0x11: 'file', 0x13: 'trailer', 0x14: 'header', 0x15: 'header_ex', 0x21: 'data', 0x22: 'IPC',

0x23: 'path', 0x24: 'subject', 0x26: 'process', 0x27: 'return', 0x28: 'text', 0x29: 'opaque',

0x2a: 'ip addr', 0x2b: 'ip', 0x2c: 'ip port', 0x2d: 'argument', 0x2e: 'socket', 0x2f: 'sequence',

0x32: 'IPC perm', 0x34: 'group', 0x38: 'priv', 0x39: 'use of privilege',

0x3b: 'group', 0x3c: 'exec arg', 0x3d: 'exec env', 0x3e: 'attribute', 0x52: 'exit',

0x60: 'zone', 0x71: 'argument', 0x72: 'return', 0x73: 'attribute', 0x74: 'header',

0x75: 'subject', 0x77: 'process', 0x79: 'header_ex', 0x7a: 'subject_ex', 0x7b: 'process_ex',

0x7c: 'subject_ex', 0x7d: 'process_ex', 0x7e: 'ip addr ex', 0x7f: 'socket', 0x80: 'socket-inet',

0x81: 'socket-inet6', 0x82: 'socket-unix', 0x84: 'argument', 0x85: 'return', 0xed: 'identity',

def __init__(self, data, start, end):

self.data = data

self.pos = start

self.end = end

def take(self, size):

if size < 0 or self.pos + size > self.end:

raise _Short()

chunk = self.data[self.pos:self.pos + size]

self.pos += size

return chunk

def u8(self):

return self.take(1)[0]

def u16(self):

return struct.unpack('>H', self.take(2))[0]

def u32(self):

return struct.unpack('>I', self.take(4))[0]

def u64(self):

return struct.unpack('>Q', self.take(8))[0]

def cstring_until_nul(self):

"""Bytes up to and including the next NUL, bounded by the record (fetch_execarg_tok)."""

nul = self.data.find(b'\x00', self.pos, self.end)

if nul < 0:

raise _Short()

if kind == AU_IPV4:

return ipv4(raw[:4])

if kind == AU_IPV6:

return socket.inet_ntop(socket.AF_INET6, raw[:16])

port = cur.u64() if wide else cur.u32()

kind = cur.u32()

if kind == AU_IPV4:

addr = cur.take(4)

elif kind == AU_IPV6:

addr = cur.take(16)

else:

raise _Short()

fields = {'auid': signed32(cur.u32()), 'euid': signed32(cur.u32()), 'egid': signed32(cur.u32()),

'ruid': signed32(cur.u32()), 'rgid': signed32(cur.u32()), 'pid': cur.u32(), 'sid': cur.u32()}

if ex:

fields['port'], fields['addr'] = _tid_ex(cur, wide)

else:

fields['port'] = cur.u64() if wide else cur.u32()

fields['addr'] = ipv4(cur.take(4))

fields = {'size': cur.u32(), 'version': cur.u8(), 'event': cur.u16(), 'modifier': cur.u16()}

if tid in (AUT_HEADER32_EX, AUT_HEADER64_EX):

kind = cur.u32()

# fetch_header32_ex_tok reads an address only for AU_IPv4 and AU_IPv6

fields['host'] = ip_ex(kind, cur.take(4 if kind == AU_IPV4 else 16 if kind == AU_IPV6 else 0))

wide = tid in (AUT_HEADER64, AUT_HEADER64_EX)

fields['seconds'] = cur.u64() if wide else cur.u32()

fields['msec'] = cur.u64() if wide else cur.u32()

fields = {'mode': cur.u32(), 'uid': signed32(cur.u32()), 'gid': signed32(cur.u32()), 'fsid': cur.u32(),

'nid': cur.u64()}

fields['dev'] = cur.u64() if wide else cur.u32()

# au_to_identity: signer type, then counted signing id (count includes its NUL) and a

# truncated flag, the same for the team id, then a counted cdhash

fields = {'signer_type': cur.u32(), 'signing_id': _counted(cur), 'signing_id_truncated': cur.u8()}

fields['team_id'] = _counted(cur)

fields['team_id_truncated'] = cur.u8()

fields['cdhash'] = cur.take(cur.u16()).hex()

how, unit, count = cur.u8(), cur.u8(), cur.u8()

size = {0: 1, 1: 2, 2: 4, 3: 8}.get(unit)

if size is None:

raise _Short()

fields = {'domain': cur.u16(), 'type': cur.u16()}

kind = cur.u16()

if kind not in (AU_IPV4, AU_IPV6):

raise _Short()

width = 4 if kind == AU_IPV4 else 16

fields['local_port'] = struct.unpack('>H', cur.take(2))[0]

fields['local_addr'] = ip_ex(kind, cur.take(width))

fields['remote_port'] = struct.unpack('>H', cur.take(2))[0]

fields['remote_addr'] = ip_ex(kind, cur.take(width))

family = cur.u16()

# fetch_sock_unix_tok: the path up to and including a NUL, at most AU_UNIX_PATH_MAX (108) bytes

end = min(cur.end, cur.pos + 108)

nul = cur.data.find(b'\x00', cur.pos, end)

kind = cur.u32()

if kind not in (AU_IPV4, AU_IPV6):

raise _Short()

0x11: lambda c: {'seconds': c.u32(), 'msec': c.u32(), 'name': _counted(c)},

0x13: lambda c: {'magic': c.u16(), 'count': c.u32()},

0x21: _arbitrary,

0x22: lambda c: {'type': c.u8(), 'id': c.u32()},

0x23: lambda c: {'path': _counted(c)},

0x24: _subject,

0x26: _process,

0x27: lambda c: {'status': c.u8(), 'value': c.u32()},

0x28: lambda c: {'text': _counted(c)},

0x29: lambda c: {'data': c.take(c.u16()).hex()},

0x2a: lambda c: {'addr': ipv4(c.take(4))},

0x2b: lambda c: {'header': c.take(20).hex()},

0x2c: lambda c: {'port': struct.unpack('>H', c.take(2))[0]},

0x2d: lambda c: _arg(c, False),

0x2e: lambda c: {'type': c.u16(), 'local_port': struct.unpack('>H', c.take(2))[0],

'local_addr': ipv4(c.take(4)), 'remote_port': struct.unpack('>H', c.take(2))[0],

'remote_addr': ipv4(c.take(4))},

0x2f: lambda c: {'sequence': c.u32()},

0x32: lambda c: {'uid': c.u32(), 'gid': c.u32(), 'puid': c.u32(), 'pgid': c.u32(), 'mode': c.u32(),

'seq': c.u32(), 'key': c.u32()},

0x38: lambda c: {'set_type': _counted(c), 'set': _counted(c)},

0x39: lambda c: {'success': c.u8(), 'privilege': _counted(c)},

0x3b: lambda c: {'groups': [c.u32() for _ in range(c.u16())]},

0x3c: _strings,

0x3d: _strings,

0x3e: lambda c: _attr(c, False),

0x52: lambda c: {'status': c.u32(), 'value': c.u32()},

0x60: lambda c: {'zone': _counted(c)},

0x71: lambda c: _arg(c, True),

0x72: lambda c: {'status': c.u8(), 'value': c.u64()},

0x73: lambda c: _attr(c, True),

0x75: lambda c: _subject(c, wide=True),

0x77: lambda c: _process(c, wide=True),

0x7a: lambda c: _subject(c, ex=True),

0x7b: lambda c: _process(c, ex=True),

0x7c: lambda c: _subject(c, wide=True, ex=True),

0x7d: lambda c: _process(c, wide=True, ex=True),

0x7e: _in_addr_ex,

0x7f: _socket_ex,

0x80: lambda c: {'family': c.u16(), 'port': struct.unpack('>H', c.take(2))[0], 'addr': ipv4(c.take(4))},

0x81: lambda c: {'family': c.u16(), 'port': struct.unpack('>H', c.take(2))[0],

'addr': ip_ex(AU_IPV6, c.take(16))},

0x82: _sock_unix,

0x84: lambda c: {'number': c.u8(), 'uuid': c.take(16).hex(), 'desc': _counted(c)},

0x85: lambda c: {'number': c.u8(), 'uuid': c.take(16).hex(), 'desc': _counted(c)},

0xed: _identity,

"""The tokens of one record, data[start:end], as (id, fields) pairs."""

out = []

pos = start

while pos < end:

tid = data[pos]

cur = _Cursor(data, pos + 1, end)

if tid in HEADERS:

reader = lambda c, t=tid: _header(c, t)

else:

reader = _READERS.get(tid)

if reader is None:

# fetch_invalid_tok: everything up to where the trailer would start

skip = end - (pos + 1 + AUDIT_TRAILER_SIZE)

if skip <= 0:

counts[SHORT_TOKEN] += 1

break

counts[UNKNOWN_TOKEN] += 1

out.append((tid, {'skipped_bytes': skip}))

pos = pos + 1 + skip

continue

try:

fields = reader(cur)

except _Short:

counts[SHORT_TOKEN] += 1

break

out.append((tid, fields))

pos = cur.pos

"""Every record and stand-alone file token in one trail, in file order.

counts = Counter() if counts is None else counts

records = []

pos = 0

size = len(data)

while pos < size:

tid = data[pos]

if tid in HEADERS:

if pos + 5 > size:

break

length = struct.unpack('>I', data[pos + 1:pos + 5])[0]

if length < 5 or pos + length > size:

break

elif tid == AUT_OTHER_FILE32:

if pos + 11 > size:

break

length = 11 + struct.unpack('>H', data[pos + 9:pos + 11])[0]

if pos + length > size:

break

else:

break

tokens = _tokens(data, pos, pos + length, counts)

if tid in HEADERS:

trailers = [fields for token, fields in tokens if token == AUT_TRAILER]

if not trailers:

counts[NO_TRAILER] += 1

elif trailers[-1]['magic'] != AUT_TRAILER_MAGIC or trailers[-1]['count'] != length:

counts[BAD_TRAILER] += 1

records.append({'offset': pos, 'size': length, 'tokens': tokens})

pos += length

if pos < size:

counts[TRAILING] += size - pos

"""{event number: description} from an audit_event file's bytes, read the way libbsm's

table = {}

for line in raw.decode('utf-8', errors='backslashreplace').split('\n'):

parts = [part for part in line.split(':') if part]

if len(parts) < 2:

continue

match = re.match(r'\s*[+-]?\d+', parts[0])

if not match:

continue

table.setdefault(int(match.group()) & 0xFFFF, parts[2] if len(parts) > 2 else '')

281: 'AUE_OPENAT_RWTC',

362: 'AUE_TRACKERACTION',

6169: 'AUE_poweroff',

6206: 'AUE_listdevice_fail',

43196: 'AUE_LPATHCONF',

43197: 'AUE_PDFORK',

43198: 'AUE_PDKILL',

43199: 'AUE_PDGETPID',

43200: 'AUE_PDWAIT',

43201: 'AUE_GETATTRLISTBULK',