From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Cerri Subject: [PATCH] ausearch: Fix parsing of uid in user space events Date: Tue, 7 Feb 2012 14:30:19 -0200 Message-ID: <1328632219-19071-1-git-send-email-mhcerri@linux.vnet.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx14.extmail.prod.ext.phx2.redhat.com [10.5.110.19]) by int-mx12.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id q17GUW33031130 for ; Tue, 7 Feb 2012 11:30:32 -0500 Received: from e24smtp03.br.ibm.com (e24smtp03.br.ibm.com [32.104.18.24]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q17GUUho013287 for ; Tue, 7 Feb 2012 11:30:31 -0500 Received: from /spool/local by e24smtp03.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 7 Feb 2012 14:30:29 -0200 Received: from d24av01.br.ibm.com (d24av01.br.ibm.com [9.8.31.91]) by d24relay01.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q17GQElK3281118 for ; Tue, 7 Feb 2012 13:26:14 -0300 Received: from d24av01.br.ibm.com (loopback [127.0.0.1]) by d24av01.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q17EUJo1005913 for ; Tue, 7 Feb 2012 12:30:20 -0200 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: gcwilson@us.ibm.com, bryntcor@us.ibm.com List-Id: linux-audit@redhat.com The function parse_user aborts when it tries to parse a record which contains an uuid field (usually a VIRT_* record). --- src/ausearch-parse.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c index d38ed56..f83f84b 100644 --- a/src/ausearch-parse.c +++ b/src/ausearch-parse.c @@ -719,7 +719,7 @@ static int parse_user(const lnode *n, search_items *s) str = strstr(term, "auid="); if (str == NULL) { // Try the older one str = strstr(term, "loginuid="); - if (str == NULL) + if (str == NULL) return 7; ptr = str + 9; } else @@ -792,7 +792,7 @@ static int parse_user(const lnode *n, search_items *s) term = str; while (*term != ' ' && *term != ':') term++; - if (term == str) + if (term == str) return 24; saved = *term; *term = 0; @@ -804,9 +804,9 @@ static int parse_user(const lnode *n, search_items *s) // USER_LOGIN for example. str = strstr(term, "uid="); if (str) { - if (*(str-1)=='a' || *(str-1)=='s') + if (*(str - 1) == 'a' || *(str - 1) == 's' || *(str - 1) == 'u') goto skip; - if (!(*(str-1)=='\'' || *(str-1)==' ')) + if (!(*(str - 1) == '\'' || *(str - 1) == ' ')) return 25; ptr = str + 4; term = ptr; -- 1.7.1