void foreachRuleSystemcall(unsigned int syscall, void* userData)
{
- auto &str = *(std::stringstream*)userData;
- str << CONVERT_HEX(syscall) << ", ";
+ auto &syscalls = *(std::vector<unsigned int>*)userData;
+ syscalls.push_back(syscall);
}
void foreachRuleCondition(unsigned int field, unsigned int op,
str << "exit";
str << ",systemcall={";
- audit_rule_foreach_systemcall(rule, foreachRuleSystemcall, &str);
+ {
+ std::vector<unsigned int> syscalls;
+ audit_rule_foreach_systemcall(rule, foreachRuleSystemcall, &syscalls);
+ if (syscalls.size() > 0x7ef) {
+ str << "all";
+ } else {
+ for (auto syscall : syscalls) {
+ str << CONVERT_HEX(syscall) << ", ";
+ }
+ }
+ }
str << "},condition={";
audit_rule_foreach_condition(rule, foreachRuleCondition, &str);