sp-watch.d
1 #!/usr/sbin/dtrace -qs 2 # 3 # 4 # 5 self unsigned char *cdhash; 6 7 syspolicy*:::assess-* 8 { 9 self->cdhash = 0; 10 } 11 12 self string type; 13 syspolicy*:::assess-outcome-* { self->type = "???"; } 14 syspolicy*:::assess-outcome-* / arg1 == 1 / { self->type = "execute"; } 15 syspolicy*:::assess-outcome-* / arg1 == 2 / { self->type = "install"; } 16 syspolicy*:::assess-outcome-* / arg1 == 3 / { self->type = "open"; } 17 18 syspolicy*:::assess-outcome-accept 19 { 20 printf("accept %s %s;%s", self->type, copyinstr(arg0), copyinstr(arg2)); 21 self->cdhash = copyin(arg3, 20); 22 } 23 24 syspolicy*:::assess-outcome-deny 25 { 26 printf("deny %s %s;%s", self->type, copyinstr(arg0), copyinstr(arg2)); 27 self->cdhash = copyin(arg3, 20); 28 } 29 30 syspolicy*:::assess-outcome-default 31 { 32 printf("default %s %s;%s", self->type, copyinstr(arg0), copyinstr(arg2)); 33 self->cdhash = copyin(arg3, 20); 34 } 35 36 syspolicy*:::assess-outcome-unsigned 37 { 38 printf("unsigned %s %s;", self->type, copyinstr(arg0)); 39 } 40 41 syspolicy*:::assess-* 42 / self->cdhash / 43 { 44 printf(";%02.2x%02.2x%02.2x%02.2x%02.2x%02.2x%02.2x%02.2x%02.2x%02.2x%02.2x%02.2x%02.2x%02.2x%02.2x%02.2x%02.2x%02.2x%02.2x%02.2x", 45 self->cdhash[0], self->cdhash[1], self->cdhash[2], self->cdhash[3], self->cdhash[4], 46 self->cdhash[5], self->cdhash[6], self->cdhash[7], self->cdhash[8], self->cdhash[9], 47 self->cdhash[10], self->cdhash[11], self->cdhash[12], self->cdhash[13], self->cdhash[14], 48 self->cdhash[15], self->cdhash[16], self->cdhash[17], self->cdhash[18], self->cdhash[19]); 49 } 50 51 syspolicy*:::assess-* 52 { 53 printf("\n"); 54 }