Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Analyze from audit log #879

Merged
merged 66 commits into from
Jul 4, 2023
Merged
Changes from 1 commit
Commits
Show all changes
66 commits
Select commit Hold shift + click to select a range
dfb60b0
initial enable check bindings
jw3 Jun 14, 2023
a30ac81
new auparse crates
jw3 Jun 14, 2023
6aaf706
examples
jw3 Jun 14, 2023
e3ad690
restructure to parsers
jw3 Jun 14, 2023
4010a54
initial population of analysis-event-like struct
jw3 Jun 15, 2023
1cd1a83
wip
jw3 Jun 23, 2023
19db388
wip
jw3 Jun 23, 2023
11735de
wip
jw3 Jun 24, 2023
5a23fa6
specify path to log file
jw3 Jun 27, 2023
bbeacfe
resolve the last field
jw3 Jun 27, 2023
4ae1e26
clap for dev
jw3 Jun 27, 2023
3634c16
parsing
jw3 Jun 27, 2023
620aaa2
wiring
jw3 Jun 27, 2023
1c9790c
bindings
jw3 Jun 27, 2023
4d8deb1
hack
jw3 Jun 27, 2023
0a2de22
build requires clang and auparse dev libs
jw3 Jun 27, 2023
2960055
no examples
jw3 Jun 27, 2023
75743b7
bindgen 0.63
jw3 Jun 27, 2023
8af857f
unhack
jw3 Jun 27, 2023
6b838d5
finish wiring audit into menu
jw3 Jun 28, 2023
f6570ec
more wiring
jw3 Jun 28, 2023
555eb63
remove print
jw3 Jun 28, 2023
f213489
clippy
jw3 Jun 28, 2023
70d811c
improve header check
jw3 Jun 28, 2023
288cf86
remove example
jw3 Jun 28, 2023
c2174c3
headers
jw3 Jun 28, 2023
2250931
pytests
jw3 Jun 28, 2023
581e138
enable features in setup.py
jw3 Jun 29, 2023
a4b6e79
add audit dev libs to ci
jw3 Jun 29, 2023
b0a35c6
spec updates
jw3 Jun 29, 2023
6594105
add clang
jw3 Jun 29, 2023
686eabb
audit is normally disabled
jw3 Jun 29, 2023
10ce92e
imports
jw3 Jun 29, 2023
4334bf0
sensitivity based on audit availability
jw3 Jun 29, 2023
a320062
more conditional build
jw3 Jun 29, 2023
b1582d2
spec
jw3 Jun 29, 2023
013fefe
fix fmt ci
jw3 Jun 29, 2023
716d94e
always
jw3 Jun 29, 2023
13167d8
deps for rpm prep
jw3 Jun 29, 2023
af59bc6
placeholder for ci fmt
jw3 Jun 29, 2023
8d6a3d1
deps for python ci
jw3 Jun 29, 2023
15d73bf
python: use enum for log type
jw3 Jun 29, 2023
59cb688
doc
jw3 Jun 29, 2023
3fa530e
clean up quote strip
jw3 Jun 29, 2023
1ef1aab
additional crate props
jw3 Jun 29, 2023
b7bef7f
remove SystemBoot
jw3 Jun 29, 2023
161fe94
update readme
jw3 Jun 29, 2023
e6a7c9b
Merge branch 'master' into 294-audit
jw3 Jun 29, 2023
d4cc81c
cleanup and tests
jw3 Jun 29, 2023
8ee171e
wip error handling on parse
jw3 Jun 29, 2023
f6b7e11
handling parse errors
jw3 Jun 29, 2023
c74066f
unexpect
jw3 Jun 30, 2023
7b9c17b
ununwrap
jw3 Jun 30, 2023
459e09b
clarify
jw3 Jun 30, 2023
057f089
clarify errors in auparse
jw3 Jun 30, 2023
63f7f4b
refactor file locations in auparse
jw3 Jun 30, 2023
ab01900
restructure api
jw3 Jun 30, 2023
d389472
analyzer no longer needs sys dep
jw3 Jun 30, 2023
84a0adf
parser callback on error
jw3 Jun 30, 2023
c03fb12
headers
jw3 Jun 30, 2023
4efb958
ref
jw3 Jul 2, 2023
00d9621
py tests
jw3 Jul 4, 2023
10ff376
clean up import
jw3 Jul 4, 2023
deddbc1
log parser errors
jw3 Jul 4, 2023
f1bf1f6
flake
jw3 Jul 4, 2023
e603484
rename for clarity
jw3 Jul 4, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
wip
  • Loading branch information
jw3 committed Jun 28, 2023
commit 11735deaa971a94a53809ecc207bbcd58c3b26e2
10 changes: 6 additions & 4 deletions crates/auparse/examples/uptime.rs
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,16 @@ use fapolicy_auparse::error::Error;
use fapolicy_auparse::error::Error::GeneralFail;
use fapolicy_auparse::logs::Logs;
use fapolicy_auparse::record::Type::SystemBoot;
use std::time::SystemTime;
use std::time::{Duration, SystemTime};

struct BootEvent {
time: SystemTime,
time: u64,
}

fn parse(e: Event) -> Option<BootEvent> {
Some(BootEvent { time: e.time() })
Some(BootEvent {
time: e.ts() as u64,
})
}

/// Example that behaves like the ubiquitous uptime command
Expand All @@ -23,7 +25,7 @@ fn main() -> Result<(), Error> {

// uptime from then till now
let now = SystemTime::now();
let uptime = now.duration_since(then.time)?;
let uptime = now.duration_since(std::time::UNIX_EPOCH + Duration::from_secs(then.time))?;

let datetime: DateTime<Local> = now.into();
let duration = chrono::Duration::from_std(uptime)
Expand Down