diff options
Diffstat (limited to 'framework/src/audit/tools/ausyscall')
| -rw-r--r-- | framework/src/audit/tools/ausyscall/Makefile.am | 32 | ||||
| -rw-r--r-- | framework/src/audit/tools/ausyscall/ausyscall.8 | 34 | ||||
| -rw-r--r-- | framework/src/audit/tools/ausyscall/ausyscall.c | 155 |
3 files changed, 221 insertions, 0 deletions
diff --git a/framework/src/audit/tools/ausyscall/Makefile.am b/framework/src/audit/tools/ausyscall/Makefile.am new file mode 100644 index 00000000..6ad983e5 --- /dev/null +++ b/framework/src/audit/tools/ausyscall/Makefile.am @@ -0,0 +1,32 @@ +# Makefile.am -- +# Copyright 2008,2015 Red Hat Inc., Durham, North Carolina. +# All Rights Reserved. +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# +# Authors: +# Steve Grubb <sgrubb@redhat.com> +# + +CONFIG_CLEAN_FILES = *.loT *.rej *.orig +AUTOMAKE_OPTIONS = no-dependencies +EXTRA_DIST = $(man_MANS) +AM_CPPFLAGS = -I${top_srcdir} -I${top_srcdir}/lib +LIBS = -L${top_builddir}/lib -laudit +bin_PROGRAMS = ausyscall +man_MANS = ausyscall.8 + +ausyscall_SOURCES = ausyscall.c +ausyscall_CFLAGS = -g -D_GNU_SOURCE diff --git a/framework/src/audit/tools/ausyscall/ausyscall.8 b/framework/src/audit/tools/ausyscall/ausyscall.8 new file mode 100644 index 00000000..16f9196e --- /dev/null +++ b/framework/src/audit/tools/ausyscall/ausyscall.8 @@ -0,0 +1,34 @@ +.TH AUSYSCALL: "8" "Nov 2008" "Red Hat" "System Administration Utilities" +.SH NAME +ausyscall \- a program that allows mapping syscall names and numbers +.SH SYNOPSIS +.B ausyscall [arch] name | number | \-\-dump | \-\-exact +.SH DESCRIPTION +\fBausyscall\fP is a program that prints out the mapping from syscall name to number and reverse for the given arch. The arch can be anything returned by `uname \-m`. If arch is not given, the program will take a guess based on the running image. You may give the syscall name or number and it will find the opposite. You can also dump the whole table with the \-\-dump option. By default a syscall name lookup will be a substring match meaning that it will try to match all occurrences of the given name with syscalls. So giving a name of chown will match both fchown and chown as any other syscall with chown in its name. If this behavior is not desired, pass the \-\-exact flag and it will do an exact string match. + +This program can be used to verify syscall numbers on a biarch platform for rule optimization. For example, suppose you had an auditctl rule: + +.B \-a always, exit \-S open \-F exit=\-EPERM \-k fail\-open + +If you wanted to verify that both 32 and 64 bit programs would be audited, run "ausyscall i386 open" and then "ausyscall x86_64 open". Look at the returned numbers. If they are different, you will have to write two auditctl rules to get complete coverage. + +.nf +.B \-a always,exit \-F arch=b32 \-S open \-F exit=\-EPERM \-k fail\-open +.B \-a always,exit \-F arch=b64 \-S open \-F exit=\-EPERM \-k fail\-open +.fi + +For more information about a specific syscall, use the man program and pass the number 2 as an argument to make sure that you get the syscall information rather than a shell script program or glibc function call of the same name. For example, if you wanted to learn about the open syscall, type: man 2 open. +.SH OPTIONS +.TP +.B \-\-dump +Print all syscalls for the given arch +.TP +.B \-\-exact +Instead of doing a partial word match, match the given syscall name exactly. + +.SH "SEE ALSO" +.BR ausearch (8), +.BR auditctl (8). + +.SH AUTHOR +Steve Grubb diff --git a/framework/src/audit/tools/ausyscall/ausyscall.c b/framework/src/audit/tools/ausyscall/ausyscall.c new file mode 100644 index 00000000..361afd99 --- /dev/null +++ b/framework/src/audit/tools/ausyscall/ausyscall.c @@ -0,0 +1,155 @@ +/* + * ausysvcall.c - A program that lets you map syscall names and numbers + * Copyright (c) 2008 Red Hat Inc., Durham, North Carolina. + * All Rights Reserved. + * + * This software may be freely redistributed and/or modified under the + * terms of the GNU General Public License as published by the Free + * Software Foundation; either version 2, or (at your option) any + * later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; see the file COPYING. If not, write to the + * Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * + * Authors: + * Steve Grubb <sgrubb@redhat.com> + */ + +#include <stdio.h> +#include <string.h> +#include <stdlib.h> +#include <ctype.h> +#include "libaudit.h" + +#define LAST_SYSCALL 1400 // IA64 is in the 1300's right now + +void usage(void) +{ + fprintf(stderr, "usage: ausyscall [arch] name | number | --dump | --exact\n"); + exit(1); +} + +int main(int argc, char *argv[]) +{ + int i, rc; + int machine=-1, syscall_num=-1, dump=0, exact=0; + const char *name = NULL; + + if (argc > 4) { + fputs("Too many arguments\n", stderr); + usage(); + } else if (argc < 2) + usage(); + + for (i=1; i<argc; i++) { + if (isdigit(argv[i][0])) { + if (syscall_num != -1) { + fputs("Two syscall numbers not allowed\n", + stderr); + usage(); + } + syscall_num = strtol(argv[i], 0, 10); + } else if ((rc = audit_name_to_machine(argv[i])) != -1) { + if (machine != -1) { + fputs("Two machine types not allowed\n",stderr); + usage(); + } + machine = rc; + } else if (strcmp("--dump", argv[i]) == 0) { + dump=1; + } else if (strcmp("--exact", argv[i]) == 0) { + exact=1; +#ifndef WITH_ALPHA + } else if (strcmp("alpha", argv[i]) == 0) { + fputs("Alpha processor support is not enabled\n", + stderr); + exit(1); +#endif +#ifndef WITH_ARM + } else if (strcmp("arm", argv[i]) == 0) { + fputs("Arm eabi processor support is not enabled\n", + stderr); + exit(1); +#endif +#ifndef WITH_AARCH64 + } else if (strcmp("aarch64", argv[i]) == 0) { + fputs("Aarch64 processor support is not enabled\n", + stderr); + exit(1); +#endif + } else { + if (name != NULL) { + fputs("Two syscall names not allowed\n",stderr); + usage(); + } + name = argv[i]; + } + } + if (machine == -1) + machine = audit_detect_machine(); + if (machine == -1) { + fprintf(stderr, "Unable to detect machine type\n"); + return 1; + } + + if (dump) { + printf("Using %s syscall table:\n", + audit_machine_to_name(machine)); + for (i=0; i<8192; i++) { + name = audit_syscall_to_name(i, machine); + if (name) + printf("%d\t%s\n", i, name); + } + return 0; + } + + if (name) { + if (exact) { + rc = audit_name_to_syscall(name, machine); + if (rc < 0) { + fprintf(stderr, + "Unknown syscall %s using %s lookup table\n", + name, audit_machine_to_name(machine)); + return 1; + } else + printf("%d\n", rc); + } else { + int found = 0; + for (i=0; i< LAST_SYSCALL; i++) { + const char *n = audit_syscall_to_name(i, machine); + if (n && strcasestr(n, name)) { + found = 1; + printf("%-18s %d\n", n, i); + } + } + if (!found) { + fprintf(stderr, + "Unknown syscall %s using %s lookup table\n", + name, audit_machine_to_name(machine)); + return 1; + } + } + } else if (syscall_num != -1) { + name = audit_syscall_to_name(syscall_num, machine); + if (name == NULL) { + fprintf(stderr, + "Unknown syscall %d using %s lookup table\n", + syscall_num, audit_machine_to_name(machine)); + return 1; + } else + printf("%s\n", name); + } else { + fputs("Error - either a syscall name or number must " + "be given with an optional arch\n", stderr); + return 1; + } + + return 0; +} + |