Change MAC logs to have system call number instead of smack function

It is more helpful to show system call number than smack function.
For example, whatever file operation is denied, smack function is just
"smack_inode_getattr", which doesn't help to analyze.

Signed-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>
Change-Id: Id74ec4583b30b82b229b49d27a46fbe254734ca0

diff --git a/lib/audit-trail/mac.cpp b/lib/audit-trail/mac.cpp
index b1d4401745503983e745c6c1e6a18d1154861085..4c851cf16ddcf3f8214777a87bc2779e23c34ecb 100644 (file)
--- a/lib/audit-trail/mac.cpp
+++ b/lib/audit-trail/mac.cpp
@@ -180,13 +180,13 @@ int audit_trail_get_mac_object_label(audit_trail_mac_h handle, const char **labe
        return AUDIT_TRAIL_ERROR_NONE;
 }
 
-int audit_trail_get_mac_action_function(audit_trail_mac_h handle, const char **func)
+int audit_trail_get_mac_action_syscall(audit_trail_mac_h handle, unsigned int *syscall)
 {
        RET_ON_FAILURE(handle, AUDIT_TRAIL_ERROR_INVALID_PARAMETER);
-       RET_ON_FAILURE(func, AUDIT_TRAIL_ERROR_INVALID_PARAMETER);
+       RET_ON_FAILURE(syscall, AUDIT_TRAIL_ERROR_INVALID_PARAMETER);
 
        const auto *pAudit = (MandatoryAccessControl::AuditTrail*)handle;
-       *func = pAudit->action.function.c_str();
+       *syscall = pAudit->action.systemCall;
 
        return AUDIT_TRAIL_ERROR_NONE;
 }

diff --git a/lib/audit-trail/mac.h b/lib/audit-trail/mac.h
index cfda548b4e686f0d2498764d893c80526bf21317..b27aeb4614faffb8a1f5018a04606add205813f9 100644 (file)
--- a/lib/audit-trail/mac.h
+++ b/lib/audit-trail/mac.h
@@ -258,14 +258,14 @@ AUDIT_TRAIL_API int audit_trail_get_mac_object_label(audit_trail_mac_h handle, c
  * @details     This API can be used to get the function that causes a MAC log.
  * @since_tizen 5.0
  * @param[in]   handle The audit-trail MAC log handle
- * @param[out]  func The fungtion name
+ * @param[out]  syscall the system call number
  * @return      #AUDIT_TRAIL_ERROR_NONE on success, otherwise a negative value
  * @retval      #AUDIT_TRAIL_ERROR_NONE Successful
  * @retval      #AUDIT_TRAIL_ERROR_TIMED_OUT Time out
  * @retval      #AUDIT_TRAIL_ERROR_INVALID_PARAMETER Invalid parameter
  * @post        The function name must not be freed.
  */
-AUDIT_TRAIL_API int audit_trail_get_mac_action_function(audit_trail_mac_h handle, const char **func);
+AUDIT_TRAIL_API int audit_trail_get_mac_action_syscall(audit_trail_mac_h handle, unsigned int *syscall);
 
 /**
  * @brief       Get what operation is requested by the function of the MAC log

diff --git a/rmi/mandatory-access-control.h b/rmi/mandatory-access-control.h
index 6529af7d2e8dfe978b9c4a7410c9f3f587868ffb..c4f8a26dd5ead5be47d6196ba42723494563d551 100644 (file)
--- a/rmi/mandatory-access-control.h
+++ b/rmi/mandatory-access-control.h
@@ -45,9 +45,9 @@ public:
                        REFLECTABLE(label, name);
                } object;
                struct {
-                       std::string function;
+                       unsigned int systemCall;
                        std::string request;
-                       REFLECTABLE(function, request);
+                       REFLECTABLE(systemCall, request);
                } action;
                REFLECTABLE(time, subject, object, action);
        };

diff --git a/server/mandatory-access-control.cpp b/server/mandatory-access-control.cpp
index acb49857d2f293e624130a87b58b639979a953dd..38744fe64bf979bdb30d5eaa0b306faf3719512e 100644 (file)
--- a/server/mandatory-access-control.cpp
+++ b/server/mandatory-access-control.cpp
@@ -28,6 +28,8 @@ namespace {
 std::vector<MandatoryAccessControl::AuditTrail> logs;
 bool enabled;
 
+std::string logNoSyscall;
+
 MandatoryAccessControl::AuditTrail convertLog(std::string &log)
 {
        MandatoryAccessControl::AuditTrail ret;
@@ -55,11 +57,12 @@ MandatoryAccessControl::AuditTrail convertLog(std::string &log)
                        ret.object.label = value.substr(1, value.size() - 2);
                } else if (item == "path") {
                        ret.object.name = value.substr(1, value.size() - 2);
-               } else if (item == "fn") {
-                       ret.action.function = value;
-               } else if (item == "requested") {
+               } else if (item == "syscall") {
+            ret.action.systemCall = std::stoi(value);
+        } else if (item == "requested") {
                        ret.action.request = value;
                }
+
        }
 
        return ret;
@@ -82,10 +85,19 @@ MandatoryAccessControl::MandatoryAccessControl(AuditTrailControlContext &ctx) :
        enabled = false;
 
        context.setAuditHandler([&ctx] (int type, std::vector<char> &buf) {
-               if (type == AUDIT_AVC && enabled) {
+               if (!enabled) {
+                       return;
+               }
+
+               if (type == AUDIT_AVC) {
+                       std::string log(buf.begin(), buf.end());
+                       logNoSyscall = log;
+               } else if (type == AUDIT_SYSCALL && logNoSyscall.size() > 0) {
                        std::string log(buf.begin(), buf.end());
+                       log += " " + logNoSyscall;
                        logs.push_back(convertLog(log));
                        ctx.notify("MandatoryAccessControl", logs.size() - 1);
+                       logNoSyscall.clear();
                }
        });
 }

diff --git a/tools/cli/audit-trail-admin-cli.cpp b/tools/cli/audit-trail-admin-cli.cpp
index 2aeb09a8ac7c6c2c1e774969a99a00173e4b6abf..f835372151bb0487224c6fcf93002964eb2cd057 100644 (file)
--- a/tools/cli/audit-trail-admin-cli.cpp
+++ b/tools/cli/audit-trail-admin-cli.cpp
@@ -109,6 +109,7 @@ std::string printMACLog(audit_trail_dac_h log)
 {
        std::stringstream str;
        const char *text;
+       unsigned int uint;
        pid_t pid;
 
        time_t time;
@@ -135,8 +136,8 @@ std::string printMACLog(audit_trail_dac_h log)
        str << ",label=" << text;
 
        str << "},action={";
-       audit_trail_get_mac_action_function(log, &text);
-       str << "function=" << text;
+       audit_trail_get_mac_action_syscall(log, &uint);
+       str << "syscall=" << uint;
        audit_trail_get_mac_action_request(log, &text);
        str << ",request=" << text;
        str << "}";