54 lines
1.3 KiB
Python
54 lines
1.3 KiB
Python
#!/usr/bin/env python3
|
|
"""Shared policy for the small set of user-facing audit events."""
|
|
|
|
import os
|
|
from typing import Optional, Tuple
|
|
|
|
|
|
AUDIT_ACTIONS = frozenset({"read", "write", "move", "delete"})
|
|
|
|
OPERATION_ACTIONS = {
|
|
"read": "read",
|
|
"pread": "read",
|
|
"pread_recv": "read",
|
|
"pread_send": "read",
|
|
"sendfile": "read",
|
|
"offload_read_recv": "read",
|
|
"offload_read_send": "read",
|
|
"write": "write",
|
|
"pwrite": "write",
|
|
"pwrite_recv": "write",
|
|
"pwrite_send": "write",
|
|
"recvfile": "write",
|
|
"offload_write_recv": "write",
|
|
"offload_write_send": "write",
|
|
"renameat": "move",
|
|
"rename": "move",
|
|
"unlinkat": "delete",
|
|
"unlink": "delete",
|
|
"rmdir": "delete",
|
|
}
|
|
|
|
|
|
def action_for(operation: str) -> Optional[str]:
|
|
return OPERATION_ACTIONS.get(operation.strip().casefold())
|
|
|
|
|
|
def skipped_user_suffixes() -> Tuple[str, ...]:
|
|
raw = os.getenv("AUDIT_SKIP_USER_SUFFIXES", "_svc,_ServiceAcc")
|
|
return tuple(
|
|
suffix.strip().casefold()
|
|
for suffix in raw.split(",")
|
|
if suffix.strip()
|
|
)
|
|
|
|
|
|
def account_name(user: str) -> str:
|
|
account = user.strip().rsplit("\\", 1)[-1]
|
|
return account.split("@", 1)[0]
|
|
|
|
|
|
def skip_user(user: str) -> bool:
|
|
account = account_name(user).casefold()
|
|
return any(account.endswith(suffix) for suffix in skipped_user_suffixes())
|