Hard coded paths in OSSEC

[awiddersheim]

This issue seems to come up fairly frequently. Some past references are #24 and #207. In #24 it was specific to just the files in contrib and #207 kind of brought up a few issues so I thought it was best to make an issue that was focused on this problem across OSSEC as a whole.

It would be nice to start tracking what exactly people are doing or trying to do here and where OSSEC is falling short of allowing them to do those things. This way we can start to understand the problem and figure out the best ways to fix.

I've put my thoughts on this issue here:

#207 (comment)

[jrossi]

Here is m 2 cents.

To correct this we need to start to have context for configuration. Something like the following in shared:

/* OSSEC os_state */
struct os_state {
   char *root_dir; 
   int chroot; 
   /* other options here just not grabbing them */
};

/* Return path to files correctly taking into account chroot and other requirements */
struct os_state *os_state_new();

/* set the base_dir */ 
int os_state_set_base_dir(struct os_state *self, const char *base); 

/* Set Value of chroot to state */
int os_state_set_chroot(struct os_state *self, const int chroot); 

/* Return new string with base_dir included or if in a chroot just "/" added to the front  */
char *os_state_path(struct os_state *self, const char *filepath); 

Example of usage:

Example:

char *t;
os_state *state = os_state_new();
os_state_set_base_dir("/var/jeremy-ossec");
t = os_state_path(state, "logs/access-log.log");
printf("before set_chroot: %s\n", t);
free(t);
os_state_set_chroot(state, 1);
printf("after set_chroot: %s\n", t);
free(t);

This would produce the following:

before set_chroot: /var/jeremy-ossec/logs/access-log.log
after set_chroot: /logs/access-log.log

I think a lot of other cool things could come out of this. Like logging levels that could be defined in config, but over written from the cli if need be.

I am not going to show it, but if the extra function call is to much of a preformce issue (it will not be btw) we can make it into a MACRO.