foxcpp / foxcpp/audit_pretty

Cover more message types

Open
#1 4 comments 0 reactions 0 assignees View on GitHub
enhancement help wanted
Dominant language
Python
Stars
11
Forks
1
PR merge metrics
No merged PRs in 30d

Description

Ref.: https://github.com/linux-audit/audit-documentation

- [ ] **SELinux**
Ref.: https://selinuxproject.org/page/NB_AL

SELinux uses format different from all other audit events.
I'm not going to support it now. If you interested in SELinux
log pretty printing using audit_pretty - any help is appreciated.

- [ ] AVC
- [ ] USER_AVC
- [ ] MAC_POLICY_LOAD
- [ ] USER_MAC_POLICY_LOAD
- [ ] MAC_CONFIG_CHANGE
- [ ] MAC_STATUS
- [ ] MAC_UNLBL_STCADD
- [ ] MAC_IPSEC_EVENT
- [ ] SELINUX_ERR
- [ ] USER_ROLE_CHANGE

- [x] **AppArmor**
- [x] AVC (Policy violations)
- [x] AVC (Status messages)

- [ ] **System lifecycle events**
- [ ] SYSTEM_BOOT
- [ ] SYSTEM_RUNLEVEL
- [ ] DAEMON_START
- [ ] DAEMON_ABORT
- [x] SERVICE_START (systemd)
- [x] SERVICE_STOP (systemd)
- [ ] SERVICE_START (openrc)
- [ ] SERVICE_STOP (openrc)
- [ ] SYSTEM_SHUTDOWN
- [ ] DAEMON_END

- [ ] **User account lifecycle events**
- [x] ADD_USER
- [ ] USER_MGMT
- [ ] USER_CHAUTHTOK
- [ ] ROLE_ASSIGN
- [ ] ROLE_REMOVE
- [x] DEL_USER
- [ ] ADD_GROUP
- [ ] GRP_MGMT
- [ ] GRP_CHAUTHTOK
- [ ] DEL_GROUP

- [ ] **User login lifecycle events**
- [ ] CRYPTO_KEY_USER
- [ ] CRYPTO_SESSION
- [x] USER_AUTH
- [ ] LOGIN
- [x] USER_ACCT
- [ ] USER_CHAUTHTOK
- [ ] USER_ERR
- [ ] CRED_ACQ
- [ ] USER_ROLE_CHANGE
- [x] USER_START
- [x] USER_LOGIN
- [ ] CRED_REFR
- [ ] GRP_AUTH
- [ ] CHUSER_ID
- [ ] CHGRP_ID
- [x] USER_LOGOUT
- [x] USER_END
- [ ] CRED_DISP
- [ ] ANOM_LOGIN_FAILURES
- [ ] ANOM_LOGIN_TIME
- [ ] ANOM_LOGIN_SESSIONS
- [ ] ANOM_LOGIN_ACCT
- [ ] ANOM_LOGIN_LOCATION

- [ ] **Virt. manager guest lifecycle events**
- [ ] VIRT_MACHINE_ID
- [ ] VIRT_INTEGRITY_CHECK
- [ ] VIRT_RESOURCE
- [ ] VIRT_CONTROL

- [x] **Seccomp violation notifications**

- [x] **Generic record types**
- [x] PROCTITLE
- [x] SYSCALL
- [x] PATH
- [x] CWD

This list is incomplete. More types listed [here](https://github.com/linux-audit/audit-documentation/blob/master/specs/messages/message-dictionary.csv).

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.