From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: Re: get_field_str() and interpret_field() bug with multi-word fields Date: Tue, 12 Aug 2008 13:05:36 -0500 Message-ID: <1218564336.7022.72.camel@homeserver> References: <0E43BF2D7491F0468B56B1A5C493866B020DD0F1@SAT4MX07.RACKSPACE.CORP> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id m7CI5im7003927 for ; Tue, 12 Aug 2008 14:05:44 -0400 Received: from mail.magitekltd.com (rrcs-24-242-137-197.sw.biz.rr.com [24.242.137.197]) by mx3.redhat.com (8.13.8/8.13.8) with ESMTP id m7CI5guY023684 for ; Tue, 12 Aug 2008 14:05:43 -0400 In-Reply-To: <0E43BF2D7491F0468B56B1A5C493866B020DD0F1@SAT4MX07.RACKSPACE.CORP> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Jonathan Kelly Cc: William Kelly , Linux-audit@redhat.com, Bret Piatt List-Id: linux-audit@redhat.com On Tue, 2008-08-12 at 12:49 -0500, Jonathan Kelly wrote: > Hello, > > > > When using the python auparse library to call > AuParser.interpret_field() on a multi-word field, only the first word > in the field is returned. Using get_field_str() instead of > interpret_field() yields the same output. I have verified that this > issue exists in the C library, as well as the Python. I suspect that > this may be an issue for multi-word fields in general, but have not > noticed any other than 'op'. > > Line forms here...see the following thread: https://www.redhat.com/archives/linux-audit/2008-June/msg00005.html LCB. -- LC (Lenny) Bruzenak lenny@magitekltd.com