From df5afa4fcd9725380f94ca6476248d4cc24f889a Mon Sep 17 00:00:00 2001
From: Ashlee Young <ashlee@wildernessvoice.com>
Date: Sun, 29 Nov 2015 08:22:13 -0800
Subject: v2.4.4 audit sources

Change-Id: I9315a7408817db51edf084fb4d27fbb492785084
Signed-off-by: Ashlee Young <ashlee@wildernessvoice.com>
---
 framework/src/audit/tools/ausyscall/ausyscall.c | 155 ++++++++++++++++++++++++
 1 file changed, 155 insertions(+)
 create mode 100644 framework/src/audit/tools/ausyscall/ausyscall.c

(limited to 'framework/src/audit/tools/ausyscall/ausyscall.c')

diff --git a/framework/src/audit/tools/ausyscall/ausyscall.c b/framework/src/audit/tools/ausyscall/ausyscall.c
new file mode 100644
index 00000000..361afd99
--- /dev/null
+++ b/framework/src/audit/tools/ausyscall/ausyscall.c
@@ -0,0 +1,155 @@
+/*
+ * ausysvcall.c - A program that lets you map syscall names and numbers 
+ * Copyright (c) 2008 Red Hat Inc., Durham, North Carolina.
+ * All Rights Reserved.
+ *
+ * This software may be freely redistributed and/or modified under the
+ * terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2, or (at your option) any
+ * later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING. If not, write to the
+ * Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ * Authors:
+ *   Steve Grubb <sgrubb@redhat.com>
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <ctype.h>
+#include "libaudit.h"
+
+#define LAST_SYSCALL 1400	// IA64 is in the 1300's right now
+
+void usage(void)
+{
+	fprintf(stderr, "usage: ausyscall [arch] name | number | --dump | --exact\n");
+	exit(1);
+}
+
+int main(int argc, char *argv[])
+{
+	int i, rc;
+	int machine=-1, syscall_num=-1, dump=0, exact=0;
+	const char *name = NULL;
+
+	if (argc > 4) {
+		fputs("Too many arguments\n", stderr);
+		usage();
+	} else if (argc < 2)
+		usage();
+ 
+	for (i=1; i<argc; i++) {
+		if (isdigit(argv[i][0])) {
+			if (syscall_num != -1) {
+				fputs("Two syscall numbers not allowed\n",
+					stderr);
+				usage();
+			}
+			syscall_num = strtol(argv[i], 0, 10);
+		} else if ((rc = audit_name_to_machine(argv[i])) != -1) {
+			if (machine != -1) {
+				fputs("Two machine types not allowed\n",stderr);
+				usage();
+			}
+			machine = rc;
+		} else if (strcmp("--dump", argv[i]) == 0) {
+			dump=1;
+		} else if (strcmp("--exact", argv[i]) == 0) {
+			exact=1;
+#ifndef WITH_ALPHA
+		} else if (strcmp("alpha", argv[i]) == 0) {
+			fputs("Alpha processor support is not enabled\n",
+					stderr);
+			exit(1);
+#endif
+#ifndef WITH_ARM
+		} else if (strcmp("arm", argv[i]) == 0) {
+			fputs("Arm eabi processor support is not enabled\n",
+					stderr);
+			exit(1);
+#endif
+#ifndef WITH_AARCH64
+		} else if (strcmp("aarch64", argv[i]) == 0) {
+			fputs("Aarch64 processor support is not enabled\n",
+					stderr);
+			exit(1);
+#endif
+		} else {
+			if (name != NULL) {
+				fputs("Two syscall names not allowed\n",stderr);
+				usage();
+			}
+			name = argv[i];
+		}
+	}
+	if (machine == -1)
+		machine = audit_detect_machine();
+	if (machine == -1) {
+		fprintf(stderr, "Unable to detect machine type\n");
+		return 1;
+	}
+
+	if (dump) {
+		printf("Using %s syscall table:\n",
+			audit_machine_to_name(machine));
+		for (i=0; i<8192; i++) {
+			name = audit_syscall_to_name(i, machine);
+			if (name) 
+				printf("%d\t%s\n", i, name);
+		}
+		return 0;
+	}
+
+	if (name) {
+		if (exact) {
+			rc = audit_name_to_syscall(name, machine);
+			if (rc < 0) {
+				fprintf(stderr,
+					"Unknown syscall %s using %s lookup table\n",
+					name, audit_machine_to_name(machine));
+				return 1;
+			} else
+				printf("%d\n", rc);
+		} else {
+			int found = 0;
+			for (i=0; i< LAST_SYSCALL; i++) {
+				const char *n = audit_syscall_to_name(i, machine);
+				if (n && strcasestr(n, name)) {
+					found = 1;
+					printf("%-18s %d\n", n, i);
+				}
+			}
+			if (!found) {
+				fprintf(stderr,
+					"Unknown syscall %s using %s lookup table\n",
+					name, audit_machine_to_name(machine));
+				return 1;
+			}
+		}
+	} else if (syscall_num != -1) {
+		name = audit_syscall_to_name(syscall_num, machine);
+		if (name == NULL) {
+			fprintf(stderr,
+				"Unknown syscall %d using %s lookup table\n",
+				syscall_num, audit_machine_to_name(machine));
+			return 1;
+		} else
+			printf("%s\n", name);
+	} else {
+		fputs("Error - either a syscall name or number must "
+			"be given with an optional arch\n", stderr);
+		return 1;
+	}
+
+	return 0;
+}
+
-- 
cgit 1.2.3-korg