src/aureport-scan.c

   1 /*
   2 * aureport-scan.c - Extract interesting fields and check for match
   3 * Copyright (c) 2005-06,2008,2011,2014-15 Red Hat Inc., Durham, North Carolina.
   4 * All Rights Reserved.
   5 *
   6 * This software may be freely redistributed and/or modified under the
   7 * terms of the GNU General Public License as published by the Free
   8 * Software Foundation; either version 2, or (at your option) any
   9 * later version.
  10 *
  11 * This program is distributed in the hope that it will be useful,
  12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14 * GNU General Public License for more details.
  15 *
  16 * You should have received a copy of the GNU General Public License
  17 * along with this program; see the file COPYING. If not, write to the
  18 * Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19 *
  20 * Authors:
  21 *   Steve Grubb <sgrubb@redhat.com>
  22 */
  23
  24 #include "config.h"
  25 #include <string.h>
  26 #include <stdio.h>
  27 #include <pwd.h>
  28 #include "libaudit.h"
  29 #include "aureport-options.h"
  30 #include "ausearch-parse.h"
  31 #include "ausearch-string.h"
  32 #include "ausearch-lookup.h"
  33 #include "aureport-scan.h"
  34
  35 static void do_summary_total(llist *l);
  36 static int per_event_summary(llist *l);
  37 static int per_event_detailed(llist *l);
  38
  39 summary_data sd;
  40
  41 /* This function inits the counters */
  42 void reset_counters(void)
  43 {
  44         sd.changes = 0UL;
  45         sd.crypto = 0UL;
  46         sd.acct_changes = 0UL;
  47         sd.good_logins = 0UL;
  48         sd.bad_logins = 0UL;
  49         sd.good_auth = 0UL;
  50         sd.bad_auth = 0UL;
  51         sd.events = 0UL;
  52         sd.avcs = 0UL;
  53         sd.mac = 0UL;
  54         sd.failed_syscalls = 0UL;
  55         sd.anomalies = 0UL;
  56         sd.responses = 0UL;
  57         sd.virt = 0UL;
  58         sd.integ = 0UL;
  59         slist_create(&sd.users);
  60         slist_create(&sd.terms);
  61         slist_create(&sd.files);
  62         slist_create(&sd.hosts);
  63         slist_create(&sd.exes);
  64         slist_create(&sd.comms);
  65         slist_create(&sd.avc_objs);
  66         slist_create(&sd.keys);
  67         ilist_create(&sd.pids);
  68         ilist_create(&sd.sys_list);
  69         ilist_create(&sd.anom_list);
  70         ilist_create(&sd.mac_list);
  71         ilist_create(&sd.resp_list);
  72         ilist_create(&sd.crypto_list);
  73         ilist_create(&sd.virt_list);
  74         ilist_create(&sd.integ_list);
  75 }
  76
  77 /* This function inits the counters */
  78 void destroy_counters(void)
  79 {
  80         sd.changes = 0UL;
  81         sd.crypto = 0UL;
  82         sd.acct_changes = 0UL;
  83         sd.good_logins = 0UL;
  84         sd.bad_logins = 0UL;
  85         sd.good_auth = 0UL;
  86         sd.bad_auth = 0UL;
  87         sd.events = 0UL;
  88         sd.avcs = 0UL;
  89         sd.mac = 0UL;
  90         sd.failed_syscalls = 0UL;
  91         sd.anomalies = 0UL;
  92         sd.responses = 0UL;
  93         sd.virt = 0UL;
  94         sd.integ = 0UL;
  95         slist_clear(&sd.users);
  96         slist_clear(&sd.terms);
  97         slist_clear(&sd.files);
  98         slist_clear(&sd.hosts);
  99         slist_clear(&sd.exes);
 100         slist_clear(&sd.comms);
 101         slist_clear(&sd.avc_objs);
 102         slist_clear(&sd.keys);
 103         ilist_clear(&sd.pids);
 104         ilist_clear(&sd.sys_list);
 105         ilist_clear(&sd.anom_list);
 106         ilist_create(&sd.mac_list);
 107         ilist_clear(&sd.resp_list);
 108         ilist_create(&sd.crypto_list);
 109         ilist_create(&sd.virt_list);
 110         ilist_create(&sd.integ_list);
 111 }
 112
 113 /* This function will return 0 on no match and 1 on match */
 114 int classify_success(const llist *l)
 115 {
 116 //printf("%d,succ=%d:%d\n", l->head->type, event_failed, l->s.success);
 117         // If match only failed...
 118         if (event_failed == F_FAILED)
 119                 return l->s.success == S_FAILED ? 1 : 0;
 120         // If match only success...
 121         if (event_failed == F_SUCCESS)
 122                 return l->s.success == S_SUCCESS ? 1 : 0;
 123         // Otherwise...we don't care so pretend it matched
 124         return 1;
 125 }
 126
 127 /* This function will return 0 on no match and 1 on match */
 128 int classify_conf(const llist *l)
 129 {
 130         int rc = 1;
 131         extern int no_config;
 132
 133         switch (l->head->type)
 134         {
 135                 case AUDIT_CONFIG_CHANGE:
 136                         if (no_config)
 137                                 rc = 0;
 138                         break;
 139                 case AUDIT_USYS_CONFIG:
 140                         break;
 141                 case AUDIT_ADD_USER:
 142                         if (event_conf_act == C_DEL)
 143                                 rc = 0;
 144                         break;
 145                 case AUDIT_DEL_USER:
 146                         if (event_conf_act == C_ADD)
 147                                 rc = 0;
 148                         break;
 149                 case AUDIT_ADD_GROUP:
 150                         if (event_conf_act == C_DEL)
 151                                 rc = 0;
 152                         break;
 153                 case AUDIT_DEL_GROUP:
 154                         if (event_conf_act == C_ADD)
 155                                 rc = 0;
 156                         break;
 157                 case AUDIT_MAC_CIPSOV4_ADD:
 158                         if (event_conf_act == C_DEL)
 159                                 rc = 0;
 160                         break;
 161                 case AUDIT_MAC_CIPSOV4_DEL:
 162                         if (event_conf_act == C_ADD)
 163                                 rc = 0;
 164                         break;
 165                 case AUDIT_MAC_MAP_ADD:
 166                         if (event_conf_act == C_DEL)
 167                                 rc = 0;
 168                         break;
 169                 case AUDIT_MAC_MAP_DEL:
 170                         if (event_conf_act == C_ADD)
 171                                 rc = 0;
 172                         break;
 173                 case AUDIT_MAC_IPSEC_ADDSA:
 174                         if (event_conf_act == C_DEL)
 175                                 rc = 0;
 176                         break;
 177                 case AUDIT_MAC_IPSEC_DELSA:
 178                         if (event_conf_act == C_ADD)
 179                                 rc = 0;
 180                         break;
 181                 case AUDIT_MAC_IPSEC_ADDSPD:
 182                         if (event_conf_act == C_DEL)
 183                                 rc = 0;
 184                         break;
 185                 case AUDIT_MAC_IPSEC_DELSPD:
 186                         if (event_conf_act == C_ADD)
 187                                 rc = 0;
 188                         break;
 189                 case AUDIT_MAC_UNLBL_STCADD:
 190                         if (event_conf_act == C_DEL)
 191                                 rc = 0;
 192                         break;
 193                 case AUDIT_MAC_UNLBL_STCDEL:
 194                         if (event_conf_act == C_ADD)
 195                                 rc = 0;
 196                         break;
 197                 default:
 198                         break;
 199         }
 200 //printf("conf=%d:%d\n", l->head->type, rc);
 201         return rc;
 202 }
 203
 204 /*
 205  * This function performs that matching of search params with the record.
 206  * It returns 1 on a match, and 0 if no match.
 207  */
 208 int scan(llist *l)
 209 {
 210         // Are we within time range?
 211         if (start_time == 0 || l->e.sec >= start_time) {
 212                 if (end_time == 0 || l->e.sec <= end_time) {
 213                         // OK - do the heavier checking
 214                         int rc = extract_search_items(l);
 215                         if (rc == 0) {
 216                                 if (event_node_list) {
 217                                         const snode *sn;
 218                                         int found=0;
 219                                         slist *sptr = event_node_list;
 220
 221                                         if (l->e.node == NULL)
 222                                                 return 0;
 223
 224                                         slist_first(sptr);
 225                                         sn=slist_get_cur(sptr);
 226                                         while (sn && !found) {
 227                                                 if (sn->str && (!strcmp(sn->str, l->e.node)))
 228                                                         found++;
 229                                                 else
 230                                                         sn=slist_next(sptr);
 231                                         }
 232
 233                                         if (!found)
 234                                                 return 0;
 235                                 }
 236                                 if (classify_success(l) && classify_conf(l))
 237                                         return 1;
 238                                 return 0;
 239                         }
 240                 }
 241         }
 242         return 0;
 243 }
 244
 245 int per_event_processing(llist *l)
 246 {
 247         int rc;
 248
 249         switch (report_detail)
 250         {
 251                 case D_SUM:
 252                         rc = per_event_summary(l);
 253                         break;
 254                 case D_DETAILED:
 255                         rc = per_event_detailed(l);
 256                         break;
 257                 case D_SPECIFIC:
 258                 default:
 259                         rc = 0;
 260                         break;
 261         }
 262         return rc;
 263 }
 264
 265 static int per_event_summary(llist *l)
 266 {
 267         int rc = 0;
 268
 269         switch (report_type)
 270         {
 271                 case RPT_SUMMARY:
 272                         do_summary_total(l);
 273                         rc = 1;
 274                         break;
 275                 case RPT_AVC:
 276                         if (list_find_msg(l, AUDIT_AVC)) {
 277                                 if (alist_find_avc(l->s.avc)) {
 278                                         do {
 279                                                 slist_add_if_uniq(&sd.avc_objs,
 280                                                       l->s.avc->cur->tcontext);
 281                                         } while (alist_next_avc(l->s.avc));
 282                                 }
 283                         } else {
 284                                 if (list_find_msg(l, AUDIT_USER_AVC)) {
 285                                         if (alist_find_avc(l->s.avc)) {
 286                                                 do {
 287                                                         slist_add_if_uniq(
 288                                                                 &sd.avc_objs,
 289                                                     l->s.avc->cur->tcontext);
 290                                                 } while (alist_next_avc(
 291                                                                 l->s.avc));
 292                                         }
 293                                 }
 294                         }
 295                         break;
 296                 case RPT_MAC:
 297                         if (list_find_msg_range(l, AUDIT_MAC_POLICY_LOAD,
 298                                                 AUDIT_MAC_MAP_DEL)) {
 299                                 ilist_add_if_uniq(&sd.mac_list,
 300                                                         l->head->type, 0);
 301                         } else {
 302                                 if (list_find_msg_range(l,
 303                                         AUDIT_FIRST_USER_LSPP_MSG,
 304                                                 AUDIT_LAST_USER_LSPP_MSG)) {
 305                                         ilist_add_if_uniq(&sd.mac_list,
 306                                                         l->head->type, 0);
 307                                 }
 308                         }
 309                         break;
 310                 case RPT_INTEG:
 311                         if (list_find_msg_range(l,
 312                                 AUDIT_INTEGRITY_FIRST_MSG,
 313                                         AUDIT_INTEGRITY_LAST_MSG)) {
 314                                 ilist_add_if_uniq(&sd.integ_list,
 315                                                 l->head->type, 0);
 316                         }
 317                         break;
 318                 case RPT_VIRT:
 319                         if (list_find_msg_range(l,
 320                                 AUDIT_FIRST_VIRT_MSG,
 321                                         AUDIT_LAST_VIRT_MSG)) {
 322                                 ilist_add_if_uniq(&sd.virt_list,
 323                                                 l->head->type, 0);
 324                         }
 325                         break;
 326                 case RPT_CONFIG: /* We will borrow the pid list */
 327                         if (list_find_msg(l, AUDIT_CONFIG_CHANGE) ||
 328                                 list_find_msg(l, AUDIT_DAEMON_CONFIG) ||
 329                                 list_find_msg(l, AUDIT_USYS_CONFIG) ||
 330                                 list_find_msg(l, AUDIT_NETFILTER_CFG) ||
 331                                 list_find_msg(l, AUDIT_FEATURE_CHANGE) ||
 332                                 list_find_msg(l, AUDIT_USER_MAC_CONFIG_CHANGE)||
 333                                 list_find_msg_range(l,
 334                                         AUDIT_MAC_POLICY_LOAD,
 335                                         AUDIT_MAC_UNLBL_STCDEL)) {
 336                                 ilist_add_if_uniq(&sd.pids, l->head->type, 0);
 337                         }
 338                         break;
 339                 case RPT_AUTH:
 340                         if (list_find_msg(l, AUDIT_USER_AUTH)) {
 341                                 if (l->s.loginuid == -2 && l->s.acct)
 342                                         slist_add_if_uniq(&sd.users, l->s.acct);
 343                                 else {
 344                                         char name[64];
 345
 346                                         slist_add_if_uniq(&sd.users,
 347                                                 aulookup_uid(l->s.loginuid,
 348                                                         name,
 349                                                         sizeof(name))
 350                                                 );
 351                                 }
 352                         } else if (list_find_msg(l, AUDIT_USER_MGMT)) {
 353                                 // Only count the failures
 354                                 if (l->s.success == S_FAILED) {
 355                                         if (l->s.loginuid == -2 &&
 356                                                 l->s.acct != NULL)
 357                                         slist_add_if_uniq(&sd.users, l->s.acct);
 358                                         else {
 359                                                 char name[64];
 360
 361                                                 slist_add_if_uniq(&sd.users,
 362                                                         aulookup_uid(
 363                                                                 l->s.loginuid,
 364                                                                 name,
 365                                                                 sizeof(name))
 366                                                         );
 367                                         }
 368                                 }
 369                         }
 370                         break;
 371                 case RPT_LOGIN:
 372                         if (list_find_msg(l, AUDIT_USER_LOGIN)) {
 373                                 if ((int)l->s.loginuid < 0 && l->s.acct)
 374                                         slist_add_if_uniq(&sd.users, l->s.acct);
 375                                 else {
 376                                         char name[64];
 377
 378                                         slist_add_if_uniq(&sd.users,
 379                                                 aulookup_uid(l->s.loginuid,
 380                                                         name,
 381                                                         sizeof(name))
 382                                                 );
 383                                 }
 384                         }
 385                         break;
 386                 case RPT_ACCT_MOD: /* We will borrow the pid list */
 387                         if (list_find_msg(l, AUDIT_USER_CHAUTHTOK) ||
 388                                 list_find_msg_range(l,
 389                                         AUDIT_ADD_USER, AUDIT_DEL_GROUP) ||
 390                                 list_find_msg(l, AUDIT_USER_MGMT) ||
 391                                 list_find_msg(l, AUDIT_GRP_MGMT) ||
 392                                 list_find_msg_range(l,
 393                                         AUDIT_ROLE_ASSIGN,
 394                                         AUDIT_ROLE_REMOVE)) {
 395                                 ilist_add_if_uniq(&sd.pids, l->head->type, 0);
 396                         }
 397                         break;
 398                 case RPT_EVENT: /* We will borrow the pid list */
 399                         if (l->head->type != -1) {
 400                                 ilist_add_if_uniq(&sd.pids, l->head->type, 0);
 401                         }
 402                         break;
 403                 case RPT_FILE:
 404                         if (l->s.filename) {
 405                                 const snode *sn;
 406                                 slist *sptr = l->s.filename;
 407
 408                                 slist_first(sptr);
 409                                 sn=slist_get_cur(sptr);
 410                                 while (sn) {
 411                                         if (sn->str)
 412                                                 slist_add_if_uniq(&sd.files,
 413                                                                 sn->str);
 414                                         sn=slist_next(sptr);
 415                                 }
 416                         }
 417                         break;
 418                 case RPT_HOST:
 419                         if (l->s.hostname)
 420                                 slist_add_if_uniq(&sd.hosts, l->s.hostname);
 421                         break;
 422                 case RPT_PID:
 423                         if (l->s.pid != -1) {
 424                                 ilist_add_if_uniq(&sd.pids, l->s.pid, 0);
 425                         }
 426                         break;
 427                 case RPT_SYSCALL:
 428                         if (l->s.syscall > 0) {
 429                                 ilist_add_if_uniq(&sd.sys_list,
 430                                                 l->s.syscall, l->s.arch);
 431                         }
 432                         break;
 433                 case RPT_TERM:
 434                         if (l->s.terminal)
 435                                 slist_add_if_uniq(&sd.terms, l->s.terminal);
 436                         break;
 437                 case RPT_USER:
 438                         if (l->s.loginuid != -2) {
 439                                 char tmp[32];
 440                                 snprintf(tmp, sizeof(tmp), "%d", l->s.loginuid);
 441                                 slist_add_if_uniq(&sd.users, tmp);
 442                         }
 443                         break;
 444                 case RPT_EXE:
 445                         if (l->s.exe)
 446                                 slist_add_if_uniq(&sd.exes, l->s.exe);
 447                         break;
 448                 case RPT_COMM:
 449                         if (l->s.comm)
 450                                 slist_add_if_uniq(&sd.comms, l->s.comm);
 451                         break;
 452                 case RPT_ANOMALY:
 453                         if (list_find_msg_range(l, AUDIT_FIRST_ANOM_MSG,
 454                                                         AUDIT_LAST_ANOM_MSG)) {
 455                                 ilist_add_if_uniq(&sd.anom_list,
 456                                                         l->head->type, 0);
 457                         } else {
 458                                 if (list_find_msg_range(l,
 459                                         AUDIT_FIRST_KERN_ANOM_MSG,
 460                                                 AUDIT_LAST_KERN_ANOM_MSG)) {
 461                                         ilist_add_if_uniq(&sd.anom_list,
 462                                                         l->head->type, 0);
 463                                 }
 464                         }
 465                         break;
 466                 case RPT_RESPONSE:
 467                         if (list_find_msg_range(l, AUDIT_FIRST_ANOM_RESP,
 468                                                         AUDIT_LAST_ANOM_RESP)) {
 469                                 ilist_add_if_uniq(&sd.resp_list,
 470                                                         l->head->type, 0);
 471                         }
 472                         break;
 473                 case RPT_CRYPTO:
 474                         if (list_find_msg_range(l, AUDIT_FIRST_KERN_CRYPTO_MSG,
 475                                                 AUDIT_LAST_KERN_CRYPTO_MSG)) {
 476                                 ilist_add_if_uniq(&sd.crypto_list,
 477                                                         l->head->type, 0);
 478                         } else {
 479                                 if (list_find_msg_range(l,
 480                                         AUDIT_FIRST_CRYPTO_MSG,
 481                                                 AUDIT_LAST_CRYPTO_MSG)) {
 482                                         ilist_add_if_uniq(&sd.crypto_list,
 483                                                         l->head->type, 0);
 484                                 }
 485                         }
 486                         break;
 487                 case RPT_KEY:
 488                         if (l->s.key) {
 489                                 const snode *sn;
 490                                 slist *sptr = l->s.key;
 491
 492                                 slist_first(sptr);
 493                                 sn=slist_get_cur(sptr);
 494                                 while (sn) {
 495                                         if (sn->str &&
 496                                                     strcmp(sn->str, "(null)"))
 497                                                 slist_add_if_uniq(&sd.keys,
 498                                                                 sn->str);
 499                                         sn=slist_next(sptr);
 500                                 }
 501                         }
 502                         break;
 503                 case RPT_TTY:
 504                         UNIMPLEMENTED;
 505                         break;
 506                 default:
 507                         break;
 508         }
 509         return rc;
 510 }
 511
 512 static int per_event_detailed(llist *l)
 513 {
 514         int rc = 0;
 515
 516         switch (report_type)
 517         {
 518                 case RPT_AVC:
 519                         if (list_find_msg(l, AUDIT_AVC)) {
 520                                 print_per_event_item(l);
 521                                 rc = 1;
 522                         } else if (list_find_msg(l, AUDIT_USER_AVC)) {
 523                                 print_per_event_item(l);
 524                                 rc = 1;
 525                         }
 526                         break;
 527                 case RPT_MAC:
 528                         if (report_detail == D_DETAILED) {
 529                                 if (list_find_msg_range(l,
 530                                                 AUDIT_MAC_POLICY_LOAD,
 531                                                 AUDIT_MAC_UNLBL_STCDEL)) {
 532                                         print_per_event_item(l);
 533                                         rc = 1;
 534                                 } else {
 535                                         if (list_find_msg_range(l,
 536                                                 AUDIT_FIRST_USER_LSPP_MSG,
 537                                                 AUDIT_LAST_USER_LSPP_MSG)) {
 538                                                 print_per_event_item(l);
 539                                                 rc = 1;
 540                                         }
 541                                 }
 542                         }
 543                         break;
 544                 case RPT_INTEG:
 545                         if (report_detail == D_DETAILED) {
 546                                 if (list_find_msg_range(l,
 547                                         AUDIT_INTEGRITY_FIRST_MSG,
 548                                         AUDIT_INTEGRITY_LAST_MSG)) {
 549                                         print_per_event_item(l);
 550                                         rc = 1;
 551                                 }
 552                         }
 553                         break;
 554                 case RPT_VIRT:
 555                         if (report_detail == D_DETAILED) {
 556                                 if (list_find_msg_range(l,
 557                                         AUDIT_FIRST_VIRT_MSG,
 558                                         AUDIT_LAST_VIRT_MSG)) {
 559                                         print_per_event_item(l);
 560                                         rc = 1;
 561                                 }
 562                         }
 563                         break;
 564                 case RPT_CONFIG:
 565                         if (list_find_msg(l, AUDIT_CONFIG_CHANGE)) {
 566                                 print_per_event_item(l);
 567                                 rc = 1;
 568                         } else if (list_find_msg(l, AUDIT_DAEMON_CONFIG)) {
 569                                 print_per_event_item(l);
 570                                 rc = 1;
 571                         } else if (list_find_msg(l, AUDIT_USYS_CONFIG)) {
 572                                 print_per_event_item(l);
 573                                 rc = 1;
 574                         } else if (list_find_msg(l, AUDIT_NETFILTER_CFG)) {
 575                                 print_per_event_item(l);
 576                                 rc = 1;
 577                         } else if (list_find_msg(l, AUDIT_FEATURE_CHANGE)) {
 578                                 print_per_event_item(l);
 579                                 rc = 1;
 580                         } else if (list_find_msg(l,
 581                                         AUDIT_USER_MAC_CONFIG_CHANGE)) {
 582                                 print_per_event_item(l);
 583                                 rc = 1;
 584                         } else if (list_find_msg_range(l,
 585                                         AUDIT_MAC_POLICY_LOAD,
 586                                         AUDIT_MAC_UNLBL_STCDEL)) {
 587                                                 print_per_event_item(l);
 588                                                 rc = 1;
 589                         }
 590                         break;
 591                 case RPT_AUTH:
 592                         if (list_find_msg(l, AUDIT_USER_AUTH)) {
 593                                 print_per_event_item(l);
 594                                 rc = 1;
 595                         } else if (list_find_msg(l, AUDIT_USER_MGMT)) {
 596                                 // Only count the failed acct
 597                                 if (l->s.success == S_FAILED) {
 598                                         print_per_event_item(l);
 599                                         rc = 1;
 600                                 }
 601                         }
 602                         break;
 603                 case RPT_LOGIN:
 604                         if (list_find_msg(l, AUDIT_USER_LOGIN)) {
 605                                 print_per_event_item(l);
 606                                 rc = 1;
 607                         }
 608                         break;
 609                 case RPT_ACCT_MOD:
 610                         if (list_find_msg(l, AUDIT_USER_CHAUTHTOK)) {
 611                                 print_per_event_item(l);
 612                                 rc = 1;
 613                         } else if (list_find_msg_range(l,
 614                                         AUDIT_ADD_USER, AUDIT_DEL_GROUP)) {
 615                                 print_per_event_item(l);
 616                                 rc = 1;
 617                         } else if (list_find_msg(l, AUDIT_USER_MGMT)) {
 618                                 print_per_event_item(l);
 619                                 rc = 1;
 620                         } else if (list_find_msg(l, AUDIT_GRP_MGMT)) {
 621                                 print_per_event_item(l);
 622                                 rc = 1;
 623                         } else if (list_find_msg_range(l,
 624                                         AUDIT_ROLE_ASSIGN,
 625                                         AUDIT_ROLE_REMOVE)) {
 626                                 print_per_event_item(l);
 627                                 rc = 1;
 628                         }
 629                         break;
 630                 case RPT_EVENT:
 631                         list_first(l);
 632                         if (report_detail == D_DETAILED) {
 633                                 print_per_event_item(l);
 634                                 rc = 1;
 635                         } else { //  specific event report
 636                                 UNIMPLEMENTED;
 637                         }
 638                         break;
 639                 case RPT_FILE:
 640                         list_first(l);
 641                         if (report_detail == D_DETAILED) {
 642                                 if (l->s.filename) {
 643                                         print_per_event_item(l);
 644                                         rc = 1;
 645                                 }
 646                         } else { //  specific file report
 647                                 UNIMPLEMENTED;
 648                         }
 649                         break;
 650                 case RPT_HOST:
 651                         list_first(l);
 652                         if (report_detail == D_DETAILED) {
 653                                 if (l->s.hostname) {
 654                                         print_per_event_item(l);
 655                                         rc = 1;
 656                                 }
 657                         } else { //  specific host report
 658                                 UNIMPLEMENTED;
 659                         }
 660                         break;
 661                 case RPT_PID:
 662                         list_first(l);
 663                         if (report_detail == D_DETAILED) {
 664                                 if (l->s.pid >= 0) {
 665                                         print_per_event_item(l);
 666                                         rc = 1;
 667                                 }
 668                         } else { //  specific pid report
 669                                 UNIMPLEMENTED;
 670                         }
 671                         break;
 672                 case RPT_SYSCALL:
 673                         list_first(l);
 674                         if (report_detail == D_DETAILED) {
 675                                 if (l->s.syscall) {
 676                                         print_per_event_item(l);
 677                                         rc = 1;
 678                                 }
 679                         } else { //  specific syscall report
 680                                 UNIMPLEMENTED;
 681                         }
 682                         break;
 683                 case RPT_TERM:
 684                         list_first(l);
 685                         if (report_detail == D_DETAILED) {
 686                                 if (l->s.terminal) {
 687                                         print_per_event_item(l);
 688                                         rc = 1;
 689                                 }
 690                         } else { //  specific terminal report
 691                                 UNIMPLEMENTED;
 692                         }
 693                         break;
 694                 case RPT_USER:
 695                         list_first(l);
 696                         if (report_detail == D_DETAILED) {
 697                                 if (l->s.uid != -1) {
 698                                         print_per_event_item(l);
 699                                         rc = 1;
 700                                 }
 701                         } else { //  specific user report
 702                                 UNIMPLEMENTED;
 703                         }
 704                         break;
 705                 case RPT_EXE:
 706                         list_first(l);
 707                         if (report_detail == D_DETAILED) {
 708                                 if (l->s.exe) {
 709                                         print_per_event_item(l);
 710                                         rc = 1;
 711                                 }
 712                         } else { //  specific exe report
 713                                 UNIMPLEMENTED;
 714                         }
 715                         break;
 716                 case RPT_COMM:
 717                         list_first(l);
 718                         if (report_detail == D_DETAILED) {
 719                                 if (l->s.comm) {
 720                                         print_per_event_item(l);
 721                                         rc = 1;
 722                                 }
 723                         } else { //  specific exe report
 724                                 UNIMPLEMENTED;
 725                         }
 726                         break;
 727                 case RPT_ANOMALY:
 728                         if (report_detail == D_DETAILED) {
 729                                 if (list_find_msg_range(l,
 730                                                 AUDIT_FIRST_ANOM_MSG,
 731                                                 AUDIT_LAST_ANOM_MSG)) {
 732                                         print_per_event_item(l);
 733                                         rc = 1;
 734                                 } else {
 735                                         if (list_find_msg_range(l,
 736                                                 AUDIT_FIRST_KERN_ANOM_MSG,
 737                                                 AUDIT_LAST_KERN_ANOM_MSG)) {
 738                                                 print_per_event_item(l);
 739                                                 rc = 1;
 740                                         }
 741                                 }
 742                         } else { // FIXME: specific anom report
 743                                 UNIMPLEMENTED;
 744                         }
 745                         break;
 746                 case RPT_RESPONSE:
 747                         if (report_detail == D_DETAILED) {
 748                                 if (list_find_msg_range(l,
 749                                                 AUDIT_FIRST_ANOM_RESP,
 750                                                 AUDIT_LAST_ANOM_RESP)) {
 751                                         print_per_event_item(l);
 752                                         rc = 1;
 753                                 }
 754                         } else { // FIXME: specific resp report
 755                                 UNIMPLEMENTED;
 756                         }
 757                         break;
 758                 case RPT_CRYPTO:
 759                         if (report_detail == D_DETAILED) {
 760                                 if (list_find_msg_range(l,
 761                                                 AUDIT_FIRST_KERN_CRYPTO_MSG,
 762                                                 AUDIT_LAST_KERN_CRYPTO_MSG)) {
 763                                         print_per_event_item(l);
 764                                         rc = 1;
 765                                 } else {
 766                                         if (list_find_msg_range(l,
 767                                                 AUDIT_FIRST_CRYPTO_MSG,
 768                                                 AUDIT_LAST_CRYPTO_MSG)) {
 769                                                 print_per_event_item(l);
 770                                                 rc = 1;
 771                                         }
 772                                 }
 773                         } else { // FIXME: specific crypto report
 774                                 UNIMPLEMENTED;
 775                         }
 776                         break;
 777                 case RPT_KEY:
 778                         list_first(l);
 779                         if (report_detail == D_DETAILED) {
 780                                 if (l->s.key) {
 781                                         slist_first(l->s.key);
 782                                         if (strcmp(l->s.key->cur->str,
 783                                                         "(null)")) {
 784                                                 print_per_event_item(l);
 785                                                 rc = 1;
 786                                         }
 787                                 }
 788                         } else { //  specific key report
 789                                 UNIMPLEMENTED;
 790                         }
 791                         break;
 792                 case RPT_TTY:
 793                         if (l->head->type == AUDIT_TTY ||
 794                                         l->head->type == AUDIT_USER_TTY) {
 795                                 print_per_event_item(l);
 796                                 rc = 1;
 797                         }
 798                         break;
 799                 default:
 800                         break;
 801         }
 802         return rc;
 803 }
 804
 805 static void do_summary_total(llist *l)
 806 {
 807         // add events
 808         sd.events++;
 809
 810         // add config changes
 811         if (list_find_msg(l, AUDIT_CONFIG_CHANGE))
 812                 sd.changes++;
 813         if (list_find_msg(l, AUDIT_DAEMON_CONFIG))
 814                 sd.changes++;
 815         if (list_find_msg(l, AUDIT_USYS_CONFIG))
 816                 sd.changes++;
 817         if (list_find_msg(l, AUDIT_NETFILTER_CFG))
 818                 sd.changes++;
 819         if (list_find_msg(l, AUDIT_FEATURE_CHANGE))
 820                 sd.changes++;
 821         if (list_find_msg(l, AUDIT_USER_MAC_CONFIG_CHANGE))
 822                 sd.changes++;
 823         list_first(l);
 824         if (list_find_msg_range(l, AUDIT_MAC_POLICY_LOAD,
 825                                         AUDIT_MAC_UNLBL_STCDEL))
 826                 sd.changes++;
 827
 828         // add acct changes
 829         if (list_find_msg(l, AUDIT_USER_CHAUTHTOK))
 830                 sd.acct_changes++;
 831         if (list_find_msg_range(l, AUDIT_ADD_USER, AUDIT_DEL_GROUP))
 832                 sd.acct_changes++;
 833         if (list_find_msg(l, AUDIT_USER_MGMT))
 834                 sd.acct_changes++;
 835         if (list_find_msg(l, AUDIT_GRP_MGMT))
 836                 sd.acct_changes++;
 837         list_first(l);
 838         if (list_find_msg_range(l, AUDIT_ROLE_ASSIGN, AUDIT_ROLE_REMOVE))
 839                 sd.acct_changes++;
 840
 841         // Crypto
 842         list_first(l);
 843         if (list_find_msg_range(l, AUDIT_FIRST_KERN_CRYPTO_MSG,
 844                                         AUDIT_LAST_KERN_CRYPTO_MSG))
 845                 sd.crypto++;
 846         if (list_find_msg_range(l, AUDIT_FIRST_CRYPTO_MSG,
 847                                         AUDIT_LAST_CRYPTO_MSG))
 848                 sd.crypto++;
 849
 850         // add logins
 851         if (list_find_msg(l, AUDIT_USER_LOGIN)) {
 852                 if (l->s.success == S_SUCCESS)
 853                         sd.good_logins++;
 854                 else if (l->s.success == S_FAILED)
 855                         sd.bad_logins++;
 856         }
 857
 858         // add use of auth
 859         if (list_find_msg(l, AUDIT_USER_AUTH)) {
 860                 if (l->s.success == S_SUCCESS)
 861                         sd.good_auth++;
 862                 else if (l->s.success == S_FAILED)
 863                         sd.bad_auth++;
 864         } else if (list_find_msg(l, AUDIT_USER_MGMT)) {
 865                 // Only count the failures
 866                 if (l->s.success == S_FAILED)
 867                         sd.bad_auth++;
 868         } else if (list_find_msg(l, AUDIT_GRP_AUTH)) {
 869                 if (l->s.success == S_SUCCESS)
 870                         sd.good_auth++;
 871                 else if (l->s.success == S_FAILED)
 872                         sd.bad_auth++;
 873         }
 874
 875         // add users
 876         if (l->s.loginuid != -2) {
 877                 char tmp[32];
 878                 snprintf(tmp, sizeof(tmp), "%d", l->s.loginuid);
 879                 slist_add_if_uniq(&sd.users, tmp);
 880         }
 881
 882         // add terminals
 883         if (l->s.terminal)
 884                 slist_add_if_uniq(&sd.terms, l->s.terminal);
 885
 886         // add hosts
 887         if (l->s.hostname)
 888                 slist_add_if_uniq(&sd.hosts, l->s.hostname);
 889
 890         // add execs
 891         if (l->s.exe)
 892                 slist_add_if_uniq(&sd.exes, l->s.exe);
 893
 894         // add comms
 895         if (l->s.comm)
 896                 slist_add_if_uniq(&sd.comms, l->s.comm);
 897
 898         // add files
 899         if (l->s.filename) {
 900                 const snode *sn;
 901                 slist *sptr = l->s.filename;
 902
 903                 slist_first(sptr);
 904                 sn=slist_get_cur(sptr);
 905                 while (sn) {
 906                         if (sn->str)
 907                                 slist_add_if_uniq(&sd.files, sn->str);
 908                         sn=slist_next(sptr);
 909                 }
 910         }
 911
 912         // add avcs
 913         if (list_find_msg(l, AUDIT_AVC))
 914                 sd.avcs++;
 915         else if (list_find_msg(l, AUDIT_USER_AVC))
 916                         sd.avcs++;
 917
 918         // MAC
 919         list_first(l);
 920         if (list_find_msg_range(l, AUDIT_MAC_POLICY_LOAD,
 921                                         AUDIT_MAC_UNLBL_STCDEL))
 922                 sd.mac++;
 923         if (list_find_msg_range(l, AUDIT_FIRST_USER_LSPP_MSG,
 924                                         AUDIT_LAST_USER_LSPP_MSG))
 925                 sd.mac++;
 926
 927         // Virt
 928         list_first(l);
 929         if (list_find_msg_range(l, AUDIT_FIRST_VIRT_MSG,
 930                                         AUDIT_LAST_VIRT_MSG))
 931                 sd.virt++;
 932
 933         // Integrity
 934         list_first(l);
 935         if (list_find_msg_range(l, AUDIT_INTEGRITY_FIRST_MSG,
 936                                         AUDIT_INTEGRITY_LAST_MSG))
 937                 sd.integ++;
 938
 939         // add failed syscalls
 940         if (l->s.success == S_FAILED && l->s.syscall > 0)
 941                 sd.failed_syscalls++;
 942
 943         // add pids
 944         if (l->s.pid != -1) {
 945                 ilist_add_if_uniq(&sd.pids, l->s.pid, 0);
 946         }
 947
 948         // add anomalies
 949         if (list_find_msg_range(l, AUDIT_FIRST_ANOM_MSG, AUDIT_LAST_ANOM_MSG))
 950                 sd.anomalies++;
 951         if (list_find_msg_range(l, AUDIT_FIRST_KERN_ANOM_MSG,
 952                                  AUDIT_LAST_KERN_ANOM_MSG))
 953                 sd.anomalies++;
 954
 955         // add response to anomalies
 956         if (list_find_msg_range(l, AUDIT_FIRST_ANOM_RESP, AUDIT_LAST_ANOM_RESP))
 957                 sd.responses++;
 958
 959         // add keys
 960         if (l->s.key) {
 961                 const snode *sn;
 962                 slist *sptr = l->s.key;
 963
 964                 slist_first(sptr);
 965                 sn=slist_get_cur(sptr);
 966                 while (sn) {
 967                         if (sn->str && strcmp(sn->str, "(null)")) {
 968                                 slist_add_if_uniq(&sd.keys, sn->str);
 969                         }
 970                         sn=slist_next(sptr);
 971                 }
 972         }
 973 }
 974