From mboxrd@z Thu Jan  1 00:00:00 1970
From: Klaus Heinrich Kiwi <klausk@br.ibm.com>
Subject: auparse_interpret_field()
Date: Thu, 08 Nov 2007 17:26:00 -0500
Message-ID: <1194560760.10377.11.camel@klausk.br.ibm.com>
Reply-To: klausk@br.ibm.com
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: "sgrubb@redhat.com" <sgrubb@redhat.com>, "Linux-audit@redhat.com" <Linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

env: audit 1.6.2, s390x, RHEL5 in targeted policy, permissive mode

I'm trying to assign the field name + interpreted value to a variable
inside my dispatcher plugin. something along these lines:

do {
    name = auparse_get_field_name(au);
    value = auparse_interpret_field(au);
    snprintf(data, 1023, "%s=%s", name, value);
} while (auparse_next_record(au) > 0);

but auparse is failing to interpret fields like arch and syscall. From
gdb:
(gdb) p name
$20 = 0x80037bd0 "arch"
(gdb) printf "%s\n",auparse_get_field_str(au)
80000016
(gdb) printf "%s\n",auparse_interpret_field(au)
unknown elf type(80000016)
---
(gdb) p name
$22 = 0x80037b90 "syscall"
(gdb) p auparse_get_field_str(au)
$23 = 0x8002acf0 "5"
(gdb) p auparse_interpret_field(au)
$24 = 0x8002ade0 "unknown syscall(-1)"


uid and auid are being correctly translated (at least for root). No AVCs
seen.

Am I missing something?

 Thanks,

 Klaus