8
+++ /dev/null
@@ -1,34 +0,0 @@
-.TH AUSYSCALL: "8" "Nov 2008" "Red Hat" "System Administration Utilities"
-.SH NAME
-ausyscall \- a program that allows mapping syscall names and numbers
-.SH SYNOPSIS
-.B ausyscall [arch] name | number | \-\-dump | \-\-exact
-.SH DESCRIPTION
-\fBausyscall\fP is a program that prints out the mapping from syscall name to number and reverse for the given arch. The arch can be anything returned by `uname \-m`. If arch is not given, the program will take a guess based on the running image. You may give the syscall name or number and it will find the opposite. You can also dump the whole table with the \-\-dump option. By default a syscall name lookup will be a substring match meaning that it will try to match all occurrences of the given name with syscalls. So giving a name of chown will match both fchown and chown as any other syscall with chown in its name. If this behavior is not desired, pass the \-\-exact flag and it will do an exact string match.
-
-This program can be used to verify syscall numbers on a biarch platform for rule optimization. For example, suppose you had an auditctl rule:
-
-.B \-a always, exit \-S open \-F exit=\-EPERM \-k fail\-open
-
-If you wanted to verify that both 32 and 64 bit programs would be audited, run "ausyscall i386 open" and then "ausyscall x86_64 open". Look at the returned numbers. If they are different, you will have to write two auditctl rules to get complete coverage.
-
-.nf
-.B \-a always,exit \-F arch=b32 \-S open \-F exit=\-EPERM \-k fail\-open
-.B \-a always,exit \-F arch=b64 \-S open \-F exit=\-EPERM \-k fail\-open
-.fi
-
-For more information about a specific syscall, use the man program and pass the number 2 as an argument to make sure that you get the syscall information rather than a shell script program or glibc function call of the same name. For example, if you wanted to learn about the open syscall, type: man 2 open.
-.SH OPTIONS
-.TP
-.B \-\-dump
-Print all syscalls for the given arch
-.TP
-.B \-\-exact
-Instead of doing a partial word match, match the given syscall name exactly.
-
-.SH "SEE ALSO"
-.BR ausearch (8),
-.BR auditctl (8).
-
-.SH AUTHOR
-Steve Grubb
diff --git a/framework/src/audit/tools/ausyscall/ausyscall.c b/framework/src/audit/tools/ausyscall/ausyscall.c
deleted file mode 100644
index 361afd99..00000000
--- a/framework/src/audit/tools/ausyscall/ausyscall.c
+++ /dev/null
@@ -1,155 +0,0 @@
-/*
- * ausysvcall.c - A program that lets you map syscall names and numbers
- * Copyright (c) 2008 Red Hat Inc., Durham, North Carolina.
- * All Rights Reserved.
- *
- * This software may be freely redistributed and/or modified under the
- * terms of the GNU General Public License as published by the Free
- * Software Foundation; either version 2, or (at your option) any
- * later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; see the file COPYING. If not, write to the
- * Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- * Authors:
- * Steve Grubb <sgrubb@redhat.com>
- */
-
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-#include <ctype.h>
-#include "libaudit.h"
-
-#define LAST_SYSCALL 1400 // IA64 is in the 1300's right now
-
-void usage(void)
-{
- fprintf(stderr, "usage: ausyscall [arch] name | number | --dump | --exact\n");
- exit(1);
-}
-
-int main(int argc, char *argv[])
-{
- int i, rc;
- int machine=-1, syscall_num=-1, dump=0, exact=0;
- const char *name = NULL;
-
- if (argc > 4) {
- fputs("Too many arguments\n", stderr);
- usage();
- } else if (argc < 2)
- usage();
-
- for (i=1; i<argc; i++) {
- if (isdigit(argv[i][0])) {
- if (syscall_num != -1) {
- fputs("Two syscall numbers not allowed\n",
- stderr);
- usage();
- }
- syscall_num = strtol(argv[i], 0, 10);
- } else if ((rc = audit_name_to_machine(argv[i])) != -1) {
- if (machine != -1) {
- fputs("Two machine types not allowed\n",stderr);
- usage();
- }
- machine = rc;
- } else if (strcmp("--dump", argv[i]) == 0) {
- dump=1;
- } else if (strcmp("--exact", argv[i]) == 0) {
- exact=1;
-#ifndef WITH_ALPHA
- } else if (strcmp("alpha", argv[i]) == 0) {
- fputs("Alpha processor support is not enabled\n",
- stderr);
- exit(1);
-#endif
-#ifndef WITH_ARM
- } else if (strcmp("arm", argv[i]) == 0) {
- fputs("Arm eabi processor support is not enabled\n",
- stderr);
- exit(1);
-#endif
-#ifndef WITH_AARCH64
- } else if (strcmp("aarch64", argv[i]) == 0) {
- fputs("Aarch64 processor support is not enabled\n",
- stderr);
- exit(1);
-#endif
- } else {
- if (name != NULL) {
- fputs("Two syscall names not allowed\n",stderr);
- usage();
- }
- name = argv[i];
- }
- }
- if (machine == -1)
- machine = audit_detect_machine();
- if (machine == -1) {
- fprintf(stderr, "Unable to detect machine type\n");
- return 1;
- }
-
- if (dump) {
- printf("Using %s syscall table:\n",
- audit_machine_to_name(machine));
- for (i=0; i<8192; i++) {
- name = audit_syscall_to_name(i, machine);
- if (name)
- printf("%d\t%s\n", i, name);
- }
- return 0;
- }
-
- if (name) {
- if (exact) {
- rc = audit_name_to_syscall(name, machine);
- if (rc < 0) {
- fprintf(stderr,
- "Unknown syscall %s using %s lookup table\n",
- name, audit_machine_to_name(machine));
- return 1;
- } else
- printf("%d\n", rc);
- } else {
- int found = 0;
- for (i=0; i< LAST_SYSCALL; i++) {
- const char *n = audit_syscall_to_name(i, machine);
- if (n && strcasestr(n, name)) {
- found = 1;
- printf("%-18s %d\n", n, i);
- }
- }
- if (!found) {
- fprintf(stderr,
- "Unknown syscall %s using %s lookup table\n",
- name, audit_machine_to_name(machine));
- return 1;
- }
- }
- } else if (syscall_num != -1) {
- name = audit_syscall_to_name(syscall_num, machine);
- if (name == NULL) {
- fprintf(stderr,
- "Unknown syscall %d using %s lookup table\n",
- syscall_num, audit_machine_to_name(machine));
- return 1;
- } else
- printf("%s\n", name);
- } else {
- fputs("Error - either a syscall name or number must "
- "be given with an optional arch\n", stderr);
- return 1;
- }
-
- return 0;
-}
-