SF.net SVN: logwatch:[223] scripts/services/audit

Revision: 223
          http://sourceforge.net/p/logwatch/code/223
Author:   stefjakobs
Date:     2014-09-09 10:04:16 +0000 (Tue, 09 Sep 2014)
Log Message:
-----------
audit: report apparmor messages (Thanks: Chris)

Modified Paths:
--------------
    scripts/services/audit

Modified: scripts/services/audit
===================================================================
--- scripts/services/audit	2014-09-09 09:56:39 UTC (rev 222)
+++ scripts/services/audit	2014-09-09 10:04:16 UTC (rev 223)
@@ -89,6 +89,7 @@
 my $NumberOfDStops = 0;
 my $NumberOfDdStarts = 0;
 my $NumberOfDdStops = 0;
+my $NumberOfAllowedMessages = 0;
 my $NumberOfLostMessages = 0;
 my %InvalidContext = ();
 my %BugLog = ();
@@ -166,6 +167,11 @@
             # type=1400 audit(1314853822.672:33649): apparmor="DENIED" operation="mknod" parent=27250 profile="/usr/lib/apache2/mpm-prefork/apache2//example.com" name="/usr/share/wordpress/1114140474e5f13bea68a4.tmp" pid=27289 comm="apache2" requested_mask="c" denied_mask="c" fsuid=33 ouid=33
             # type=1400 audit(1315353795.331:33657): apparmor="DENIED" operation="exec" parent=14952 profile="/usr/lib/apache2/mpm-prefork/apache2//example.com" name="/usr/lib/sm.bin/sendmail" pid=14953 comm="sh" requested_mask="x" denied_mask="x" fsuid=33 ouid=0
             $denials{$1.' '.$3.' ('.$2.' via '.$4 . ')'}++;
+        } elsif ( $ThisLine =~ /apparmor="ALLOWED" operation="([^"]+)" (info="([^"]+)" )?(error=[+-]?\d+ )?parent=\d+ profile="([^"]+)" (name="([^"]+)" )?pid=\d+ comm="([^"]+)"/ ) {
+            # type=1400 audit(1369519203.141:259049): apparmor="ALLOWED" operation="exec" parent=3733 profile="/usr/sbin/dovecot//null-1c//null-1d" name="/usr/lib/dovecot/pop3-login" pid=24634 comm="dovecot" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 target="/usr/sbin/dovecot//null-1c//null-1d//null-d12"
+            # type=1400 audit(1369627891.522:447576): apparmor="ALLOWED" operation="capable" parent=1 profile="/usr/sbin/dovecot//null-1c//null-1d" pid=3733 comm="dovecot" capability=5 capname="kill"
+            # type=1400 audit(1369823965.682:824587): apparmor="ALLOWED" operation="getattr" info="Failed name lookup - deleted entry" error=-2 parent=1 profile="/usr/sbin/dovecot//null-1c//null-1d" name="/var/lib/dovecot/.temp.3733.d786c1fcaaa73248" pid=3733 comm="dovecot" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
+            $NumberOfAllowedMessages++;
         } else {
             $othercount++;
             $ThisLine =~ s/^\s*//;
@@ -278,6 +284,10 @@
     }
 }
 
+if ($NumberOfAllowedMessages) {
+    print "\n Number of allowed messages: $NumberOfAllowedMessages\n";
+}
+
 if ($NumberOfLostMessages) {
     print "\n Number of lost messages: $NumberOfLostMessages\n";
 }

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------
Want excitement?
Manually upgrade your production database.
When you want reliability, choose Perforce.
Perforce version control. Predictably reliable.
http://pubads.g.doubleclick.net/gampad/clk?id=157508191&iu=/4140/ostg.clktrk