Function buildAuditNetlinkMessage

ssh/tailssh/auditd_linux.go:50–79

buildAuditNetlinkMessage constructs a netlink audit message. This is separated from sendAuditMessage to allow testing the message format without requiring CAP_AUDIT_WRITE or a netlink socket.

(msgType uint16, message string)

// This is separated from sendAuditMessage to allow testing the message format
// without requiring CAP_AUDIT_WRITE or a netlink socket.
func buildAuditNetlinkMessage(msgType uint16, message string) ([]byte, error) {
	msgBytes := []byte(message)
	if len(msgBytes) > maxAuditMessageLength {
		msgBytes = msgBytes[:maxAuditMessageLength]
	}
	msgLen := len(msgBytes)

	totalLen := syscall.NLMSG_HDRLEN + msgLen
	alignedLen := (totalLen + syscall.NLMSG_ALIGNTO - 1) & ^(syscall.NLMSG_ALIGNTO - 1)

	nlh := syscall.NlMsghdr{
		Len:   uint32(totalLen),
		Type:  msgType,
		Flags: nlmFRequest,
		Seq:   1,
		Pid:   uint32(os.Getpid()),
	}

	buf := bytes.NewBuffer(make([]byte, 0, alignedLen))
	if err := binary.Write(buf, binary.NativeEndian, nlh); err != nil {
		return nil, err
	}
	buf.Write(msgBytes)

	for buf.Len() < alignedLen {
		buf.WriteByte(0)
	}

	return buf.Bytes(), nil
}

// sendAuditMessage sends a message to the audit subsystem using raw netlink.
// It logs errors but does not return them.