summaryrefslogtreecommitdiffstats
path: root/plugins/imuxsock/imuxsock.c
diff options
context:
space:
mode:
Diffstat (limited to 'plugins/imuxsock/imuxsock.c')
-rw-r--r--plugins/imuxsock/imuxsock.c101
1 files changed, 36 insertions, 65 deletions
diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c
index 1cb367b0..d5e4bb31 100644
--- a/plugins/imuxsock/imuxsock.c
+++ b/plugins/imuxsock/imuxsock.c
@@ -164,8 +164,6 @@ static int startIndexUxLocalSockets; /* process fd from that index on (used to
static int nfd = 1; /* number of Unix sockets open / read-only after startup */
static int sd_fds = 0; /* number of systemd activated sockets */
-static ee_ctx ctxee = NULL; /* library context */
-
/* config vars for legacy config system */
#define DFLT_bCreatePath 0
#define DFLT_ratelimitInterval 0
@@ -690,14 +688,12 @@ getTrustedProp(struct ucred *cred, char *propName, uchar *buf, size_t lenBuf, in
if((fd = open(namebuf, O_RDONLY)) == -1) {
DBGPRINTF("error reading '%s'\n", namebuf);
- *lenProp = 0;
- FINALIZE;
+ ABORT_FINALIZE(RS_RET_ERR);
}
if((lenRead = read(fd, buf, lenBuf - 1)) == -1) {
DBGPRINTF("error reading file data for '%s'\n", namebuf);
- *lenProp = 0;
close(fd);
- FINALIZE;
+ ABORT_FINALIZE(RS_RET_ERR);
}
/* we strip after the first \n */
@@ -733,8 +729,7 @@ getTrustedExe(struct ucred *cred, uchar *buf, size_t lenBuf, int* lenProp)
if((lenRead = readlink(namebuf, (char*)buf, lenBuf - 1)) == -1) {
DBGPRINTF("error reading link '%s'\n", namebuf);
- *lenProp = 0;
- FINALIZE;
+ ABORT_FINALIZE(RS_RET_ERR);
}
buf[lenRead] = '\0';
@@ -767,6 +762,7 @@ copyescaped(uchar *dstbuf, uchar *inbuf, int inlen)
}
+#if 0
/* Creates new field to be added to event
* used for SystemLogParseTrusted parsing
*/
@@ -785,6 +781,7 @@ createNewField(char *fieldname, char *value, int lenValue) {
return newField;
}
+#endif
/* submit received message to the queue engine
@@ -812,7 +809,7 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred, struct tim
uchar *pmsgbuf;
int toffs; /* offset for trusted properties */
struct syslogTime dummyTS;
- struct ee_event *event = NULL;
+ struct json_object *json = NULL, *jval;
DEFiRet;
/* TODO: handle format errors?? */
@@ -859,45 +856,27 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred, struct tim
}
if (pLstn->bParseTrusted) {
- struct ee_field *newField;
-
- if(ctxee == NULL) {
- if((ctxee = ee_initCtx()) == NULL) {
- errmsg.LogError(0, RS_RET_NO_RULESET, "error: could not initialize libee ctx, cannot "
- "activate action");
- ABORT_FINALIZE(RS_RET_ERR_LIBEE_INIT);
- }
+ json = json_object_new_object();
+ /* create value string, create field, and add it */
+ jval = json_object_new_int(cred->pid);
+ json_object_object_add(json, "pid", jval);
+ jval = json_object_new_int(cred->uid);
+ json_object_object_add(json, "uid", jval);
+ jval = json_object_new_int(cred->gid);
+ json_object_object_add(json, "gid", jval);
+ if(getTrustedProp(cred, "comm", propBuf, sizeof(propBuf), &lenProp) == RS_RET_OK) {
+ jval = json_object_new_string((char*)propBuf);
+ json_object_object_add(json, "appname", jval);
+ }
+ if(getTrustedExe(cred, propBuf, sizeof(propBuf), &lenProp) == RS_RET_OK) {
+ jval = json_object_new_string((char*)propBuf);
+ json_object_object_add(json, "exe", jval);
+ }
+ if(getTrustedProp(cred, "cmdline", propBuf, sizeof(propBuf), &lenProp) == RS_RET_OK) {
+ jval = json_object_new_string((char*)propBuf);
+ json_object_object_add(json, "cmd", jval);
}
-
- event = ee_newEvent(ctxee);
-
- /* create value string, create field, and add it to event */
- lenProp = snprintf((char *)propBuf, sizeof(propBuf), "%lu", (long unsigned) cred->pid);
- newField = createNewField("pid", (char *)propBuf, lenProp);
- ee_addFieldToEvent(event, newField);
-
- lenProp = snprintf((char *)propBuf, sizeof(propBuf), "%lu", (long unsigned) cred->uid);
- newField = createNewField("uid", (char *)propBuf, lenProp);
- ee_addFieldToEvent(event, newField);
-
- lenProp = snprintf((char *)propBuf, sizeof(propBuf), "%lu", (long unsigned) cred->gid);
- newField = createNewField("gid", (char *)propBuf, lenProp);
- ee_addFieldToEvent(event, newField);
-
- getTrustedProp(cred, "comm", propBuf, sizeof(propBuf), &lenProp);
- newField = createNewField("appname", (char *)propBuf, lenProp);
- ee_addFieldToEvent(event, newField);
-
- getTrustedExe(cred, propBuf, sizeof(propBuf), &lenProp);
- newField = createNewField("exe", (char *)propBuf, lenProp);
- ee_addFieldToEvent(event, newField);
-
- getTrustedProp(cred, "cmdline", propBuf, sizeof(propBuf), &lenProp);
- newField = createNewField("cmd", (char *)propBuf, lenProp);
- ee_addFieldToEvent(event, newField);
-
} else {
-
memcpy(pmsgbuf, pRcv, lenRcv);
memcpy(pmsgbuf+lenRcv, " @[", 3);
toffs = lenRcv + 3; /* next free location */
@@ -907,23 +886,20 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred, struct tim
memcpy(pmsgbuf+toffs, propBuf, lenProp);
toffs = toffs + lenProp;
- getTrustedProp(cred, "comm", propBuf, sizeof(propBuf), &lenProp);
- if(lenProp) {
+ if(getTrustedProp(cred, "comm", propBuf, sizeof(propBuf), &lenProp) == RS_RET_OK) {
memcpy(pmsgbuf+toffs, " _COMM=", 7);
memcpy(pmsgbuf+toffs+7, propBuf, lenProp);
toffs = toffs + 7 + lenProp;
}
- getTrustedExe(cred, propBuf, sizeof(propBuf), &lenProp);
- if(lenProp) {
+ if(getTrustedExe(cred, propBuf, sizeof(propBuf), &lenProp) == RS_RET_OK) {
memcpy(pmsgbuf+toffs, " _EXE=", 6);
memcpy(pmsgbuf+toffs+6, propBuf, lenProp);
toffs = toffs + 6 + lenProp;
}
- getTrustedProp(cred, "cmdline", propBuf, sizeof(propBuf), &lenProp);
- if(lenProp) {
- memcpy(pmsgbuf+toffs, " _CMDLINE=", 9);
- toffs = toffs + 9 +
- copyescaped(pmsgbuf+toffs+9, propBuf, lenProp);
+ if(getTrustedProp(cred, "cmdline", propBuf, sizeof(propBuf), &lenProp) == RS_RET_OK) {
+ memcpy(pmsgbuf+toffs, " _CMDLINE=", 10);
+ toffs = toffs + 10 +
+ copyescaped(pmsgbuf+toffs+10, propBuf, lenProp);
}
/* finalize string */
@@ -949,12 +925,11 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred, struct tim
parse++; lenMsg--; /* '>' */
- /* event is saved to pMsg */
- if(pMsg->event != NULL) {
- ee_deleteEvent(pMsg->event);
- }
- if (event != NULL) {
- pMsg->event = event;
+ if(json != NULL) {
+ /* as per lumberjack spec, these properties need to go into
+ * the CEE root.
+ */
+ msgAddJSON(pMsg, (uchar*)"!", json);
}
if(ts == NULL) {
@@ -1461,10 +1436,6 @@ CODESTARTafterRun
discardLogSockets();
nfd = 1;
- if(ctxee != NULL) {
- ee_exitCtx(ctxee);
- ctxee = NULL;
- }
ENDafterRun
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-10 12:57:32 +0000