417 lines
11 KiB
Plaintext
417 lines
11 KiB
Plaintext
|
! $OpenBSD: Xsystrace.ad,v 1.1.1.1 2006/11/26 10:58:43 matthieu Exp $
|
||
|
|
!
|
||
|
|
! Copyright (c) 2002 Matthieu Herrb and Niels Provos
|
||
|
|
! All rights reserved.
|
||
|
|
!
|
||
|
|
! Redistribution and use in source and binary forms, with or without
|
||
|
|
! modification, are permitted provided that the following conditions
|
||
|
|
! are met:
|
||
|
|
!
|
||
|
|
! - Redistributions of source code must retain the above copyright
|
||
|
|
! notice, this list of conditions and the following disclaimer.
|
||
|
|
! - Redistributions in binary form must reproduce the above
|
||
|
|
! copyright notice, this list of conditions and the following
|
||
|
|
! disclaimer in the documentation and/or other materials provided
|
||
|
|
! with the distribution.
|
||
|
|
!
|
||
|
|
! THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||
|
|
! "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||
|
|
! LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||
|
|
! FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||
|
|
! COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||
|
|
! INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||
|
|
! BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||
|
|
! LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||
|
|
! CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||
|
|
! LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||
|
|
! ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||
|
|
! POSSIBILITY OF SUCH DAMAGE.
|
||
|
|
!
|
||
|
|
|
||
|
|
*background: #d7d7d7
|
||
|
|
*.font: -*-helvetica-medium-r-*--12-*-*-*-*-*-iso8859-1
|
||
|
|
*borderWidth: 0
|
||
|
|
|
||
|
|
!
|
||
|
|
! 3D frame for Forms
|
||
|
|
!
|
||
|
|
*.Form.displayList:\
|
||
|
|
foreground gray90;\
|
||
|
|
lines 1,-2,1,16,-2,16;\
|
||
|
|
lines 0,-1,-1,-1,-1,15;\
|
||
|
|
foreground gray40;\
|
||
|
|
lines 0,-2,0,15,-2,15;\
|
||
|
|
lines 1,-2,-2,-2,-2,16
|
||
|
|
|
||
|
|
*.tip.background: #ffffc0
|
||
|
|
*.tip.font: -*-helvetica-medium-r-*--10-*-*-*-*-*-iso8859-1
|
||
|
|
|
||
|
|
!
|
||
|
|
! Generic 3D Menu
|
||
|
|
!
|
||
|
|
*MenuButton.foreground: gray20
|
||
|
|
*MenuButton.displayList:\
|
||
|
|
line-style solid;\
|
||
|
|
foreground gray40;\
|
||
|
|
lines 1,-1,-1,-1,-1,1;\
|
||
|
|
foreground gray90;\
|
||
|
|
lines -1,0,0,0,0,-1;\
|
||
|
|
line-style onoffdash;\
|
||
|
|
foreground gray80;\
|
||
|
|
draw-rect 1,1,-2,-2
|
||
|
|
!
|
||
|
|
*SimpleMenu.?.foreground: gray20
|
||
|
|
*SimpleMenu.displayList:\
|
||
|
|
foreground gray40;\
|
||
|
|
lines 1,-1,-1,-1,-1,1;\
|
||
|
|
foreground gray90;\
|
||
|
|
lines -1,0,0,0,0,-1
|
||
|
|
!
|
||
|
|
! Generic 3D Text field
|
||
|
|
!
|
||
|
|
*Text.?.foreground: gray20
|
||
|
|
*Text.borderWidth: 0
|
||
|
|
*Text.background: gray96
|
||
|
|
*Text.?.cursorColor: rgb:d/5/5
|
||
|
|
*Text.displayList:\
|
||
|
|
foreground gray90;\
|
||
|
|
lines 1,-1,-1,-1,-1,1;\
|
||
|
|
foreground gray40;\
|
||
|
|
lines -1,0,0,0,0,-1
|
||
|
|
!
|
||
|
|
! Generic 3D buttons
|
||
|
|
!
|
||
|
|
*Command.displayList:\
|
||
|
|
foreground gray40;\
|
||
|
|
lines 1,-1,-1,-1,-1,1;\
|
||
|
|
foreground gray90;\
|
||
|
|
lines -1,0,0,0,0,-1
|
||
|
|
|
||
|
|
!
|
||
|
|
! Widgets placement
|
||
|
|
!
|
||
|
|
*date-label.fromHoriz: title-label
|
||
|
|
*processInfo-form.fromVert: title-form
|
||
|
|
*processInfo-form.vertDistance: 0
|
||
|
|
*syscallInfo-form.fromVert: processInfo-form
|
||
|
|
*syscallInfo-form.vertDistance: 0
|
||
|
|
*status-form.fromVert: syscallInfo-form
|
||
|
|
*status-form.vertDistance: 0
|
||
|
|
*errorCode-form.fromVert: status-form
|
||
|
|
*errorCode-form.vertDistance: 0
|
||
|
|
*specialProc-form.fromHoriz: errorCode-form
|
||
|
|
*specialProc-form.fromVert: status-form
|
||
|
|
*specialProc-form.vertDistance: 0
|
||
|
|
*buttons-form.fromVert: specialProc-form
|
||
|
|
*buttons-form.vertDistance: 0
|
||
|
|
!
|
||
|
|
*processName-label.fromVert: processInfo-label
|
||
|
|
*processName-value.fromHoriz: processName-label
|
||
|
|
*processName-value.fromVert: processInfo-label
|
||
|
|
*processPid-label.fromVert: processName-label
|
||
|
|
*processPid-value.fromHoriz: processPid-label
|
||
|
|
*processPid-value.fromVert: processName-value
|
||
|
|
*policyName-label.fromVert: processPid-label
|
||
|
|
*policyName-value.fromVert: processPid-value
|
||
|
|
*policyName-value.fromHoriz: policyName-label
|
||
|
|
!
|
||
|
|
*syscallInfo-value.fromVert: syscallInfo-label
|
||
|
|
*filter-label.fromVert: syscallInfo-value
|
||
|
|
*filter-text.fromHoriz: filter-label
|
||
|
|
*filter-text.fromVert: syscallInfo-value
|
||
|
|
*filter-menu-button.fromHoriz: filter-text
|
||
|
|
*filter-menu-button.fromVert: syscallInfo-value
|
||
|
|
*filter-button.fromHoriz: filter-menu-button
|
||
|
|
*filter-button.fromVert: syscallInfo-value
|
||
|
|
*status-value.fromVert: status-label
|
||
|
|
*errorCode-text.fromVert: errorCode-label
|
||
|
|
*errorCode-button.fromHoriz: errorCode-text
|
||
|
|
*errorCode-button.fromVert: errorCode-label
|
||
|
|
*kill-button.fromVert: specialProc-label
|
||
|
|
*review-button.fromHoriz: kill-button
|
||
|
|
*review-button.fromVert: specialProc-label
|
||
|
|
*auto-button.fromHoriz: review-button
|
||
|
|
*auto-button.fromVert: specialProc-label
|
||
|
|
*allow-button.fromHoriz: deny-button
|
||
|
|
*deny-all-button.fromHoriz: allow-button
|
||
|
|
*deny-all-button.horizDistance: 15
|
||
|
|
*allow-all-button.fromHoriz: deny-all-button
|
||
|
|
!
|
||
|
|
*review-text.fromVert: review-label
|
||
|
|
*done-button.fromVert: review-text
|
||
|
|
!
|
||
|
|
*wizard-help-text.fromVert: wizard-help-label
|
||
|
|
*wizard-form.fromVert: wizard-help-form
|
||
|
|
*wizard-form.vertDistance: 0
|
||
|
|
*wizard-text.fromVert: wizard-label
|
||
|
|
*wizard-ok-button.fromVert: wizard-text
|
||
|
|
*wizard-cancel-button.fromHoriz: wizard-ok-button
|
||
|
|
*wizard-cancel-button.fromVert: wizard-text
|
||
|
|
!
|
||
|
|
! Main form
|
||
|
|
!
|
||
|
|
*.form.displayList:
|
||
|
|
*.wizard-top.displayList:
|
||
|
|
!
|
||
|
|
! Logo Display
|
||
|
|
!
|
||
|
|
*title-form.displayList:
|
||
|
|
*title-label.label:
|
||
|
|
*title-label.width: 209
|
||
|
|
*title-label.height: 28
|
||
|
|
*title-label.displayList:\
|
||
|
|
image xpm:logo.xpm,0,0,0,0
|
||
|
|
!
|
||
|
|
*date-label.width: 200
|
||
|
|
!
|
||
|
|
! Process Information
|
||
|
|
!
|
||
|
|
*processName-label.width: 120
|
||
|
|
*processName-label.justify: left
|
||
|
|
!*processName-value.font: -*-helvetica-bold-r-*--14-*-*-*-*-*-iso8859-1
|
||
|
|
*processName-value.foreground: red2
|
||
|
|
*processName-value.justify: left
|
||
|
|
*processName-value.width: 335
|
||
|
|
*processPid-label.width: 120
|
||
|
|
*processPid-label.justify: left
|
||
|
|
!*processPid-value.font: -*-helvetica-bold-r-*--14-*-*-*-*-*-iso8859-1
|
||
|
|
*processPid-value.foreground: red2
|
||
|
|
*processPid-value.justify: left
|
||
|
|
*processPid-value.width: 335
|
||
|
|
*policyName-label.width: 120
|
||
|
|
*policyName-label.justify: left
|
||
|
|
!*policyName-value.font: -*-helvetica-bold-r-*--14-*-*-*-*-*-iso8859-1
|
||
|
|
*policyName-value.foreground: red2
|
||
|
|
*policyName-value.width: 335
|
||
|
|
*policyName-value.justify: left
|
||
|
|
!
|
||
|
|
! Syscall Information
|
||
|
|
!
|
||
|
|
*syscallInfo-value.font: -*-helvetica-bold-r-*--14-*-*-*-*-*-iso8859-1
|
||
|
|
*syscallInfo-value.foreground: red2
|
||
|
|
*syscallInfo-value.width: 460
|
||
|
|
!
|
||
|
|
! Syscall Filter text entry
|
||
|
|
!
|
||
|
|
*filter-text.width: 270
|
||
|
|
*filter-text.background: gray90
|
||
|
|
*filter-text.translations: #override \
|
||
|
|
<Key>Return: filter-changed()
|
||
|
|
!
|
||
|
|
*status-value.width: 460
|
||
|
|
*status-value.label:
|
||
|
|
!
|
||
|
|
! Special processing buttons
|
||
|
|
!
|
||
|
|
*kill-button.width: 65
|
||
|
|
*kill-button.height: 40
|
||
|
|
*kill-button.displayList:\
|
||
|
|
foreground gray40;\
|
||
|
|
lines 1,-1,-1,-1,-1,1;\
|
||
|
|
foreground gray90;\
|
||
|
|
lines -1,0,0,0,0,-1;\
|
||
|
|
image xpm:skull.xpm,5,5,0,0;\
|
||
|
|
foreground black;\
|
||
|
|
font -*-helvetica-medium-r-*--12-*-*-*-*-*-iso8859-1;\
|
||
|
|
draw-string 40,25,Kill
|
||
|
|
!
|
||
|
|
*review-button.height: 40
|
||
|
|
!
|
||
|
|
*auto-button.height: 40
|
||
|
|
!
|
||
|
|
*buttons-form.displayList:
|
||
|
|
!
|
||
|
|
! Permit button
|
||
|
|
!
|
||
|
|
*allow-button.width: 100
|
||
|
|
*allow-button.height: 50
|
||
|
|
*allow-button.displayList:\
|
||
|
|
foreground gray40;\
|
||
|
|
lines 1,-1,-1,-1,-1,1;\
|
||
|
|
foreground gray90;\
|
||
|
|
lines -1,0,0,0,0,-1;\
|
||
|
|
image xpm:permit.xpm,0,0,0,0;\
|
||
|
|
foreground black;\
|
||
|
|
font -*-helvetica-medium-r-*--12-*-*-*-*-*-iso8859-1;\
|
||
|
|
draw-string 55,30,Permit
|
||
|
|
!
|
||
|
|
! Deny button
|
||
|
|
!
|
||
|
|
*deny-button.width: 100
|
||
|
|
*deny-button.height: 50
|
||
|
|
*deny-button.displayList:\
|
||
|
|
foreground gray40;\
|
||
|
|
lines 1,-1,-1,-1,-1,1;\
|
||
|
|
foreground gray90;\
|
||
|
|
lines -1,0,0,0,0,-1;\
|
||
|
|
image xpm:deny.xpm,0,0,0,0;\
|
||
|
|
foreground black;\
|
||
|
|
font -*-helvetica-medium-r-*--12-*-*-*-*-*-iso8859-1;\
|
||
|
|
draw-string 55,30,Deny
|
||
|
|
!
|
||
|
|
! Permit Always button
|
||
|
|
!
|
||
|
|
*allow-all-button.width: 120
|
||
|
|
*allow-all-button.height: 50
|
||
|
|
*allow-all-button.displayList:\
|
||
|
|
foreground gray40;\
|
||
|
|
lines 1,-1,-1,-1,-1,1;\
|
||
|
|
foreground gray90;\
|
||
|
|
lines -1,0,0,0,0,-1;\
|
||
|
|
image xpm:permit-always.xpm,5,0,0,0;\
|
||
|
|
foreground black;\
|
||
|
|
font -*-helvetica-medium-r-*--12-*-*-*-*-*-iso8859-1;\
|
||
|
|
draw-string 55,20,"Permit";\
|
||
|
|
draw-string 60,35,"Always"
|
||
|
|
!
|
||
|
|
! Deny Always button
|
||
|
|
!
|
||
|
|
*deny-all-button.width: 120
|
||
|
|
*deny-all-button.height: 50
|
||
|
|
*deny-all-button.displayList:\
|
||
|
|
foreground gray40;\
|
||
|
|
lines 1,-1,-1,-1,-1,1;\
|
||
|
|
foreground gray90;\
|
||
|
|
lines -1,0,0,0,0,-1;\
|
||
|
|
image xpm:deny-always.xpm,5,0,0,0;\
|
||
|
|
foreground black;\
|
||
|
|
font -*-helvetica-medium-r-*--12-*-*-*-*-*-iso8859-1;\
|
||
|
|
draw-string 55,20,"Deny";\
|
||
|
|
draw-string 60,35,"Always";
|
||
|
|
!
|
||
|
|
!
|
||
|
|
*review-text.width: 380
|
||
|
|
*review-text.height: 70
|
||
|
|
*review-text.scrollVertical: Always
|
||
|
|
*review-text*borderwidth: 1
|
||
|
|
!
|
||
|
|
*wizard-text.width: 100
|
||
|
|
*wizard-text.height: 100
|
||
|
|
*wizard-text.verticalList: True
|
||
|
|
*wizard-text.forceColumns: True
|
||
|
|
*wizard-text.defaultColumns: 1
|
||
|
|
*wizard-text.background: white
|
||
|
|
*wizard-text*borderwidth: 1
|
||
|
|
!
|
||
|
|
! Various labels
|
||
|
|
!
|
||
|
|
*processInfo-label.label: Process Information
|
||
|
|
*processName-label.label: Process Name:
|
||
|
|
*processPid-label.label: Process Id:
|
||
|
|
*policyName-label.label: Policy Name:
|
||
|
|
*syscallInfo-label.label: System Call Information
|
||
|
|
*filter-label.label: Filter Expression:
|
||
|
|
*filter-button.label: Wizard
|
||
|
|
*status-label.label: Status:
|
||
|
|
*kill-button.label:
|
||
|
|
*review-button.label: Review Filter
|
||
|
|
*auto-button.label: Automatic
|
||
|
|
*allow-button.label:
|
||
|
|
*deny-button.label:
|
||
|
|
*allow-all-button.label:
|
||
|
|
*deny-all-button.label:
|
||
|
|
*review-label.label: Filter List
|
||
|
|
*done-button.label: OK
|
||
|
|
!
|
||
|
|
*filter-menu-button.width: 25
|
||
|
|
*filter-menu-button.label:
|
||
|
|
*filter-menu-button.displayList:\
|
||
|
|
foreground gray90;\
|
||
|
|
lines -1,0,0,0,0,-1;\
|
||
|
|
lines 12,15,5,5,20,5;\
|
||
|
|
foreground gray40;\
|
||
|
|
lines 1,-1,-1,-1,-1,1;\
|
||
|
|
lines 12,15,20,5
|
||
|
|
!
|
||
|
|
*wizard-help-label.label: Systrace Notification
|
||
|
|
*wizard-help-text.label: \
|
||
|
|
This dialog allows the selection of default policies\n\
|
||
|
|
for the current application. The following list \n\
|
||
|
|
describes potential templates that can be used as \n\
|
||
|
|
a quick start for a new policy.
|
||
|
|
*wizard-label.label: Templates
|
||
|
|
*wizard-ok-button.label: OK
|
||
|
|
*wizard-cancel-button.label: Cancel
|
||
|
|
!
|
||
|
|
*errorCode-label.label: Error Code:
|
||
|
|
*errorCode-button.label:
|
||
|
|
*errorCode-text.width: 200
|
||
|
|
*errorCode-text.background: gray90
|
||
|
|
*errorCode-text.translations: #override \
|
||
|
|
<Key>Return: errorcode-changed()
|
||
|
|
*errorCode-button.width: 25
|
||
|
|
*errorCode-button.displayList:\
|
||
|
|
foreground gray90;\
|
||
|
|
lines -1,0,0,0,0,-1;\
|
||
|
|
lines 12,15,5,5,20,5;\
|
||
|
|
foreground gray40;\
|
||
|
|
lines 1,-1,-1,-1,-1,1;\
|
||
|
|
lines 12,15,20,5
|
||
|
|
!
|
||
|
|
*specialProc-label.label: Special Processing
|
||
|
|
!
|
||
|
|
!
|
||
|
|
! Tips
|
||
|
|
!
|
||
|
|
*filter-text.tip: \
|
||
|
|
Enter a filter expression that will \n\
|
||
|
|
be added to the current policy. \n\
|
||
|
|
A sample policy can be choosed from the \n\
|
||
|
|
pull-down list.
|
||
|
|
|
||
|
|
*filter-menu-button.tip: \
|
||
|
|
Give a choice of sample policies \n\
|
||
|
|
for the current system call.
|
||
|
|
|
||
|
|
*filter-button.tip: \
|
||
|
|
Pops up a dialog that allows to \n\
|
||
|
|
select a template policy.
|
||
|
|
|
||
|
|
*errorCode-button.tip: \
|
||
|
|
Configure the error code that is \n\
|
||
|
|
returned to the application when \n\
|
||
|
|
the system call is denied.
|
||
|
|
|
||
|
|
*errorCode-text.tip: \
|
||
|
|
You can enter an error code here\n\
|
||
|
|
that's not listed in the menu on\n\
|
||
|
|
the right.
|
||
|
|
|
||
|
|
*kill-button.tip: \
|
||
|
|
This button will terminate\n\
|
||
|
|
the current application.
|
||
|
|
|
||
|
|
*review-button.tip: \
|
||
|
|
Review the configured policy\n\
|
||
|
|
for this system call.
|
||
|
|
|
||
|
|
*auto-button.tip: \
|
||
|
|
Detaches the interactive monitoring from\n\
|
||
|
|
the current policy. If a policy exists, all\n\
|
||
|
|
system calls not covered by it will be\n\
|
||
|
|
denied. Otherwise, if no policy exists,\n\
|
||
|
|
all system calls for this process will be\n\
|
||
|
|
allowed.
|
||
|
|
|
||
|
|
*allow-button.tip: \
|
||
|
|
Allows the current system call. If the\n\
|
||
|
|
application attempts the system call again,\n\
|
||
|
|
a new warning will be generated.
|
||
|
|
|
||
|
|
*deny-button.tip: \
|
||
|
|
Denies the current system call. \n\
|
||
|
|
The error code above is returned to the\n\
|
||
|
|
application. The application is allowed\n\
|
||
|
|
to attempt the system call again
|
||
|
|
|
||
|
|
*allow-all-button.tip: \
|
||
|
|
Permits this system call forever. No more\n\
|
||
|
|
monitoring of this system call is happening.\n\
|
||
|
|
Use this option very carefully.
|
||
|
|
|
||
|
|
*deny-all-button.tip: \
|
||
|
|
Denies the application to execute the system\n\
|
||
|
|
call ever again. The error configured above\n\
|
||
|
|
will be returned. Use this option carefully.
|
||
|
|
|