package avc

import "audit2fivew/internal/avc"

Package avc provides parsing and representation of SELinux AVC denials.

Index

Types

type Denial

type Denial struct {
	ID          int64     // Unique primary key in the SQLite database.
	Timestamp   time.Time // Logged timestamp of the denial event.
	Serial      string    // Audit event serial number (e.g. "456").
	RawLog      string    // Original raw audit log line.
	Permissions []string  // Denied permissions (e.g. ["read", "write"]).
	TClass      string    // Target security class (e.g. "file", "dir", "process").
	SContext    string    // Full source SELinux security context.
	TContext    string    // Full target SELinux security context.
	PID         int       // Process ID that triggered the denial.
	Comm        string    // Executable/command name (e.g. "httpd").
	Name        string    // Target object basename (if reported by audit).
	Dev         string    // Storage device identifier.
	Ino         string    // Inode number of the target object.
	Path        string    // Full filesystem path of the target object (if reported).
	Permissive  bool      // True if the denial occurred in permissive mode (audit only).
	ContentHash string    // Stable SHA-256 deduplication hash based on semantic identity.
	FirstSeen   time.Time // First time this specific denial was recorded.
	LastSeen    time.Time // Most recent time this denial was recorded.
	Count       int       // Total number of occurrences observed.
}

Denial represents a single parsed SELinux AVC denial event.

func Parse
func Parse(line string) (*Denial, error)

Parse extracts an AVC denial from a single audit log line. Returns an error if the line is not a valid AVC denial.

func (*Denial) GenerateCommands
func (d *Denial) GenerateCommands() string

GenerateCommands returns the shell commands needed to compile and install the generated TE module via checkmodule / semodule_package / semodule.

func (*Denial) GenerateModuleName
func (d *Denial) GenerateModuleName() string

GenerateModuleName returns a sanitised module name for the TE rule derived from the source and target SELinux types.

func (*Denial) GenerateTE
func (d *Denial) GenerateTE() string

GenerateTE produces a complete Type Enforcement (.te) policy module that would allow the denied action. This replicates the output of audit2allow for a single denial.

func (*Denial) PermissionsStr
func (d *Denial) PermissionsStr() string

PermissionsStr returns permissions as a space-separated string.

func (*Denial) SType
func (d *Denial) SType() string

SType extracts the SELinux type from the source context. For "system_u:system_r:httpd_t:s0" it returns "httpd_t".

func (*Denial) TType
func (d *Denial) TType() string

TType extracts the SELinux type from the target context.