09b3135c4a7deae8dc32f4332a49a718ec4f987f,src/spade/reporter/Audit.java,Audit,handleTruncate,#Map#SYSCALL#,1676
Before Change
if(FileIdentity.class.equals(artifactIdentity.getClass()) || UnknownIdentity.class.equals(artifactIdentity.getClass())){
Artifact vertex = putArtifact(eventData, artifactIdentity, true);
WasGeneratedBy wgb = new WasGeneratedBy(vertex, process);
wgb.addAnnotation("operation", getOperation(syscall));
wgb.addAnnotation("time", time);
addEventIdAndSourceAnnotationToEdge(wgb, eventData.get("eventid"), DEV_AUDIT);
putEdge(wgb);
}else{
logger.log(Level.INFO, "Unexpected artifact type '"+artifactIdentity+"' for truncate. event id '"+eventData.get("eventid")+"'");
}
After Change
String pid = eventData.get("pid");
Process process = putProcess(eventData);
String time = eventData.get("time");
ArtifactIdentifier artifactIdentifier = null;
if (syscall == SYSCALL.TRUNCATE) {
Map<Integer, String> paths = getPathsWithNametype(eventData, "NORMAL");
if(paths.size() == 0){
log(Level.INFO, "Missing PATH record", null, eventData.get("eventid"), syscall);
return;
}
String path = paths.values().iterator().next();
path = constructPath(path, eventData.get("cwd"));
if(path == null){
log(Level.INFO, "Missing PATH or CWD record", null, eventData.get("eventid"), syscall);
return;
}
artifactIdentifier = new FileIdentifier(path);
} else if (syscall == SYSCALL.FTRUNCATE) {
String fd = eventData.get("a0");
if(descriptors.getDescriptor(pid, fd) == null){
descriptors.addUnknownDescriptor(pid, fd);
getArtifactProperties(descriptors.getDescriptor(pid, fd)).markNewEpoch(eventData.get("eventid"));
}
artifactIdentifier = descriptors.getDescriptor(pid, fd);
}
if(FileIdentifier.class.equals(artifactIdentifier.getClass()) || UnknownIdentifier.class.equals(artifactIdentifier.getClass())){
Artifact vertex = putArtifact(eventData, artifactIdentifier, true);
WasGeneratedBy wgb = new WasGeneratedBy(vertex, process);
putEdge(wgb, getOperation(syscall), time, eventData.get("eventid"), DEV_AUDIT);
}else{
log(Level.INFO, "Unexpected artifact type '"+artifactIdentifier+"'. Can only be file or unknown", null, eventData.get("eventid"), syscall);
}