Changeset 68

Timestamp:

Oct 30, 2006, 12:03:44 AM (18 years ago)

Author:

rainer

Message:

Update trunk to samhain 2.3

Location:

trunk

Files:

• Makefile.in (modified) (11 diffs)
• aclocal.m4 (modified) (2 diffs)
• configure.ac (modified) (7 diffs)
• depend.dep (modified) (2 diffs)
• depend.sum (modified) (1 diff)
• docs/Changelog (modified) (2 diffs)
• docs/README.UPGRADE (modified) (1 diff)
• include/rijndael-api-fst.h (modified) (1 diff)
• include/samhain.h (modified) (1 diff)
• include/sh_cat.h (modified) (1 diff)
• include/sh_kern.h (modified) (1 diff)
• include/sh_modules.h (modified) (1 diff)
• include/sh_suidchk.h (modified) (1 diff)
• include/sh_unix.h (modified) (2 diffs)
• include/sh_userfiles.h (modified) (1 diff)
• include/sh_utils.h (modified) (2 diffs)
• include/sh_utmp.h (modified) (1 diff)
• rules.deb-light.in (modified) (1 diff)
• rules.deb.in (modified) (1 diff)
• samhain.spec.in (modified) (1 diff)
• scripts/redhat_i386.client.spec.in (modified) (1 diff)
• scripts/samhain.ebuild.in (modified) (1 diff)
• scripts/samhain.spec.in (modified) (1 diff)
• sql_init/samhain.mysql.init (modified) (1 diff)
• sql_init/samhain.oracle.init (modified) (1 diff)
• sql_init/samhain.postgres.init (modified) (1 diff)
• src/cutest_sh_utils.c (modified) (2 diffs)
• src/sh_cat.c (modified) (3 diffs)
• src/sh_database.c (modified) (12 diffs)
• src/sh_files.c (modified) (11 diffs)
• src/sh_hash.c (modified) (36 diffs)
• src/sh_kern.c (modified) (11 diffs)
• src/sh_modules.c (modified) (3 diffs)
• src/sh_mounts.c (modified) (7 diffs)
• src/sh_readconf.c (modified) (1 diff)
• src/sh_suidchk.c (modified) (14 diffs)
• src/sh_unix.c (modified) (3 diffs)
• src/sh_userfiles.c (modified) (3 diffs)
• src/sh_utils.c (modified) (6 diffs)
• src/sh_utmp.c (modified) (5 diffs)
• test/test.sh (modified) (13 diffs)
• test/testcompile.sh (modified) (3 diffs)
• test/testrun_1.sh (modified) (10 diffs)

trunk/Makefile.in

@@ -87 +87 @@
 LIBS_KVM = @sh_libkvm@
 CFLAGS = @CFLAGS@
-COMPILE = $(CC) $(DEFS) $(INCLUDES) $(CPPFLAGS) $(CFLAGS)
+CUTEST =
+COMPILE = $(CC) $(DEFS) $(INCLUDES) $(CPPFLAGS) $(CFLAGS) $(CUTEST)
 LINK = $(CC) $(DBGDEF) -O $(LDFLAGS) -o $@
 
@@ -114 +115 @@
         lzoconf.h minilzo.h rijndael-alg-fst.h rijndael-api-fst.h \
         rijndael-boxes-fst.h sh_socket.h sh_ignore.h sh_prelude.h \
-        sh_mounts.h sh_userfiles.h sh_static.h sh_prelink.h 
+        sh_mounts.h sh_userfiles.h sh_static.h sh_prelink.h \
+        sh_processcheck.h sh_portcheck.h
 
 
@@ -146 +148 @@
         $(srcsrc)/sh_userfiles.c $(srcsrc)/sh_prelude.c \
         $(srcsrc)/sh_prelink.c $(srcsrc)/sh_static.c \
-        $(srcsrc)/sh_prelude_old.c 
+        $(srcsrc)/sh_portcheck.c \
+        $(srcsrc)/sh_processcheck.c $(srcsrc)/sh_prelude_old.c 
 
 OBJECTS = sh_files.o sh_tiger0.o sh_tiger2.o sh_tiger2_64.o \
@@ -159 +162 @@
         zAVLTree.o sh_socket.o sh_ignore.o sh_prelude.o \
         sh_mounts.o sh_userfiles.o sh_prelink.o sh_static.o \
-        sh_prelude_old.o 
+        sh_processcheck.o sh_portcheck.o sh_prelude_old.o  
 
 KERN = kern_head.h kern_head.c
@@ -165 +168 @@
 TESTSUITE = test.sh testcompile.sh testhash.sh testtiger.txt \
         testtimesrv.sh \
-        testext.sh testrc_1ext.in test_ext.c.in \
+        testext.sh testrc_1ext.in test_ext.c.in testrun_1d.sh \
         testrun_1.sh testrun_1a.sh testrun_1b.sh testrun_1c.sh testrc_1 \
         testrun_2.sh testrun_2a.sh testrun_2b.sh testrc_2.in \
@@ -808 +811 @@
         echo $(top_srcdir)/docs/HOWTO-client+server.html >> debian/docs; \
         echo $(top_srcdir)/docs/HOWTO-samhain+GnuPG.html >> debian/docs; \
-        echo $(top_srcdir)/docs/MANUAL-2_2.html.tar      >> debian/docs; \
-        echo $(top_srcdir)/docs/MANUAL-2_2.pdf           >> debian/docs; \
+        echo $(top_srcdir)/docs/MANUAL-2_3.html.tar      >> debian/docs; \
+        echo $(top_srcdir)/docs/MANUAL-2_3.pdf           >> debian/docs; \
         echo $(top_srcdir)/docs/README.gcc_bug           >> debian/docs; \
         echo $(top_srcdir)/docs/README.LZO               >> debian/docs; \
@@ -819 +822 @@
 
 deb-run:
-        @maintainer=`gpg --list-secret-keys | grep 'sec ' | cut -d" " -f 5- | sed 's/^ *//' | sed q1`;\
+        @maintainer=`gpg --list-secret-keys | grep 'uid ' | cut -d" " -f 5- | sed 's/^ *//' | sed q1`;\
         if test "x$$maintainer" = x; then \
                 maintainer="Nobody Nowhere <nobody@example.com>"; \
@@ -1148 +1151 @@
         rm x_`echo $@ |sed 's%\.o$$%%'`.c
 
-cutest: internal.h $(OBJECTS) $(CUTEST_OBJECTS) sh_tiger_i.o $(srcsrc)/make-tests.sh
+
+cutest: $(SOURCES) $(CUTEST_SOURCES)
+        @$(MAKE) CUTEST='-DSH_CUTEST=1' intcutest
+
+intcutest: internal.h $(OBJECTS) $(CUTEST_OBJECTS) sh_tiger_i.o $(srcsrc)/make-tests.sh
         cd $(srcsrc)/ && ./make-tests.sh >CuTestMain.c
         @$(COMPILE) -o CuTestMain.o -c $(srcsrc)/CuTestMain.c; \
@@ -1154 +1161 @@
         rm -f samhain.o; \
         ./encode $(XOR_CODE) $(srcsrc)/samhain.c; \
-        $(COMPILE) $(VFLAG) -DSH_CUTEST=1 -o samhain.o -c x_samhain.c; \
+        $(COMPILE) $(VFLAG) -o samhain.o -c x_samhain.c; \
         rm x_samhain.c; \
         $(LINK) sh_tiger_i.o $(CUTEST_OBJECTS) CuTestMain.o CuTest.o $(OBJECTS) $(LIBS_TRY); \
+        test -f ./intcutest && mv ./intcutest ./cutest; \
         ./cutest
 
@@ -1631 +1639 @@
 sh_entropy.o: $(srcsrc)/sh_entropy.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_utils.h $(srcinc)/sh_unix.h $(srcinc)/sh_tiger.h $(srcinc)/sh_calls.h $(srcinc)/sh_static.h 
 sh_forward.o: $(srcsrc)/sh_forward.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_tiger.h $(srcinc)/sh_utils.h $(srcinc)/sh_unix.h $(srcinc)/sh_forward.h $(srcinc)/sh_srp.h $(srcinc)/sh_fifo.h $(srcinc)/sh_tools.h $(srcinc)/sh_entropy.h $(srcinc)/sh_html.h $(srcinc)/sh_mail.h $(srcinc)/sh_socket.h $(srcinc)/sh_static.h $(srcinc)/rijndael-api-fst.h $(srcinc)/sh_readconf.h $(srcinc)/zAVLTree.h $(srcinc)/sh_extern.h 
-sh_modules.o: $(srcsrc)/sh_modules.c Makefile config_xor.h $(srcinc)/sh_modules.h $(srcinc)/sh_utmp.h $(srcinc)/sh_mounts.h $(srcinc)/sh_userfiles.h $(srcinc)/sh_kern.h $(srcinc)/sh_suidchk.h 
+sh_modules.o: $(srcsrc)/sh_modules.c Makefile config_xor.h $(srcinc)/sh_modules.h $(srcinc)/sh_utmp.h $(srcinc)/sh_mounts.h $(srcinc)/sh_userfiles.h $(srcinc)/sh_kern.h $(srcinc)/sh_suidchk.h $(srcinc)/sh_processcheck.h $(srcinc)/sh_portcheck.h 
 sh_utmp.o: $(srcsrc)/sh_utmp.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_utils.h $(srcinc)/sh_error.h $(srcinc)/sh_modules.h $(srcinc)/sh_utmp.h 
 sh_kern.o: $(srcsrc)/sh_kern.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_utils.h $(srcinc)/sh_error.h $(srcinc)/sh_modules.h $(srcinc)/sh_kern.h sh_ks_xor.h $(srcinc)/sh_unix.h $(srcinc)/sh_hash.h 
@@ -1674 +1682 @@
 sh_prelude_old.o: $(srcsrc)/sh_prelude_old.c Makefile config_xor.h $(srcinc)/slib.h $(srcinc)/sh_mem.h $(srcinc)/sh_cat.h $(srcinc)/sh_error_min.h $(srcinc)/sh_prelude.h $(srcinc)/sh_static.h 
 sh_async.o: $(srcsrc)/sh_async.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_calls.h $(srcinc)/sh_error.h 
+sh_processcheck.o: $(srcsrc)/sh_processcheck.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_modules.h $(srcinc)/sh_processcheck.h $(srcinc)/sh_utils.h $(srcinc)/sh_error.h $(srcinc)/sh_extern.h $(srcinc)/CuTest.h 
+sh_portcheck.o: $(srcsrc)/sh_portcheck.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_error.h $(srcinc)/sh_mem.h $(srcinc)/sh_utils.h $(srcinc)/sh_modules.h $(srcinc)/CuTest.h 

trunk/aclocal.m4

@@ -402 +402 @@
 x_libraries=NONE
 DESTDIR=
-SH_ENABLE_OPTS="db-reload xml-log message-queue login-watch mounts-check userfiles debug ptrace static network udp nocl stealth micro-stealth install-name identity khide suidcheck base largefile mail external-scripts encrypt srp"
+SH_ENABLE_OPTS="db-reload xml-log message-queue login-watch process-check port-check mounts-check userfiles debug ptrace static network udp nocl stealth micro-stealth install-name identity khide suidcheck base largefile mail external-scripts encrypt srp"
 SH_WITH_OPTS="prelude libprelude-prefix database libwrap cflags libs console altconsole timeserver alttimeserver rnd egd-socket port logserver altlogserver kcheck gpg checksum fp recipient sender trusted tmp-dir config-file log-file pid-file state-dir data-file html-file"
 
@@ -1238 +1238 @@
 ])dnl
 
+AC_DEFUN([sh_CHECK_POSIX_ACL],
+[
+  AC_CHECK_HEADERS(sys/acl.h)
+  if test $ac_cv_header_sys_acl_h = yes; then
+
+        AC_CHECK_LIB([acl], [acl_get_file], sh_lacl=yes, sh_lacl=no)
+        if test x"$sh_lacl" = xyes; then
+                LIBACL=-lacl
+        else
+                LIBACL=
+        fi
+
+        OLDLIBS="$LIBS"
+        LIBS="$LIBS $LIBACL"
+        AC_CHECK_FUNCS([acl_free acl_get_file acl_get_fd],
+                       [sh_facl=yes],[sh_facl=no])
+        LIBS="$OLDLIBS"
+
+        if test x"$sh_facl" = xyes; then
+          AC_DEFINE(USE_ACL, 1, [Define if you want ACL support.])
+          LIBS="$LIBS $LIBACL"
+        fi
+  fi
+])
+
+AC_DEFUN([sh_CHECK_XATTR],
+[
+  AC_CHECK_HEADERS(attr/xattr.h)
+  if test $ac_cv_header_attr_xattr_h = yes; then
+
+        AC_CHECK_LIB([attr], [getxattr], sh_lattr=yes, sh_lattr=no)
+        if test x"$sh_lattr" = xyes; then
+                LIBATTR=-lattr
+        else
+                LIBATTR=
+        fi
+  
+        OLDLIBS="$LIBS"
+        LIBS="$LIBS $LIBATTR"
+        AC_CHECK_FUNCS([getxattr lgetxattr fgetxattr],
+                       [sh_fattr=yes],[sh_fattr=no])
+        LIBS="$OLDLIBS"
+
+        if test x"$sh_fattr" = xyes; then
+          AC_DEFINE(USE_XATTR, 1, [Define if you want extended attributes support.])
+          LIBS="$LIBS $LIBATTR"
+        fi
+  fi
+])
 
 dnl Autoconf macros for libprelude

trunk/configure.ac

@@ -13 +13 @@
 dnl start
 dnl
-AM_INIT_AUTOMAKE(samhain, 2.2.5)
+AM_INIT_AUTOMAKE(samhain, 2.3.0)
 AC_CANONICAL_HOST
 
@@ -200 +200 @@
         linux/ext2_fs.h ext2fs/ext2_fs.h \
         elf.h linux/elf.h \
-        paths.h arpa/nameser.h arpa/nameser_compat.h,
+        paths.h arpa/nameser.h arpa/nameser_compat.h \
+        rpc/rpcent.h,
         [],
         [],
@@ -264 +265 @@
         inet_aton gethostbyname setutent setrlimit gethostname uname \
         initgroups getpagesize \
-        ttyname fchmod
+        ttyname fchmod \
+        getsid getpriority getpgid
 )
 AC_CHECK_FUNC(statfs, AC_DEFINE(HAVE_STATFS) statfs="yes",  statfs="no")
@@ -374 +376 @@
 ])
 
+dnl *****************************************
+dnl     checks for extended attribute or ACL 
+dnl     support
+dnl *****************************************
+
+sh_CHECK_XATTR
+sh_CHECK_POSIX_ACL
 
 dnl *****************************************
@@ -529 +538 @@
 
 dnl
+dnl check for /proc filesystem
+dnl
+if test -d "/proc/$$"
+then
+        AC_DEFINE([HAVE_PROCFS],[1],[Define if you have a proc fs])
+fi
+
+dnl
 dnl check for GNU gmp
 dnl
@@ -543 +560 @@
 AC_CHECK_HEADERS(gmp.h)
 
+AC_MSG_CHECKING([for ps])
+PS=
+for ff in /usr/ucb /bin /usr/bin; do
+    if test -x "$ff/ps"; then
+       PS="$ff/ps"
+       AC_MSG_RESULT([$PS])
+       break
+    fi
+done
+if test x$PS = x
+then
+        AC_MSG_RESULT([no])
+        AC_MSG_ERROR([No ps in /usr/ucb /bin /usr/bin])
+fi
+AC_DEFINE_UNQUOTED([PSPATH], _("$PS"), [Path to ps])
+
+AC_MSG_CHECKING([how to use ps])
+$PS ax >/dev/null 2>&1
+if test $? -eq 0; then
+   one=`$PS ax | wc -l`
+else
+   one=0
+fi
+$PS -e >/dev/null 2>&1
+if test $? -eq 0; then
+   two=`$PS -e | wc -l`
+else
+   two=0
+fi
+if test $one -ge $two 
+then
+    PSARG="ax"
+else
+    PSARG="-e"
+fi
+AC_DEFINE_UNQUOTED([PSARG], _("$PSARG"), [Argument for ps])
+AC_MSG_RESULT([$PS $PSARG])
 
 dnl *****************************************
@@ -1218 +1272 @@
 )
 
+AC_ARG_ENABLE(process-check,
+        [  --enable-process-check       check processes [[no]]],
+        [
+        if test "x${enable_process_check}" = xyes; then
+                AC_CHECK_LIB([rt], [sched_getparam], sh_lrt=yes, sh_lrt=no)
+                if test x"$sh_lrt" = xyes; then
+                   LIBRT=-lrt
+                else
+                   LIBRT=
+                fi
+                LIBS="$LIBS $LIBRT"
+                AC_DEFINE(SH_USE_PROCESSCHECK, [1], [Define if you want to check processes])
+        fi
+        ]
+)
+
+AC_ARG_ENABLE(port-check,
+        [  --enable-port-check          check ports [[no]]],
+        [
+        if test "x${enable_port_check}" = xyes; then
+                AC_DEFINE(SH_USE_PORTCHECK, [1], [Define if you want to check ports])
+        fi
+        ]
+)
+
 AC_ARG_ENABLE(userfiles,
        [  --enable-userfiles            check for users' config files [[no]]],

trunk/depend.dep

@@ -18 +18 @@
 sh_entropy.o: $(srcsrc)/sh_entropy.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_utils.h $(srcinc)/sh_unix.h $(srcinc)/sh_tiger.h $(srcinc)/sh_calls.h $(srcinc)/sh_static.h 
 sh_forward.o: $(srcsrc)/sh_forward.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_tiger.h $(srcinc)/sh_utils.h $(srcinc)/sh_unix.h $(srcinc)/sh_forward.h $(srcinc)/sh_srp.h $(srcinc)/sh_fifo.h $(srcinc)/sh_tools.h $(srcinc)/sh_entropy.h $(srcinc)/sh_html.h $(srcinc)/sh_mail.h $(srcinc)/sh_socket.h $(srcinc)/sh_static.h $(srcinc)/rijndael-api-fst.h $(srcinc)/sh_readconf.h $(srcinc)/zAVLTree.h $(srcinc)/sh_extern.h 
-sh_modules.o: $(srcsrc)/sh_modules.c Makefile config_xor.h $(srcinc)/sh_modules.h $(srcinc)/sh_utmp.h $(srcinc)/sh_mounts.h $(srcinc)/sh_userfiles.h $(srcinc)/sh_kern.h $(srcinc)/sh_suidchk.h 
+sh_modules.o: $(srcsrc)/sh_modules.c Makefile config_xor.h $(srcinc)/sh_modules.h $(srcinc)/sh_utmp.h $(srcinc)/sh_mounts.h $(srcinc)/sh_userfiles.h $(srcinc)/sh_kern.h $(srcinc)/sh_suidchk.h $(srcinc)/sh_processcheck.h $(srcinc)/sh_portcheck.h 
 sh_utmp.o: $(srcsrc)/sh_utmp.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_utils.h $(srcinc)/sh_error.h $(srcinc)/sh_modules.h $(srcinc)/sh_utmp.h 
 sh_kern.o: $(srcsrc)/sh_kern.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_utils.h $(srcinc)/sh_error.h $(srcinc)/sh_modules.h $(srcinc)/sh_kern.h sh_ks_xor.h $(srcinc)/sh_unix.h $(srcinc)/sh_hash.h 
@@ -61 +61 @@
 kern_head.o: $(srcsrc)/kern_head.c Makefile config.h $(srcinc)/kern_head.h $(srcinc)/kern_head.h 
 sh_async.o: $(srcsrc)/sh_async.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_calls.h $(srcinc)/sh_error.h 
+sh_processcheck.o: $(srcsrc)/sh_processcheck.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_modules.h $(srcinc)/sh_processcheck.h $(srcinc)/sh_utils.h $(srcinc)/sh_error.h $(srcinc)/sh_extern.h $(srcinc)/CuTest.h 
+sh_portcheck.o: $(srcsrc)/sh_portcheck.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_error.h $(srcinc)/sh_mem.h $(srcinc)/sh_utils.h $(srcinc)/sh_modules.h $(srcinc)/CuTest.h 

trunk/depend.sum

@@ -1 @@
-896592903
+1289129628

trunk/docs/Changelog

@@ +1 @@
+2.3.0:
+        * fix concurrency for inserts in oracle db
+        * add acl_(new|old) to database schema
+        * check for selix attributes and/or posix acl
+        * new option UseSelinuxCheck (bool) 
+        * new option UseAclCheck (bool)
+        * regression tests for above
+        * add module to check for open ports
+        * add module to check processes (hidden/fake/missing)
+        * use const char* for argument of module configuration callbacks
+ 
 2.2.6:
         * fix error about non-readable file with no checksum required
@@ -4 +15 @@
         * fix 'make deb' makefile target
         * fix default export severity for server
-        
+                        
 2.2.5 (05-10-2006):
         * fix broken Install.sh, reported by Alexander Kraemer

trunk/docs/README.UPGRADE

@@ +1 @@
+
+from lower to 2.3.x: database scheme has changed slightly
+
+  -- MySQL:
+        ALTER TABLE samhain.log ADD COLUMN acl_old BLOB;
+        ALTER TABLE samhain.log ADD COLUMN acl_new BLOB;
+
+  -- PostgreSQL:
+        ALTER TABLE samhain.log ADD COLUMN acl_old TEXT;
+        ALTER TABLE samhain.log ADD COLUMN acl_new TEXT;
+
+  -- Oracle:
+        ALTER TABLE samhain.log ADD COLUMN acl_old VARCHAR2(4000);
+        ALTER TABLE samhain.log ADD COLUMN acl_new VARCHAR2(4000);
+        DROP TRIGGER trigger_on_log;
+ 
+
 
 since 2.2.0: server-to-server relay is possible

trunk/include/rijndael-api-fst.h

@@ -25 +25 @@
 #define     MODE_CBC              2 /*  Are we ciphering in CBC mode?   */
 #define     MODE_CFB1             3 /*  Are we ciphering in 1-bit CFB mode? */
+#ifndef     TRUE
 #define     TRUE                  1
+#endif
+#ifndef     FALSE
 #define     FALSE                 0
+#endif
 #define     BITSPERBLOCK        128 /* Default number of bits in a cipher block */
 

trunk/include/samhain.h

@@ -316 +316 @@
      } while (0)
 
+#define SH_VALIDATE_GE(a,b) \
+     do { \
+         if ((a) < (b)) safe_fatal(#a " < " #b, FIL__, __LINE__);\
+     } while (0)
+
 #if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
 #define MLOCK(a, b) \

trunk/include/sh_cat.h

@@ -130 +130 @@
  MSG_UT_ROT,      
 
+#endif
+
+#ifdef SH_USE_PROCESSCHECK
+ MSG_PCK_CHECK,  
+ MSG_PCK_OK,     
+ MSG_PCK_HIDDEN, 
+ MSG_PCK_FAKE,   
+ MSG_PCK_MISS,   
+#endif
+
+#ifdef SH_USE_PORTCHECK
+ MSG_PORT_REPORT,
 #endif
 

trunk/include/sh_kern.h

@@ -12 +12 @@
 int sh_kern_null  (void);
 
-int sh_kern_set_activate (char * c);
-int sh_kern_set_severity (char * c);
-int sh_kern_set_timer    (char * c);
-int sh_kern_set_idt      (char * c);
-
-/* FIXME: document these */
-int sh_kern_set_sct_addr (char * c);
-int sh_kern_set_sc_addr  (char * c);
-int sh_kern_set_proc_root (char * c);
-int sh_kern_set_proc_root_lookup (char * c);
-int sh_kern_set_proc_root_iops (char * c);
+int sh_kern_set_activate (const char * c);
+int sh_kern_set_severity (const char * c);
+int sh_kern_set_timer    (const char * c);
+int sh_kern_set_idt      (const char * c);
+int sh_kern_set_sct_addr (const char * c);
+int sh_kern_set_sc_addr  (const char * c);
+int sh_kern_set_proc_root (const char * c);
+int sh_kern_set_proc_root_lookup (const char * c);
+int sh_kern_set_proc_root_iops (const char * c);
 
 extern sh_rconf sh_kern_table[];

trunk/include/sh_modules.h

@@ -7 +7 @@
 {
   char * the_opt;
-  int (*func)(char * opt);
+  int (*func)(const char * opt);
 } sh_rconf;
 

trunk/include/sh_suidchk.h

@@ -12 +12 @@
 int sh_suidchk_free_schedule (void);
 
-int sh_suidchk_set_activate   (char * c);
-int sh_suidchk_set_severity   (char * c);
-int sh_suidchk_set_timer      (char * c);
-int sh_suidchk_set_schedule   (char * c);
-int sh_suidchk_set_exclude    (char * c);
-int sh_suidchk_set_fps        (char * c);
-int sh_suidchk_set_yield      (char * c);
-int sh_suidchk_set_quarantine (char * c);
-int sh_suidchk_set_qmethod    (char * c);
-int sh_suidchk_set_qdelete    (char * c);
+int sh_suidchk_set_activate   (const char * c);
+int sh_suidchk_set_severity   (const char * c);
+int sh_suidchk_set_timer      (const char * c);
+int sh_suidchk_set_schedule   (const char * c);
+int sh_suidchk_set_exclude    (const char * c);
+int sh_suidchk_set_fps        (const char * c);
+int sh_suidchk_set_yield      (const char * c);
+int sh_suidchk_set_quarantine (const char * c);
+int sh_suidchk_set_qmethod    (const char * c);
+int sh_suidchk_set_qdelete    (const char * c);
 
 

trunk/include/sh_unix.h

@@ -139 +139 @@
   char             link_c_mode[11];
   int              linkisok;
+  char           * attr_string;
 } file_type;
+
+extern int sh_unix_check_selinux;
+extern int sh_unix_check_acl;
 
 /* mlock utilities
@@ -157 +161 @@
  */
 int sh_unix_uselocaltime (const char * c);
+
+/* whether to perform selinux/acl checks
+ */ 
+#ifdef USE_XATTR
+int sh_unix_setcheckselinux (const char * c);
+#endif
+#ifdef USE_ACL
+int sh_unix_setcheckacl (const char * c);
+#endif
 
 /* set I/O limit

trunk/include/sh_userfiles.h

@@ -16 +16 @@
 int sh_userfiles_reconf (void);
 
-int sh_userfiles_set_uid (char * str);
-int sh_userfiles_add_file(char *c);
-int sh_userfiles_set_interval(char *c);
-int sh_userfiles_set_active(char *c);
+int sh_userfiles_set_uid (const char * str);
+int sh_userfiles_add_file(const char *c);
+int sh_userfiles_set_interval(const char *c);
+int sh_userfiles_set_active(const char *c);
 int sh_userfiles_check_internal();
 

trunk/include/sh_utils.h

@@ -63 +63 @@
 char * sh_util_strsep (char **str, const char *delim);
 
+/* compactify verbose acl text
+ */
+char * sh_util_acl_compact (char * buf, ssize_t len);
+
 /* set signature type HASH-TIGER/HMAC-TIGER
  */
@@ -84 +88 @@
  */
 int sh_util_hidesetup(const char * c);
+
+/* valif utf-8 string
+ */
+int sh_util_valid_utf8 (const unsigned char * str);
+
+/* filenames are utf8
+ */
+int sh_util_obscure_utf8 (const char * c);
 
 /* exceptions to obscure name check

trunk/include/sh_utmp.h

@@ -12 +12 @@
 int sh_utmp_null (void);
 
-int sh_utmp_set_login_activate (char * c);
-int sh_utmp_set_login_solo     (char * c);
-int sh_utmp_set_login_multi    (char * c);
-int sh_utmp_set_logout_good    (char * c);
-int sh_utmp_set_login_timer    (char * c);
+int sh_utmp_set_login_activate (const char * c);
+int sh_utmp_set_login_solo     (const char * c);
+int sh_utmp_set_login_multi    (const char * c);
+int sh_utmp_set_logout_good    (const char * c);
+int sh_utmp_set_login_timer    (const char * c);
 
 extern sh_rconf sh_utmp_table[];

trunk/rules.deb-light.in

@@ -69 +69 @@
                     sed 's%/etc/init.d/@install_name@ start%:%' > postinst.tmp && \
                     mv postinst.tmp postinst.debhelper
+        [ -f debian/postinst.debhelper ] && \
+                cd debian && \
+                cat postinst.debhelper | \
+                    sed 's%invoke-rc.d @install_name@ start%:%' > postinst.tmp && \
+                    mv postinst.tmp postinst.debhelper
         [ -f debian/prerm.debhelper ] && \
                 cd debian && \
                 cat prerm.debhelper | \
                     sed 's%/etc/init.d/@install_name@ stop%/etc/init.d/@install_name@ stop || echo service @install_name@ already stopped%' > prerm.tmp && \
+                    mv prerm.tmp prerm.debhelper
+        [ -f debian/prerm.debhelper ] && \
+                cd debian && \
+                cat prerm.debhelper | \
+                    sed 's%invoke-rc.d @install_name@ stop%invoke-rc.d @install_name@ stop || echo service @install_name@ already stopped%' > prerm.tmp && \
                     mv prerm.tmp prerm.debhelper
         # dh_installmanpages

trunk/rules.deb.in

@@ -70 +70 @@
         dh_installdebconf       
         dh_installdocs 
-        [ -f debian/tmp/usr/share/doc/@install_name@/MANUAL-2_2.html.tar ] && \
+        [ -f debian/tmp/usr/share/doc/@install_name@/MANUAL-2_3.html.tar ] && \
                 cd debian/tmp/usr/share/doc/@install_name@ && \
-                tar xf MANUAL-2_2.html.tar && mv MANUAL-2_2 manual.html && \
-                rm -f MANUAL-2_2.html.tar
+                tar xf MANUAL-2_3.html.tar && mv MANUAL-2_3 manual.html && \
+                rm -f MANUAL-2_3.html.tar
         dh_installexamples @top_srcdir@/scripts/example_pager.pl \
                 @top_srcdir@/scripts/example_sms.pl \

trunk/samhain.spec.in

@@ -179 +179 @@
 %dir @mylogdir@
 %doc docs/BUGS COPYING docs/Changelog docs/TODO
-%doc LICENSE docs/FAQ.html docs/HOWTO* docs/MANUAL-2_2.* docs/README*
+%doc LICENSE docs/FAQ.html docs/HOWTO* docs/MANUAL-2_3.* docs/README*
 @mydataroot@
 %if "%{withstg_prg}" == "xsamhain_stealth"

trunk/scripts/redhat_i386.client.spec.in

@@ -136 +136 @@
 %dir /var/log
 #%doc docs/BUGS COPYING docs/Changelog docs/TODO
-#%doc LICENSE docs/HOWTO* docs/MANUAL-2_2.* docs/README*
+#%doc LICENSE docs/HOWTO* docs/MANUAL-2_3.* docs/README*
 /etc
 /usr/local/sbin/samhain

trunk/scripts/samhain.ebuild.in

@@ -69 +69 @@
         dodoc docs/BUGS COPYING docs/Changelog LICENSE docs/README \
               docs/README.UPGRADE docs/sh_mounts.txt docs/sh_userfiles.txt \
-              docs/MANUAL-2_0.ps docs/MANUAL-2_0.html.tar
+              docs/MANUAL-2_3.ps docs/MANUAL-2_3.html.tar
 
         dohtml docs/HOWTO-client+server.html docs/HOWTO-samhain+GnuPG.html \

trunk/scripts/samhain.spec.in

@@ -122 +122 @@
 %dir %{_localstatedir}/log
 %doc docs/BUGS COPYING docs/Changelog docs/TODO
-%doc LICENSE docs/HOWTO* docs/MANUAL-2_2.* docs/README*
+%doc LICENSE docs/HOWTO* docs/MANUAL-2_3.* docs/README*
 %{_localstatedir}/lib/%{name}
 %{_sbindir}/%{name}

trunk/sql_init/samhain.mysql.init

@@ -86 +86 @@
         iowner_new    BIGINT,
         igroup_old    BIGINT,
-        igroup_new    BIGINT
+        igroup_new    BIGINT,
         
 
+        acl_old       BLOB,
+        acl_new       BLOB
                  
         );

trunk/sql_init/samhain.oracle.init

@@ -73 +73 @@
         iowner_new    NUMBER(20),
         igroup_old    NUMBER(20),
-        igroup_new    NUMBER(20)
+        igroup_new    NUMBER(20),
+        acl_old       VARCHAR2(4000),
+        acl_new       VARCHAR2(4000)
         );
-
-CREATE OR REPLACE TRIGGER trigger_on_log
-before insert on log
-for each row
-declare
-log_index integer;
-begin
-select log_log_index_seq.NEXTVAL into :new.log_index from dual;
-end trigger_on_log;
-.
-run;
 
 CREATE UNIQUE INDEX log_log_index_key on log (log_index);

trunk/sql_init/samhain.postgres.init

@@ -80 +80 @@
         iowner_new    BIGINT,
         igroup_old    BIGINT,
-        igroup_new    BIGINT
+        igroup_new    BIGINT,
                  
+        acl_old       TEXT,
+        acl_new       TEXT
         );
 

trunk/src/cutest_sh_utils.c

@@ -7 +7 @@
 #include "sh_utils.h"
 
+void Test_sh_util_acl_compact (CuTest *tc) {
+  char * ret = 0;
+  char   inp1[] = "user::r--\nuser:lisa:rwx\t\t#effective: r--\ngroup::r--\ngroup:toolies:rw-  #effective: r--\nmask::r--\nother::r--\n";
+  char   inp2[] = "use\n\nuser:lisa:rwx\t\t#effective: r--\ngroup::r--\ngroup:toolies:rw-  #effective: r--\nmask::r--\nother::r--\n";
+  char   inp3[] = "user:\177\145\177\122:r--\nuser:lisa:rwx\t\t#effective: r--\ngroup::r--\ngroup:toolies:rw-  #effective: r--\nmask::r--\nother::r--\n";
+  
+  ret = sh_util_acl_compact (inp1, strlen(inp1));
+  CuAssertPtrNotNull(tc, ret);
+  CuAssertStrEquals(tc, "u::r--,u:lisa:rwx,g::r--,g:toolies:rw-,m::r--,o::r--",
+                    ret); 
+
+  ret = sh_util_acl_compact (inp2, strlen(inp2));
+  CuAssertPtrNotNull(tc, ret);
+  CuAssertStrEquals(tc, "use,u:lisa:rwx,g::r--,g:toolies:rw-,m::r--,o::r--",
+                    ret); 
+
+  ret = sh_util_acl_compact (inp3, strlen(inp3));
+  CuAssertPtrNotNull(tc, ret);
+  CuAssertStrEquals(tc, "u:eR:r--,u:lisa:rwx,g::r--,g:toolies:rw-,m::r--,o::r--",
+                    ret); 
+
+  return;
+}
+
 void Test_sh_util_strdup_ok (CuTest *tc) {
   char * ret = 0;
@@ -108 +132 @@
 
   return;
+}
+
+void Test_sh_util_utf8_ok (CuTest *tc) {
+  int ret = 0;
+#if defined(SH_WITH_CLIENT) || defined(SH_STANDALONE)
+  unsigned char seq[16];
+  unsigned char input[16] = "foobar";
+
+  seq[0] = 0x00;
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_TRUE);
+
+  seq[0] = 0xd7; seq[1] = 0x90; seq[2] = 0x00;
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_TRUE);
+
+  seq[0] = 0xed; seq[1] = 0x9f; seq[2] = 0xbf; seq[3] = 0x00;
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_TRUE);
+
+  seq[0] = 0xee; seq[1] = 0x80; seq[2] = 0x80; seq[3] = 0x00;
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_TRUE);
+
+  seq[0] = 0xef; seq[1] = 0xbf; seq[2] = 0xbd; seq[3] = 0x00;
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_TRUE);
+
+  seq[0] = 0xf4; seq[1] = 0x8f; seq[2] = 0xbf; seq[3] = 0xbf; seq[4] = 0x00;
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_TRUE);
+
+  seq[0] = 0xf4; seq[1] = 0x90; seq[2] = 0x80; seq[3] = 0x80; seq[4] = 0x00;
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_TRUE);
+
+  seq[0] = 0xd7; seq[1] = 0x90; seq[2] = 0xd7; seq[3] = 0x90; seq[4] = 0x00;
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_TRUE);
+
+  /* cont. char */
+
+  seq[0] = 0x80; seq[1] = 0x00; 
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+  seq[0] = 0xbf; seq[1] = 0x00; 
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+  /* overlong */
+
+  seq[0] = 0xc0; seq[1] = 0xaf; seq[2] = 0x00;  
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+  seq[0] = 0xe0; seq[1] = 0x8f; seq[2] = 0xaf;  seq[3] = 0x00;  
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+  seq[0] = 0xf0; seq[1] = 0x80; seq[2] = 0x80;  seq[3] = 0xaf; seq[4] = 0x00;  
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+  /* overlong */
+
+  seq[0] = 0xc1; seq[1] = 0xbf; seq[2] = 0x00;  
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+  seq[0] = 0xe0; seq[1] = 0x9f; seq[2] = 0xbf;  seq[3] = 0x00;  
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+  seq[0] = 0xf0; seq[1] = 0x8f; seq[2] = 0xbf;  seq[3] = 0xbf; seq[4] = 0x00;  
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+  /* overlong */
+
+  seq[0] = 0xc0; seq[1] = 0x80; seq[2] = 0x00;  
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+  seq[0] = 0xe0; seq[1] = 0x80; seq[2] = 0x80;  seq[3] = 0x00;  
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+  seq[0] = 0xf0; seq[1] = 0x80; seq[2] = 0x80;  seq[3] = 0x80; seq[4] = 0x00;  
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+  /* cont missing */
+
+  seq[0] = 0xd7; seq[1] = 0x20; seq[3] = 0x00;
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+  seq[0] = 0xee; seq[1] = 0x80; seq[2] = 0x20; seq[3] = 0x00;
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+  seq[0] = 0xf4; seq[1] = 0x8f; seq[2] = 0xbf; seq[3] = 0x20; seq[4] = 0x00;
+  ret = sh_util_valid_utf8(seq);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+
+  ret = sh_util_obscure_ok ("0x01,0x02,0x03");
+  CuAssertIntEquals(tc, ret, 0);
+
+  ret = sh_util_valid_utf8 (input);
+  CuAssertIntEquals(tc, ret, S_TRUE);
+
+  input[0] = '\t';
+  ret = sh_util_valid_utf8 (input);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+  input[0] = 0x01;
+  ret = sh_util_valid_utf8 (input);
+  CuAssertIntEquals(tc, ret, S_TRUE);
+
+  input[0] = 0x02;
+  ret = sh_util_valid_utf8 (input);
+  CuAssertIntEquals(tc, ret, S_TRUE);
+
+  input[0] = 0x03;
+  ret = sh_util_valid_utf8 (input);
+  CuAssertIntEquals(tc, ret, S_TRUE);
+
+  input[0] = 0x04;
+  ret = sh_util_valid_utf8 (input);
+  CuAssertIntEquals(tc, ret, S_FALSE);
+
+
+#else
+  CuAssertIntEquals(tc, ret, 0);
+#endif
 }
 

trunk/src/sh_cat.c

@@ -122 +122 @@
   { MSG_UT_ROT,      SH_ERR_WARN,    RUN,   N_("msg=\"Logfile size decreased\" path=\"%s\"")},
 
+#endif
+
+#ifdef SH_USE_PROCESSCHECK
+  { MSG_PCK_CHECK,   SH_ERR_NOTICE,  RUN,   N_("msg=\"Checking processes in pid interval [%ld,%ld]\"")},
+  { MSG_PCK_OK,      SH_ERR_ALL,     RUN,   N_("msg=\"PID %ld found with tests %s\"")},
+  { MSG_PCK_HIDDEN,  SH_ERR_SEVERE,  EVENT, N_("msg=\"POLICY [Process] Hidden pid: %ld tests: %s\"")},
+  { MSG_PCK_FAKE,    SH_ERR_SEVERE,  EVENT, N_("msg=\"POLICY [Process] Fake pid: %ld tests: %s\"")},
+  { MSG_PCK_MISS,    SH_ERR_SEVERE,  EVENT, N_("msg=\"POLICY [Process] Missing: %s\"")},
+#endif
+
+#ifdef SH_USE_PORTCHECK
+  { MSG_PORT_REPORT, SH_ERR_SEVERE,  EVENT, N_("msg=\"%s\"")},
 #endif
 
@@ -181 +193 @@
   { MSG_TCP_MISMATCH,SH_ERR_ERR,     TCP,   N_("msg=\"Protocol mismatch\"")},
   { MSG_TCP_MISENC,  SH_ERR_ERR,     TCP,   N_("msg=\"Encryption mismatch in %s: server: %s client: %s\"")},
-  { MSG_TCP_NONAME,  SH_ERR_ERR,     TCP,   N_("msg=\"No server name available\"")},
+  { MSG_TCP_NONAME,  SH_ERR_ERR,     TCP,   N_("msg=\"No server name known\"")},
   { MSG_TCP_UNEXP,   SH_ERR_ERR,     TCP,   N_("msg=\"Unexpected reply\"")},
   { MSG_TCP_EFIL,    SH_ERR_ERR,     TCP,   N_("msg=\"Could not open temporary file\"")},
@@ -424 +436 @@
   { MSG_UT_ROT,      SH_ERR_WARN,    RUN,   N_("msg=<Logfile size decreased>, path=<%s>")},
 
+#endif
+
+#ifdef SH_USE_PROCESSCHECK
+  { MSG_PCK_CHECK,   SH_ERR_NOTICE,  RUN,   N_("msg=<Checking processes in pid interval [%ld,%ld]>")},
+  { MSG_PCK_OK,      SH_ERR_ALL,     RUN,   N_("msg=<PID %ld found with tests %s>")},
+  { MSG_PCK_HIDDEN,  SH_ERR_SEVERE,  EVENT, N_("msg=<POLICY [Process] Hidden pid: %ld tests: %s>")},
+  { MSG_PCK_FAKE,    SH_ERR_SEVERE,  EVENT, N_("msg=<POLICY [Process] Fake pid: %ld tests: %s>")},
+  { MSG_PCK_MISS,    SH_ERR_SEVERE,  EVENT, N_("msg=<POLICY [Process] Missing: %s>")},
+#endif
+
+#ifdef SH_USE_PORTCHECK
+  { MSG_PORT_REPORT, SH_ERR_SEVERE,  EVENT, N_("msg=<%s>")},
 #endif
 

trunk/src/sh_database.c

@@ -109 +109 @@
   char            link_old[1024];
   char            link_new[1024];
+  char            acl_old[1024];
+  char            acl_new[1024];
 
   long            long_data[20];
@@ -204 +206 @@
   { NULL, N_("attr_old"),     0,  71,   16, 0, offsetof(struct dbins_, attr_old)},
   { NULL, N_("attr_new"),     0,  72,   16, 0, offsetof(struct dbins_, attr_new)},
+  { NULL, N_("acl_old"),      0,  73, 1024, 0, offsetof(struct dbins_, acl_old)},
+  { NULL, N_("acl_new"),      0,  74, 1024, 0, offsetof(struct dbins_, acl_new)},
 
   { NULL, NULL,      0,  0, 0, 0, 0 }
@@ -497 +501 @@
 static    OCIError  * o_error = NULL;
 static    OCIStmt   * o_statement;
+static    OCIBind   * o_bind = (OCIBind *) 0;
 static    text        o_errormsg[512];
 static    sb4         o_errorcode;
@@ -666 +671 @@
  oracle_connected:
 
-  /* 
-   * Insert
-   */
+  /* Get row index
+   */
+  sl_strlcpy (row_query, _("SELECT log_log_index_seq.NEXTVAL FROM dual"), 128);
+
 #ifdef DB_DEBUG
   sh_error_handle(SH_ERR_NOTICE, FIL__, __LINE__, 0, MSG_E_SUBGEN,
-                  query, 
+                  row_query, 
                   _("sh_database_query"));
 #endif
 
   if (OCIStmtPrepare(o_statement, o_error, 
-                     (OraText*) query, sl_strlen(query), 
+                     (OraText*) row_query, sl_strlen(row_query), 
                      OCI_NTV_SYNTAX, OCI_DEFAULT))
-    {
-      OCIErrorGet(o_error, 1, NULL, 
-                  &o_errorcode, o_errormsg, sizeof(o_errormsg), 
-                  OCI_HTYPE_ERROR);
-      sh_stripnl (o_errormsg);
-      sh_error_handle((-1), FIL__, __LINE__, (long) o_errorcode, MSG_E_SUBGEN,
-                      o_errormsg, 
-                      _("sh_database_query"));
-      if (retry == 0 && 
-          (3114 == o_errorcode || 0 == strncmp(o_errormsg, _("ORA-03114"), 9))) 
-        { 
-          ++retry; sh_database_reset(); goto oracle_doconnect; 
-        }
-      goto err_out;
-    }
- 
-   if (OCIStmtExecute(o_servicecontext, 
-                      o_statement, o_error, 1,  0, 
-                      NULL, NULL, OCI_COMMIT_ON_SUCCESS))
     {
       OCIErrorGet(o_error, 1, NULL, 
@@ -713 +700 @@
     }
 
-#ifdef DB_DEBUG
-  sh_error_handle(SH_ERR_NOTICE, FIL__, __LINE__, 0, MSG_E_SUBGEN,
-                  _("No error on insert"), 
-                  _("sh_database_query"));
-#endif
-
-  /* Get row index
-   */
-  sl_strlcpy (row_query, _("SELECT MAX(log_index) FROM "), 128);
-  sl_strlcat (row_query, db_table, 128);
-
-#ifdef DB_DEBUG
-  sh_error_handle(SH_ERR_NOTICE, FIL__, __LINE__, 0, MSG_E_SUBGEN,
-                  row_query, 
-                  _("sh_database_query"));
-#endif
-
-  if (OCIStmtPrepare(o_statement, o_error, 
-                     (OraText*) row_query, sl_strlen(row_query), 
-                     OCI_NTV_SYNTAX, OCI_DEFAULT))
+  if (OCIStmtExecute(o_servicecontext, o_statement, o_error, 
+                     0, 0, NULL, NULL, OCI_DEFAULT))
     {
       OCIErrorGet(o_error, 1, NULL, 
@@ -749 +718 @@
     }
 
-  if (OCIStmtExecute(o_servicecontext, o_statement, o_error, 
-                     0, 0, NULL, NULL, OCI_DEFAULT))
+  if (OCIDefineByPos (o_statement, &o_define, o_error, 1, 
+                      &result, sizeof(result), 
+                      SQLT_INT, 0, 0, 0, OCI_DEFAULT))
     {
       OCIErrorGet(o_error, 1, NULL, 
@@ -766 +736 @@
       goto err_out;
     }
-
-  if (OCIDefineByPos (o_statement, &o_define, o_error, 1, 
-                      &result, sizeof(result), 
-                      SQLT_INT, 0, 0, 0, OCI_DEFAULT))
+  if (OCIStmtFetch (o_statement, o_error, 1, OCI_FETCH_NEXT, OCI_DEFAULT))
     {
       OCIErrorGet(o_error, 1, NULL, 
@@ -785 +752 @@
       goto err_out;
     }
-  if (OCIStmtFetch (o_statement, o_error, 1, OCI_FETCH_NEXT, OCI_DEFAULT))
+  
+#ifdef DB_DEBUG
+  sl_snprintf(row_query, 127, _("Returned value: %d"), result); 
+  sh_error_handle(SH_ERR_NOTICE, FIL__, __LINE__, 0, MSG_E_SUBGEN,
+                  row_query, 
+                  _("sh_database_query"));
+#endif
+
+  *id = result;
+
+  /* do the insert
+   */
+#ifdef DB_DEBUG
+  sh_error_handle(SH_ERR_NOTICE, FIL__, __LINE__, 0, MSG_E_SUBGEN,
+                  query, 
+                  _("sh_database_query"));
+#endif
+
+  if (OCIStmtPrepare(o_statement, o_error, 
+                     (OraText*) query, sl_strlen(query), 
+                     OCI_NTV_SYNTAX, OCI_DEFAULT))
+    {
+      OCIErrorGet(o_error, 1, NULL, 
+                  &o_errorcode, o_errormsg, sizeof(o_errormsg), 
+                  OCI_HTYPE_ERROR);
+      sh_stripnl (o_errormsg);
+      sh_error_handle((-1), FIL__, __LINE__, (long) o_errorcode, MSG_E_SUBGEN,
+                      o_errormsg, 
+                      _("sh_database_query"));
+      if (retry == 0 && 
+          (3114 == o_errorcode || 0 == strncmp(o_errormsg, _("ORA-03114"), 9))) 
+        { 
+          ++retry; sh_database_reset(); goto oracle_doconnect; 
+        }
+      goto err_out;
+    }
+ 
+  if (OCIBindByPos(o_statement, &o_bind, o_error, 1,
+                   (dvoid *) &result, (sword) sizeof(result), SQLT_INT, 
+                   (dvoid *) 0, (ub2 *) 0, (ub2 *) 0, (ub4) 0, (ub4 *) 0, OCI_DEFAULT))
     {
       OCIErrorGet(o_error, 1, NULL, 
@@ -801 +807 @@
       goto err_out;
     }
-  
+
+   if (OCIStmtExecute(o_servicecontext, 
+                      o_statement, o_error, 1,  0, 
+                      NULL, NULL, OCI_COMMIT_ON_SUCCESS))
+    {
+      OCIErrorGet(o_error, 1, NULL, 
+                  &o_errorcode, o_errormsg, sizeof(o_errormsg), 
+                  OCI_HTYPE_ERROR);
+      sh_stripnl (o_errormsg);
+      sh_error_handle((-1), FIL__, __LINE__, (long) o_errorcode, MSG_E_SUBGEN,
+                      o_errormsg, 
+                      _("sh_database_query"));
+      if (retry == 0 && 
+          (3114 == o_errorcode || 0 == strncmp(o_errormsg, _("ORA-03114"), 9))) 
+          { 
+            ++retry; sh_database_reset(); goto oracle_doconnect; 
+          }
+      goto err_out;
+    }
+
 #ifdef DB_DEBUG
-  sl_snprintf(row_query, 127, _("Returned value: %d"), result); 
   sh_error_handle(SH_ERR_NOTICE, FIL__, __LINE__, 0, MSG_E_SUBGEN,
-                  row_query, 
+                  _("No error on insert"), 
                   _("sh_database_query"));
 #endif
-
-  *id = result;
 
   if (sh_persistent_dbconn == S_FALSE)
@@ -1254 +1276 @@
   (void)
   sl_snprintf (values, SH_QUERY_MAX,  
-               _("(%s,%c%s%c,to_date(%c%s%c,'YYYY-MM-DD HH24:MI:SS'),%c%s%c,%c%s%c"),
+               _("(:1,%s,%c%s%c,to_date(%c%s%c,'YYYY-MM-DD HH24:MI:SS'),%c%s%c,%c%s%c"),
                id >= 0 ? num : _("NULL"),
                '\'', db_entry->host,'\'', 
@@ -1263 +1285 @@
                '\'');
   (void) sl_snprintf (columns, 1023, 
-                      _("(log_ref,log_host,log_time,log_sev,log_msg"));
+                      _("(log_index,log_ref,log_host,log_time,log_sev,log_msg"));
 #elif defined(WITH_POSTGRES)
   /* Prepare query for PQexecParams
@@ -1495 +1517 @@
 }
 
-static int is_escaped(unsigned char * p) {
+static int is_escaped(char * p_in) {
 
   int    escp = 0;
   int    retv = S_TRUE;
+  unsigned char * p = (unsigned char *) p_in;
 
   while (*p != '\0') 

trunk/src/sh_files.c

@@ -1563 +1563 @@
    */
   sl_strlcpy (theFile.fullpath, iname, PATH_MAX);
+  theFile.attr_string = NULL;
 
   (void) relativeName;
@@ -1571 +1572 @@
   if ((sig_termfast == 1) || (sig_terminate == 1)) 
     {
+      if (theFile.attr_string) SH_FREE(theFile.attr_string);
       SL_RETURN((0), _("sh_files_checkdir"));
     }
@@ -1577 +1579 @@
     {
       SH_FREE(tmpname); 
+      if (theFile.attr_string) SH_FREE(theFile.attr_string);
       SL_RETURN((-1), _("sh_files_checkdir"));
     }
@@ -1586 +1589 @@
                        tmpname);
       SH_FREE(tmpname); 
+      if (theFile.attr_string) SH_FREE(theFile.attr_string);
       SL_RETURN((-1), _("sh_files_checkdir"));
     }
@@ -1607 +1611 @@
       SH_FREE(tmpname); 
 
+      if (theFile.attr_string) SH_FREE(theFile.attr_string);
       SL_RETURN((-1), _("sh_files_checkdir"));
     }
@@ -1660 +1665 @@
     if (sig_termfast == 1) 
       {
+        if (theFile.attr_string) SH_FREE(theFile.attr_string);
         SL_RETURN((0), _("sh_files_checkdir"));
       }
@@ -1850 +1856 @@
     if ((sig_termfast == 1) || (sig_terminate == 1)) 
       {
+        if (theFile.attr_string) SH_FREE(theFile.attr_string);
         SL_RETURN((0), _("sh_files_checkdir"));
       }
@@ -1896 +1903 @@
 #endif
 
+  if (theFile.attr_string) SH_FREE(theFile.attr_string);
   SH_FREE(tmpname);
 
@@ -1986 +1994 @@
    */
   sl_strlcpy (theFile.fullpath, fullpath, PATH_MAX);
-  theFile.check_mask = sh_files_maskof(class);
-  theFile.reported   = (*reported);
+  theFile.check_mask  = sh_files_maskof(class);
+  theFile.reported    = (*reported);
+  theFile.attr_string = NULL;
 
   TPT(( 0, FIL__, __LINE__, _("msg=<checking file: %s>\n"),  fullpath));
@@ -2001 +2010 @@
             fullpath, status));
       if (class == SH_LEVEL_ALLIGNORE && sh.flag.checkSum != SH_CHECK_INIT)
-          sh_hash_set_visited_true (fullpath);
+        sh_hash_set_visited_true (fullpath);
+      if (theFile.attr_string) 
+        SH_FREE(theFile.attr_string);
       SL_RETURN(SH_FILE_UNKNOWN, _("sh_files_filecheck"));
     }
@@ -2080 +2091 @@
     }
 #else
-      (void) rsrcflag; /* avoid compiler warning */
+  (void) rsrcflag; /* avoid compiler warning */
 #endif
 
  ret_point:
+
+  if (theFile.attr_string) SH_FREE(theFile.attr_string);
 
   switch (theFile.c_mode[0]) 

trunk/src/sh_hash.c

@@ -285 +285 @@
   char           * fullpath;
   char           * linkpath;
+  char           * attr_string;
   int              visited;
   int              reported;
@@ -337 +338 @@
 #endif
 
+#define REC_FLAGS_ATTR (1<<8)
+#define REC_FLAGS_MASK 0xFF00
 
 /**************************************************************
@@ -389 +392 @@
   theFile->hardlinks = p->theFile.hardlinks;
 
+  if (p->attr_string)
+    theFile->attr_string = sh_util_strdup(p->attr_string);
+  else
+    theFile->attr_string = NULL;
+
   SL_RETURN((theFile), _("sh_hash_create_ft"));
 }
@@ -440 +448 @@
   SH_FREE(tmp);
   SH_FREE(str);
+  if (theFile->attr_string)
+    SH_FREE(theFile->attr_string);
   SH_FREE(theFile);
   return 0;
@@ -517 +527 @@
                                    MSG_FI_MISS2, tmp, str);
                   SH_FREE(str);
+                  if (theFile->attr_string)
+                    SH_FREE(theFile->attr_string);
                   SH_FREE(theFile);
 
@@ -532 +544 @@
               theFile = sh_hash_create_ft (p, fileHash);
               sh_hash_pushdata (theFile, fileHash);
+              if (theFile->attr_string)
+                SH_FREE(theFile->attr_string);
               SH_FREE(theFile);
             }
@@ -554 +568 @@
                   p->linkpath = NULL;
                 }
+              if (p->attr_string)
+                {
+                  SH_FREE(p->attr_string);
+                  p->attr_string = NULL;
+                }
               SH_FREE(p);
               p = NULL;
@@ -576 +595 @@
                            MSG_FI_MISS2, tmp, str);
           SH_FREE(str);
+          if (theFile->attr_string)
+            SH_FREE(theFile->attr_string);
           SH_FREE(theFile);
 
@@ -635 +656 @@
       SH_FREE(p->linkpath);
       p->linkpath = NULL;
+    }
+  if (p->attr_string)
+    {
+      SH_FREE(p->attr_string);
+      p->attr_string = NULL;
     }
   SH_FREE(p);
@@ -696 +722 @@
               if(p->linkpath)
                 SH_FREE(p->linkpath);
+              if(p->attr_string)
+                SH_FREE(p->attr_string);
               memcpy(p, s, sizeof(sh_file_t));
               p->next = q;
@@ -868 +896 @@
   char * fullpath;
   char * linkpath;
+  char * attr_string = NULL;
   char * tmp;
 
@@ -908 +937 @@
 #endif
 
-  if (ft.mark != REC_MAGIC)
+  if ((ft.mark & ~REC_FLAGS_MASK) != REC_MAGIC)
     {
       SH_FREE(p);
@@ -967 +996 @@
     linkpath[len-2] = '\0';
 
+  /* Read next record -- Part Four -- attr_string
+   */
+  if ((ft.mark & REC_FLAGS_ATTR) != 0)
+    {
+      i =  sh_hash_getline (sh_fin_fd, line, size);
+      if (i < 0 ) 
+        {
+          SH_FREE(line);
+          SH_FREE(fullpath);
+          SH_FREE(linkpath);
+          SH_FREE(p);
+          dlog(1, FIL__, __LINE__, 
+               _("There is a corrupt record in the file signature database: %s\nThe attribute string is missing.\n"),
+               (NULL == file_path('D', 'R'))? _("(null)"):file_path('D', 'R'));
+          sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_P_NODATA,
+                           ( (NULL == file_path('D', 'R')) ? _("(null)") :
+                             file_path('D', 'R'))
+                           );
+          aud_exit (FIL__, __LINE__,EXIT_FAILURE);
+        }
+
+      tmp = unquote_string (line);
+
+      len = sl_strlen(tmp)+1;
+      attr_string = SH_ALLOC(len);
+      (void) sl_strlcpy (attr_string, tmp, len);
+      if (tmp)
+        SH_FREE(tmp);
+      if (attr_string[len-2] == '\n')
+        attr_string[len-2] = '\0';
+    }
+
   /* Read next record -- Part Four -- Decode
    */
@@ -986 +1047 @@
       sh_do_decode(linkpath, sl_strlen(linkpath));
     }
+  if ((ft.mark & REC_FLAGS_ATTR) != 0)
+    {  
+      sh_do_decode(attr_string, sl_strlen(attr_string));
+    }
 #endif
 
@@ -995 +1060 @@
   p->fullpath  = fullpath;
   p->linkpath  = linkpath;
+
+  p->attr_string = attr_string;
 
   /* set to an invalid value 
@@ -1313 +1380 @@
   char *  fullpath = NULL;
   char *  linkpath = NULL;
+  char *  attr_string = NULL;
 
   char * line = NULL;
@@ -1518 +1586 @@
     }
 
+  if (buf != NULL && buf->attr_string != NULL) 
+    {
+      old_len = sl_strlen(buf->attr_string);
+#if defined(SH_STEALTH)
+      sh_do_encode(buf->attr_string, old_len);
+#endif
+      tmp = quote_string(buf->attr_string);
+      if (tmp)
+        {
+          attr_string = tmp;
+          tmp = NULL;
+        }
+#if defined(SH_STEALTH)
+      sh_do_decode(buf->attr_string, old_len);
+#endif
+    }
+
+
   if (buf != NULL) {
     p.mark = REC_MAGIC;
+    if (attr_string)
+      p.mark |= REC_FLAGS_ATTR;
     sl_strlcpy(p.c_mode,   buf->c_mode,   11);
     sl_strlcpy(p.c_group,  buf->c_group,  GROUP_MAX+1);
@@ -1640 +1728 @@
       sl_write_line (pushdata_fd, fullpath,    sl_strlen(fullpath));
       sl_write_line (pushdata_fd, linkpath,    sl_strlen(linkpath));
+      if (attr_string)
+        sl_write_line (pushdata_fd, attr_string,    sl_strlen(attr_string));
     } else {
       fwrite (&p, sizeof(sh_filestore_t), 1, stdout);
       printf ("%s\n", fullpath);
       printf ("%s\n", linkpath);
+      if (attr_string)
+        printf ("%s\n", attr_string);
     }
 
@@ -1656 +1748 @@
   SH_FREE(fullpath);
   SH_FREE(linkpath);
+  if (attr_string)
+    SH_FREE(attr_string);
 
   SL_RET0(_("sh_hash_pushdata"));
@@ -1689 +1783 @@
           f = sh_hash_create_ft (p, fileHash);
           sh_hash_pushdata (f, fileHash);
+          if (f->attr_string)
+            SH_FREE(f->attr_string);
           SH_FREE(f);
         }
@@ -1757 +1853 @@
   tmpFile->mtime = p->theFile.mtime;
   tmpFile->ctime = p->theFile.ctime;
+
+  tmpFile->attr_string = NULL;
   return 0;
 }
@@ -1857 +1955 @@
   int         i = 0;
   char      * p;
+
+  tmpFile.attr_string = NULL;
 
   sl_strlcpy(tmpFile.fullpath, key, PATH_MAX);
@@ -1979 +2079 @@
   char * fullpath;
   char * linkpath;
+  char * attr_string = NULL;
 
   SL_ENTER(_("sh_hash_push_int"));
@@ -1985 +2086 @@
 
   p.mark = REC_MAGIC;
+  if (buf->attr_string)
+    p.mark |= REC_FLAGS_ATTR;
   sl_strlcpy(p.c_mode,   buf->c_mode,   11);
   sl_strlcpy(p.c_group,  buf->c_group,  GROUP_MAX+1);
@@ -2015 +2118 @@
   fp->modi_mask = 0L;
 
+  if (buf->attr_string)
+    attr_string = sh_util_strdup(buf->attr_string);
+  fp->attr_string = attr_string;
+
   len = sl_strlen(buf->fullpath);
   if (len <= MAX_PATH_STORE) 
@@ -2235 +2342 @@
         } 
     }
+
+  if (theFile->attr_string)
+    {
+      tmp_lnk     = sh_util_safe_name(theFile->attr_string);
+      if (tmp_lnk)
+        {
+          if (is_new)
+            sl_snprintf(tmp, SH_BUFSIZE, _("acl_new=\"%s\" "), tmp_lnk);
+          else
+            sl_snprintf(tmp, SH_BUFSIZE, _("acl_old=\"%s\" "), tmp_lnk);
+          SH_FREE(tmp_lnk);
+          sl_strlcat(msg, tmp, SH_BUFSIZE);
+        } 
+    }
+
   
   SH_FREE(tmp);
@@ -2387 +2509 @@
     }
   
+  if (theFile->attr_string)
+    {
+      tmp_lnk     = sh_util_safe_name(theFile->attr_string);
+      if (tmp_lnk)
+        {
+          if (is_new)
+            sl_snprintf(tmp, SH_BUFSIZE, _(", acl_new=<%s> "), tmp_lnk);
+          else
+            sl_snprintf(tmp, SH_BUFSIZE, _(", acl_old=<%s> "), tmp_lnk);
+          SH_FREE(tmp_lnk);
+          sl_strlcat(msg, tmp, SH_BUFSIZE);
+        } 
+    }
+
   SH_FREE(tmp);
   return (msg);
@@ -2605 +2741 @@
 
   if ( (  (theFile->mode != p->theFile.mode)
+#if defined(USE_ACL) || defined(USE_XATTR)
+          || ( (sh_unix_check_selinux|sh_unix_check_acl) &&
+               ( 
+                (theFile->attr_string == NULL && p->attr_string != NULL) ||
+                (theFile->attr_string != NULL && p->attr_string == NULL) ||
+                (theFile->attr_string != NULL && 0 != strcmp(theFile->attr_string, p->attr_string))
+                )
+               )
+#endif
 #if defined(__linux__) || defined(HAVE_STAT_FLAGS)
           || (theFile->attributes != p->theFile.attributes)
 #endif
-        )
+          )
        && (theFile->check_mask & MODI_MOD) != 0)
     {
@@ -2652 +2797 @@
     } 
   
-  if ( theFile->atime != (time_t) p->theFile.atime &&
-       (theFile->check_mask & MODI_ATM) != 0)
+  if ( (theFile->check_mask & MODI_ATM) != 0 &&
+       theFile->atime != (time_t) p->theFile.atime)
     {
       modi_mask |= MODI_ATM;
@@ -2705 +2850 @@
       if (   ((modi_mask & MODI_MOD) != 0)
 #if defined(HAVE_LIBPRELUDE) && defined(HAVE_LIBPRELUDE_9)
-          || ((modi_mask & MODI_USR) != 0)
-          || ((modi_mask & MODI_GRP) != 0)
+             || ((modi_mask & MODI_USR) != 0)
+             || ((modi_mask & MODI_GRP) != 0)
 #endif
              )
@@ -2729 +2874 @@
           sl_snprintf(tmp, SH_BUFSIZE, 
                       _("mode_old=\"%s\" mode_new=\"%s\" imode_old=\"%ld\" imode_new=\"%ld\" "),
-#else
-                      sl_snprintf(tmp, SH_BUFSIZE, _("mode_old=<%s>, mode_new=<%s>, "),
-#endif
-                      p->theFile.c_mode, theFile->c_mode
+                      p->theFile.c_mode, theFile->c_mode,
+                      (long) p->theFile.mode, (long) theFile->mode);
+#else
+          sl_snprintf(tmp, SH_BUFSIZE, _("mode_old=<%s>, mode_new=<%s>, "),
+                      p->theFile.c_mode, theFile->c_mode);
+#endif
+#endif
+          sl_strlcat(msg, tmp, SH_BUFSIZE);
+
+#if defined(USE_ACL) || defined(USE_XATTR)
+          if (theFile->attr_string != NULL || p->attr_string != NULL)
+            {
+              sl_snprintf(tmp, SH_BUFSIZE, 
 #ifdef SH_USE_XML
-                      , (long) p->theFile.mode, (long) theFile->mode
-#endif
-                      );
-#endif
-          sl_strlcat(msg, tmp, SH_BUFSIZE);
+                          _("acl_old=\"%s\" acl_new=\"%s\" "),
+#else
+                          _("acl_old=<%s>, acl_new=<%s>, "),
+#endif
+                          (p->attr_string)       ? p->attr_string       : _("none"), 
+                          (theFile->attr_string) ? theFile->attr_string : _("none"));
+              
+              sl_strlcat(msg, tmp, SH_BUFSIZE);
+            }
+#endif
+
 #ifdef REPLACE_OLD
           if ((modi_mask & MODI_MOD) != 0)
@@ -2754 +2914 @@
                   p->theFile.attributes = theFile->attributes;
 #endif
+#if defined(USE_ACL) || defined(USE_XATTR)
+                  if      (p->attr_string == NULL && theFile->attr_string != NULL)
+                    { p->attr_string = sh_util_strdup (theFile->attr_string); }
+                  else if (p->attr_string != NULL && theFile->attr_string == NULL)
+                    { SH_FREE(p->attr_string); p->attr_string = NULL; }
+                  else if (theFile->attr_string != NULL && p->attr_string != NULL)
+                    { 
+                      if (0 != strcmp(theFile->attr_string, p->attr_string))
+                        {
+                          SH_FREE(p->attr_string);
+                          p->attr_string = sh_util_strdup (theFile->attr_string);
+                        }
+                    }
+#endif
                 }
             }
@@ -3039 +3213 @@
               sl_strlcpy(theFile->c_attributes, p->theFile.c_attributes, 16);
               theFile->attributes =  p->theFile.attributes;
+#endif
+#if defined(USE_ACL) || defined(USE_XATTR)
+              if      (theFile->attr_string == NULL && p->attr_string != NULL)
+                { theFile->attr_string = sh_util_strdup (p->attr_string); }
+              else if (theFile->attr_string != NULL && p->attr_string == NULL)
+                { SH_FREE(theFile->attr_string); theFile->attr_string = NULL; }
+              else if (theFile->attr_string != NULL && p->attr_string != NULL)
+                { 
+                  if (0 != strcmp(theFile->attr_string, p->attr_string))
+                    {
+                      SH_FREE(theFile->attr_string);
+                      theFile->attr_string = sh_util_strdup (p->attr_string);
+                    }
+                }
 #endif
               
@@ -3084 +3272 @@
               p->theFile.attributes = theFile->attributes;
 #endif
+#if defined(USE_ACL) || defined(USE_XATTR)
+              if      (p->attr_string == NULL && theFile->attr_string != NULL)
+                { p->attr_string = sh_util_strdup (theFile->attr_string); }
+              else if (p->attr_string != NULL && theFile->attr_string == NULL)
+                { SH_FREE(p->attr_string); p->attr_string = NULL; }
+              else if (theFile->attr_string != NULL && p->attr_string != NULL)
+                { 
+                  if (0 != strcmp(theFile->attr_string, p->attr_string))
+                    {
+                      SH_FREE(p->attr_string);
+                      p->attr_string = sh_util_strdup (theFile->attr_string);
+                    }
+                }
+#endif
               
               if (theFile->c_mode[0] == 'l')
@@ -3216 +3418 @@
   char * tmp;
   char   str[81];
+  size_t i;
 
   if (ListWithDelimiter == S_TRUE)
@@ -3270 +3473 @@
       tmp = sh_util_safe_name(p->linkpath);
       if (ListWithDelimiter == S_TRUE)
-        printf(_(" %s\n"), tmp);
+        printf(_(" %s"), tmp);
       else
-        printf(_(" -> %s\n"), tmp);
+        printf(_(" -> %s"), tmp);
       SH_FREE(tmp);
     }
-  else
-    printf("\n");
+  if (ListWithDelimiter == S_TRUE)
+    putchar(',');
+
+  if (p->attr_string)
+    {
+      tmp = sh_util_safe_name(p->attr_string);
+      if (ListWithDelimiter == S_TRUE) {
+        for (i = 0; i < strlen(tmp); ++i) 
+          if (tmp[i] == ',') tmp[i] = ';';
+      }
+      printf(_(" %s"), tmp);
+      SH_FREE(tmp);
+    }
+  else
+    {
+      if (ListWithDelimiter == S_TRUE)
+        printf(_(" no_attr"));
+    }
+  putchar('\n');
 
   return;

trunk/src/sh_kern.c

@@ -209 +209 @@
   int         i = 0;
   char      * p;
+
+  tmpFile.attr_string = NULL;
 
   sl_strlcpy(tmpFile.fullpath, name, PATH_MAX);
@@ -1790 +1792 @@
  *************/
 
-int sh_kern_set_severity  (char * c)
+int sh_kern_set_severity  (const char * c)
 {
   char tmp[32];
@@ -1799 +1801 @@
 }
 
-int sh_kern_set_timer (char * c)
+int sh_kern_set_timer (const char * c)
 {
   long val;
@@ -1816 +1818 @@
 }
 
-int sh_kern_set_activate (char * c)
+int sh_kern_set_activate (const char * c)
 {
   int i;
@@ -1824 +1826 @@
 }
 
-int sh_kern_set_idt (char * c)
+int sh_kern_set_idt (const char * c)
 {
   int i;
@@ -1832 +1834 @@
 }
 
-int sh_kern_set_sc_addr (char * c)
+int sh_kern_set_sc_addr (const char * c)
 {
   char * endptr;
@@ -1853 +1855 @@
 }
 
-int sh_kern_set_sct_addr (char * c)
+int sh_kern_set_sct_addr (const char * c)
 {
   char * endptr;
@@ -1874 +1876 @@
 }
 
-int sh_kern_set_proc_root (char * c)
+int sh_kern_set_proc_root (const char * c)
 {
   char * endptr;
@@ -1896 +1898 @@
 }
 
-int sh_kern_set_proc_root_iops (char * c)
+int sh_kern_set_proc_root_iops (const char * c)
 {
   char * endptr;
@@ -1918 +1920 @@
 }
 
-int sh_kern_set_proc_root_lookup (char * c)
+int sh_kern_set_proc_root_lookup (const char * c)
 {
   char * endptr;
@@ -1941 +1943 @@
 #endif
 
-/* #ifdef SH_USE_UTMP */
-#endif
-
-
-
+/* #ifdef SH_USE_KERN */
+#endif
+
+
+

trunk/src/sh_modules.c

@@ -13 +13 @@
 #include "sh_kern.h"
 #include "sh_suidchk.h"
+#include "sh_processcheck.h"
+#include "sh_portcheck.h"
 
 sh_mtype modList[] = {
@@ -74 +76 @@
   },
 #endif
+
 #ifdef SH_USE_SUIDCHK
   {
@@ -88 +91 @@
   },
 #endif
+
+#ifdef SH_USE_PROCESSCHECK
+  {
+    N_("PROCESSCHECK"),
+    0,
+    sh_prochk_init,
+    sh_prochk_timer,
+    sh_prochk_check,
+    sh_prochk_cleanup,
+    sh_prochk_reconf,
+
+    N_("[ProcessCheck]"),
+    sh_prochk_table,
+  },
+#endif
+
+#ifdef SH_USE_PORTCHECK
+  {
+    N_("PORTCHECK"),
+    0,
+    sh_portchk_init,
+    sh_portchk_timer,
+    sh_portchk_check,
+    sh_portchk_cleanup,
+    sh_portchk_reconf,
+
+    N_("[PortCheck]"),
+    sh_portchk_table,
+  },
+#endif
+
   {
     NULL,

trunk/src/sh_mounts.c

@@ -51 +51 @@
 
 /* Prototypes for configuration functions */
-int sh_mounts_config_activate (char * opt);
-int sh_mounts_config_timer    (char * opt);
-int sh_mounts_config_mount    (char * opt);
-int sh_mounts_config_sevmnt   (char * opt);
-int sh_mounts_config_sevopt   (char * opt);
+int sh_mounts_config_activate (const char * opt);
+int sh_mounts_config_timer    (const char * opt);
+int sh_mounts_config_mount    (const char * opt);
+int sh_mounts_config_sevmnt   (const char * opt);
+int sh_mounts_config_sevopt   (const char * opt);
 
 /* Prototype for the function to read info on mounted filesystems */
@@ -276 +276 @@
 
 /* Configure to check a particular mount */
-int sh_mounts_config_mount (char * opt)
+int sh_mounts_config_mount (const char * opt_in)
 {
   struct sh_mounts_mnt *m;
   struct sh_mounts_opt *o;
-  char *sp, *temp;
+  char *sp, *temp, *opt;
 
   SL_ENTER(_("sh_mounts_config_mount"));
@@ -286 +286 @@
   /* It's probably best to make a copy of opt before messing about with it
    * via string functions. Good practice and all that. */
-  temp = sh_util_strdup(opt);
+  temp = sh_util_strdup(opt_in);
 
   /* Since we're going to "consume" this new buffer, it'll be good to have a
    * reference to it's allocated memory so we can free it later. Let's use
-   * temp for that, and the now-unused "opt" for consumption */
+   * temp for that, and "opt" for consumption */
   opt = temp;
   
@@ -327 +327 @@
 
 /* Simply sets our boolean as to whether this module is active */
-int sh_mounts_config_activate (char * opt)
+int sh_mounts_config_activate (const char * opt)
 {
   int i;
@@ -336 +336 @@
 
 /* Sets up our timer */
-int sh_mounts_config_timer (char * opt)
+int sh_mounts_config_timer (const char * opt)
 {
   long val;
@@ -357 +357 @@
 
 /* Configure severity for "mount missing" messages */
-int sh_mounts_config_sevmnt  (char * opt)
+int sh_mounts_config_sevmnt  (const char * opt)
 {
   int retval = 0;
@@ -370 +370 @@
 }
 
-int sh_mounts_config_sevopt  (char * opt)
+int sh_mounts_config_sevopt  (const char * opt)
 {
   int retval = 0;

trunk/src/sh_readconf.c

@@ -857 +857 @@
   { N_("hardlinkoffset"),     SH_SECTION_MISC,   SH_SECTION_NONE,
     sh_files_hle_reg },
+#if defined(USE_XATTR)
+  { N_("useselinuxcheck"),    SH_SECTION_MISC,   SH_SECTION_NONE, 
+    sh_unix_setcheckselinux },
+#endif
+#if defined(USE_ACL)
+  { N_("useaclcheck"),        SH_SECTION_MISC,   SH_SECTION_NONE, 
+    sh_unix_setcheckacl },
+#endif
   { N_("addokchars"),         SH_SECTION_MISC,   SH_SECTION_NONE,
     sh_util_obscure_ok },
+  { N_("filenamesareutf8"),   SH_SECTION_MISC,   SH_SECTION_NONE, /* FIXME document this option */
+    sh_util_obscure_utf8 },
   { N_("setrecursionlevel"),  SH_SECTION_MISC,   SH_SECTION_NONE, 
     sh_files_setrecursion },

trunk/src/sh_suidchk.c

@@ -146 +146 @@
 static int     ShSuidchkSeverity = SH_ERR_SEVERE;
 static char *  ShSuidchkExclude  = NULL;
-static int     ExcludeLen        = 0;
+static size_t  ExcludeLen        = 0;
 
 static time_t  FileLimNow        = 0;
@@ -554 +554 @@
                     )
                    )
-            {
+            { /* way too long routine */
               
               (void) sl_strlcpy (theFile.fullpath, tmpcat, PATH_MAX);
-              theFile.check_mask = sh_files_maskof(SH_LEVEL_READONLY);
-              theFile.reported   = S_FALSE;
+              theFile.check_mask  = sh_files_maskof(SH_LEVEL_READONLY);
+              theFile.reported    = S_FALSE;
+              theFile.attr_string = NULL;
+
               status = sh_unix_getinfo (ShDFLevel[SH_ERR_T_RO], 
                                         thisEntry->d_name,
@@ -971 +973 @@
                 }
               SH_FREE(tmp);
-
-            }
+              if (theFile.attr_string)
+                SH_FREE(theFile.attr_string);
+
+            } /* end of way too long routine */
         }
       SH_FREE(tmpcat);
     }
+
 #ifdef HAVE_SCHED_YIELD
     if (ShSuidchkYield == S_TRUE)
@@ -989 +994 @@
       }
 #endif
+
   }  while (thisEntry != NULL);
 
@@ -1087 +1093 @@
  *************/
 
-int sh_suidchk_set_severity  (char * c)
+int sh_suidchk_set_severity  (const char * c)
 {
   int retval;
@@ -1099 +1105 @@
 }
 
-int sh_suidchk_set_exclude (char * c)
+int sh_suidchk_set_exclude (const char * c)
 {
   SL_ENTER(_("sh_suidchk_set_exclude"));
+
   if (c == NULL || c[0] == '\0')
     {
@@ -1118 +1125 @@
     SH_FREE(ShSuidchkExclude);
 
-  ExcludeLen       = (int) sl_strlen(c);
-  if (c[ExcludeLen-1] == '/')
-    {
-      c[ExcludeLen-1] = '\0';
+  ShSuidchkExclude = sh_util_strdup (c);
+  ExcludeLen       = sl_strlen (ShSuidchkExclude);
+  if (ShSuidchkExclude[ExcludeLen-1] == '/')
+    {
+      ShSuidchkExclude[ExcludeLen-1] = '\0';
       ExcludeLen--;
     }
-  ShSuidchkExclude = SH_ALLOC((size_t) ExcludeLen + 1);
-  (void) sl_strlcpy(ShSuidchkExclude, c, (size_t)(ExcludeLen + 1));
-
   SL_RETURN(0, _("sh_suidchk_set_exclude"));
 }
 
-int sh_suidchk_set_timer (char * c)
+int sh_suidchk_set_timer (const char * c)
 {
   long val;
@@ -1163 +1168 @@
 }
 
-int sh_suidchk_set_schedule (char * str)
+int sh_suidchk_set_schedule (const char * str)
 {
   int status;
@@ -1201 +1206 @@
 
 
-int sh_suidchk_set_fps (char * c)
+int sh_suidchk_set_fps (const char * c)
 {
   long val;
@@ -1218 +1223 @@
 }
 
-int sh_suidchk_set_yield (char * c)
+int sh_suidchk_set_yield (const char * c)
 {
   int i;
@@ -1231 +1236 @@
 }
 
-int sh_suidchk_set_activate (char * c)
+int sh_suidchk_set_activate (const char * c)
 {
   int i;
@@ -1239 +1244 @@
 }
 
-int sh_suidchk_set_quarantine (char * c)
+int sh_suidchk_set_quarantine (const char * c)
 {
   int i;
@@ -1247 +1252 @@
 }
 
-int sh_suidchk_set_qdelete (char * c)
+int sh_suidchk_set_qdelete (const char * c)
 {
   int i;
@@ -1255 +1260 @@
 }
 
-int sh_suidchk_set_qmethod (char * c)
+int sh_suidchk_set_qmethod (const char * c)
 {
   long val;

trunk/src/sh_unix.c

@@ -2863 +2863 @@
                                         alert_timeout),
                  KEY_LEN+1);
-
+      
       /* return */
       SL_RETURN( 0, _("sh_unix_checksum_size"));
@@ -2874 +2874 @@
   SL_RETURN( -1, _("sh_unix_checksum_size"));
 }
+
+int sh_unix_check_selinux = S_FALSE;
+int sh_unix_check_acl     = S_FALSE;
+
+#ifdef USE_ACL
+
+#include <sys/acl.h>
+static char * sh_unix_getinfo_acl (char * path, int fd, struct stat * buf)
+{
+  /* system.posix_acl_access, system.posix_acl_default
+   */
+  char *  out  = NULL;
+  char *  collect = NULL;
+  char *  tmp;
+  char *  out_compact;
+  ssize_t len;
+  acl_t   result;
+
+  SL_ENTER(_("sh_unix_getinfo_acl"));
+
+  result = (fd == -1) ? 
+    acl_get_file (path, ACL_TYPE_ACCESS) :
+    acl_get_fd   (fd);
+
+  if (result)
+    {
+      out = acl_to_text (result, &len);
+      if (out && (len > 0)) {
+        out_compact = sh_util_acl_compact (out, len);
+        acl_free(out);
+        if (out_compact) 
+          {
+            collect = sh_util_strconcat (_("acl_access:"), out_compact, NULL);
+            SH_FREE(out_compact);
+          }
+      }
+      acl_free(result);
+    }
+  
+  
+  if ( S_ISDIR(buf->st_mode) ) 
+    {
+      result = acl_get_file (path, ACL_TYPE_DEFAULT);
+      
+      if (result)
+        {
+          out = acl_to_text (result, &len);
+          if (out && (len > 0)) {
+            out_compact = sh_util_acl_compact (out, len);
+            acl_free(out);
+            if (out_compact) {
+              if (collect) {
+                tmp = sh_util_strconcat (_("acl_default:"), 
+                                         out_compact, ":", collect, NULL);
+                SH_FREE(collect);
+              }
+              else {
+                tmp = sh_util_strconcat (_("acl_default:"), out_compact, NULL);
+              }
+              SH_FREE(out_compact);
+              collect = tmp;
+            }
+          }
+          acl_free(result);
+        }
+    }
+  
+  SL_RETURN((collect),_("sh_unix_getinfo_acl"));
+}
+#endif
+
+#ifdef USE_XATTR
+
+#include <attr/xattr.h>
+static char * sh_unix_getinfo_xattr_int (char * path, int fd, char * name)
+{
+  char *  out   = NULL;
+  char *  tmp   = NULL;
+  size_t  size  = 256;
+  ssize_t result;
+
+  SL_ENTER(_("sh_unix_getinfo_xattr_int"));
+
+  out = SH_ALLOC(size);
+
+  result = (fd == -1) ? 
+    lgetxattr (path, name, out, size-1) :
+    fgetxattr (fd,   name, out, size-1);
+
+  if (result == -1 && errno == ERANGE) 
+    {
+      SH_FREE(out);
+      result = (fd == -1) ? 
+        lgetxattr (path, name, NULL, 0) :
+        fgetxattr (fd,   name, NULL, 0);
+      size = result + 1;
+      out  = SH_ALLOC(size);
+      result = (fd == -1) ? 
+        lgetxattr (path, name, out, size-1) :
+        fgetxattr (fd,   name, out, size-1);
+    }
+
+  if ((result > 0) && ((size_t)result < size))
+    {
+      out[size-1] = '\0';
+      tmp = out;
+    }
+  else
+    {
+      SH_FREE(out);
+    }
+
+  SL_RETURN((tmp),_("sh_unix_getinfo_xattr_int"));
+}
+
+
+static char * sh_unix_getinfo_xattr (char * path, int fd, struct stat * buf)
+{
+  /* system.posix_acl_access, system.posix_acl_default, security.selinux 
+   */
+  char *  tmp;
+  char *  out  = NULL;
+  char *  collect = NULL;
+
+  SL_ENTER(_("sh_unix_getinfo_xattr"));
+
+#ifdef USE_ACL
+  /*
+   * we need the acl_get_fd/acl_get_file functions, getxattr will only
+   * yield the raw bytes
+   */
+  if (sh_unix_check_acl == S_TRUE) 
+    {
+      out = sh_unix_getinfo_acl(path, fd, buf);
+      
+      if (out)
+        {
+          collect = out;
+        }
+  }
+#endif
+
+  out = sh_unix_getinfo_xattr_int(path, fd, _("security.selinux"));
+
+  if (out)
+    {
+      if (collect) {
+        tmp = sh_util_strconcat(_("selinux:"), out, ":", collect, NULL);
+        SH_FREE(collect);
+      }
+      else {
+        tmp = sh_util_strconcat(_("selinux:"), out, NULL);
+      }
+      SH_FREE(out);
+      collect = tmp;
+    }
+
+  SL_RETURN((collect),_("sh_unix_getinfo_xattr"));
+}
+#endif
+
+#ifdef USE_XATTR
+int sh_unix_setcheckselinux (const char * c)
+{
+  int i;
+  SL_ENTER(_("sh_unix_setcheckselinux"));
+  i = sh_util_flagval(c, &(sh_unix_check_selinux));
+
+  SL_RETURN(i, _("sh_unix_setcheckselinux"));
+}
+#endif
+
+#ifdef USE_ACL
+int sh_unix_setcheckacl (const char * c)
+{
+  int i;
+  SL_ENTER(_("sh_unix_setcheckacl"));
+  i = sh_util_flagval(c, &(sh_unix_check_acl));
+
+  SL_RETURN(i, _("sh_unix_setcheckacl"));
+}
+#endif
+    
 
 int sh_unix_getinfo (int level, char * filename, file_type * theFile, 
@@ -3124 +3307 @@
                          &theFile->attributes, theFile->c_attributes, 
                          fd, &buf);
+#endif
+
+#if defined(USE_XATTR)
+  if (sh_unix_check_selinux == S_TRUE)
+    theFile->attr_string = sh_unix_getinfo_xattr (theFile->fullpath, fd, &buf);
+#elif defined(USE_ACL)
+  if (sh_unix_check_acl == S_TRUE)
+    theFile->attr_string = sh_unix_getinfo_acl (theFile->fullpath, fd, &buf);
+#else
+  theFile->attr_string = NULL;
 #endif
 

trunk/src/sh_userfiles.c

@@ -115 +115 @@
 }
   
-int sh_userfiles_set_uid (char * str)
+int sh_userfiles_set_uid (const char * str)
 {
   char * end;
-  char * p = str;
+  const  char * p = str;
   unsigned long lower;
   unsigned long upper = 0;
@@ -183 +183 @@
  * directory that should be checked. */
 
-int sh_userfiles_add_file(char *c) {
+int sh_userfiles_add_file(const char *c) {
     struct userfileslist *new;
     char *s, *orig;
@@ -232 +232 @@
 }
 
-/* Decide if we're active.  1 means yes, all else means no */
-
-int sh_userfiles_set_active(char *c) {
+/* Decide if we're active. 
+ */
+int sh_userfiles_set_active(const char *c) {
     int value;
     
     SL_ENTER(_("sh_userfiles_set_active"));
-
     value = sh_util_flagval(c, &ShUserfilesActive);
-
-    /*
-    if( value == 1 ) {
-        ShUserfilesActive = S_TRUE;
-    } else {
-        ShUserfilesActive = S_FALSE;
-    }
-    */
-
     SL_RETURN((value), _("sh_userfiles_set_active"));
 }

trunk/src/sh_utils.c

@@ -196 +196 @@
 
   SL_RETURN(i, _("sh_util_hidesetup"));
+}
+
+char * sh_util_acl_compact(char * buf, ssize_t len)
+{
+  unsigned char  * p = (unsigned char *) buf;
+  int       state = 0;
+  ssize_t   rem = 0;
+  char    * out;
+  
+  SH_VALIDATE_NE(buf, NULL);
+  SH_VALIDATE_GE(len, 0);
+
+  out = SH_ALLOC(len + 1);
+
+  while (*p != '\0')  {
+
+    /* -- not at start or after newline
+     */
+    if (state == 1) {
+      if (*p == '\n' || *p == ' ' || *p == '\t' || *p == '#') {
+        while (*p != '\n') {
+          ++p;
+          if (*p == '\0') {
+            goto exit_it;
+          }
+        }
+        out[rem] = ','; ++rem;
+        while (p[1] == '\n') ++p; /* scan over consecutive newlines */
+        state = 0;
+        if (p[1] == '\0') {
+          if (rem > 0) out[rem-1] = '\0';
+          break;
+        }
+      }
+      else {
+        if (*p <= 0x7F && isgraph((int) *p)) {
+          out[rem] = (char) *p; ++rem;
+        }
+      }
+    }
+
+    /* -- at start or after newline
+     */
+    else /* if (state == 0) */ {
+      if        (0 == strncmp((char *) p, "user", 4)) {
+        out[rem] = 'u'; ++rem;
+        p += 3; state = 1;
+      } else if (0 == strncmp((char *) p, "group", 5)) {
+        out[rem] = 'g'; ++rem;
+        p += 4; state = 1; 
+      } else if (0 == strncmp((char *) p, "mask", 4)) {
+        out[rem] = 'm'; ++rem;
+        p += 3; state = 1;
+      } else if (0 == strncmp((char *) p, "other", 5)) {
+        out[rem] = 'o';
+        p += 4; state = 1; ++rem;
+      } else if (*p == '\0') {
+        if (rem > 0) { out[rem-1] = '\0'; }
+        break;
+      } else {
+        if (*p <= 0x7F && isprint((int) *p)) {
+          out[rem] = (char) *p; ++rem;
+        }
+      }
+      state = 1;
+    }
+    ++p;
+  }
+ exit_it:
+  out[rem] = '\0';
+  return out;
 }
     
@@ -1343 +1414 @@
 static unsigned char sh_obscure_index[256];
 
+int sh_util_valid_utf8 (const unsigned char * str) 
+{
+  size_t        len = strlen((char *)str);
+  size_t        l   = 0;
+  unsigned char c;
+
+#define SH_VAL_UTF8_1 ((c != '\0') && ((c & 0x80) == 0x00))
+#define SH_VAL_UTF8_2 ((c != '\0') && ((c & 0xE0) == 0xC0)) /* 110x xxxx */
+#define SH_VAL_UTF8_3 ((c != '\0') && ((c & 0xF0) == 0xE0)) /* 1110 xxxx */
+#define SH_VAL_UTF8_4 ((c != '\0') && ((c & 0xF8) == 0xF0)) /* 1111 0xxx */
+#define SH_VAL_UTF8_N ((c != '\0') && ((c & 0xC0) == 0x80)) /* 10xx xxxx */
+#define SH_VAL_BAD    ((c == '"') || (c == '\t') || (c == '\b') || (c == '\f') || (c == '\n') || \
+                       (c == '\r') || (c == '\v') || iscntrl((int) c) || \
+                       (c != ' ' && !isgraph ((int) c)))
+   
+  while(l < len) 
+    {
+      c = str[l];
+
+      if      (SH_VAL_UTF8_1) 
+        {
+          if (SH_VAL_BAD && (sh_obscure_index[c] != 1)) return S_FALSE;
+          ++l; continue; /* ASCII character */
+        } 
+      else if (SH_VAL_UTF8_2) 
+        { 
+          if ((c & 0x3e) == 0x00) 
+            return S_FALSE; /* overlong 2-byte seq. */
+          ++l; if (l == len) return S_FALSE; c = str[l];
+          if(!SH_VAL_UTF8_N) return S_FALSE; 
+          ++l; continue;
+          
+        } 
+      else if (SH_VAL_UTF8_3) 
+        {
+          ++l; if (l == len) return S_FALSE; c = str[l];
+          if(!SH_VAL_UTF8_N) return S_FALSE;
+          if (((str[l-1] & 0x1F) == 0x00) && ((c & 0x60) == 0x00))
+            return S_FALSE; /* overlong 3-byte seq. */
+          ++l; if (l == len) return S_FALSE; c = str[l];
+          if(!SH_VAL_UTF8_N) return S_FALSE;
+          ++l; continue;
+        } 
+      else if (SH_VAL_UTF8_4) 
+        {
+          ++l; if (l == len) return S_FALSE; c = str[l];
+          if(!SH_VAL_UTF8_N) return S_FALSE;
+          if (((str[l-1] & 0x0F) == 0x00) && ((c & 0x70) == 0x00))
+            return S_FALSE; /* overlong 4-byte seq. */
+          ++l; if (l == len) return S_FALSE; c = str[l];
+          if(!SH_VAL_UTF8_N) return S_FALSE;
+          ++l; if (l == len) return S_FALSE; c = str[l];
+          if(!SH_VAL_UTF8_N) return S_FALSE;
+          ++l; continue;
+        }
+      return S_FALSE;
+    }
+  return S_TRUE;
+}
+
+
 int sh_util_obscure_ok (const char * str)
 {
@@ -1387 +1519 @@
 }
 
+static int sh_obscure_check_utf8 = S_FALSE;
+
+int sh_util_obscure_utf8 (const char * c)
+{
+  int i;
+  SL_ENTER(_("sh_util_obscure_utf8"));
+  i = sh_util_flagval(c, &(sh_obscure_check_utf8));
+
+  SL_RETURN(i, _("sh_util_obscure_utf8"));
+}
+
+
 int sh_util_obscurename (ShErrLevel level, char * name_orig, int flag)
 {
@@ -1396 +1540 @@
 
   ASSERT_RET((name != NULL), _("name != NULL"), (0))
+
+  if (sh_obscure_check_utf8 == S_TRUE)
+    {
+      if (S_FALSE == sh_util_valid_utf8(name))
+        {
+          goto err;
+        }
+      SL_RETURN((0),_("sh_util_obscurename"));
+    }
 
   /* -- Check name. --
@@ -1410 +1563 @@
           if (sh_obscure_index[i] != (unsigned char)1)
             {
-              if (flag == S_TRUE)
-                {
-                  safe = sh_util_safe_name (name_orig);  
-                  sh_error_handle (level, FIL__, __LINE__, 0, MSG_FI_OBSC, 
-                                   safe);
-                  SH_FREE(safe);
-                }
-              SL_RETURN((-1),_("sh_util_obscurename"));
+              goto err;
             }
         }
@@ -1424 +1570 @@
 
   SL_RETURN((0),_("sh_util_obscurename"));
-}
+
+ err:
+
+  if (flag == S_TRUE)
+    {
+      safe = sh_util_safe_name (name_orig);  
+      sh_error_handle (level, FIL__, __LINE__, 0, MSG_FI_OBSC, 
+                       safe);
+      SH_FREE(safe);
+    }
+  SL_RETURN((-1),_("sh_util_obscurename"));
+}
+
 #endif
 

trunk/src/sh_utmp.c

@@ -547 +547 @@
  *************/
 
-int sh_utmp_set_login_solo  (char * c)
+int sh_utmp_set_login_solo  (const char * c)
 {
   int retval;
@@ -559 +559 @@
 }
 
-int sh_utmp_set_login_multi (char * c)
+int sh_utmp_set_login_multi (const char * c)
 {
   int retval;
@@ -571 +571 @@
 }
 
-int sh_utmp_set_logout_good (char * c)
+int sh_utmp_set_logout_good (const char * c)
 {
   int retval;
@@ -583 +583 @@
 }
 
-int sh_utmp_set_login_timer (char * c)
+int sh_utmp_set_login_timer (const char * c)
 {
   int retval = 0;
@@ -603 +603 @@
 }
 
-int sh_utmp_set_login_activate (char * c)
+int sh_utmp_set_login_activate (const char * c)
 {
   int i;

trunk/test/test.sh

@@ -138 +138 @@
 usage() {
     echo "test.sh [options] <test_number> [hostname]"
-    echo "        [-q|--quiet|-v|--verbose] [-s|--stoponerr] [--no-cleanup]"
+    echo "        [-q|--quiet|-v|--verbose] [-s|--stoponerr] [-n|--no-cleanup]"
     echo "        [--srcdir=top_srcdir] [--color=always|never|auto]"
     echo
@@ -149 +149 @@
     echo "  ${S}test.sh  7${E}  -- GnuPG signed files / prelude log"
     echo "  ${S}test.sh  8${E}  -- Suidcheck"
-
-    echo "  ${S}test.sh 10${E}  -- Test c/s init/check      (testrc_2.in)"
-    echo "  ${S}test.sh 11${E}  -- Test full c/s init/check (testrc_2.in)"
-    echo "  ${S}test.sh 12${E}  -- Test full c/s w/gpg      (testrc_2.in)"
-    echo "  ${S}test.sh 13${E}  -- Test full c/s w/mysql    (testrc_2.in)"
-    echo "  ${S}test.sh 14${E}  -- Test full c/s w/postgres (testrc_2.in)"
+    echo "  ${S}test.sh  9${E}  -- Process check"
+    echo "  ${S}test.sh 10${E}  -- Port check"
+
+    echo "  ${S}test.sh 20${E}  -- Test c/s init/check      (testrc_2.in)"
+    echo "  ${S}test.sh 21${E}  -- Test full c/s init/check (testrc_2.in)"
+    echo "  ${S}test.sh 22${E}  -- Test full c/s w/gpg      (testrc_2.in)"
+    echo "  ${S}test.sh 23${E}  -- Test full c/s w/mysql    (testrc_2.in)"
+    echo "  ${S}test.sh 24${E}  -- Test full c/s w/postgres (testrc_2.in)"
     echo "  ${S}test.sh all${E} -- All tests"
 }
@@ -162 +164 @@
     echo "  (1) testcompile.sh (2) testhash.sh     (3) testrun_1.sh   (4) testrun_1a.sh"
     echo "  (5) testext.sh     (6) testtimesrv.sh  (7) testrun_1b.sh  (8) testrun_1c.sh" 
-    echo " (10) testrun_2.sh  (11) testrun_2a.sh  (12) testrun_2b.sh (13) testrun_2c.sh"
-    echo " (14) testrun_2d.sh"
+    echo "  (9) testrun_1d.sh" 
+    echo " (20) testrun_2.sh  (21) testrun_2a.sh  (22) testrun_2b.sh (23) testrun_2c.sh"
+    echo " (24) testrun_2d.sh"
 }
 
@@ -185 +188 @@
         -q|--quiet)    quiet=on; verbose= ;;
         -s|--stoponerr)     stoponerr=on;;
-        --no-cleanup) cleanup= ;;
+        -n|--no-cleanup) cleanup= ;;
         --really-all) doall=on;;
         --valgrind) usevalgrind=on;;
@@ -366 +369 @@
 
 log_fail () { 
-    log_msg "$1" "$2" failure "$3"; 
+    [ -z "$quiet" ] && log_msg "$1" "$2" failure "$3"; 
     let "failcount = failcount + 1" >/dev/null; 
     test -z "$stoponerr" || exit 1; 
 }
 log_ok ()   { 
-    log_msg "$1" "$2" success "$3"; 
+    [ -z "$quiet" ] && log_msg "$1" "$2" success "$3"; 
     let "okcount = okcount + 1" >/dev/null; 
 }
 log_skip () { 
-    log_msg "$1" "$2" skipped "$3"; 
+    [ -z "$quiet" ] && log_msg "$1" "$2" skipped "$3"; 
     let "skipcount = skipcount + 1" >/dev/null; 
 }
@@ -441 +444 @@
 print_summary ()
 {
-    let "gcount = okcount + skipcount + failcount" >/dev/null;
+    # let "gcount = okcount + skipcount + failcount" >/dev/null;
+    gcount=$MAXTEST;
+    let "failcount = gcount - okcount - skipcount" >/dev/null;
+
     [ -z "$quiet" ] && { 
         echo
@@ -594 +600 @@
     exit $?
 fi
+if test x$1 = x9; then
+    . ${SCRIPTDIR}/testrun_1.sh
+    . ${SCRIPTDIR}/testrun_1d.sh
+    testrun1d
+    print_summary
+    exit $?
+fi
 if test x$1 = x10; then
+    . ${SCRIPTDIR}/testrun_1.sh
+    . ${SCRIPTDIR}/testrun_1e.sh
+    testrun1e
+    print_summary
+    exit $?
+fi
+if test x$1 = x20; then
     . ${SCRIPTDIR}/testrun_2.sh 
     testrun2 $hostname
@@ -600 +620 @@
     exit $?
 fi
-if test x$1 = x11; then
+if test x$1 = x21; then
     . ${SCRIPTDIR}/testrun_2a.sh
     testrun2a $hostname
@@ -606 +626 @@
     exit $?
 fi
-if test x$1 = x12; then
+if test x$1 = x22; then
     . ${SCRIPTDIR}/testrun_2a.sh
     . ${SCRIPTDIR}/testrun_2b.sh
@@ -613 +633 @@
     exit $?
 fi
-if test x$1 = x13; then
+if test x$1 = x23; then
     . ${SCRIPTDIR}/testrun_2a.sh
     . ${SCRIPTDIR}/testrun_2c.sh 
@@ -620 +640 @@
     exit $?
 fi
-if test x$1 = x14; then
+if test x$1 = x24; then
     . ${SCRIPTDIR}/testrun_2a.sh
     . ${SCRIPTDIR}/testrun_2d.sh
@@ -644 +664 @@
     let "TEST_MAX = TEST_MAX + MAXTEST" >/dev/null
     . ${SCRIPTDIR}/testrun_1c.sh
+    let "TEST_MAX = TEST_MAX + MAXTEST" >/dev/null
+    . ${SCRIPTDIR}/testrun_1d.sh
+    let "TEST_MAX = TEST_MAX + MAXTEST" >/dev/null
+    . ${SCRIPTDIR}/testrun_1e.sh
     let "TEST_MAX = TEST_MAX + MAXTEST" >/dev/null
     . ${SCRIPTDIR}/testrun_2.sh
@@ -687 +711 @@
     MAXTEST=${TEST_MAX}; export MAXTEST
     testrun1c
+    #
+    . ${SCRIPTDIR}/testrun_1.sh
+    . ${SCRIPTDIR}/testrun_1d.sh
+    MAXTEST=${TEST_MAX}; export MAXTEST
+    testrun1d
+    #
+    . ${SCRIPTDIR}/testrun_1.sh
+    . ${SCRIPTDIR}/testrun_1e.sh
+    MAXTEST=${TEST_MAX}; export MAXTEST
+    testrun1e
     #
     . ${SCRIPTDIR}/testrun_2.sh

trunk/test/testcompile.sh

@@ -20 +20 @@
 #
 
-MAXTEST=61; export MAXTEST
+MAXTEST=63; export MAXTEST
 
 run_flawfinder ()
@@ -164 +164 @@
         # test standalone compilation
         #
-        TEST="${S}standalone w/suidcheck${E}"
+        TEST="${S}standalone w/suidcheck w/processcheck${E}"
         #
         if test -r "Makefile"; then
@@ -170 +170 @@
         fi
         #
-        ${TOP_SRCDIR}/configure --quiet  --prefix=$PW_DIR --localstatedir=$PW_DIR --with-config-file=$PW_DIR/samhainrc.test  --enable-suidcheck > /dev/null 2>> test_log
+        ${TOP_SRCDIR}/configure --quiet  --prefix=$PW_DIR --localstatedir=$PW_DIR --with-config-file=$PW_DIR/samhainrc.test  --enable-suidcheck --enable-process-check > /dev/null 2>> test_log
+        #
+        let "num = num + 1" >/dev/null
+        testmake $? $num || let "numfail = numfail + 1"  >/dev/null
+        let "num = num + 1" >/dev/null
+        run_smatch $? $num || let "numfail = numfail + 1"  >/dev/null
+
+        #
+        # test standalone compilation
+        #
+        TEST="${S}standalone w/processcheck w/portcheck${E}"
+        #
+        if test -r "Makefile"; then
+                $MAKE distclean 
+        fi
+        #
+        ${TOP_SRCDIR}/configure --quiet  --prefix=$PW_DIR --localstatedir=$PW_DIR --with-config-file=$PW_DIR/samhainrc.test  --enable-process-check --enable-port-check > /dev/null 2>> test_log
         #
         let "num = num + 1" >/dev/null

trunk/test/testrun_1.sh

@@ -41 +41 @@
 testrun1_setup=0
 
-MAXTEST=11; export MAXTEST
+MAXTEST=13; export MAXTEST
 
 test_dirs () {
@@ -70 +70 @@
 # combine file check schedule with one-shot mode 
 # 
-TESTPOLICY_11="
+TESTPOLICY_13="
 [ReadOnly]
 dir=99${BASE}
 "
 
-mod_testdata_11 () {
+mod_testdata_13 () {
     one_sec_sleep 
     echo "foobar" >"${BASE}/c/x"; # bad
@@ -87 +87 @@
 }
 
-chk_testdata_11 () {
+chk_testdata_13 () {
     # CDIRS="a b c a/a a/b a/c a/a/a a/a/b a/a/c a/a/a/a a/a/a/b a/a/a/c";
     tmp=`grep CRIT $LOGFILE | wc -l`
@@ -110 +110 @@
 }
 
-TESTPOLICY_10="
+TESTPOLICY_12="
 [ReadOnly]
 dir=99${BASE}
@@ -119 +119 @@
 "
 
-mod_testdata_10 () {
+mod_testdata_12 () {
     one_sec_sleep
     echo "foobar" >"${BASE}/b/x"; # ok
@@ -129 +129 @@
 }
 
+chk_testdata_12 () {
+    # CDIRS="a b c a/a a/b a/c a/a/a a/a/b a/a/c a/a/a/a a/a/a/b a/a/a/c";
+    tmp=`grep CRIT $LOGFILE | wc -l`
+    if [ $tmp -ne 3 ]; then
+        [ -z "$verbose" ] || log_msg_fail "policy count";
+        return 1
+    fi
+    egrep "CRIT.*POLICY \[ReadOnly\] C-------TS.*${BASE}/c/x" $LOGFILE >/dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        [ -z "$verbose" ] || log_msg_fail "${BASE}/c/x";
+        return 1
+    fi
+    egrep "CRIT.*POLICY \[Attributes\] -----M----.*${BASE}/a/a/x" $LOGFILE >/dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        [ -z "$verbose" ] || log_msg_fail "${BASE}/a/a/x";
+        return 1
+    fi
+    egrep "CRIT.*POLICY \[Attributes\] -----M----.*${BASE}/a/y" $LOGFILE >/dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        [ -z "$verbose" ] || log_msg_fail "${BASE}/a/y";
+        return 1
+    fi
+    CDIRS="a a/a a/b a/c c";
+    NDIRS="b a/a/a a/a/b a/a/c a/a/a/a a/a/a/b a/a/a/c";
+    test_dirs;
+    return $?
+}
+
+#
+# --- ACL/SELinux test case
+#
+TESTPOLICY_11="
+[ReadOnly]
+dir=99${BASE}
+[IgnoreAll]
+dir=-1${BASE}/b
+[Attributes]
+dir=1${BASE}/a
+[Misc]
+UseSelinuxCheck = no
+UseAclCheck = no
+"
+
+mod_testdata_11 () {
+    one_sec_sleep
+    setfacl -m 'user:nobody:r--' "${BASE}/b/x"; # ok (ign)
+    setfacl -m 'user:nobody:r--' "${BASE}/c/x"; # bad
+    setfacl -m 'user:nobody:r--' "${BASE}/a/x"; # bad
+    setfattr -n 'security.selinux' -v "system_u:object_r:etc_t\000" "${BASE}/b/y";    # ok (ign)
+    setfattr -n 'security.selinux' -v "system_u:object_r:etc_t\000" "${BASE}/a/a/a/x";# ok (depth)
+    setfattr -n 'security.selinux' -v "system_u:object_r:etc_t\000" "${BASE}/a/x";    # bad
+    setfattr -n 'security.selinux' -v "system_u:object_r:etc_t\000" "${BASE}/a/y";    # bad
+}
+
+chk_testdata_11 () {
+    # CDIRS="a b c a/a a/b a/c a/a/a a/a/b a/a/c a/a/a/a a/a/a/b a/a/a/c";
+    tmp=`grep CRIT $LOGFILE | wc -l`
+    if [ $tmp -ne 1 ]; then
+        [ -z "$verbose" ] || log_msg_fail "policy count";
+        return 1
+    fi
+    egrep "CRIT.*POLICY \[ReadOnly\] --------T-.*${BASE}/c/x" $LOGFILE >/dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        [ -z "$verbose" ] || log_msg_fail "${BASE}/c/x";
+        return 1
+    fi
+    CDIRS="a a/a a/b a/c c";
+    NDIRS="b a/a/a a/a/b a/a/c a/a/a/a a/a/a/b a/a/a/c";
+    test_dirs;
+    return $?
+}
+
+TESTPOLICY_10="
+[ReadOnly]
+dir=99${BASE}
+[IgnoreAll]
+dir=-1${BASE}/b
+[Attributes]
+dir=1${BASE}/a
+"
+
+mod_testdata_10 () {
+    one_sec_sleep
+    setfacl -m 'user:nobody:r--' "${BASE}/b/x"; # ok (ign)
+    setfacl -m 'user:nobody:r--' "${BASE}/c/x"; # bad
+    setfacl -m 'user:nobody:r--' "${BASE}/a/x"; # bad
+    setfattr -n 'security.selinux' -v "system_u:object_r:etc_t\000" "${BASE}/b/y";    # ok (ign)
+    setfattr -n 'security.selinux' -v "system_u:object_r:etc_t\000" "${BASE}/a/a/a/x";# ok (depth)
+    setfattr -n 'security.selinux' -v "system_u:object_r:etc_t\000" "${BASE}/a/x";    # bad
+    setfattr -n 'security.selinux' -v "system_u:object_r:etc_t\000" "${BASE}/a/y";    # bad
+}
+
 chk_testdata_10 () {
     # CDIRS="a b c a/a a/b a/c a/a/a a/a/b a/a/c a/a/a/a a/a/a/b a/a/a/c";
@@ -136 +228 @@
         return 1
     fi
-    egrep "CRIT.*POLICY \[ReadOnly\] C-------TS.*${BASE}/c/x" $LOGFILE >/dev/null 2>&1
+    egrep "CRIT.*POLICY \[ReadOnly\] -----M--T-.*${BASE}/c/x" $LOGFILE >/dev/null 2>&1
     if [ $? -ne 0 ]; then
         [ -z "$verbose" ] || log_msg_fail "${BASE}/c/x";
         return 1
     fi
-    egrep "CRIT.*POLICY \[Attributes\] -----M----.*${BASE}/a/a/x" $LOGFILE >/dev/null 2>&1
-    if [ $? -ne 0 ]; then
-        [ -z "$verbose" ] || log_msg_fail "${BASE}/a/a/x";
+    egrep "CRIT.*POLICY \[Attributes\] -----M----.*${BASE}/a/x" $LOGFILE >/dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        [ -z "$verbose" ] || log_msg_fail "${BASE}/a/x";
         return 1
     fi
@@ -825 +917 @@
 run_check ()
 {
-    ${VALGRIND} ./samhain -t check -p none -l debug 2>>test_log_valgrind
-
+     ${VALGRIND} ./samhain -t check -p none -l debug 2>>test_log_valgrind
+ 
     if test x$? = x0; then
+
         ./samhain -j -L $LOGFILE >"${LOGFILE}.tmp" && mv "${LOGFILE}.tmp" "${LOGFILE}"
+
         if [ $? -ne 0 ]; then
             [ -z "$quiet" ]   && log_msg_fail  "mv logfile...";
@@ -927 +1021 @@
 {
     if [ $1 -ne 0 ]; then
-        [ -z "$quiet" ] && log_fail ${2} ${MAXTEST};
+        log_fail ${2} ${MAXTEST};
         return 1
     fi
@@ -1012 +1106 @@
               [ -z "$quiet" ] && log_ok ${tcount} ${MAXTEST};
           fi
+          #
           let "tcount = tcount + 1" >/dev/null
+          #
+          if [ -z "$doall" -a $tcount -eq 10 ]; then
+              log_skip 10 $MAXTEST 'ACL/SELinux test (or use --really-all)'
+              let "tcount = tcount + 1" >/dev/null
+          fi
+          #
+          if [ -z "$doall" -a $tcount -eq 11 ]; then
+              log_skip 11 $MAXTEST 'ACL/SELinux test (or use --really-all)'
+              let "tcount = tcount + 1" >/dev/null
+          fi
+          #
           POLICY=`eval echo '"$'"TESTPOLICY_$tcount"'"'`
         done