From 08207d77be79afc6f75d1611726b92bdf622717f Mon Sep 17 00:00:00 2001
From: We-unite <3205135446@qq.com>
Date: Mon, 2 Sep 2024 16:45:07 +0800
Subject: Show filt result in tree&json, fix sth in listener

In the listener, I change the order coroutines are started to avoid
'send on a closed channel'. Besides, the method to get syscall names
and numbers are not so universial, so let's go back to check unistd.h.

In the filter, the output is set to be written to ./log dir. Pid tree
are shown in logs/tree.log, and detail info in pids.log, while file info
in the logs/files.log. tree.log shows a tree just like `tree` command,
the other two files are written in json.

What's more, the flags while opening files are also checked ans showed
in files.log.
---
 listener/basefunc.go | 54 +++++++++++++++++++++++++++++-----------------------
 listener/godo.go     |  4 ++--
 2 files changed, 32 insertions(+), 26 deletions(-)

(limited to 'listener')

diff --git a/listener/basefunc.go b/listener/basefunc.go
index 2f39507..dcaf68a 100644
--- a/listener/basefunc.go
+++ b/listener/basefunc.go
@@ -4,46 +4,52 @@ import (
 	"bufio"
 	"fmt"
 	"os"
-	"os/exec"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
 )
 
 func figureOutSyscalls() error {
-	cmd := exec.Command("ausyscall", "--dump")
-	stdout, err := cmd.StdoutPipe()
+	var targetFile string
+	err := filepath.Walk("/usr/include", func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if strings.HasSuffix(path, "asm/unistd_64.h") {
+			targetFile = path
+			return filepath.SkipDir // 找到后提前退出遍历
+		}
+		return nil
+	})
 	if err != nil {
 		return err
 	}
 
-	if err := cmd.Start(); err != nil {
+	// 如果没有找到目标文件
+	if targetFile == "" {
+		return fmt.Errorf("file asm/unistd_64.h not found in /usr/include")
+	}
+
+	NRRegex := regexp.MustCompile(`#define __NR_(.*?) (\d+)$`)
+	file, err := os.Open("/usr/include/asm/unistd_64.h")
+	if err != nil {
 		return err
 	}
+	defer file.Close()
 
-	scanner := bufio.NewScanner(stdout)
-	for i := 0; scanner.Scan(); i++ {
-		if i == 0 {
-			continue
-		}
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
 		line := scanner.Text()
-		parts := strings.Split(line, "\t")
-		if len(parts) != 2 {
-			return fmt.Errorf("invalid ausyscall format")
+		if NRRegex.MatchString(line) {
+			match := NRRegex.FindStringSubmatch(line)
+			num, err := strconv.Atoi(match[2])
+			if err != nil {
+				return err
+			}
+			syscallTable[num] = match[1]
 		}
-		num, err := strconv.Atoi(parts[0])
-		if err != nil {
-			return err
-		}
-		syscallTable[num] = parts[1]
-	}
-
-	if err := scanner.Err(); err != nil {
-		return err
-	}
-	if err := cmd.Wait(); err != nil {
-		return err
 	}
 	return nil
 }
diff --git a/listener/godo.go b/listener/godo.go
index 0e1dc73..4f09b67 100644
--- a/listener/godo.go
+++ b/listener/godo.go
@@ -108,11 +108,11 @@ func coroutine(client *libaudit.AuditClient) error {
 	wg.Add(1)
 	go deal()
 	wg.Add(1)
-	go procWatch()
-	wg.Add(1)
 	go receive(client)
 	wg.Add(1)
 	go orgnaze()
+	wg.Add(1)
+	go procWatch()
 
 	wg.Wait()
 	time.Sleep(2 * time.Second)
-- 
cgit v1.2.3-70-g09d2