Improve error handling, using thiserror, anyhow crates

- Replace Box<dyn std::erro::Error> with custom error types – or
  simple static strings
- Use anyhow crate to add context where appropriate

Cargo.toml

@@ -33,6 +33,8 @@ tinyvec = { version = "1", features = ["alloc"] }
 log = "0.4"
 simple_logger = ">= 1"
 syslog = "6"
+thiserror = "1"
+anyhow = "1"
 
 [target.'cfg(target_os = "linux")'.dependencies]
 caps = "0.5"

src/bin/laurel/main.rs

@@ -3,7 +3,7 @@
 
 use getopts::Options;
 use std::env;
-use std::error::Error;
+use std::error::Error as StdError;
 use std::fs;
 use std::io::{self, BufRead, BufReader, BufWriter, Read, Write};
 use std::ops::AddAssign;
@@ -17,6 +17,8 @@ use std::sync::{
 };
 use std::time::{Duration, SystemTime};
 
+use anyhow::{anyhow, Context};
+
 use nix::unistd::{chown, execve, Uid, User};
 #[cfg(target_os = "linux")]
 use nix::unistd::{setresgid, setresuid};
@@ -58,24 +60,22 @@ impl AddAssign for Stats {
 /// environment variables from arbitrary processes
 /// (/proc/$PID/environ).
 #[cfg(target_os = "linux")]
-fn drop_privileges(runas_user: &User) -> Result<(), Box<dyn Error>> {
+fn drop_privileges(runas_user: &User) -> anyhow::Result<()> {
  set_keepcaps(true)?;
  let uid = runas_user.uid;
  let gid = runas_user.gid;
- setresgid(gid, gid, gid).map_err(|e| format!("setresgid({}): {}", gid, e))?;
- setresuid(uid, uid, uid).map_err(|e| format!("setresuid({}): {}", uid, e))?;
+ setresgid(gid, gid, gid).with_context(|| format!("setresgid({gid})"))?;
+ setresuid(uid, uid, uid).with_context(|| format!("setresuid({uid})"))?;
 
  #[cfg(feature = "procfs")]
  {
  let mut capabilities = std::collections::HashSet::new();
  capabilities.insert(Capability::CAP_SYS_PTRACE);
  capabilities.insert(Capability::CAP_DAC_READ_SEARCH);
- caps::set(None, CapSet::Permitted, &capabilities)
- .map_err(|e| format!("set permitted capabilities: {}", e))?;
- caps::set(None, CapSet::Effective, &capabilities)
- .map_err(|e| format!("set effective capabilities: {}", e))?;
+ caps::set(None, CapSet::Permitted, &capabilities).context("set permitted capabilities")?;
+ caps::set(None, CapSet::Effective, &capabilities).context("set effective capabilities")?;
  caps::set(None, CapSet::Inheritable, &capabilities)
- .map_err(|e| format!("set inheritable capabilities: {}", e))?;
+ .context("set inheritable capabilities")?;
  }
 
  set_keepcaps(false)?;
@@ -97,26 +97,25 @@ impl Logger {
  self.output.flush().unwrap();
  }
 
- fn new(def: &Logfile, dir: &Path) -> Result<Self, Box<dyn Error>> {
+ fn new(def: &Logfile, dir: &Path) -> anyhow::Result<Self> {
  match &def.file {
  p if p.as_os_str() == "-" => Ok(Logger {
  prefix: def.line_prefix.clone(),
  output: BufWriter::new(Box::new(io::stdout())),
  }),
- p if p.has_root() && p.parent().is_none() => Err(format!(
+ p if p.has_root() && p.parent().is_none() => Err(anyhow!(
  "invalid file directory={} file={}",
  dir.to_string_lossy(),
  p.to_string_lossy()
- )
- .into()),
+ )),
  p => {
  let mut filename = dir.to_path_buf();
  filename.push(p);
  let mut rot = FileRotate::new(filename);
  for user in &def.clone().users.unwrap_or_default() {
  rot = rot.with_uid(
  User::from_name(user)?
- .ok_or_else(|| format!("user {} not found", &user))?
+ .ok_or_else(|| anyhow!("user {user} not found"))?
  .uid,
  );
  }
@@ -135,7 +134,7 @@ impl Logger {
  }
 }
 
-fn run_app() -> Result<(), Box<dyn Error>> {
+fn run_app() -> Result<(), Box<dyn StdError>> {
  let args: Vec<String> = env::args().collect();
 
  let mut opts = Options::new();
@@ -158,20 +157,17 @@ fn run_app() -> Result<(), Box<dyn Error>> {
  let config: Config = match matches.opt_str("c") {
  Some(f_name) => {
  if fs::metadata(&f_name)
- .map_err(|e| format!("stat {}: {}", &f_name, &e))?
+ .with_context(|| format!("stat: {f_name}"))?
  .permissions()
  .mode()
  & 0o002
  != 0
  {
  return Err(format!("Config file {} must not be world-writable", f_name).into());
  }
- let lines = fs::read(&f_name).map_err(|e| format!("read {}: {}", &f_name, &e))?;
- toml::from_str(
- &String::from_utf8(lines)
- .map_err(|_| format!("parse: {}: contains invalid UTF-8 sequences", &f_name))?,
- )
- .map_err(|e| format!("parse {}: {}", f_name, e))?
+ let lines = fs::read(&f_name).with_context(|| format!("read(: {f_name}"))?;
+ toml::from_str(&String::from_utf8(lines).with_context(|| format!("parse: {f_name}"))?)
+ .with_context(|| format!("parse {f_name}"))?
  }
  None => Config::default(),
  };
@@ -184,7 +180,7 @@ fn run_app() -> Result<(), Box<dyn Error>> {
  Input::Stdin => Box::new(unsafe { std::fs::File::from_raw_fd(0) }),
  Input::Unix(path) => Box::new(
  UnixStream::connect(path)
- .map_err(|e| format!("connect: {}: {}", path.to_string_lossy(), e))?,
+ .with_context(|| format!("connect: {}", path.to_string_lossy()))?,
  ),
  };
 
@@ -217,7 +213,7 @@ fn run_app() -> Result<(), Box<dyn Error>> {
  }
  if dir
  .metadata()
- .map_err(|e| format!("stat {}: {}", dir.to_string_lossy(), &e))?
+ .with_context(|| format!("stat {}", dir.to_string_lossy()))?
  .permissions()
  .mode()
  & 0o002
@@ -230,15 +226,15 @@ fn run_app() -> Result<(), Box<dyn Error>> {
  }
  } else {
  fs::create_dir_all(&dir)
- .map_err(|e| format!("create_dir: {}: {}", dir.to_string_lossy(), e))?;
+ .with_context(|| format!("create_dir: {}", dir.to_string_lossy()))?;
  }
  chown(&dir, Some(runas_user.uid), Some(runas_user.gid))
- .map_err(|e| format!("chown: {}: {}", dir.to_string_lossy(), e))?;
+ .with_context(|| format!("chown: {}", dir.to_string_lossy()))?;
  fs::set_permissions(&dir, PermissionsExt::from_mode(0o755))
- .map_err(|e| format!("chmod: {}: {}", dir.to_string_lossy(), e))?;
+ .with_context(|| format!("chmod: {}", dir.to_string_lossy()))?;
 
  let mut debug_logger = if let Some(l) = &config.debug.log {
- Some(Logger::new(l, &dir).map_err(|e| format!("can't create debug logger: {}", e))?)
+ Some(Logger::new(l, &dir).context("can't create debug logger")?)
  } else {
  None
  };
@@ -293,13 +289,12 @@ fn run_app() -> Result<(), Box<dyn Error>> {
  let emit_fn_drop;
  let emit_fn_log;
 
- let mut logger = Logger::new(&config.auditlog, &dir)
- .map_err(|e| format!("can't create audit logger: {}", e))?;
+ let mut logger = Logger::new(&config.auditlog, &dir).context("can't create audit logger")?;
 
  if let laurel::config::FilterAction::Log = config.filter.filter_action {
  log::info!("Logging filtered audit records");
- let mut filter_logger = Logger::new(&config.filterlog, &dir)
- .map_err(|e| format!("can't create filterlog logger: {}", e))?;
+ let mut filter_logger =
+ Logger::new(&config.filterlog, &dir).context("can't create filterlog logger")?;
  emit_fn_log = move |e: &Event| {
  if e.filter {
  filter_logger.log(e)
@@ -344,7 +339,7 @@ fn run_app() -> Result<(), Box<dyn Error>> {
  if let Some(ref mut l) = error_logger {
  l.write_all(line)
  .and_then(|_| l.flush())
- .map_err(|e| format!("write log: {}", e))?;
+ .context("write log")?;
  }
  let line = String::from_utf8_lossy(line).replace('\n', "");
  log::error!("Error {} processing msg: {}", e, &line);
@@ -373,7 +368,7 @@ fn run_app() -> Result<(), Box<dyn Error>> {
  line.clear();
  if input
  .read_until(b'\n', &mut line)
- .map_err(|e| format!("read from stdin: {}", e))?
+ .context("read from stdin")?
  == 0
  {
  break;
@@ -387,7 +382,7 @@ fn run_app() -> Result<(), Box<dyn Error>> {
  if let Some(ref mut l) = error_logger {
  l.write_all(&line)
  .and_then(|_| l.flush())
- .map_err(|e| format!("write log: {}", e))?;
+ .context("write log")?;
  }
  let line = String::from_utf8_lossy(&line).replace('\n', "");
  log::error!("Error {} processing msg: {}", e, &line);
@@ -419,6 +414,7 @@ fn run_app() -> Result<(), Box<dyn Error>> {
  if dump_state_last_t.elapsed()? >= *p {
  coalesce
  .dump_state(&mut dl.output)
+ // .context("dump state")?;
  .map_err(|e| format!("dump state: {}", e))?;
  dump_state_last_t = SystemTime::now();
  }

src/coalesce.rs

@@ -8,7 +8,7 @@ use serde_json::json;
 
 use crate::constants::{msg_type::*, ARCH_NAMES, SYSCALL_NAMES};
 use crate::label_matcher::LabelMatcher;
-use crate::parser::parse;
+use crate::parser::{parse, ParseError};
 use crate::proc::{ContainerInfo, ProcTable, Process, ProcessKey};
 #[cfg(all(feature = "procfs", target_os = "linux"))]
 use crate::procfs;
@@ -17,6 +17,8 @@ use crate::sockaddr::SocketAddr;
 use crate::types::*;
 use crate::userdb::UserDB;
 
+use thiserror::Error;
+
 #[derive(Clone)]
 pub struct Settings<'a> {
  /// Generate ARGV and ARGV_STR from EXECVE
@@ -74,6 +76,16 @@ impl Default for Settings<'_> {
  }
 }
 
+#[derive(Debug, Error)]
+pub enum CoalesceError {
+ #[error("{0}")]
+ Parse(ParseError),
+ #[error("duplicate event id {0}")]
+ DuplicateEvent(EventID),
+ #[error("Event id {0} for EOE marker not found")]
+ SpuriousEOE(EventID),
+}
+
 /// Coalesce collects Audit Records from individual lines and assembles them to Events
 pub struct Coalesce<'a> {
  /// Events that are being collected/processed
@@ -1005,9 +1017,9 @@ impl<'a> Coalesce<'a> {
  ///
  /// The line is consumed and serves as backing store for the
  /// EventBody objects.
- pub fn process_line(&mut self, line: Vec<u8>) -> Result<(), Box<dyn Error>> {
+ pub fn process_line(&mut self, line: Vec<u8>) -> Result<(), CoalesceError> {
  let skip_enriched = self.settings.translate_universal && self.settings.translate_userdb;
- let (node, typ, id, rv) = parse(line, skip_enriched)?;
+ let (node, typ, id, rv) = parse(line, skip_enriched).map_err(CoalesceError::Parse)?;
  let nid = (node.clone(), id);
 
  // clean out state every EXPIRE_PERIOD
@@ -1024,12 +1036,12 @@ impl<'a> Coalesce<'a> {
 
  if typ == EOE {
  if self.done.contains(&nid) {
- return Err(format!("duplicate event id {}", id).into());
+ return Err(CoalesceError::DuplicateEvent(id));
  }
  let ev = self
  .inflight
  .remove(&nid)
- .ok_or(format!("Event id {} for EOE marker not found", &id))?;
+ .ok_or(CoalesceError::SpuriousEOE(id))?;
  self.emit_event(ev);
  } else if typ.is_multipart() {
  // kernel-level messages
@@ -1055,7 +1067,7 @@ impl<'a> Coalesce<'a> {
  } else {
  // user-space messages
  if self.done.contains(&nid) {
- return Err(format!("duplicate event id {}", id).into());
+ return Err(CoalesceError::DuplicateEvent(id));
  }
  let mut ev = Event::new(node, id);
  ev.body.insert(typ, EventValues::Single(rv));

src/label_matcher.rs

@@ -1,4 +1,3 @@
-use std::error::Error;
 use std::fmt;
 
 use regex::bytes::RegexSet;
@@ -14,7 +13,7 @@ pub struct LabelMatcher {
 }
 
 impl LabelMatcher {
- pub fn new(exprs: &[(&str, &str)]) -> Result<Self, Box<dyn Error>> {
+ pub fn new(exprs: &[(&str, &str)]) -> Result<Self, regex::Error> {
  let mut regexes = Vec::with_capacity(exprs.len());
  let mut tags = Vec::with_capacity(exprs.len());
  for (r, t) in exprs {