[tomoyo-dev-en 43] Re: Access Logs

Back to archive index

Tetsuo Handa from-****@I-lov*****
Fri Dec 17 23:00:41 JST 2010


Jamie Nguyen wrote:
> I think that having separate lines for old_pattern and new_pattern may
> improve readability when patterns are long and complex. It also makes
> more intuitive, as the old_pattern line is a condition to be matched,
> just like the preconditions above it. Only if all are matched, then
> new_pattern replaces old_pattern.

OK. I modified to use separate lines.
Initial content of /etc/ccs/tools/patternize.conf as of revision 4208 is

# Files on proc filesystem.
old_path_pattern proc:/self/task/\$/fdinfo/\$
new_path_pattern proc:/self/task/\$/fdinfo/\$
old_path_pattern proc:/self/task/\$/fd/\$
new_path_pattern proc:/self/task/\$/fd/\$
old_head_pattern proc:/self/task/\$/
new_head_pattern proc:/self/task/\$/
old_path_pattern proc:/self/fdinfo/\$
new_path_pattern proc:/self/fdinfo/\$
old_path_pattern proc:/self/fd/\$
new_path_pattern proc:/self/fd/\$
old_head_pattern proc:/self/
new_head_pattern proc:/self/
old_path_pattern proc:/\$/task/\$/fdinfo/\$
new_path_pattern proc:/\$/task/\$/fdinfo/\$
old_path_pattern proc:/\$/task/\$/fd/\$
new_path_pattern proc:/\$/task/\$/fd/\$
old_head_pattern proc:/\$/task/\$/
new_head_pattern proc:/\$/task/\$/
old_path_pattern proc:/\$/fdinfo/\$
new_path_pattern proc:/\$/fdinfo/\$
old_path_pattern proc:/\$/fd/\$
new_path_pattern proc:/\$/fd/\$
old_head_pattern proc:/\$/
new_head_pattern proc:/\$/

# Files on devpts filesystem.
old_path_pattern devpts:/\$
new_path_pattern devpts:/\$

# Files on pipe filesystem.
old_path_pattern pipe:[\$]
new_path_pattern pipe:[\$]

# Files on / partition.
old_tail_pattern /etc/mtab~\$
new_tail_pattern /etc/mtab~\$
old_tail_pattern /etc/ccs/domain_policy.\*.conf
new_tail_pattern /etc/ccs/domain_policy.\*.conf
old_tail_pattern /etc/ccs/exception_policy.\*.conf
new_tail_pattern /etc/ccs/exception_policy.\*.conf

# Files on /tmp/ partition.
old_tail_pattern /vte\?\?\?\?\?\?
new_tail_pattern /vte\?\?\?\?\?\?
old_tail_pattern /.ICE-unix/\$
new_tail_pattern /.ICE-unix/\$
old_tail_pattern /keyring-\?\?\?\?\?\?/socket.ssh
new_tail_pattern /keyring-\?\?\?\?\?\?/socket.ssh
old_tail_pattern /orbit-\*/bonobo-activation-register-\X.lock
new_tail_pattern /orbit-\*/bonobo-activation-register-\X.lock
old_tail_pattern /orbit-\*/bonobo-activation-server-\X-ior
new_tail_pattern /orbit-\*/bonobo-activation-server-\X-ior
old_tail_pattern /orbit-\*/linc-\*
new_tail_pattern /orbit-\*/linc-\*
old_tail_pattern /orbit-\*/
new_tail_pattern /orbit-\*/
old_tail_pattern /sh-thd-\$
new_tail_pattern /sh-thd-\$
old_tail_pattern /zman\?\?\?\?\?\?
new_tail_pattern /zman\?\?\?\?\?\?

# Files on home directory.
old_tail_pattern /.ICEauthority-\?
new_tail_pattern /.ICEauthority-\?
old_tail_pattern /.xauth\?\?\?\?\?\?
new_tail_pattern /.xauth\?\?\?\?\?\?
old_tail_pattern /.xauth\?\?\?\?\?\?-?
new_tail_pattern /.xauth\?\?\?\?\?\?-?
old_tail_pattern /.local/share/applications/preferred-mail-reader.desktop.\?\?\?\?\?\?
new_tail_pattern /.local/share/applications/preferred-mail-reader.desktop.\?\?\?\?\?\?
old_tail_pattern /.local/share/applications/preferred-web-browser.desktop.\?\?\?\?\?\?
new_tail_pattern /.local/share/applications/preferred-web-browser.desktop.\?\?\?\?\?\?

# Files on /var/ partition.
old_tail_pattern /cache/fontconfig/\X-le64.cache-3
new_tail_pattern /cache/fontconfig/\X-le64.cache-3
old_tail_pattern /lib/gdm/.pulse/\X-default-source
new_tail_pattern /lib/gdm/.pulse/\X-default-source
old_tail_pattern /lib/gdm/.pulse/\X-default-sink
new_tail_pattern /lib/gdm/.pulse/\X-default-sink
old_tail_pattern /lib/gdm/.dbus/session-bus/\X-\X
new_tail_pattern /lib/gdm/.dbus/session-bus/\X-\X
old_tail_pattern /run/gdm/auth-for-\*/database-\?
new_tail_pattern /run/gdm/auth-for-\*/database-\?
old_tail_pattern /run/gdm/auth-for-\*/database
new_tail_pattern /run/gdm/auth-for-\*/database
old_tail_pattern /run/gdm/auth-for-\*/
new_tail_pattern /run/gdm/auth-for-\*/
old_tail_pattern /spool/abrt/pyhook-\*/\{\*\}/\*
new_tail_pattern /spool/abrt/pyhook-\*/\{\*\}/\*
old_tail_pattern /spool/abrt/pyhook-\*/\{\*\}/
new_tail_pattern /spool/abrt/pyhook-\*/\{\*\}/


Now, 'old_{path,head,tail,number,address}_pattern' lines are interpreted just
like 'domain' and 'acl' lines, and evaluation stops at first chunk which
reached the last line of that chunk (i.e. one of
'new_{path,head,tail,number,address}_pattern' lines).

But I feel that 'old_{path,head,tail,number,address}_pattern' and
'new_{path,head,tail,number,address}_pattern' are misnamed.
These keywords convey that the former refers old value and the latter refers
new value, but these keywords do not convey that the former is interpreted as
precondition and the latter is interpreted as chunk terminator.
Something like

  acl[1].equals    file
  acl[2].equals    read
  path_pattern     /tmp/cc\*
  rewrite          @TMP_CC_FILES

might be better than

  acl[1].equals    file
  acl[2].equals    read
  old_path_pattern /tmp/cc\*
  new_path_pattern @TMP_CC_FILES

.



> My only concern about having separate lines for old_pattern and
> new_pattern is that all lines will have a keyword and a value (e.g.
> acl[1].equals file), while the last line will contain only a value
> (new_pattern). Perhaps the last line should have a keyword also, like:
> 
>  acl[1].equals    file
>  acl[2].equals    read
>  path_pattern    /tmp/cc\*
>  new_pattern    @TMP_CC_FILES

A line must have a keyword, otherwise parser will misinterpret when
value matches one of keywords. I wanted to say that

  acl[1].equals    file
  acl[2].equals    read
  path_pattern     /tmp/cc\*
  new_pattern

is interpreted as


  acl[1].equals    file
  acl[2].equals    read
  path_pattern     /tmp/cc\*
  new_pattern      /tmp/cc\*

.



Regards.




More information about the tomoyo-dev-en mailing list
Back to archive index