improve text generation for process groups

Author: stevegrubb

auparse/internal.h

@@ -194,6 +194,7 @@ void aup_free_config(struct daemon_conf *config);
 
 /* Resolve @name to a uid, caching the result for future lookups. */
 uid_t lookup_uid_from_name(auparse_state_t *au, const char *name);
+
 // normalize.c
 void init_normalizer(normalize_data *d);
 void clear_normalizer(normalize_data *d);

auparse/normalize.c

@@ -797,8 +797,6 @@ static int normalize_syscall(auparse_state_t *au, const char *syscall)
 						auparse_get_record_num(au));
 					attr = set_field(attr,
 						auparse_get_field_num(au));
-					if (is_unset(D.thing.primary))
-						D.thing.primary = attr;
 					cllist_append(&D.thing.attr, attr,
 							NULL);
 				}
@@ -2264,6 +2262,11 @@ const char *auparse_normalize_object_kind(const auparse_state_t *au)
 	return normalize_obj_kind_map_i2s(D.thing.what);
 }
 
+int auparse_normalize_object_kind_int(const auparse_state_t *au)
+{
+	return D.thing.what;
+}
+
 int auparse_normalize_get_results(auparse_state_t *au)
 {
 	return seek_field(au, D.results);

src/ausearch-report.c

@@ -34,6 +34,7 @@
 #include "auparse.h"
 #include "auparse-idata.h"
 #include "auditd-config.h"
+#include "normalize-internal.h"	// pid list
 
 static int interp_init = 0;
 static auparse_state_t *au = NULL;
@@ -691,6 +692,7 @@ static void csv_event(auparse_state_t *au,
 
 /* This function will output a normalized line of audit
  * fields one line per event as an english sentence */
+extern int auparse_normalize_object_kind_int(const auparse_state_t *au);
 static void text_event(auparse_state_t *au,
 		auparse_cb_event_t cb_event_type, void *user_data)
 {
@@ -800,6 +802,33 @@ static void text_event(auparse_state_t *au,
 		printf("to %s ", val);
 	}
 
+	// Print pid list if process group
+	int kind = auparse_normalize_object_kind_int(au);
+	if (kind == NORM_WHAT_PROCESS_GROUP || kind == NORM_WHAT_PROCESS) {
+		rc = auparse_normalize_object_first_attribute(au);
+		if (rc == 1) {
+			int sep = 0, cnt = 1;
+			putchar('(');
+			do {
+				const char *name = auparse_get_field_name(au);
+				if (strcmp(name, "opid") == 0) {
+					if (sep)
+						putchar(',');
+					printf("%s",
+					       auparse_interpret_field(au));
+					sep = 1;
+				}
+			       rc = auparse_normalize_object_next_attribute(au);
+			       cnt++;
+			} while (rc == 1 && cnt < 4);
+			if (cnt >= 4)
+				printf(",...)");
+			else
+				putchar(')');
+			putchar(' ');
+		}
+	}
+
 	how = auparse_normalize_how(au);
 	if (how && action && *action != 'e')   // Don't print for ended-session
 		printf("using %s", how);