File Coverage

lib/Audit/Log.pm

Criterion	Covered	Total	%
statement	81	99	81.8
branch	24	42	57.1
condition	16	21	76.1
subroutine	9	10	90.0
pod	3	3	100.0
total	133	175	76.0

package Audit::Log 0.005;

use strict;
use warnings;

use 5.006;
use v5.12.0;    # Before 5.006, v5.10.0 would not be understood.

use File::Which();
use UUID::Tiny();
use List::Util qw{uniq};

# ABSTRACT: auditd log parser with minimal dependencies, using no perl features past 5.12

sub new {
    my ( $class, $path, @returning ) = @_;
    $path = '/var/log/audit/audit.log' unless $path;
    my $fullpath = File::Which::which('ausearch');

    if ( $path eq 'ausearch' ) {
        die "Cannot find ausearch" unless -f $fullpath;
    }
    else {
        die "Cannot access $path" unless -f $path;
    }
    return
      bless( { path => $path, ausearch => $fullpath, returning => \@returning },
        $class );
}

sub search {
    my ( $self, %options ) = @_;

    my $ret      = [];
    my $in_block = 1;
    my $line     = -1;
    my ( $cwd, $exe, $comm, $res ) = ( '', '', '', '' );
    my $fh;
    if ( $self->{path} eq 'ausearch' ) {
        my @args = qw{--input-logs --raw};
        push( @args, ( '-k',  $self->{key} ) );
        push( @args, ( '-sv', $options{res} ? 'yes' : 'no' ) )
          if defined $options{success};
        push( @args, ( '-comm', $options{comm} ) ) if defined $options{comm};
        open( $fh, '|', qq|$self->{fullpath} @args| )
          or die "Could not run $self->{fullpath}!";
    }
    else {
        open( $fh, '<', $self->{path} ) or die "Could not open $self->{path}!";
    }
  LINE: while (<$fh>) {
        next if index( $_, 'SYSCALL' ) < 0 && !$in_block;

        # I am trying to cheat here to snag the timestamp.
        my $msg_start = index( $_, 'msg=audit(' ) + 10;
        my $msg_end   = index( $_, ':' );
        my $timestamp = substr( $_, $msg_start, $msg_end - $msg_start );
        next if $options{older} && $timestamp > $options{older};
        next if $options{newer} && $timestamp < $options{newer};

        # Snag CWDs
        if ( index( $_, 'type=CWD' ) == 0 ) {
            my $cwd_start = index( $_, 'cwd="' ) + 5;
            my $cwd_end   = index( $_, "\n" ) - 1;
            $cwd = substr( $_, $cwd_start, $cwd_end - $cwd_start );
            $line++;
            next;
        }

        # Replace GROUP SEPARATOR usage with simple spaces
        s/[\x1D]/ /g;

        my %parsed = map {
            my @out = split( /=/, $_ );
            shift @out, join( '=', @out )
        } grep { $_ } map {
            my $subj = $_;
            $subj =~ s/"//g;
            chomp $subj;
            $subj
        } split( / /, $_ );

        $line++;
        $parsed{line}      = $line;
        $parsed{timestamp} = $timestamp;
        $parsed{cwd}       = $cwd;
        $parsed{exe}  //= $exe;
        $parsed{comm} //= $comm;
        $parsed{res}  //= $res;

        if ( exists $options{key} && $parsed{type} eq 'SYSCALL' ) {
            $in_block = $parsed{key} =~ $options{key};
            $exe      = $parsed{exe};
            $comm     = $parsed{comm};
            $res      = lc( $parsed{success} ) eq 'yes';
            $cwd      = '';
            next unless $in_block;
        }

        # Check constraints BEFORE filtering returned values, this is a WHERE clause
      CONSTRAINT: foreach my $constraint ( keys(%options) ) {
            next CONSTRAINT if !exists $parsed{$constraint};
            next LINE       if $parsed{$constraint} !~ $options{$constraint};
        }

        # Filter fields for RETURNING clause
        if ( @{ $self->{returning} } ) {
            foreach my $field ( keys(%parsed) ) {
                delete $parsed{$field}
                  unless grep { $field eq $_ } @{ $self->{returning} };
            }
        }
        push( @$ret, \%parsed );
    }
    close($fh);
    return $ret;
}

sub file_changes(&@) {
    my ( $block, @dirs ) = @_;
    my %rules;

    # Instruct auditctl to add UUID based rules
    foreach my $dir (@dirs) {
        $rules{$dir} = UUID::Tiny::create_uuid_as_string( UUID::Tiny::UUID_V1,
            UUID::Tiny::UUID_NS_DNS );

        #TODO handle errors, etc
        system( qw[auditctl -w], $dir, qw[-p rw -k], $rules{$dir} );
    }

    $block->();

    # Unload the rule, flush the log
    foreach my $dir (@dirs) {

        #TODO errors, flush
        system( qw[auditctl -W], $dir );
    }

    # Grab events
    my $parser = Audit::Log->new( 'ausearch', qw{name cwd} );

    # TODO support arrayref
    my $entries = $parser->search( 'key' => [ values(%rules) ] );
    return uniq
      map { $_->{name} =~ m/^\// ? $_->{name} : "$_->{cwd}/$_->{name}" }
      @$entries;
}

1;

__END__