in auparse/mk_audit_msg_types.go [222:244]
func readRecordTypes() (map[string]int, error) {
out, err := exec.Command("gcc", "-E", "-dD", "audit-records.h").Output()
if err != nil {
return nil, fmt.Errorf("failed to run gcc: %w", err)
}
recordTypeToNum := map[string]int{}
s := bufio.NewScanner(bytes.NewReader(out))
for s.Scan() {
matches := recordTypeDefinitionRegex.FindStringSubmatch(s.Text())
if len(matches) != 3 {
continue
}
recordNum, _ := strconv.Atoi(matches[2])
// Filter constants.
if recordNum >= minRecordNum && recordNum <= maxRecordNum {
recordTypeToNum[matches[1]] = recordNum
}
}
return recordTypeToNum, s.Err()
}