From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Cerri Subject: [PATCH] auparse: apparmor fields Date: Fri, 17 Feb 2012 10:42:42 -0200 Message-ID: <1329482562-21751-1-git-send-email-mhcerri@linux.vnet.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx13.extmail.prod.ext.phx2.redhat.com [10.5.110.18]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id q1HCgqR4024136 for ; Fri, 17 Feb 2012 07:42:52 -0500 Received: from e24smtp01.br.ibm.com (e24smtp01.br.ibm.com [32.104.18.85]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q1HCgnDA001563 for ; Fri, 17 Feb 2012 07:42:50 -0500 Received: from /spool/local by e24smtp01.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 17 Feb 2012 10:42:48 -0200 Received: from mailhub3.br.ibm.com (mailhub3.br.ibm.com [9.18.232.110]) by d24dlp01.br.ibm.com (Postfix) with ESMTP id 6C6E0352004E for ; Fri, 17 Feb 2012 10:42:46 -0200 (BRST) Received: from d24av01.br.ibm.com (d24av01.br.ibm.com [9.8.31.91]) by mailhub3.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q1HCiVoG1093756 for ; Fri, 17 Feb 2012 10:44:31 -0200 Received: from d24av01.br.ibm.com (loopback [127.0.0.1]) by d24av01.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q1HAgdOR014993 for ; Fri, 17 Feb 2012 08:42:39 -0200 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: gcwilson@us.ibm.com, bryntcor@us.ibm.com List-Id: linux-audit@redhat.com Hi, I'm taking a look at the AVC records generated by apparmor and some fields in these records, such as "apparmor" and "operation", are quoted and are not listed in the auparse/typetab.h file. Searching in the kernel source, I've found the piece of code that generates the AVC records and I noticed that it uses the function audit_log_string, which just add quotes to the string, instead of audit_log_untrustedstring, which seems to be targeted to escaped fields. I'd like to know if these fields should be treated the same way as escaped fields by libauparse or maybe it should be changed in the kernel. If libauparse really needs to be changed, please consider this patch that includes the fields "apparmor" and "operation" in the file auparse/typetab.h as escaped fields. Regards, Marcelo --- auparse/typetab.h | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/auparse/typetab.h b/auparse/typetab.h index 7838c17..0a81e25 100644 --- a/auparse/typetab.h +++ b/auparse/typetab.h @@ -86,3 +86,5 @@ _S(AUPARSE_TYPE_NFPROTO, "family" ) _S(AUPARSE_TYPE_ICMPTYPE, "icmptype" ) _S(AUPARSE_TYPE_PROTOCOL, "proto" ) _S(AUPARSE_TYPE_ADDR, "addr" ) +_S(AUPARSE_TYPE_ESCAPED, "apparmor" ) +_S(AUPARSE_TYPE_ESCAPED, "operation" ) -- 1.7.1