From 3e49a044d22635157916651f0acb5a062397b34b Mon Sep 17 00:00:00 2001
From: We-unite <3205135446@qq.com>
Date: Fri, 9 Aug 2024 13:56:37 +0800
Subject: Add db structure, fix filePath, start filtering

This commit I made several changes:

- Use structure instead of simple bson.M(interface{}). bson.M has
  some shortcomings: 1) It makes the database in chaos and hard to
  read, but this's not important; 2) Some entrys may has more or
  less content than others, which makes it hard to decode and filt.
  So I design new data structure to encode and decode. Hopes that
  there's no bugs.
- Fix the way to calculate file path. The original method is to add
  all the PATH entries together, that's totally wrong! PATH entry
  has several types, as it shows in "objtype". I can't find it in
  the kernel src code, so what i know is just "PARENT" means the dir
  the file is in, while the filename itself has the path, so we
  whould ignore all "PARENT"s. When the src code is found, we should
  check it again.
- Fix bugs in updating. The update function of mongodb is set to
  required to has a '$' such as 'set'/'push', so when we update a
  whole doc, we should use replace but not update function. And,
  we should never ignore the error infomation it gives us.

Hope that there's no more bugs for this Big Change.

Now its' time to write filter as well as viewer. Best wishes with
NO BUGS!
---
 listener/audit.go | 84 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 84 insertions(+)
 create mode 100644 listener/audit.go

(limited to 'listener/audit.go')

diff --git a/listener/audit.go b/listener/audit.go
new file mode 100644
index 0000000..ed48691
--- /dev/null
+++ b/listener/audit.go
@@ -0,0 +1,84 @@
+package main
+
+import (
+	"fmt"
+	"io"
+	"log"
+	"os"
+
+	"github.com/elastic/go-libaudit/v2"
+)
+
+func read() error {
+	// Write netlink response to a file for further analysis or for writing
+	// tests cases.
+	var diagWriter io.Writer
+	if *diag != "" {
+		f, err := os.OpenFile(*diag, os.O_CREATE|os.O_RDWR|os.O_TRUNC, 0o600)
+		if err != nil {
+			return err
+		}
+		defer f.Close()
+		diagWriter = f
+	}
+
+	log.Println("starting netlink client")
+
+	var err error
+	var client *libaudit.AuditClient
+	if *receiveOnly {
+		client, err = libaudit.NewMulticastAuditClient(diagWriter)
+		if err != nil {
+			return fmt.Errorf("failed to create receive-only audit client: %w", err)
+		}
+		defer client.Close()
+	} else {
+		client, err = libaudit.NewAuditClient(diagWriter)
+		if err != nil {
+			return fmt.Errorf("failed to create audit client: %w", err)
+		}
+		defer client.Close()
+
+		status, err := client.GetStatus()
+		if err != nil {
+			return fmt.Errorf("failed to get audit status: %w", err)
+		}
+		log.Printf("received audit status=%+v", status)
+
+		if status.Enabled == 0 {
+			log.Println("enabling auditing in the kernel")
+			if err = client.SetEnabled(true, libaudit.WaitForReply); err != nil {
+				return fmt.Errorf("failed to set enabled=true: %w", err)
+			}
+		}
+
+		if status.RateLimit != uint32(*rate) {
+			log.Printf("setting rate limit in kernel to %v", *rate)
+			if err = client.SetRateLimit(uint32(*rate), libaudit.NoWait); err != nil {
+				return fmt.Errorf("failed to set rate limit to unlimited: %w", err)
+			}
+		}
+
+		if status.BacklogLimit != uint32(*backlog) {
+			log.Printf("setting backlog limit in kernel to %v", *backlog)
+			if err = client.SetBacklogLimit(uint32(*backlog), libaudit.NoWait); err != nil {
+				return fmt.Errorf("failed to set backlog limit: %w", err)
+			}
+		}
+
+		if status.Enabled != 2 && *immutable {
+			log.Printf("setting kernel settings as immutable")
+			if err = client.SetImmutable(libaudit.NoWait); err != nil {
+				return fmt.Errorf("failed to set kernel as immutable: %w", err)
+			}
+		}
+
+		log.Printf("sending message to kernel registering our PID (%v) as the audit daemon", os.Getpid())
+		if err = client.SetPID(libaudit.NoWait); err != nil {
+			return fmt.Errorf("failed to set audit PID: %w", err)
+		}
+	}
+
+	coroutine(client)
+	return nil
+}
-- 
cgit v1.2.3-70-g09d2