File Coverage

lib/Audit/Log.pm

Criterion	Covered	Total	%
statement	66	66	100.0
branch	21	24	87.5
condition	13	18	72.2
subroutine	6	6	100.0
pod	2	2	100.0
total	108	116	93.1

package Audit::Log 0.003;

use strict;
use warnings;

use 5.006;
use v5.12.0;    # Before 5.006, v5.10.0 would not be understood.

# ABSTRACT: auditd log parser with no external dependencies, using no perl features past 5.12

sub new {
    my ( $class, $path, @returning ) = @_;
    $path = '/var/log/audit/audit.log' unless $path;
    die "Cannot access $path" unless -f $path;
    return bless( { path => $path, returning => \@returning }, $class );
}

sub search {
    my ( $self, %options ) = @_;

    my $ret      = [];
    my $in_block = 1;
    my $line     = -1;
    my ( $cwd, $exe, $comm ) = ( '', '', '' );
    open( my $fh, '<', $self->{path} );
  LINE: while (<$fh>) {
        next if index( $_, 'SYSCALL' ) < 0 && !$in_block;

        # I am trying to cheat here to snag the timestamp.
        my $msg_start = index( $_, 'msg=audit(' ) + 10;
        my $msg_end   = index( $_, ':' );
        my $timestamp = substr( $_, $msg_start, $msg_end - $msg_start );
        next if $options{older} && $timestamp > $options{older};
        next if $options{newer} && $timestamp < $options{newer};

        # Snag CWDs
        if ( index( $_, 'type=CWD' ) == 0 ) {
            my $cwd_start = index( $_, 'cwd="' ) + 5;
            my $cwd_end   = index( $_, "\n" ) - 1;
            $cwd = substr( $_, $cwd_start, $cwd_end - $cwd_start );
            $line++;
            next;
        }

        # Replace GROUP SEPARATOR usage with simple spaces
        s/[\x1D]/ /g;

        my %parsed = map {
            my @out = split( /=/, $_ );
            shift @out, join( '=', @out )
        } grep { $_ } map {
            my $subj = $_;
            $subj =~ s/"//g;
            chomp $subj;
            $subj
        } split( / /, $_ );

        $line++;
        $parsed{line}      = $line;
        $parsed{timestamp} = $timestamp;
        $parsed{cwd}       = $cwd;
        $parsed{exe}  //= $exe;
        $parsed{comm} //= $comm;

        if ( exists $options{key} && $parsed{type} eq 'SYSCALL' ) {
            $in_block = $parsed{key} =~ $options{key};
            $exe      = $parsed{exe};
            $comm     = $parsed{comm};
            $cwd      = '';
            next unless $in_block;
        }

        # Check constraints BEFORE filtering returned values, this is a WHERE clause
      CONSTRAINT: foreach my $constraint ( keys(%options) ) {
            next CONSTRAINT if !exists $parsed{$constraint};
            next LINE       if $parsed{$constraint} !~ $options{$constraint};
        }

        # Filter fields for RETURNING clause
        if ( @{ $self->{returning} } ) {
            foreach my $field ( keys(%parsed) ) {
                delete $parsed{$field}
                  unless grep { $field eq $_ } @{ $self->{returning} };
            }
        }
        push( @$ret, \%parsed );
    }
    close($fh);
    return $ret;
}

1;

__END__