[apparmor] [PATCH] update parsing structure to include "comm"

[Kees Cook]

This adds the "comm" string to the log parsing structure.

=== modified file 'libraries/libapparmor/src/aalogparse.h'
--- libraries/libapparmor/src/aalogparse.h	2009-09-18 21:13:04 +0000
+++ libraries/libapparmor/src/aalogparse.h	2010-07-24 11:58:32 +0000
@@ -129,6 +129,7 @@
 	unsigned long fsuid;		/* fsuid of task - if logged */
 	unsigned long ouid;		/* ouid of task - if logged */
 	char *profile;			/* The name of the profile */
+	char *comm;			/* Command that triggered msg */
 	char *name;
 	char *name2;
 	char *namespace;

=== modified file 'libraries/libapparmor/src/grammar.y'
--- libraries/libapparmor/src/grammar.y	2010-07-24 10:43:53 +0000
+++ libraries/libapparmor/src/grammar.y	2010-07-24 11:58:32 +0000
@@ -432,6 +432,7 @@
 	| TOK_KEY_OUID TOK_EQUALS TOK_DIGITS
 	{ ret_record->ouid = $3;}
 	| TOK_KEY_COMM TOK_EQUALS TOK_QUOTED_STRING
+	{ ret_record->comm = $3;}
 	| TOK_KEY_APPARMOR TOK_EQUALS apparmor_event
 	;
 

=== modified file 'libraries/libapparmor/src/libaalogparse.c'
--- libraries/libapparmor/src/libaalogparse.c	2009-09-18 21:13:04 +0000
+++ libraries/libapparmor/src/libaalogparse.c	2010-07-24 11:58:32 +0000
@@ -56,6 +56,8 @@
 			free(record->denied_mask);
 		if (record->profile != NULL)
 			free(record->profile);
+		if (record->comm != NULL)
+			free(record->comm);
 		if (record->name != NULL)
 			free(record->name);
 		if (record->name2 != NULL)

=== modified file 'libraries/libapparmor/testsuite/test_multi.c'
--- libraries/libapparmor/testsuite/test_multi.c	2009-09-18 21:13:04 +0000
+++ libraries/libapparmor/testsuite/test_multi.c	2010-07-24 11:58:32 +0000
@@ -129,6 +129,10 @@
 		{
 			printf("Name: %s\n", record->name);
 		}
+		if (record->comm != NULL)
+		{
+			printf("Command: %s\n", record->comm);
+		}
 		if (record->name2 != NULL)
 		{
 			printf("Name2: %s\n", record->name2);

=== modified file 'libraries/libapparmor/testsuite/test_multi/avc_audit_01.out'
--- libraries/libapparmor/testsuite/test_multi/avc_audit_01.out	2010-07-24 10:36:13 +0000
+++ libraries/libapparmor/testsuite/test_multi/avc_audit_01.out	2010-07-24 11:58:32 +0000
@@ -9,6 +9,7 @@
 ouid: 1000
 Profile: /usr/sbin/cupsd
 Name: /home/user/.ssh/
+Command: ls
 Parent: 12332
 PID: 12333
 Epoch: 1279948288

=== modified file 'libraries/libapparmor/testsuite/test_multi/avc_audit_02.out'
--- libraries/libapparmor/testsuite/test_multi/avc_audit_02.out	2010-07-24 10:36:13 +0000
+++ libraries/libapparmor/testsuite/test_multi/avc_audit_02.out	2010-07-24 11:58:32 +0000
@@ -4,6 +4,7 @@
 Audit ID: 1279948227.175:27
 Operation: profile_replace
 Name: /sbin/dhclient3
+Command: apparmor_parser
 PID: 12291
 Epoch: 1279948227
 Audit subid: 27

=== modified file 'libraries/libapparmor/testsuite/test_multi/avc_audit_03.out'
--- libraries/libapparmor/testsuite/test_multi/avc_audit_03.out	2010-07-24 10:57:56 +0000
+++ libraries/libapparmor/testsuite/test_multi/avc_audit_03.out	2010-07-24 11:58:32 +0000
@@ -9,6 +9,7 @@
 ouid: 0
 Profile: /tmp/cat
 Name: /etc/passwd
+Command: cat
 Parent: 7014
 PID: 21645
 Epoch: 1279968846

=== modified file 'libraries/libapparmor/testsuite/test_multi/avc_syslog_01.out'
--- libraries/libapparmor/testsuite/test_multi/avc_syslog_01.out	2010-07-24 10:36:13 +0000
+++ libraries/libapparmor/testsuite/test_multi/avc_syslog_01.out	2010-07-24 11:58:32 +0000
@@ -9,6 +9,7 @@
 ouid: 0
 Profile: /usr/sbin/cupsd
 Name: /boot/
+Command: ls
 Parent: 19650
 PID: 19651
 Epoch: 1279967133

=== modified file 'libraries/libapparmor/testsuite/test_multi/avc_syslog_02.out'
--- libraries/libapparmor/testsuite/test_multi/avc_syslog_02.out	2010-07-24 10:36:13 +0000
+++ libraries/libapparmor/testsuite/test_multi/avc_syslog_02.out	2010-07-24 11:58:32 +0000
@@ -4,6 +4,7 @@
 Audit ID: 1279967081.455:42
 Operation: profile_replace
 Name: /sbin/dhclient3
+Command: apparmor_parser
 PID: 19610
 Epoch: 1279967081
 Audit subid: 42

=== modified file 'libraries/libapparmor/testsuite/test_multi/avc_syslog_03.out'
--- libraries/libapparmor/testsuite/test_multi/avc_syslog_03.out	2010-07-24 10:57:56 +0000
+++ libraries/libapparmor/testsuite/test_multi/avc_syslog_03.out	2010-07-24 11:58:32 +0000
@@ -9,6 +9,7 @@
 ouid: 0
 Profile: /tmp/cat
 Name: /etc/passwd
+Command: cat
 Parent: 7014
 PID: 21645
 Epoch: 1279968846


-- 
Kees Cook
Ubuntu Security Team