Re: [PATCH] Handle timestamp 0.0 in auparse, was Re: audit-viewer help needed

[LC Bruzenak <lenny@magitekltd.com>]

On Mon, 2008-09-22 at 23:30 +0000, Miloslav Trmač wrote:
> Hello,
> the attached patch modifies auparse not to handle timestamp 0.x
> specially by using out-of-band information (parse_state == EVENT_EMPTY)
> instead of assuming (au->le.e.sec == 0) has a special meaning.  As far
> as I can see, this the two conditions are equivalent if no event has a
> timestamp 0.x.
> 
> The patch also decreases the assumed minimal length of a timestamp.
> 
> I have tested this only minimally - I have checked that (make check)
> succeeds, and that audit-viewer doesn't crash on startup.
> 
> This patch fixes handling of the following Lenny's audit record:
> 
> > node=hugo type=AVC msg=audit(0.000:6760): avc:  denied  { recvfrom }
> > for  pid=2589 comm="lockd" saddr=127.0.0.1 src=687 daddr=127.0.0.1
> > dest=111 netif=lo scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023
> > tcontext=system_u:system_r:kernel_t:s15:c0.c1023 tclass=association
> 
> I'm curious how this audit record could have been created (notabile is
> that the previous record has a sequence ID 6758 and a reasonable
> timestamp).  Lenny, Steve, any ideas?
> 
> Thank you,
> 	Mirek


Steve, Mirek - 

This patch didn't make it into the 1.7.9 code?
I have been running with it since its release.
Even if the kernel was patched I thought this was good.

Thx,
LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com