<commit_before>/* Copyright (C) 2003-2004 Tresys Technology, LLC
 * see file 'COPYING' for use and warranty information */

/* 
 * Author: <EMAIL> and <NAME> <<EMAIL>>
 * Date: October 1, 2003
 * 
 * This file contains the data structure definitions for storing
 * audit logs.
 *
 * auditlog.h
 */

#ifndef LIBAUDIT_AUDITLOG_H
#define LIBAUDIT_AUDITLOG_H
#include <time.h>
#include "../libapol/util.h"
#include "../libapol/avl-util.h"

/* The following should be defined in the make environment */
#ifndef LIBSEAUDIT_VERSION_STRING
	#define LIBSEAUDIT_VERSION_STRING "UNKNOWN"
#endif

/* 
 * msg_type_t defines the different types of audit messages this library will
 * handle.  AVC_MSG is a standard 'allowed' or 'denied' type message.  
 * LOAD_POLICY_MSG is the message that results when a policy is loaded into the
 * system  BOOLEAN_MSG is the message that results when changing booleans in a 
 * conditional policy. Message types are put in alphabetical order to make 
 * msg_field_compare() in sort.c easier.
 */
#define BOOLEAN_MSG     0x00000001
#define AVC_MSG 	0x00000002
#define	LOAD_POLICY_MSG 0x00000004


/* defines for the fields in the message types */
#define AVC_MSG_FIELD 		0
#define AVC_EXE_FIELD 		1
#define AVC_PATH_FIELD 		2
#define AVC_DEV_FIELD 		3
#define AVC_SRC_USER_FIELD	4
#define AVC_SRC_ROLE_FIELD	5
#define AVC_SRC_TYPE_FIELD	6
#define AVC_TGT_USER_FIELD	7
#define AVC_TGT_ROLE_FIELD	8
#define AVC_TGT_TYPE_FIELD	9
#define AVC_OBJ_CLASS_FIELD	10
#define AVC_PERM_FIELD		11
#define AVC_INODE_FIELD		12
#define AVC_PID_FIELD		13
#define AVC_SRC_SID_FIELD       14
#define AVC_TGT_SID_FIELD       15
#define AVC_COMM_FIELD          16
#define AVC_NETIF_FIELD         17
#define AVC_KEY_FIELD           18
#define AVC_CAPABILITY_FIELD    19
#define AVC_PORT_FIELD          20
#define AVC_LPORT_FIELD         21
#define AVC_FPORT_FIELD         22
#define AVC_DEST_FIELD          23
#define AVC_SOURCE_FIELD        24
#define AVC_LADDR_FIELD         25
#define AVC_FADDR_FIELD         26
#define AVC_DADDR_FIELD         27
#define AVC_SADDR_FIELD         28
#define AVC_SRC_CONTEXT         29
#define AVC_TGT_CONTEXT         30
#define AVC_NAME_FIELD          31
#define AVC_MISC_FIELD          32
#define AVC_NUM_FIELDS		33

#define LOAD_POLICY_USERS_FIELD   33
#define LOAD_POLICY_ROLES_FIELD   34
#define LOAD_POLICY_TYPES_FIELD   35
#define LOAD_POLICY_CLASSES_FIELD 36
#define LOAD_POLICY_RULES_FIELD   37
#define LOAD_POLICY_BINARY_FIELD  38
#define LOAD_POLICY_NUM_FIELDS    6

#define BOOLEAN_NUM_BOOLS         39
#define BOOLEAN_BOOLS             40
#define BOOLEAN_VALUES            41

#define DATE_FIELD		42
#define HOST_FIELD              43

#define MSG_MAX_NFIELDS AVC_NUM_FIELDS
#define NUM_FIELDS		44

extern const char *audit_log_field_strs[NUM_FIELDS]; 
int audit_log_field_strs_get_index(const char *str);
				       	       
enum avc_msg_class_t {
	AVC_AUDIT_DATA_NO_VALUE,
	AVC_AUDIT_DATA_IPC,
	AVC_AUDIT_DATA_CAP,
	AVC_AUDIT_DATA_FS,
	AVC_AUDIT_DATA_NET,
	AVC_AUDIT_DATA_MALFORMED
};
/*
 * avc_msg contains all fields unique to an AVC message.
 */
#define AVC_DENIED  0
#define AVC_GRANTED 1
typedef struct avc_msg {
	enum avc_msg_class_t avc_type;
	char *exe;           /* executable and path */
	char *comm;
	char *path;          /* path of the OBJECT */
	char *dev;           /* device for the object */
	char *netif;
	char *laddr;
	char *faddr;
	char *daddr;
	char *saddr;
	char *name;
        int *perms;	     /* object permissions */
	int num_perms;	     /* num of object permissions */
	int msg;             /* message ie. AVC_DENIED or AVC_GRANTED */
	int key;
	bool_t is_key;
	int capability;
	bool_t is_capability;
	int lport;
	int fport;
	int dest;
	int port;
	int source;
	int src_user;         /* source user */
	int src_role;         /* source role */
	int src_type;         /* source type */
	int tgt_user;         /* target user */
	int tgt_role;         /* target role */
	int tgt_type;         /* target type */
	int obj_class;        /* object class */
        unsigned int src_sid; /* source sid */
	unsigned int tgt_sid; /* target sid */
	unsigned int pid;     /* process ID of the subject */
	unsigned long inode;  /* inode of the object */
	bool_t is_inode;
} avc_msg_t;

/* 
 * load_policy_msg contains all fields unique to the loaded policy message.
 */
typedef struct load_policy_msg {
	unsigned int users;   /* number of users */
	unsigned int roles;   /* number of roles */
	unsigned int types;   /* number of types */
	unsigned int classes; /* number of classes */
	unsigned int rules;   /* number of rules */
	char *binary;         /* path for binary that was loaded */
} load_policy_msg_t;


/*
 * boolean_msg contains all fields unique to a conditional boolean message.
 */
typedef struct boolean_msg {
        int num_bools;    /* number of booleans */
        int *booleans;    /* ordered array of ints refering to boolean name */
        bool_t *values;      /* ordered array 0 or 1 depending on boolean value */
} boolean_msg_t;


/*
 * msg_t is the type for all audit log messages.  It will contain either <commit_msg>Inserted two additional fields into the avc message structure in order to store the ip address of a log message, and the audit header token.<commit_after>/* Copyright (C) 2003-2004 Tresys Technology, LLC
 * see file 'COPYING' for use and warranty information */

/* 
 * Author: <NAME> <EMAIL>
 *         <NAME> <<EMAIL>>
 *         <NAME> <<EMAIL>>
 *
 * Date: October 1, 2003
 * 
 * This file contains the data structure definitions for storing
 * audit logs.
 *
 * auditlog.h
 */

#ifndef LIBAUDIT_AUDITLOG_H
#define LIBAUDIT_AUDITLOG_H
#include <time.h>
#include "../libapol/util.h"
#include "../libapol/avl-util.h"

/* The following should be defined in the make environment */
#ifndef LIBSEAUDIT_VERSION_STRING
	#define LIBSEAUDIT_VERSION_STRING "UNKNOWN"
#endif

/* 
 * msg_type_t defines the different types of audit messages this library will
 * handle.  AVC_MSG is a standard 'allowed' or 'denied' type message.  
 * LOAD_POLICY_MSG is the message that results when a policy is loaded into the
 * system  BOOLEAN_MSG is the message that results when changing booleans in a 
 * conditional policy. Message types are put in alphabetical order to make 
 * msg_field_compare() in sort.c easier.
 */
#define BOOLEAN_MSG     0x00000001
#define AVC_MSG 	0x00000002
#define	LOAD_POLICY_MSG 0x00000004


/* defines for the fields in the message types */
#define AVC_MSG_FIELD 		0
#define AVC_EXE_FIELD 		1
#define AVC_PATH_FIELD 		2
#define AVC_DEV_FIELD 		3
#define AVC_SRC_USER_FIELD	4
#define AVC_SRC_ROLE_FIELD	5
#define AVC_SRC_TYPE_FIELD	6
#define AVC_TGT_USER_FIELD	7
#define AVC_TGT_ROLE_FIELD	8
#define AVC_TGT_TYPE_FIELD	9
#define AVC_OBJ_CLASS_FIELD	10
#define AVC_PERM_FIELD		11
#define AVC_INODE_FIELD		12
#define AVC_IPADDR_FIELD        13
#define AVC_AUDIT_HEADER_FIELD  14
#define AVC_PID_FIELD		15
#define AVC_SRC_SID_FIELD       16
#define AVC_TGT_SID_FIELD       17
#define AVC_COMM_FIELD          18
#define AVC_NETIF_FIELD         19
#define AVC_KEY_FIELD           20
#define AVC_CAPABILITY_FIELD    21
#define AVC_PORT_FIELD          22
#define AVC_LPORT_FIELD         23
#define AVC_FPORT_FIELD         24
#define AVC_DEST_FIELD          25
#define AVC_SOURCE_FIELD        26
#define AVC_LADDR_FIELD         27
#define AVC_FADDR_FIELD         28
#define AVC_DADDR_FIELD         29
#define AVC_SADDR_FIELD         30
#define AVC_SRC_CONTEXT         31
#define AVC_TGT_CONTEXT         32
#define AVC_NAME_FIELD          33
#define AVC_MISC_FIELD          34
#define AVC_NUM_FIELDS		35

#define LOAD_POLICY_USERS_FIELD   35
#define LOAD_POLICY_ROLES_FIELD   36
#define LOAD_POLICY_TYPES_FIELD   37
#define LOAD_POLICY_CLASSES_FIELD 38
#define LOAD_POLICY_RULES_FIELD   39
#define LOAD_POLICY_BINARY_FIELD  40
#define LOAD_POLICY_NUM_FIELDS    6

#define BOOLEAN_NUM_BOOLS         41
#define BOOLEAN_BOOLS             42
#define BOOLEAN_VALUES            43

#define DATE_FIELD		44
#define HOST_FIELD              45

#define MSG_MAX_NFIELDS AVC_NUM_FIELDS
#define NUM_FIELDS		46

extern const char *audit_log_field_strs[NUM_FIELDS]; 
int audit_log_field_strs_get_index(const char *str);
				       	       
enum avc_msg_class_t {
	AVC_AUDIT_DATA_NO_VALUE,
	AVC_AUDIT_DATA_IPC,
	AVC_AUDIT_DATA_CAP,
	AVC_AUDIT_DATA_FS,
	AVC_AUDIT_DATA_NET,
	AVC_AUDIT_DATA_MALFORMED
};
/*
 * avc_msg contains all fields unique to an AVC message.
 */
#define AVC_DENIED  0
#define AVC_GRANTED 1
typedef struct avc_msg {
	enum avc_msg_class_t avc_type;
	char *exe;           /* executable and path */
	char *comm;
	char *path;          /* path of the OBJECT */
	char *dev;           /* device for the object */
	char *netif;
	char *laddr;
	char *faddr;
	char *daddr;
	char *saddr;
	char *name;
        char *ipaddr;
	char *audit_header;
        int *perms;	     /* object permissions */
	int num_perms;	     /* num of object permissions */
	int msg;             /* message ie. AVC_DENIED or AVC_GRANTED */
	int key;
	bool_t is_key;
	int capability;
	bool_t is_capability;
	int lport;
	int fport;
	int dest;
	int port;
	int source;
	int src_user;         /* source user */
	int src_role;         /* source role */
	int src_type;         /* source type */
	bool_t is_src_con;
	int tgt_user;         /* target user */
	int tgt_role;         /* target role */
	int tgt_type;         /* target type */
	bool_t is_tgt_con;
	int obj_class;        /* object class */
	bool_t is_obj_class;
        unsigned int src_sid; /* source sid */
	bool_t is_src_sid;    
	unsigned int tgt_sid; /* target sid */
	bool_t is_tgt_sid;
	unsigned int pid;     /* process ID of the subject */
	bool_t is_pid;
	unsigned long inode;  /* inode of the object */
	bool_t is_inode;
} avc_msg_t;

/* 
 * load_policy_msg contains all fields unique to the loaded policy message.
 */
typedef struct load_policy_msg {
	unsigned int users;   /* number of users */
	unsigned int roles;   /* number of roles */
	unsigned int types;   /* number of types */
	unsigned int classes; /* number of classes */
	unsigned int rules;   /* number of rules */
	char *binary;         /* path for binary that was loaded */
} load_policy_msg_t;


/*
 * boolean_msg contains all fields unique to a conditional boolean message.
 */
typedef struct boolean_msg {
        int num_bools;    /* number of booleans */
        int *booleans;    /* ordered array of ints refering to boolean name */
        bool_t *values;      /* ordered array 0 or 1 depending on boolean value */
} boolean_msg_t;


/*
 * msg_t is the type for all audit log messages.  It will contain either 
{'fraction_non_alphanumeric': 0.06978058197570393, 'fraction_numerical': 0.02429607307656088, 'mean_word_length': 3.0705251054043696, 'pattern_counts': {'":': 0, '<': 17, '<?xml version=': 0, '>': 17, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 6, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5369866', 'n_tokens_mistral': 3954, 'n_tokens_neox': 3708, 'n_words': 1142}