diff --git a/etc/laurel/config.toml b/etc/laurel/config.toml index 7af3baa..5d4043d 100644 --- a/etc/laurel/config.toml +++ b/etc/laurel/config.toml @@ -71,6 +71,8 @@ execve-argv = [ "array" ] universal = false # UID, GID values user-db = false +# Drop raw (numeric) UID, GID values if they are translated +drop-raw = false [enrich] diff --git a/man/laurel.8.md b/man/laurel.8.md index 5c2f665..6396232 100644 --- a/man/laurel.8.md +++ b/man/laurel.8.md @@ -118,6 +118,8 @@ does when configured with `log_format=ENRICHED`. - `userdb`: Add translations for `uid` and `gid` fields. Default: false - `universal`: Add translations for everything else: `SYSCALL.arch`, `SYSCALL.syscall`, `SOCKADDR.saddr` +- `drop-raw`: Drop raw (numeric) UID, GID values if they are + translated. Default: false ## `[enrich]` section diff --git a/src/coalesce.rs b/src/coalesce.rs index 50de791..43f61b2 100644 --- a/src/coalesce.rs +++ b/src/coalesce.rs @@ -34,6 +34,7 @@ pub struct Settings<'a> { pub translate_universal: bool, pub translate_userdb: bool, + pub drop_translated: bool, pub label_exe: Option<&'a LabelMatcher>, pub unlabel_exe: Option<&'a LabelMatcher>, @@ -60,6 +61,7 @@ impl Default for Settings<'_> { proc_propagate_labels: HashSet::new(), translate_universal: false, translate_userdb: false, + drop_translated: false, label_exe: None, unlabel_exe: None, label_script: None, @@ -521,6 +523,9 @@ impl<'a> Coalesce<'a> { _ => { if let Some((k, v)) = self.translate_userdb(&mut nrv, k, v) { nrv.elems.push((k, v)); + if self.settings.drop_translated { + continue; + } } } }; @@ -820,6 +825,9 @@ impl<'a> Coalesce<'a> { for (k, v) in &rv.elems { if let Some((k, v)) = self.translate_userdb(&mut nrv, k, v) { nrv.elems.push((k, v)); + if self.settings.drop_translated { + continue; + } } else if let Some((k, v)) = self.enrich_generic_pid(&mut nrv, k, v) { nrv.elems.push((k, v)); } @@ -832,6 +840,9 @@ impl<'a> Coalesce<'a> { for (k, v) in &rv.elems { if let Some((k, v)) = self.translate_userdb(&mut nrv, k, v) { nrv.elems.push((k, v)); + if self.settings.drop_translated { + continue; + } } else if let Some((k, v)) = self.enrich_generic_pid(&mut nrv, k, v) { nrv.elems.push((k, v)); } @@ -1175,6 +1186,32 @@ mod test { process_record(&mut c, include_bytes!("testdata/record-adjntpval.txt"))?; process_record(&mut c, include_bytes!("testdata/record-avc-apparmor.txt"))?; + let mut c = Coalesce::new(mk_emit_vec(&ec)); + c.settings.translate_userdb = true; + c.settings.drop_translated = true; + process_record( + &mut c, + strip_enriched(include_bytes!("testdata/record-execve.txt")), + )?; + let output = event_to_json(ec.borrow().last().unwrap()); + println!("{}", output); + assert!( + output.contains(r#""UID":"root","#), + "output contains translated UID" + ); + assert!( + output.contains(r#""EGID":"root","#), + "output contains translated EGID" + ); + assert!( + !output.contains(r#""uid":"0,"#), + "output does not contain raw uid" + ); + assert!( + !output.contains(r#""egid":0,"#), + "output does not contain raw egid" + ); + Ok(()) } diff --git a/src/config.rs b/src/config.rs index 48eab85..fe0a0bf 100644 --- a/src/config.rs +++ b/src/config.rs @@ -67,6 +67,8 @@ pub struct Translate { pub universal: bool, #[serde(default, rename = "user-db")] pub userdb: bool, + #[serde(default, rename = "drop-raw")] + pub drop_raw: bool, } fn execve_env_default() -> HashSet { @@ -306,6 +308,7 @@ impl Config { .collect(), translate_universal: self.translate.universal, translate_userdb: self.translate.userdb, + drop_translated: self.translate.drop_raw, label_exe: self.label_process.label_exe.as_ref(), unlabel_exe: self.label_process.unlabel_exe.as_ref(), label_script: self.label_process.label_script.as_ref(),