Write documents of the program.

Add README.md on the design of the whole program, and how its every
part(listener, filter) works, finally how to compile and use them.

Besides, notes.md records the things and technology learned in this
program, such as how to read kernel src, how the pthread_create/fork/
clone syscall works on processes and threads, the techs used to make
docker container works well, and books to be read. Good good study,
day day up.

1 files changed, 29 insertions, 8 deletions

diff --git a/listener/godo.go b/listener/godo.go
index 8d82231..0e1dc73 100644
--- a/listener/godo.go
+++ b/listener/godo.go
@@ -18,14 +18,15 @@ import (
 
 var (
         fs          = flag.NewFlagSet("audit", flag.ExitOnError)
-        diag        = fs.String("diag", "", "dump raw information from kernel to file")
+        diag        = fs.String("diag", "godo.log", "dump raw information from kernel to file")
         rate        = fs.Uint("rate", 0, "rate limit in kernel (default 0, no rate limit)")
-        backlog     = fs.Uint("backlog", 8192, "backlog limit")
+        backlog     = fs.Uint("backlog", 1<<30, "backlog limit")
         immutable   = fs.Bool("immutable", false, "make kernel audit settings immutable (requires reboot to undo)")
         receiveOnly = fs.Bool("ro", false, "receive only using multicast, requires kernel 3.16+")
+        mongoURI    = fs.String("mongo", "localhost:27017", "mongo database uri")
 )
 
-const bufferPages = 100
+const bufferPages = 1000
 
 func main() {
         // 检查用户身份，并添加auditd规则，监听所有syscall
@@ -41,7 +42,6 @@ func main() {
         }
 
         exec.Command("auditctl", "-D").Run()
-        exec.Command("auditctl", "-b", "1000000000").Run()
         exec.Command("auditctl", "--reset-lost").Run()
 
         var auditCmd *exec.Cmd
@@ -78,24 +78,45 @@ func main() {
         }
 }
 
-func coroutine(client *libaudit.AuditClient) {
+func coroutine(client *libaudit.AuditClient) error {
         // 各协程至此开始
         bufferSize := bufferPages * syscall.Getpagesize()
         rawChan = make(chan interface{}, bufferSize)
         cookedChan = make(chan Event, bufferSize)
 
+        var err error
+        if err = pidCol.init(dbName, pidColName); err != nil {
+                fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
+                return err
+        }
+        if err = initPidCol(); err != nil {
+                fmt.Fprintf(os.Stderr, "Err while initing pidcol: %v\n", err)
+        }
+
+        if err = fdCol.init(dbName, fdColName); err != nil {
+                fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
+                return err
+        }
+        if err = fileCol.init(dbName, fileColName); err != nil {
+                fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
+        }
+
+        defer pidCol.Disconnect()
+        defer fdCol.Disconnect()
+        defer fileCol.Disconnect()
+
+        wg.Add(1)
+        go deal()
         wg.Add(1)
         go procWatch()
-
         wg.Add(1)
         go receive(client)
         wg.Add(1)
         go orgnaze()
-        wg.Add(1)
-        go deal()
 
         wg.Wait()
         time.Sleep(2 * time.Second)
+        return nil
 }
 
 func procWatch() error {