Add parsing of device id in AUDIT_PATH type

Change-Id: Ib6e18c2102a831db02a514a56e86974b8fa8fde9
Signed-off-by: yeji01.kim <yeji01.kim@samsung.com>

diff --git a/common/audit/audit-system-log.cpp b/common/audit/audit-system-log.cpp
index 39e4d5a9f2a1dcdd964c96c448038082dc07400f..c71e89e268e6f2cbbc868e3eb4ffddaae0e51a43 100644 (file)
--- a/common/audit/audit-system-log.cpp
+++ b/common/audit/audit-system-log.cpp
@@ -161,6 +161,8 @@ void AuditLogBuilder<AuditSystemLog>::addMessage(int type, const std::string &lo
                                        instance.object.uid = std::stoul(value);
                                } else if (name == "ogid") {
                                        instance.object.gid = std::stoul(value);
+                               } else if (name == "dev") {
+                                       instance.object.dev = value;
                                } else if (name == "key") { /* tag */
                                        if (value != "(null)" && instance.tag != "smack") {
                                                instance.tag = value;

diff --git a/common/audit/audit-system-log.h b/common/audit/audit-system-log.h
index d10105f3e8fedb464ff00878d7db971e38a5677d..5c5178f01353b0c44af05d9ccb1fcef9946f4672 100644 (file)
--- a/common/audit/audit-system-log.h
+++ b/common/audit/audit-system-log.h
@@ -50,6 +50,7 @@ struct AuditSystemLog final {
                std::string label;
                std::string name;
                std::string socketAddr;
+               std::string dev;
                pid_t pid = UINT_MAX;
                ino_t inode = UINT_MAX;
        } object;

diff --git a/lib/audit-trail/system-log.cpp b/lib/audit-trail/system-log.cpp
index a5fdf8315697a9177033b208e314d2b48738a8c8..3aa63e75019a925b10476866e2e4c979f099f442 100644 (file)
--- a/lib/audit-trail/system-log.cpp
+++ b/lib/audit-trail/system-log.cpp
@@ -239,6 +239,27 @@ int audit_system_log_get_object_sockaddr(audit_system_log_h handle, struct socka
        return AUDIT_TRAIL_ERROR_NONE;
 }
 
+int audit_system_log_get_object_dev(audit_system_log_h handle, dev_t *dev)
+{
+       RET_ON_FAILURE(handle, AUDIT_TRAIL_ERROR_INVALID_PARAMETER);
+       RET_ON_FAILURE(dev, AUDIT_TRAIL_ERROR_INVALID_PARAMETER);
+
+       const auto &log = GetSystemLog(handle).log;
+       std::string devString = log.object.dev;
+       std::string delimiter = ":";
+       unsigned int majorNum, minorNum;
+
+       if (devString.size() != 0) {
+               majorNum = std::stoul(devString.substr(0, devString.find(delimiter)), 0, 16);
+               minorNum = std::stoul(devString.substr(devString.find(delimiter) + 1), 0, 16);
+               *dev = makedev(majorNum, minorNum);
+       } else {
+               return AUDIT_TRAIL_ERROR_NO_DATA;
+       }
+
+       return AUDIT_TRAIL_ERROR_NONE;
+}
+
 int audit_system_log_get_action_systemcall(audit_system_log_h handle, unsigned int *systemcall)
 {
        RET_ON_FAILURE(handle, AUDIT_TRAIL_ERROR_INVALID_PARAMETER);

diff --git a/lib/audit-trail/system-log.h b/lib/audit-trail/system-log.h
index 5459ba62daae33b87c51e4497ef254197c6c66bc..61de6811d025f6dc21416d081ab4f6d2eec5fd2c 100644 (file)
--- a/lib/audit-trail/system-log.h
+++ b/lib/audit-trail/system-log.h
@@ -262,6 +262,21 @@ AUDIT_TRAIL_API int audit_system_log_get_object_inode(audit_system_log_h handle,
  */
 AUDIT_TRAIL_API int audit_system_log_get_object_sockaddr(audit_system_log_h handle, struct sockaddr *addr, int *family);
 
+/**
+ * @brief       Get the object dev field from the system audit log
+ * @details     This API can be used to get the object the minor and major ID of the device
+ *               in each system audit logs.
+ * @since_tizen 5.0
+ * @param[in]   handle The system audit log handle
+ * @param[out]  dev The object the minor and major ID of the device
+ * @return      #AUDIT_TRAIL_ERROR_NONE on success, otherwise a negative value
+ * @retval      #AUDIT_TRAIL_ERROR_NONE Successful
+ * @retval      #AUDIT_TRAIL_ERROR_TIMED_OUT Time out
+ * @retval      #AUDIT_TRAIL_ERROR_INVALID_PARAMETER Invalid parameter
+ * @retval      #AUDIT_TRAIL_ERROR_NO_DATA no data
+ */
+AUDIT_TRAIL_API int audit_system_log_get_object_dev(audit_system_log_h handle, dev_t *dev);
+
 /**
  * @brief       Get which systemcalls made the system log
  * @details     This API can be used to get the systemcall caused a system log in

diff --git a/rmi/log-management.h b/rmi/log-management.h
index 07d906f18f713d847d56dd76eb7a1e4d52d5fc60..c675384ba27429b2ee61be3245fd2741c82140f5 100644 (file)
--- a/rmi/log-management.h
+++ b/rmi/log-management.h
@@ -34,7 +34,7 @@ struct SystemLog {
                                log.object.type, log.object.uid, log.object.gid,
                                log.object.mode, log.object.label,
                                log.object.name, log.object.socketAddr,
-                               log.object.pid, log.object.inode,
+                               log.object.dev, log.object.pid, log.object.inode,
                                log.action.systemCall, log.action.exitCode,
                                log.action.args[0], log.action.args[1],
                                log.action.args[2], log.action.args[3]);

diff --git a/tools/cli/audit-trail-admin-cli.cpp b/tools/cli/audit-trail-admin-cli.cpp
index b2463b59c8e17af3d2ff841b0c1f20df78951501..c71d4dba85a04f33aaec0b447d71f0ed4fb3fac8 100644 (file)
--- a/tools/cli/audit-trail-admin-cli.cpp
+++ b/tools/cli/audit-trail-admin-cli.cpp
@@ -170,6 +170,7 @@ std::string printSystemLog(audit_system_log_h log)
                ino_t obj_inode;
                struct sockaddr_un addr_un;
                struct sockaddr_in addr_in;
+               dev_t obj_dev;
 
                audit_system_log_get_object_type(log, &obj_type);
                audit_system_log_get_object_name(log, &obj_name);
@@ -178,6 +179,7 @@ std::string printSystemLog(audit_system_log_h log)
                audit_system_log_get_object_pid(log, &obj_pid);
                audit_system_log_get_object_permission(log, &obj_mode);
                audit_system_log_get_object_inode(log, &obj_inode);
+               audit_system_log_get_object_dev(log, &obj_dev);
 
                audit_system_log_get_object_sockaddr(log, NULL, &sock_family);
                if (sock_family == AF_UNIX) {
@@ -197,7 +199,7 @@ std::string printSystemLog(audit_system_log_h log)
                case OBJECT_TYPE_FILE:
                        str << "type=file" << ",name=" << obj_name << ",label=" << obj_label
                                << ",inode=" << obj_inode << ",mode=" << CONVERT_OCT(obj_mode)
-                               << ",uid=" << obj_uid << ",gid=" << obj_gid;
+                               << ",uid=" << obj_uid << ",gid=" << obj_gid << ",dev=" << CONVERT_HEX(major(obj_dev))  << ":" << CONVERT_HEX(minor(obj_dev));
                        break;
                case OBJECT_TYPE_SOCKET:
                {