U
    i©¹d;  ã                   @   s&   d dl mZmZ G dd„ deeƒZdS )é    )ÚPluginÚIndependentPluginc                   @   s$   e Zd ZdZdZdZdZdd„ ZdS )ÚAuditdzAudit daemon informationZauditd)ÚsystemZsecurity)Úauditc              
   C   sú   |   ddddddg¡ |  d¡ | jdd	d
 | jddd
 d}d}zXt|dƒD}| ¡  ¡ D ]0}|shq^| d¡}|d  ¡ dkr^|d  ¡ }q^W 5 Q R X W n4 tk
rÐ } z|  d||f ¡ W 5 d }~X Y nX |  	d¡sè|   |¡ n|   |d ¡ d S )Nz/etc/audit/auditd.confz/etc/audit/audit.rulesz/etc/audit/audit-stop.rulesz/etc/audit/rules.d/z/etc/audit/plugins.d/z/etc/audisp/z8ausearch --input-logs -m avc,user_avc,fanotify -ts todayzauditctl -lZauditctl_rules)Ztagszauditctl -sZauditctl_statusz/var/log/audit/audit.logÚrú=r   Úlog_fileé   zCould not open conf file %s: %sZall_logsÚ*)
Zadd_copy_specZadd_cmd_outputÚopenÚreadÚ
splitlinesÚsplitÚstripÚIOErrorZ
_log_errorZ
get_option)ÚselfZconfig_filer	   ZcfÚlineZwordsÚerror© r   ú;/usr/lib/python3/dist-packages/sos/report/plugins/auditd.pyÚsetup   s<    ú	ÿ
ÿ
zAuditd.setupN)Ú__name__Ú
__module__Ú__qualname__Z
short_descZplugin_nameZprofilesZpackagesr   r   r   r   r   r      s
   r   N)Zsos.report.pluginsr   r   r   r   r   r   r   Ú<module>	   s   