* See the License for the specific language governing permissions and
* limitations under the License
*/
-
#include "rule.h"
-Rule::Rule(RuleType type, Action action, Filter filter)
- : _type(type), buf(sizeof(RuleData))
+Rule::Rule(Action action, Filter filter)
+ : buf(sizeof(RuleData))
{
set(action);
set(filter);
}
Rule::Rule(const std::vector<char> &rule)
- : _type(RuleType::Default), buf(sizeof(RuleData))
+ : buf(sizeof(RuleData))
{
setComponents(rule);
}
Rule::Rule(const Rule &rule)
- : _type(rule._type), buf(sizeof(RuleData))
+ : buf(sizeof(RuleData))
{
conditions.insert(rule.conditions.begin(), rule.conditions.end());
setComponents(rule.buf);
std::vector<char> Rule::data() const
{
std::vector<char> ret(buf);
- if (!isSetMask(ret)) {
- auto r = reinterpret_cast<RuleData*>(ret.data());
- std::fill_n(r->mask, AUDIT_BITMASK_SIZE, ~0);
- }
for (auto &c : conditions) {
if (c.second)
return ret;
}
-bool Rule::isSetMask(std::vector<char> rule) const
-{
- auto r = reinterpret_cast<RuleData*>(rule.data());
- for (auto &m : r->mask) {
- if (m != 0)
- return true;
- }
- return false;
-}
-
-void Rule::setTag(const std::string &tag)
-{
- //[TODO]: save tags
- setCondition(Tag(tag));
-}
-
void Rule::set(Action action)
{
ruleData()->action = static_cast<unsigned int>(action);
Exclude = AUDIT_FILTER_TYPE,
};
-enum class RuleType {
- Default,
- User,
- Syscall,
- Watch,
- Exclude,
-};
-
class Rule {
public:
enum Perm {
};
using RuleData = struct audit_rule_data;
- Rule(RuleType type = RuleType::Syscall,
- Action action = Action::Always, Filter filter = Filter::Exit);
+ Rule(Action action = Action::Always, Filter filter = Filter::Exit);
virtual ~Rule();
Rule(Rule &&) = delete;
return (data() == rule.data());
}
- RuleType type() const
- {
- return _type;
- }
-
std::vector<char> data() const;
- void set(RuleType type)
- {
- _type = type;
- }
- void setTag(const std::string &tag);
-
template <typename T>
void setCondition(const Field<T> &field);
template <typename T>
return reinterpret_cast<RuleData*>(buf.data());
}
void setComponents(const std::vector<char> &rule);
- bool isSetMask(std::vector<char> rule) const;
private:
- RuleType _type;
std::vector<char> buf;
};