foxcpp / foxcpp/audit_pretty

Cover more message types

Aperta
#1 4 commenti 0 reazioni 0 assegnatari Vedi su GitHub
enhancement help wanted
Lingua principale
Python
Stelle
11
Fork
1
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

Ref.: https://github.com/linux-audit/audit-documentation

- [ ] **SELinux**
Ref.: https://selinuxproject.org/page/NB_AL

SELinux uses format different from all other audit events.
I'm not going to support it now. If you interested in SELinux
log pretty printing using audit_pretty - any help is appreciated.

- [ ] AVC
- [ ] USER_AVC
- [ ] MAC_POLICY_LOAD
- [ ] USER_MAC_POLICY_LOAD
- [ ] MAC_CONFIG_CHANGE
- [ ] MAC_STATUS
- [ ] MAC_UNLBL_STCADD
- [ ] MAC_IPSEC_EVENT
- [ ] SELINUX_ERR
- [ ] USER_ROLE_CHANGE

- [x] **AppArmor**
- [x] AVC (Policy violations)
- [x] AVC (Status messages)

- [ ] **System lifecycle events**
- [ ] SYSTEM_BOOT
- [ ] SYSTEM_RUNLEVEL
- [ ] DAEMON_START
- [ ] DAEMON_ABORT
- [x] SERVICE_START (systemd)
- [x] SERVICE_STOP (systemd)
- [ ] SERVICE_START (openrc)
- [ ] SERVICE_STOP (openrc)
- [ ] SYSTEM_SHUTDOWN
- [ ] DAEMON_END

- [ ] **User account lifecycle events**
- [x] ADD_USER
- [ ] USER_MGMT
- [ ] USER_CHAUTHTOK
- [ ] ROLE_ASSIGN
- [ ] ROLE_REMOVE
- [x] DEL_USER
- [ ] ADD_GROUP
- [ ] GRP_MGMT
- [ ] GRP_CHAUTHTOK
- [ ] DEL_GROUP

- [ ] **User login lifecycle events**
- [ ] CRYPTO_KEY_USER
- [ ] CRYPTO_SESSION
- [x] USER_AUTH
- [ ] LOGIN
- [x] USER_ACCT
- [ ] USER_CHAUTHTOK
- [ ] USER_ERR
- [ ] CRED_ACQ
- [ ] USER_ROLE_CHANGE
- [x] USER_START
- [x] USER_LOGIN
- [ ] CRED_REFR
- [ ] GRP_AUTH
- [ ] CHUSER_ID
- [ ] CHGRP_ID
- [x] USER_LOGOUT
- [x] USER_END
- [ ] CRED_DISP
- [ ] ANOM_LOGIN_FAILURES
- [ ] ANOM_LOGIN_TIME
- [ ] ANOM_LOGIN_SESSIONS
- [ ] ANOM_LOGIN_ACCT
- [ ] ANOM_LOGIN_LOCATION

- [ ] **Virt. manager guest lifecycle events**
- [ ] VIRT_MACHINE_ID
- [ ] VIRT_INTEGRITY_CHECK
- [ ] VIRT_RESOURCE
- [ ] VIRT_CONTROL

- [x] **Seccomp violation notifications**

- [x] **Generic record types**
- [x] PROCTITLE
- [x] SYSCALL
- [x] PATH
- [x] CWD

This list is incomplete. More types listed [here](https://github.com/linux-audit/audit-documentation/blob/master/specs/messages/message-dictionary.csv).

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.