journal: use audit event names instead of numbers

<audit-1400> is replaced by AVC, etc.

A fallback mechanism is provided for unlisted event types.
Occasionally new types are added to the kernel, but not too often.

Add a simple "test", which simply prints the mapping.

1 files changed, 13 insertions, 0 deletions

diff --git a/src/journal/audit-type.h b/src/journal/audit-type.h
index 9f37716cd6..fa5284e027 100644
--- a/src/journal/audit-type.h
+++ b/src/journal/audit-type.h
@@ -21,6 +21,19 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
+#include "macro.h"
 
 const char *audit_type_to_string(int type);
 int audit_type_from_string(const char *s);
+
+/* This is inspired by DNS TYPEnnn formatting */
+#define audit_type_name_alloca(type)                                    \
+        ({                                                              \
+                const char *_s_;                                        \
+                _s_ = audit_type_to_string(type);                       \
+                if (!_s_) {                                             \
+                        _s_ = alloca(strlen("AUDIT") + DECIMAL_STR_MAX(int)); \
+                        sprintf((char*) _s_, "AUDIT%04i", type);        \
+                }                                                       \
+                _s_;                                                    \
+        })