Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add native go line parser implementation to go-audit #62

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

mwielgoszewski
Copy link

  • I've read and understood the Contributing guidelines and have done my best effort to follow them.
  • I've read and agree to the Code of Conduct.
  • I've been mindful about doing atomic commits, adding documentation to my changes, not refactoring too much.
  • I've a descriptive title and added any useful information for the reviewer. Where appropriate, I've attached a screenshot and/or screencast (gif preferrably).
  • I've written tests to cover the new code and functionality included in this PR.
  • I've read, agree to, and signed the Contributor License Agreement (CLA).

PR Summary

This PR implements a native lineparser (javascript implementation originally written by @nbrownus) directly into go-audit.

For performance reasons, it is turned off by default, but may be switched on via two configuration options under message_decoding:

message_decoding:
  enabled: true
  human_friendly_messages: true

enabled simply performs basic line parsing. human_friendly_messages extends this parsing to construct human-friendly messages based on the contents of an audit message.

@codecov-io
Copy link

Codecov Report

Merging #62 into master will decrease coverage by 28.3%.
The diff coverage is 6.34%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master     #62       +/-   ##
==========================================
- Coverage   75.21%   46.9%   -28.31%     
==========================================
  Files           5       6        +1     
  Lines         476     776      +300     
==========================================
+ Hits          358     364        +6     
- Misses        101     393      +292     
- Partials       17      19        +2
Impacted Files Coverage Δ
client.go 89.23% <ø> (ø) ⬆️
lineparser.go 0% <0%> (ø)
parser.go 89.61% <100%> (ø) ⬆️
writer.go 73.33% <100%> (ø) ⬆️
audit.go 74.48% <50%> (-0.41%) ⬇️
marshaller.go 51.13% <75%> (-0.12%) ⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update daf7385...d43dd35. Read the comment docs.

AUDIT_FANOTIFY: "fanotify",
}

var syscallNumbers = map[uint16]string{
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI this mapping is kernel and architecture specific.

@CLAassistant
Copy link

CLAassistant commented Jul 30, 2019

CLA assistant check
All committers have signed the CLA.

@mwielgoszewski
Copy link
Author

@wadey what would it take to get this merged?

@codecov-commenter
Copy link

Codecov Report

Merging #62 into master will decrease coverage by 28.30%.
The diff coverage is 6.34%.

Impacted file tree graph

@@             Coverage Diff             @@
##           master      #62       +/-   ##
===========================================
- Coverage   75.21%   46.90%   -28.31%     
===========================================
  Files           5        6        +1     
  Lines         476      776      +300     
===========================================
+ Hits          358      364        +6     
- Misses        101      393      +292     
- Partials       17       19        +2     
Impacted Files Coverage Δ
client.go 89.23% <ø> (ø)
lineparser.go 0.00% <0.00%> (ø)
audit.go 74.48% <50.00%> (-0.41%) ⬇️
marshaller.go 51.13% <75.00%> (-0.12%) ⬇️
parser.go 89.61% <100.00%> (ø)
writer.go 73.33% <100.00%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update daf7385...d43dd35. Read the comment docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants