o
    O6ufT  ã                   @   s&   d dl mZmZ G dd„ deeƒZdS )é    )ÚPluginÚIndependentPluginc                   @   s$   e Zd ZdZdZdZdZdd„ ZdS )ÚAuditdzAudit daemon informationÚauditd)ÚsystemÚsecurity)Úauditc              
   C   s  |   g d¢¡ |  d¡ | jddd� | jddd� d}d	}z8t|d
dd��'}| ¡  ¡ D ]}|s2q-| d¡}|d  ¡ dkrE|d  ¡ }q-W d   ƒ n1 sPw   Y  W n tys } z|  d|› d|› �¡ W Y d }~nd }~ww |  	d¡s€|   |¡ d S |   |d ¡ d S )N)ú/etc/audit/auditd.confz/etc/audit/audit.rulesz/etc/audit/audit-stop.rulesz/etc/audit/rules.d/z/etc/audit/plugins.d/z/etc/audisp/z;ausearch -i --input-logs -m avc,user_avc,fanotify -ts todayzauditctl -lÚauditctl_rules)Útagszauditctl -sÚauditctl_statusr	   z/var/log/audit/audit.logÚrzUTF-8)Úencodingú=r   Úlog_fileé   zCould not open conf file z: Úall_logsÚ*)
Úadd_copy_specÚadd_cmd_outputÚopenÚreadÚ
splitlinesÚsplitÚstripÚIOErrorÚ
_log_errorÚ
get_option)ÚselfÚconfig_filer   ÚcfileÚlineÚwordsÚerror© r$   ú;/usr/lib/python3/dist-packages/sos/report/plugins/auditd.pyÚsetup   s:   	ÿ
€ûÿ€ÿ€ÿ
zAuditd.setupN)Ú__name__Ú
__module__Ú__qualname__Ú
short_descÚplugin_nameÚprofilesÚpackagesr&   r$   r$   r$   r%   r      s    r   N)Úsos.report.pluginsr   r   r   r$   r$   r$   r%   Ú<module>   s   