interpret.go

// This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at http://mozilla.org/MPL/2.0/.

package libaudit

import (
	"bytes"
	"encoding/hex"
	"fmt"
	"net"
	"os/user"
	"runtime"
	"strconv"
	"strings"
	"syscall"

	"github.com/lunixbochs/struc"
	"github.com/mozilla/libaudit-go/headers"
)

// fieldType denotes the integer values of various fields occuring in audit messages
type fieldType int

const (
	typeUID fieldType = iota
	typeGID
	typeSyscall
	typeArch
	typeExit
	typePerm
	typeEscaped
	typeMode
	typeSockaddr
	typePromisc
	typeCapability
	typeSuccess
	typeA0
	typeA1
	typeA2
	typeA3
	typeSignal
	typeList
	typeTTYData
	typeSession
	typeCapBitmap
	typeNFProto
	typeICMP
	typeProtocol
	typeAddr
	typePersonality
	typeOFlag
	typeSeccomp
	typeMmap
	typeMacLabel
	typeProctile
	typeUnclassified
	typeModeShort
)

// interpretField takes fieldName and the encoded fieldValue (part of the audit message) and
// returns the string representations for the values e.g., syscall numbers to names, uids to
// usernames, etc.
func interpretField(fieldName string, fieldValue string, msgType auditConstant, r record) (string, error) {
	// the code follows the same logic as these auditd functions (call chain is shown) =>
	// auparse_interpret_field() [auparse.c] -> nvlist_interp_cur_val(const rnode *r) [nvlist.c]
	// -> interpret(r) [interpret.c] -> type = auparse_interp_adjust_type(r->type, id.name, id.val); [interpret.c]
	// 	out = auparse_do_interpretation(type, &id); [interpret.c]
	var (
		ftype  fieldType
		result string
		err    error
		ok     bool
	)

	if msgType == AUDIT_EXECVE && strings.HasPrefix(fieldName, "a") &&
		fieldName != "argc" && strings.Index(fieldName, "_len") == -1 {
		ftype = typeEscaped
	} else if msgType == AUDIT_AVC && fieldName == "saddr" {
		ftype = typeUnclassified
	} else if msgType == AUDIT_USER_TTY && fieldName == "msg" {
		ftype = typeEscaped
	} else if msgType == AUDIT_NETFILTER_PKT && fieldName == "saddr" {
		ftype = typeAddr
	} else if fieldName == "acct" {
		if strings.HasPrefix(fieldValue, `"`) {
			ftype = typeEscaped
		} else if _, err := strconv.ParseInt(fieldValue, 16, -1); err != nil {
			ftype = typeEscaped
		} else {
			ftype = typeUnclassified
		}
	} else if msgType == AUDIT_MQ_OPEN && fieldName == "mode" {
		ftype = typeModeShort
	} else if msgType == AUDIT_CRYPTO_KEY_USER && fieldName == "fp" {
		ftype = typeUnclassified
	} else if fieldName == "id" && (msgType == AUDIT_ADD_GROUP || msgType == AUDIT_GRP_MGMT ||
		msgType == AUDIT_DEL_GROUP) {
		ftype = typeGID
	} else {
		if ftype, ok = fieldLookupMap[fieldName]; !ok {
			ftype = typeUnclassified
		}
	}

	switch ftype {
	case typeUID:
		result, err = printUID(fieldValue)
		if err != nil {
			return "", err
		}
	case typeGID:
		// XXX printGID is currently only a stub
		result, err = printGID(fieldValue)
		if err != nil {
			return "", err
		}
	case typeSyscall:
		result, err = printSyscall(fieldValue)
		if err != nil {
			return "", err
		}
	case typeArch:
		return printArch()
	case typeExit:
		result, err = printExit(fieldValue) // peek on exit codes (stderror)
		if err != nil {
			return "", err
		}
	case typePerm:
		result, err = printPerm(fieldValue)
		if err != nil {
			return "", err
		}
	case typeEscaped:
		result, err = printEscaped(fieldValue)
		if err != nil {
			return "", err
		}
	case typeMode:
		result, err = printMode(fieldValue, 8)
		if err != nil {
			return "", err
		}
	case typeModeShort:
		result, err = printModeShort(fieldValue, 8)
		if err != nil {
			return "", err
		}
	case typeSockaddr:
		result, err = printSockAddr(fieldValue)
		if err != nil {
			return "", err
		}
	case typePromisc:
		result, err = printPromiscuous(fieldValue)
		if err != nil {
			return "", err
		}
	case typeCapability:
		result, err = printCapabilities(fieldValue, 10)
		if err != nil {
			return "", err
		}
	case typeSuccess:
		result, err = printSuccess(fieldValue)
		if err != nil {
			return "", err
		}
	case typeA0:
		result, err = printA0(fieldValue, r.syscallNum)
		if err != nil {
			return "", err
		}
	case typeA1:
		result, err = printA1(fieldValue, r.syscallNum, r.a0)
		if err != nil {
			return "", err
		}
	case typeA2:
		result, err = printA2(fieldValue, r.syscallNum, r.a1)
		if err != nil {
			return "", err
		}
	case typeA3:
		result, err = printA3(fieldValue, r.syscallNum)
		if err != nil {
			return "", err
		}
	case typeSignal:
		result, err = printSignals(fieldValue, 10)
		if err != nil {
			return "", err
		}
	case typeList:
		result, err = printList(fieldValue)
		if err != nil {
			return "", err
		}
	case typeTTYData:
		// TODO: add printTTYData (see interpret.c (auparse) for ideas)
		// result, err = printTTYData(fieldValue)
		// if err != nil {
		// 	return "", err
		// }
	case typeSession:
		result, err = printSession(fieldValue)
		if err != nil {
			return "", err
		}
	case typeCapBitmap:
		// TODO: add printCapBitMap (see interpret.c (auparse) for ideas)
		// result, err = printCapBitMap(fieldValue)
		// if err != nil {
		// 	return "", err
		// }
	case typeNFProto:
		result, err = printNFProto(fieldValue)
		if err != nil {
			return "", err
		}
	case typeICMP:
		result, err = printICMP(fieldValue)
		if err != nil {
			return "", err
		}
	case typeProtocol:
		// getprotobynumber
		// result, err = printProtocol(fieldValue)
		// if err != nil {
		// 	return "", err
		// }
	case typeAddr:
		result, err = printAddr(fieldValue)
		if err != nil {
			return "", err
		}
	case typePersonality:
		result, err = printPersonality(fieldValue)
		if err != nil {
			return "", err
		}
	case typeOFlag:
		result, err = printOpenFlags(fieldValue)
		if err != nil {
			return "", err
		}
	case typeSeccomp:
		result, err = printSeccompCode(fieldValue)
		if err != nil {
			return "", err
		}
	case typeMmap:
		result, err = printMmap(fieldValue)
		if err != nil {
			return "", err
		}
	case typeProctile:
		// Printing proctitle is same as printing escaped
		result, err = printEscaped(fieldValue)
		if err != nil {
			return "", err
		}
	case typeMacLabel:
		fallthrough
	case typeUnclassified:
		fallthrough
	default:
		result = fieldValue
	}

	return result, nil
}

func printUID(fieldValue string) (string, error) {
	name, err := user.LookupId(fieldValue)
	if err != nil {
		return fmt.Sprintf("unknown(%v)", fieldValue), nil
	}
	return name.Username, nil
}

func printGID(fieldValue string) (string, error) {
	return fieldValue, nil
}

func printSyscall(fieldValue string) (string, error) {
	name, err := syscallToName(fieldValue)
	if err != nil {
		return "", err
	}
	return name, nil
}

func printArch() (string, error) {
	return runtime.GOARCH, nil
}

func printExit(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 10, 64)
	if err != nil {
		return "", err
	}
	// c version of this method tries to retrieve string description of the error code
	// ignoring the same approach as the codes can vary
	if ival == 0 {
		return "success", nil
	}
	return fieldValue, nil
}

func printPerm(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 10, 64)
	if err != nil {
		return "", err
	}
	var perm string
	if ival == 0 {
		ival = 0x0F
	}
	if ival&AUDIT_PERM_READ > 0 {
		perm += "read"
	}
	if ival&AUDIT_PERM_WRITE > 0 {
		if len(perm) > 0 {
			perm += ",write"
		} else {
			perm += "write"
		}
	}
	if ival&AUDIT_PERM_EXEC > 0 {
		if len(perm) > 0 {
			perm += ",exec"
		} else {
			perm += "exec"
		}
	}
	if ival&AUDIT_PERM_ATTR > 0 {
		if len(perm) > 0 {
			perm += ",attr"
		} else {
			perm += "attr"
		}
	}
	return perm, nil
}

func printMode(fieldValue string, base int) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, base, 64)
	if err != nil {
		return "", err
	}
	var name string
	firstIFMTbit := syscall.S_IFMT & ^(syscall.S_IFMT - 1)
	if syscall.S_IFMT&ival == syscall.S_IFSOCK {
		name = "socket"
	} else if syscall.S_IFMT&ival == syscall.S_IFBLK {
		name = "block"
	} else if syscall.S_IFMT&ival == syscall.S_IFREG {
		name = "file"
	} else if syscall.S_IFMT&ival == syscall.S_IFDIR {
		name = "dir"
	} else if syscall.S_IFMT&ival == syscall.S_IFCHR {
		name = "character"
	} else if syscall.S_IFMT&ival == syscall.S_IFIFO {
		name = "fifo"
	} else if syscall.S_IFMT&ival == syscall.S_IFLNK {
		name = "link"
	} else {
		name += fmt.Sprintf("%03o", (int(ival)&syscall.S_IFMT)/firstIFMTbit)
	}
	// check on special bits
	if ival&syscall.S_ISUID > 0 {
		name += ",suid"
	}
	if ival&syscall.S_ISGID > 0 {
		name += ",sgid"
	}
	if ival&syscall.S_ISVTX > 0 {
		name += ",sticky"
	}
	// the read, write, execute flags in octal
	name += fmt.Sprintf("%03o", ((syscall.S_IRWXU | syscall.S_IRWXG | syscall.S_IRWXO) & int(ival)))
	return name, nil
}

func printModeShort(fieldValue string, base int) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, base, 64)
	if err != nil {
		return "", err
	}
	return printModeShortInt(ival)
}

func printModeShortInt(ival int64) (string, error) {
	var name string
	// check on special bits
	if ival&syscall.S_ISUID > 0 {
		name += "suid"
	}
	if ival&syscall.S_ISGID > 0 {
		if len(name) > 0 {
			name += ","
		}
		name += "sgid"
	}
	if ival&syscall.S_ISVTX > 0 {
		if len(name) > 0 {
			name += ","
		}
		name += "sticky"
	}
	name += fmt.Sprintf("0%03o", ((syscall.S_IRWXU | syscall.S_IRWXG | syscall.S_IRWXO) & int(ival)))

	return name, nil
}

func printSockAddr(fieldValue string) (string, error) {
	// representations of c struct to unpack bytestream into
	type sockaddr struct {
		SaFamily uint16   `struc:"uint16,little"`   // address family, AF_xxx
		SaData   [14]byte `struc:"[14]byte,little"` // 14 bytes of protocol address
	}

	type sockaddrUn struct {
		SunFamily uint16    `struc:"uint16,little"`    /* AF_UNIX */
		SunPath   [108]byte `struc:"[108]byte,little"` /* pathname */
	}

	type sockaddrNl struct {
		SunFamily uint16 `struc:"uint16,little"` /* AF_NETLINK */
		NlPad     uint16 `struc:"uint16,little"` /* Zero. */
		NlPid     int32  `struc:"int32,little"`  /* Port ID. */
		NlGroups  uint32 `struc:"uint32,little"` /* Multicast groups mask. */
	}

	type sockaddrLl struct {
		SllFamily   uint16  `struc:"uint16,little"`  /* Always AF_PACKET */
		SllProtocol uint16  `struc:"uint16,little"`  /* Physical-layer protocol */
		SllIfindex  int32   `struc:"int32,little"`   /* Interface number */
		SllHatype   uint16  `struc:"uint16,little"`  /* ARP hardware type */
		SllPkttype  byte    `struc:"byte,little"`    /* Packet type */
		SllHalen    byte    `struc:"byte,little"`    /* Length of address */
		SllAddr     [8]byte `struc:"[8]byte,little"` /* Physical-layer address */
	}

	type sockaddrIn struct {
		SinFamily uint16  `struc:"uint16,little"` // e.g. AF_INET, AF_INET6
		SinPort   uint16  `struc:"uint16,big"`    // port in network byte order
		InAddr    [4]byte `struc:"[4]byte,big"`   // address in network byte order
		SinZero   [8]byte `struc:"[8]byte,little"`
	}

	type sockaddrIn6 struct {
		Sin6Family   uint16   `struc:"uint16,little"` // address family, AF_INET6
		Sin6Port     uint16   `struc:"uint16,big"`    // port in network byte order
		Sin6Flowinfo uint32   `struc:"uint32,little"` // IPv6 flow information
		Sin6Addr     [16]byte `struc:"[16]byte,big"`  // IPv6 address
		Sin6ScopeID  uint32   `struc:"uint32,little"` // Scope ID
	}

	var (
		name string
		s    sockaddr
	)

	bytestr, err := hex.DecodeString(fieldValue)
	if err != nil {
		return fieldValue, err
	}

	buf := bytes.NewBuffer(bytestr)
	err = struc.Unpack(buf, &s)
	if err != nil {
		return fieldValue, err
	}
	family := int(s.SaFamily)

	if _, ok := headers.SocketFamLookup[int(family)]; !ok {
		return fmt.Sprintf("unknown family (%v)", family), nil
	}

	errstring := fmt.Errorf("%s (error resolving addr)", headers.SocketFamLookup[family])

	switch family {
	case syscall.AF_LOCAL:
		var p sockaddrUn
		nbuf := bytes.NewBuffer(bytestr)

		err = struc.Unpack(nbuf, &p)
		if err != nil {
			return fieldValue, errstring
		}
		name = fmt.Sprintf("%s %s", headers.SocketFamLookup[family], string(p.SunPath[:]))
		return name, nil
	case syscall.AF_INET:
		var ip4 sockaddrIn

		nbuf := bytes.NewBuffer(bytestr)
		err = struc.Unpack(nbuf, &ip4)
		if err != nil {
			return fieldValue, errstring
		}
		addrBytes := ip4.InAddr[:]
		var x net.IP = addrBytes
		name = fmt.Sprintf("%s host:%s serv:%d", headers.SocketFamLookup[family], x.String(), ip4.SinPort)
		return name, nil
	case syscall.AF_INET6:
		var ip6 sockaddrIn6
		nbuf := bytes.NewBuffer(bytestr)
		err = struc.Unpack(nbuf, &ip6)
		if err != nil {
			return fieldValue, errstring
		}
		addrBytes := ip6.Sin6Addr[:]
		var x net.IP = addrBytes
		name = fmt.Sprintf("%s host:%s serv:%d", headers.SocketFamLookup[family], x.String(), ip6.Sin6Port)
		return name, nil
	case syscall.AF_NETLINK:
		var n sockaddrNl

		nbuf := bytes.NewBuffer(bytestr)
		err = struc.Unpack(nbuf, &n)
		if err != nil {
			return fieldValue, errstring
		}
		name = fmt.Sprintf("%s pid:%d", headers.SocketFamLookup[family], n.NlPid)
		return name, nil
	case syscall.AF_PACKET:
		var l sockaddrLl

		nbuf := bytes.NewBuffer(bytestr)
		err = struc.Unpack(nbuf, &l)
		if err != nil {
			return fieldValue, errstring
		}
		// TODO: decide on kind of information to return
		// currently only returning the family name
		// name = fmt.Sprintf("%s pid:%u", famLookup[family], l.)
		return headers.SocketFamLookup[family], nil
	}
	return headers.SocketFamLookup[family], nil
}

// this is currently just a stub as its only used in RHEL kernels, interpretation
// can be added, see auparse -> interpret.c -> print_flags()
func printFlags(fieldValue string) (string, error) {
	return fieldValue, nil
}

func printEscaped(fieldValue string) (string, error) {
	if fieldValue[0] == '"' && fieldValue[len(fieldValue)-1] == '"' {
		return fieldValue[1 : len(fieldValue)-1], nil
	}
	if strings.HasPrefix(fieldValue, "00") {
		newStr := unescape(fieldValue[2:])
		if newStr == "" {
			return fieldValue, nil
		}
	}
	newStr := unescape(fieldValue)
	if newStr == "" {
		return fieldValue, nil
	}

	return newStr, nil
}

func unescape(fieldvalue string) string {
	if strings.HasPrefix(fieldvalue, "(") {
		return fieldvalue
	}
	if len(fieldvalue) < 2 {
		return ""
	}
	var str []byte
	// try to chop 2 characters at a time and convert them from hexadecimal to decimal
	str, err := hex.DecodeString(fieldvalue)
	if err != nil {
		return fieldvalue
	}
	return string(str)
}

func printPromiscuous(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 10, 64)
	if err != nil {
		return "", err
	}
	if ival == 0 {
		return "no", nil
	}
	return "yes", nil
}

func printCapabilities(fieldValue string, base int) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, base, 64)
	if err != nil {
		return "", err
	}
	cap, ok := headers.CapabLookup[int(ival)]
	if ok {
		return cap, nil
	}
	if base == 16 {
		return fmt.Sprintf("unknown capability(0x%d)", ival), nil
	}
	return fmt.Sprintf("unknown capability(%d)", ival), nil
}

func printSuccess(fieldValue string) (string, error) {

	ival, err := strconv.ParseInt(fieldValue, 10, 64)
	if err != nil {
		// if we are unable to parse success values just return them as is,
		// behaviour is the same as auparse interpret.c
		return fieldValue, nil
	}
	const (
		sUnset  = -1
		sFailed = iota
		sSuccess
	)

	switch int(ival) {
	case sSuccess:
		return "yes", nil
	case sFailed:
		return "no", nil
	default:
		return "unset", nil
	}

}

func printA0(fieldValue string, sysNum string) (string, error) {
	name, err := syscallToName(sysNum)
	if err != nil {
		return "", err
	}
	if strings.HasPrefix(name, "r") {
		if name == "rt_sigaction" {
			return printSignals(fieldValue, 16)
		} else if name == "renameat" {
			return printDirFd(fieldValue)
		} else if name == "readlinkat" {
			return printDirFd(fieldValue)
		}
	} else if strings.HasPrefix(name, "c") {
		if name == "clone" {
			return printCloneFlags(fieldValue)
		} else if name == "clock_settime" {
			return printClockID(fieldValue)
		}
	} else if strings.HasPrefix(name, "p") {
		if name == "personality" {
			return printPersonality(fieldValue)
		} else if name == "ptrace" {
			return printPtrace(fieldValue)
		} else if name == "prctl" {
			return printPrctlOpt(fieldValue)
		}
	} else if strings.HasPrefix(name, "m") {
		if name == "mkdirat" {
			return printDirFd(fieldValue)
		} else if name == "mknodat" {
			return printDirFd(fieldValue)
		}
	} else if strings.HasPrefix(name, "f") {
		if name == "fchownat" {
			return printDirFd(fieldValue)
		} else if name == "futimesat" {
			return printDirFd(fieldValue)
		} else if name == "fchmodat" {
			return printDirFd(fieldValue)
		} else if name == "faccessat" {
			return printDirFd(fieldValue)
		} else if name == "ftimensat" {
			return printDirFd(fieldValue)
		}
	} else if strings.HasPrefix(name, "u") {
		if name == "unshare" {
			return printCloneFlags(fieldValue)
		} else if name == "unlinkat" {
			return printDirFd(fieldValue)
		} else if name == "utimesat" {
			return printDirFd(fieldValue)
		} else if name == "etrlimit" {
			return printRLimit(fieldValue)
		}
	} else if strings.HasPrefix(name, "s") {
		if name == "setuid" {
			return printUID(fieldValue)
		} else if name == "setreuid" {
			return printUID(fieldValue)
		} else if name == "setresuid" {
			return printUID(fieldValue)
		} else if name == "setfsuid" {
			return printUID(fieldValue)
		} else if name == "setgid" {
			return printGID(fieldValue)
		} else if name == "setregid" {
			return printGID(fieldValue)
		} else if name == "setresgid" {
			return printGID(fieldValue)
		} else if name == "socket" {
			return printSocketDomain(fieldValue)
		} else if name == "setfsgid" {
			return printGID(fieldValue)
		} else if name == "socketcall" {
			return printSocketCall(fieldValue, 16)
		}
	} else if name == "linkat" {
		return printDirFd(fieldValue)
	} else if name == "newfsstat" {
		return printDirFd(fieldValue)
	} else if name == "openat" {
		return printDirFd(fieldValue)
	} else if name == "ipccall" {
		return printIpcCall(fieldValue, 16)
	}

	return fmt.Sprintf("0x%s", fieldValue), nil
}

func printSignals(fieldValue string, base int) (string, error) {

	ival, err := strconv.ParseInt(fieldValue, base, 64)
	if err != nil {
		return "", err
	}
	if ival < 31 {
		return headers.SignalLookup[int(ival)], nil
	}
	if base == 16 {
		return fmt.Sprintf("unknown signal (0x%s)", fieldValue), nil
	}
	return fmt.Sprintf("unknown signal (%s)", fieldValue), nil
}

func printDirFd(fieldValue string) (string, error) {
	if fieldValue == "-100" {
		return "AT_FDWD", nil
	}
	return fmt.Sprintf("0x%s", fieldValue), nil
}

func printCloneFlags(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}

	var name string
	for key, val := range headers.CloneLookUp {
		if key&int(ival) > 0 {
			if len(name) > 0 {
				name += "|"
			}
			name += val
		}
	}
	var cloneSignal = ival & 0xFF
	if cloneSignal > 0 && cloneSignal < 32 {
		if len(name) > 0 {
			name += "|"
		}
		name += headers.SignalLookup[int(cloneSignal)]
	}
	if len(name) == 0 {
		return fmt.Sprintf("0x%d", ival), nil
	}
	return name, nil
}

func printClockID(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if ival < 7 {
		return headers.ClockLookup[int(ival)], nil
	}
	return fmt.Sprintf("unknown clk_id (0x%s)", fieldValue), nil
}

// TODO: add personality interpretation
// see auparse -> interpret.c -> print_personality() lookup table persontab.h
func printPersonality(fieldValue string) (string, error) {
	return fieldValue, nil
}

func printPtrace(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.PtraceLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown ptrace (0x%s)", fieldValue), nil
	}
	return headers.PtraceLookup[int(ival)], nil
}

func printPrctlOpt(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.PrctlLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown prctl option (0x%s)", fieldValue), nil
	}
	return headers.PrctlLookup[int(ival)], nil
}

func printSocketDomain(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.SocketFamLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown family (0x%s)", fieldValue), nil
	}
	return headers.SocketFamLookup[int(ival)], nil

}

func printSocketCall(fieldValue string, base int) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.SockLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown socketcall (0x%s)", fieldValue), nil
	}
	return headers.SockLookup[int(ival)], nil
}

func printRLimit(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.RlimitLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown rlimit (0x%s)", fieldValue), nil
	}
	return headers.RlimitLookup[int(ival)], nil
}

func printIpcCall(fieldValue string, base int) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.IpccallLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown ipccall (%s)", fieldValue), nil
	}
	return headers.IpccallLookup[int(ival)], nil
}

func printA1(fieldValue, sysNum string, a0 int) (string, error) {
	name, err := syscallToName(sysNum)
	if err != nil {
		return "", err
	}
	if strings.HasPrefix(name, "f") {
		if name == "fchmod" {
			return printModeShort(fieldValue, 16)
		} else if name == "fcntl" {
			return printFcntlCmd(fieldValue)
		}
	}
	if strings.HasPrefix(name, "c") {
		if name == "chmod" {
			return printModeShort(fieldValue, 16)
		} else if k := strings.Index(name, "chown"); k != -1 {
			return printUID(fieldValue)
		} else if name == "creat" {
			return printModeShort(fieldValue, 16)
		}
	}
	if name[1:] == "etsocketopt" {
		return printSockOptLevel(fieldValue)
	} else if strings.HasPrefix(name, "s") {
		if name == "setreuid" {
			return printUID(fieldValue)
		} else if name == "setresuid" {
			return printUID(fieldValue)
		} else if name == "setregid" {
			return printGID(fieldValue)
		} else if name == "setresgid" {
			return printGID(fieldValue)
		} else if name == "socket" {
			return printSocketType(fieldValue)
		} else if name == "setns" {
			return printCloneFlags(fieldValue)
		} else if name == "sched_setscheduler" {
			return printSched(fieldValue)
		}
	} else if strings.HasPrefix(name, "m") {
		if name == "mkdir" {
			return printModeShort(fieldValue, 16)
		} else if name == "mknod" {
			return printMode(fieldValue, 16)
		} else if name == "mq_open" {
			return printOpenFlags(fieldValue)
		}
	} else if name == "open" {
		return printOpenFlags(fieldValue)
	} else if name == "access" {
		return printAccess(fieldValue)
	} else if name == "epoll_ctl" {
		return printEpollCtl(fieldValue)
	} else if name == "kill" {
		return printSignals(fieldValue, 16)
	} else if name == "prctl" {
		if a0 == syscall.PR_CAPBSET_READ || a0 == syscall.PR_CAPBSET_DROP {
			return printCapabilities(fieldValue, 16)
		} else if a0 == syscall.PR_SET_PDEATHSIG {
			return printSignals(fieldValue, 16)
		}
	} else if name == "tkill" {
		return printSignals(fieldValue, 16)
	} else if name == "umount2" {
		return printUmount(fieldValue)
	} else if name == "ioctl" {
		return printIoctlReq(fieldValue)
	}
	return fmt.Sprintf("0x%s", fieldValue), nil
}

func printFcntlCmd(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.FcntlLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown fcntl command(%d)", ival), nil
	}
	return headers.FcntlLookup[int(ival)], nil
}

func printSocketType(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.SockTypeLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown socket type(%d)", ival), nil
	}
	return headers.SockTypeLookup[int(ival)], nil
}

func printSched(fieldValue string) (string, error) {
	const schedResetOnFork int64 = 0x40000000
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.SchedLookup[int(ival)&0x0F]; !ok {
		return fmt.Sprintf("unknown scheduler policy (0x%s)", fieldValue), nil
	}
	if ival&schedResetOnFork > 0 {
		return headers.SchedLookup[int(ival)] + "|SCHED_RESET_ON_FORK", nil
	}
	return headers.SchedLookup[int(ival)], nil
}

// TODO: add interpretation
// see auparse -> interpret.c -> print_open_flags() for ideas
// useful for debugging rather than forensics actual policy is to filter either on open or write or both
// and emit msg that this happened so if its opened in r,rw, etc. All endup looking the same i.e READ or WRITE
// auparse specific table is open-flagtab.h.
func printOpenFlags(fieldValue string) (string, error) {
	// look at table of values from /usr/include/asm-generic/fcntl.h
	return fieldValue, nil
}

// policy is to only log success or denial but not read the actual value
// ie make a rule on the arguments but dont read it and just trust that right rule is reported
// auparse specific table is accesstab.h
func printAccess(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if ival&0x0F == 0 {
		return "F_OK", nil
	}
	var name string
	for key, val := range headers.AccessLookUp {
		if key&int(ival) > 0 {
			if len(name) > 0 {
				name += "|"
			}
			name += val
		}
	}
	if len(name) == 0 {
		return fmt.Sprintf("0x%s", fieldValue), nil
	}
	return name, nil
}

func printEpollCtl(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.EpollLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown epoll_ctl operation (%d)", ival), nil
	}
	return headers.EpollLookup[int(ival)], nil
}

func printUmount(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	var name string
	for key, val := range headers.UmountLookUp {
		if key&int(ival) > 0 {
			if len(name) > 0 {
				name += "|"
			}
			name += val
		}
	}

	if len(name) == 0 {
		return fmt.Sprintf("0x%s", fieldValue), nil
	}
	return name, nil
}

func printIoctlReq(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}

	if _, ok := headers.IoctlLookup[int(ival)]; !ok {
		return fmt.Sprintf("0x%s", fieldValue), nil
	}
	return headers.IoctlLookup[int(ival)], nil
}

// TODO: add interpretation
// see auparse -> interpret.c -> print_sock_opt_level
// needs a go implementation of getprotobynumber
func printSockOptLevel(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if ival == syscall.SOL_SOCKET {
		return "SOL_SOCKET", nil
	}
	// pure go implementation of getprotobynumber
	// if not find by getprotobynumber use map
	if _, ok := headers.SockOptLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown sockopt level (0x%s)", fieldValue), nil
	}
	return headers.SockOptLookup[int(ival)], nil
}

// TODO: add interpretation
// see auparse -> interpret.c -> print_socket_proto
// add pure go implementation of getprotobynumber
func printSocketProto(fieldValue string) (string, error) {
	// ival, err := strconv.ParseInt(fieldValue, 16, 64)
	// if err != nil {
	// 	return "", err
	// }
	//protocol = getprotobynumber(ival)
	// if not found
	// return fmt.Sprintf("unknown proto(%s)", fieldValue), nil
	return fieldValue, nil
}

func printA2(fieldValue, sysNum string, a1 int) (string, error) {
	name, err := syscallToName(sysNum)
	if err != nil {
		return "", err
	}
	if name == "fcntl" {
		ival, err := strconv.ParseInt(fieldValue, 16, 64)
		if err != nil {
			return "", err
		}
		switch a1 {
		case syscall.F_SETOWN:
			return printUID(fieldValue)
		case syscall.F_SETFD:
			if ival == syscall.FD_CLOEXEC {
				return "FD_CLOSEXEC", nil
			}
		case syscall.F_SETFL:
		case syscall.F_SETLEASE:
		case syscall.F_GETLEASE:
		case syscall.F_NOTIFY:
		}
	} else if name[1:] == "esockopt" {
		if a1 == syscall.IPPROTO_IP {
			return printIPOptName(fieldValue)
		} else if a1 == syscall.SOL_SOCKET {
			return printSockOptName(fieldValue) // add machine ?
		} else if a1 == syscall.IPPROTO_UDP {
			return printUDPOptName(fieldValue)
		} else if a1 == syscall.IPPROTO_IPV6 {
			return printIP6OptName(fieldValue)
		} else if a1 == syscall.SOL_PACKET {
			return printPktOptName(fieldValue)
		}
		return fmt.Sprintf("0x%s", fieldValue), nil
	} else if strings.HasPrefix(name, "o") {
		if name == "openat" {
			return printOpenFlags(fieldValue)
		}
		if name == "open" && (a1&syscall.O_CREAT > 0) {
			return printModeShort(fieldValue, 16)
		}
	} else if strings.HasPrefix(name, "f") {
		if name == "fchmodat" {
			return printModeShort(fieldValue, 16)
		} else if name == "faccessat" {
			return printAccess(fieldValue)
		}
	} else if strings.HasPrefix(name, "s") {
		if name == "setresuid" {
			return printUID(fieldValue)
		} else if name == "setresgid" {
			return printGID(fieldValue)
		} else if name == "socket" {
			return printSocketProto(fieldValue)
		} else if name == "sendmsg" {
			return printRecv(fieldValue)
		} else if name == "shmget" {
			return printSHMFlags(fieldValue)
		}
	} else if strings.HasPrefix(name, "m") {
		if name == "mmap" {
			return printProt(fieldValue, 1)
		} else if name == "mkdirat" {
			return printModeShort(fieldValue, 16)
		} else if name == "mknodat" {
			return printModeShort(fieldValue, 16)
		} else if name == "mprotect" {
			return printProt(fieldValue, 0)
		} else if name == "mqopen" && a1&syscall.O_CREAT > 0 {
			return printModeShort(fieldValue, 16)
		}
	} else if strings.HasPrefix(name, "r") {
		if name == "recvmsg" {
			return printRecv(fieldValue)
		} else if name == "readlinkat" {
			return printDirFd(fieldValue)
		}
	} else if strings.HasPrefix(name, "l") {
		if name == "linkat" {
			return printDirFd(fieldValue)
		} else if name == "lseek" {
			return printSeek(fieldValue)
		}
	} else if name == "chown" {
		return printGID(fieldValue)
	} else if name == "tgkill" {
		return printSignals(fieldValue, 16)
	}
	return fmt.Sprintf("0x%s", fieldValue), nil
}

func printIPOptName(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.IpOptLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown ipopt name (0x%s)", fieldValue), nil
	}
	return headers.IpOptLookup[int(ival)], nil
}

func printIP6OptName(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.Ip6OptLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown ip6opt name (0x%s)", fieldValue), nil
	}
	return headers.Ip6OptLookup[int(ival)], nil
}

func printTCPOptName(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.TcpOptLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown tcpopt name (0x%s)", fieldValue), nil
	}
	return headers.TcpOptLookup[int(ival)], nil
}

func printUDPOptName(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if ival == 1 {
		return "UDP_CORK", nil
	} else if ival == 100 {
		return "UDP_ENCAP", nil
	}

	return fmt.Sprintf("unknown udpopt name (0x%s)", fieldValue), nil
}

func printPktOptName(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.PktOptLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown pktopt name (0x%s)", fieldValue), nil
	}
	return headers.PktOptLookup[int(ival)], nil
}

// printSHMFlags - What are the actual values from table ( are they in binary?)
func printSHMFlags(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	var ipccmdLookUp = map[int]string{
		00001000: "IPC_CREAT",
		00002000: "IPC_EXCL",
		00004000: "IPC_NOWAIT",
	}
	var name string
	var partial = ival & 00003000
	for key, val := range ipccmdLookUp {
		if key&int(partial) > 0 {
			if len(name) > 0 {
				name += "|"
			}
			name += val
		}
	}
	partial = ival & 00014000
	var shmLookUp = map[int]string{
		00001000: "SHM_DEST",
		00002000: "SHM_LOCKED",
		00004000: "SHM_HUGETLB",
		00010000: "SHM_NORESERVE",
	}
	for key, val := range shmLookUp {
		if key&int(partial) > 0 {
			if len(name) > 0 {
				name += "|"
			}
			name += val
		}
	}
	partial = ival & 000777
	tmode, err := printModeShortInt(partial)
	if err != nil {
		return "", err
	}
	if len(name) > 0 {
		name += "|"
	}
	name += tmode

	if len(name) == 0 {
		return fmt.Sprintf("0x%s", fieldValue), nil
	}

	return name, nil
}

func printProt(fieldValue string, isMmap int) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if ival&0x07 == 0 {
		return "PROT_NONE", nil
	}

	var name string
	for key, val := range headers.ProtLookUp {
		if key&int(ival) > 0 {
			if len(name) > 0 {
				name += "|"
			}
			// skip last key if isMmap == 0
			if isMmap == 0 && val == "PROT_SEM" {
				continue
			}
			name += val
		}
	}

	if len(name) == 0 {
		return fmt.Sprintf("0x%s", fieldValue), nil
	}

	return name, nil
}

func printSockOptName(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.SockOptNameLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown sockopt name (0x%s)", fieldValue), nil
	}
	return headers.SockOptNameLookup[int(ival)], nil
}

func printRecv(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	var name string
	for key, val := range headers.RecvLookUp {
		if key&int(ival) > 0 {
			if len(name) > 0 {
				name += "|"
			}
			name += val
		}
	}

	if len(name) == 0 {
		return fmt.Sprintf("0x%s", fieldValue), nil
	}
	return name, nil
}

func printSeek(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	var whence = int(ival) & 0xFF
	if _, ok := headers.SeekLookup[whence]; !ok {
		return fmt.Sprintf("unknown whence(0x%s)", fieldValue), nil
	}
	return headers.SeekLookup[whence], nil
}

func printA3(fieldValue, sysNum string) (string, error) {
	name, err := syscallToName(sysNum)
	if err != nil {
		return "", err
	}
	if strings.HasPrefix(name, "m") {
		if name == "mmap" {
			return printMmap(fieldValue)
		} else if name == "mount" {
			return printMount(fieldValue)
		}
	} else if strings.HasPrefix(name, "r") {
		if name == "recv" {
			return printRecv(fieldValue)
		} else if name == "recvfrom" {
			return printRecv(fieldValue)
		} else if name == "recvmsg" {
			return printRecv(fieldValue)
		}
	} else if strings.HasPrefix(name, "s") {
		if name == "send" {
			return printRecv(fieldValue)
		} else if name == "sendto" {
			return printRecv(fieldValue)
		} else if name == "sendmmsg" {
			return printRecv(fieldValue)
		}
	}
	return fmt.Sprintf("0x%s", fieldValue), nil
}

func printMmap(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	var name string
	if ival&0x0F == 0 {
		name += "MAP_FILE"
	}
	for key, val := range headers.MmapLookUp {
		if key&int(ival) > 0 {
			if len(name) > 0 {
				name += "|"
			}
			name += val
		}
	}

	if len(name) == 0 {
		return fmt.Sprintf("0x%s", fieldValue), nil
	}
	return name, nil
}

func printMount(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	var name string
	for key, val := range headers.MountLookUp {
		if key&int(ival) > 0 {
			if len(name) > 0 {
				name += "|"
			}
			name += val
		}
	}

	if len(name) == 0 {
		return fmt.Sprintf("0x%s", fieldValue), nil
	}
	return name, nil
}

func printSession(fieldValue string) (string, error) {
	if fieldValue == "4294967295" {
		return "unset", nil
	}
	return fieldValue, nil
}

func printNFProto(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 10, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.NfProtoLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown netfilter protocol (%s)", fieldValue), nil
	}
	return headers.NfProtoLookup[int(ival)], nil
}

func printICMP(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 10, 64)
	if err != nil {
		return "", err
	}
	if _, ok := headers.IcmpLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown icmp type (%s)", fieldValue), nil
	}
	return headers.IcmpLookup[int(ival)], nil
}

func printAddr(fieldValue string) (string, error) {
	return fieldValue, nil
}

func printSeccompCode(fieldValue string) (string, error) {
	if strings.HasPrefix(fieldValue, "0x") {
		fieldValue = fieldValue[2:]
	}
	ival, err := strconv.ParseInt(fieldValue, 16, 64)
	if err != nil {
		return "", err
	}
	var SECCOMPRETACTION = 0x7fff0000
	if _, ok := headers.SeccompCodeLookUp[int(ival)&SECCOMPRETACTION]; !ok {
		return fmt.Sprintf("unknown seccomp code (%s)", fieldValue), nil
	}
	return headers.SeccompCodeLookUp[int(ival)&SECCOMPRETACTION], nil
}

func printList(fieldValue string) (string, error) {
	ival, err := strconv.ParseInt(fieldValue, 10, 64)
	if err != nil {
		return "", err
	}
	if _, ok := flagLookup[int(ival)]; !ok {
		return fmt.Sprintf("unknown list (%s)", fieldValue), nil
	}
	return flagLookup[int(ival)], nil
}