diff options
Diffstat (limited to 'framework/src/audit/tools/ausyscall')
| -rw-r--r-- | framework/src/audit/tools/ausyscall/Makefile.am | 32 | ||||
| -rw-r--r-- | framework/src/audit/tools/ausyscall/ausyscall.8 | 34 | ||||
| -rw-r--r-- | framework/src/audit/tools/ausyscall/ausyscall.c | 155 |
3 files changed, 0 insertions, 221 deletions
diff --git a/framework/src/audit/tools/ausyscall/Makefile.am b/framework/src/audit/tools/ausyscall/Makefile.am deleted file mode 100644 index 6ad983e5..00000000 --- a/framework/src/audit/tools/ausyscall/Makefile.am +++ /dev/null @@ -1,32 +0,0 @@ -# Makefile.am -- -# Copyright 2008,2015 Red Hat Inc., Durham, North Carolina. -# All Rights Reserved. -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA -# -# Authors: -# Steve Grubb <sgrubb@redhat.com> -# - -CONFIG_CLEAN_FILES = *.loT *.rej *.orig -AUTOMAKE_OPTIONS = no-dependencies -EXTRA_DIST = $(man_MANS) -AM_CPPFLAGS = -I${top_srcdir} -I${top_srcdir}/lib -LIBS = -L${top_builddir}/lib -laudit -bin_PROGRAMS = ausyscall -man_MANS = ausyscall.8 - -ausyscall_SOURCES = ausyscall.c -ausyscall_CFLAGS = -g -D_GNU_SOURCE diff --git a/framework/src/audit/tools/ausyscall/ausyscall.8 b/framework/src/audit/tools/ausyscall/ausyscall.8 deleted file mode 100644 index 16f9196e..00000000 --- a/framework/src/audit/tools/ausyscall/ausyscall.8 +++ /dev/null @@ -1,34 +0,0 @@ -.TH AUSYSCALL: "8" "Nov 2008" "Red Hat" "System Administration Utilities" -.SH NAME -ausyscall \- a program that allows mapping syscall names and numbers -.SH SYNOPSIS -.B ausyscall [arch] name | number | \-\-dump | \-\-exact -.SH DESCRIPTION -\fBausyscall\fP is a program that prints out the mapping from syscall name to number and reverse for the given arch. The arch can be anything returned by `uname \-m`. If arch is not given, the program will take a guess based on the running image. You may give the syscall name or number and it will find the opposite. You can also dump the whole table with the \-\-dump option. By default a syscall name lookup will be a substring match meaning that it will try to match all occurrences of the given name with syscalls. So giving a name of chown will match both fchown and chown as any other syscall with chown in its name. If this behavior is not desired, pass the \-\-exact flag and it will do an exact string match. - -This program can be used to verify syscall numbers on a biarch platform for rule optimization. For example, suppose you had an auditctl rule: - -.B \-a always, exit \-S open \-F exit=\-EPERM \-k fail\-open - -If you wanted to verify that both 32 and 64 bit programs would be audited, run "ausyscall i386 open" and then "ausyscall x86_64 open". Look at the returned numbers. If they are different, you will have to write two auditctl rules to get complete coverage. - -.nf -.B \-a always,exit \-F arch=b32 \-S open \-F exit=\-EPERM \-k fail\-open -.B \-a always,exit \-F arch=b64 \-S open \-F exit=\-EPERM \-k fail\-open -.fi - -For more information about a specific syscall, use the man program and pass the number 2 as an argument to make sure that you get the syscall information rather than a shell script program or glibc function call of the same name. For example, if you wanted to learn about the open syscall, type: man 2 open. -.SH OPTIONS -.TP -.B \-\-dump -Print all syscalls for the given arch -.TP -.B \-\-exact -Instead of doing a partial word match, match the given syscall name exactly. - -.SH "SEE ALSO" -.BR ausearch (8), -.BR auditctl (8). - -.SH AUTHOR -Steve Grubb diff --git a/framework/src/audit/tools/ausyscall/ausyscall.c b/framework/src/audit/tools/ausyscall/ausyscall.c deleted file mode 100644 index 361afd99..00000000 --- a/framework/src/audit/tools/ausyscall/ausyscall.c +++ /dev/null @@ -1,155 +0,0 @@ -/* - * ausysvcall.c - A program that lets you map syscall names and numbers - * Copyright (c) 2008 Red Hat Inc., Durham, North Carolina. - * All Rights Reserved. - * - * This software may be freely redistributed and/or modified under the - * terms of the GNU General Public License as published by the Free - * Software Foundation; either version 2, or (at your option) any - * later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; see the file COPYING. If not, write to the - * Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - * - * Authors: - * Steve Grubb <sgrubb@redhat.com> - */ - -#include <stdio.h> -#include <string.h> -#include <stdlib.h> -#include <ctype.h> -#include "libaudit.h" - -#define LAST_SYSCALL 1400 // IA64 is in the 1300's right now - -void usage(void) -{ - fprintf(stderr, "usage: ausyscall [arch] name | number | --dump | --exact\n"); - exit(1); -} - -int main(int argc, char *argv[]) -{ - int i, rc; - int machine=-1, syscall_num=-1, dump=0, exact=0; - const char *name = NULL; - - if (argc > 4) { - fputs("Too many arguments\n", stderr); - usage(); - } else if (argc < 2) - usage(); - - for (i=1; i<argc; i++) { - if (isdigit(argv[i][0])) { - if (syscall_num != -1) { - fputs("Two syscall numbers not allowed\n", - stderr); - usage(); - } - syscall_num = strtol(argv[i], 0, 10); - } else if ((rc = audit_name_to_machine(argv[i])) != -1) { - if (machine != -1) { - fputs("Two machine types not allowed\n",stderr); - usage(); - } - machine = rc; - } else if (strcmp("--dump", argv[i]) == 0) { - dump=1; - } else if (strcmp("--exact", argv[i]) == 0) { - exact=1; -#ifndef WITH_ALPHA - } else if (strcmp("alpha", argv[i]) == 0) { - fputs("Alpha processor support is not enabled\n", - stderr); - exit(1); -#endif -#ifndef WITH_ARM - } else if (strcmp("arm", argv[i]) == 0) { - fputs("Arm eabi processor support is not enabled\n", - stderr); - exit(1); -#endif -#ifndef WITH_AARCH64 - } else if (strcmp("aarch64", argv[i]) == 0) { - fputs("Aarch64 processor support is not enabled\n", - stderr); - exit(1); -#endif - } else { - if (name != NULL) { - fputs("Two syscall names not allowed\n",stderr); - usage(); - } - name = argv[i]; - } - } - if (machine == -1) - machine = audit_detect_machine(); - if (machine == -1) { - fprintf(stderr, "Unable to detect machine type\n"); - return 1; - } - - if (dump) { - printf("Using %s syscall table:\n", - audit_machine_to_name(machine)); - for (i=0; i<8192; i++) { - name = audit_syscall_to_name(i, machine); - if (name) - printf("%d\t%s\n", i, name); - } - return 0; - } - - if (name) { - if (exact) { - rc = audit_name_to_syscall(name, machine); - if (rc < 0) { - fprintf(stderr, - "Unknown syscall %s using %s lookup table\n", - name, audit_machine_to_name(machine)); - return 1; - } else - printf("%d\n", rc); - } else { - int found = 0; - for (i=0; i< LAST_SYSCALL; i++) { - const char *n = audit_syscall_to_name(i, machine); - if (n && strcasestr(n, name)) { - found = 1; - printf("%-18s %d\n", n, i); - } - } - if (!found) { - fprintf(stderr, - "Unknown syscall %s using %s lookup table\n", - name, audit_machine_to_name(machine)); - return 1; - } - } - } else if (syscall_num != -1) { - name = audit_syscall_to_name(syscall_num, machine); - if (name == NULL) { - fprintf(stderr, - "Unknown syscall %d using %s lookup table\n", - syscall_num, audit_machine_to_name(machine)); - return 1; - } else - printf("%s\n", name); - } else { - fputs("Error - either a syscall name or number must " - "be given with an optional arch\n", stderr); - return 1; - } - - return 0; -} - |