From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: auparse_interpret_field()
Date: Wed, 14 Nov 2007 13:34:12 -0500
Message-ID: <200711141334.13096.sgrubb@redhat.com>
References: <1194560760.10377.11.camel@klausk.br.ibm.com>
	<200711091256.42639.sgrubb@redhat.com>
	<OF209A8D73.B1D992BE-ON8525738E.006D0615-8525738E.006DDEFC@br.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <OF209A8D73.B1D992BE-ON8525738E.006D0615-8525738E.006DDEFC@br.ibm.com>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: klausk@br.ibm.com
Cc: "Linux-audit@redhat.com" <Linux-audit@redhat.com>, linux-audit-bounces@redhat.com
List-Id: linux-audit@redhat.com

On Friday 09 November 2007 14:56:05 klausk@br.ibm.com wrote:
> See that 'r->machine' and 'r->syscall' are only filled when the 'arch'
> field in found in the 2nd position, and syscall in the 3rd position
> respectively. That is not true when the dispatcher is appending a 'node='
> field to each record.

This is the patch I'm testing.

-Steve


--- audit-1.6.3.orig/auparse/ellist.c	2007-10-01 13:56:21.000000000 -0400
+++ audit-1.6.3/auparse/ellist.c	2007-11-12 14:27:31.000000000 -0500
@@ -65,6 +65,7 @@
 static int parse_up_record(rnode* r)
 {
 	char *ptr, *buf, *saved;
+	int offset = 0;
 
 	buf = strdup(r->record);
 	ptr = strtok_r(buf, " ", &saved);
@@ -123,27 +124,34 @@
 				}
 			}
 			nvlist_append(&r->nv, &n);
-			if (r->nv.cnt == 1 && strcmp(n.name, "type") == 0) {
+			if (r->nv.cnt == 1 && strcmp(n.name, "node") == 0)
+				offset = 1; // if node, some positions changes
+			else if (r->nv.cnt == (1 + offset) &&
+					strcmp(n.name, "type") == 0) {
 				r->type = audit_name_to_msg_type(n.val);
-			} else if(r->nv.cnt == 2 && strcmp(n.name, "arch")== 0){
+			} else if (r->nv.cnt == (2 + offset) && 
+					strcmp(n.name, "arch")== 0){
 				unsigned int ival;
 				errno = 0;
 				ival = strtoul(n.val, NULL, 16);
 				if (errno)
-					r->machine = -1;
-				r->machine = audit_elf_to_machine(ival);
-			} else if(r->nv.cnt == 3 && strcmp(n.name,
-							"syscall") == 0){
+					r->machine = -2;
+				else
+					r->machine = audit_elf_to_machine(ival);
+			} else if (r->nv.cnt == (3 + offset) &&
+					strcmp(n.name, "syscall") == 0){
 				errno = 0;
 				r->syscall = strtoul(n.val, NULL, 10);
 				if (errno)
 					r->syscall = -1;
-			} else if(r->nv.cnt == 6 && strcmp(n.name, "a0") == 0){
+			} else if (r->nv.cnt == (6 + offset) &&
+					strcmp(n.name, "a0") == 0){
 				errno = 0;
 				r->a0 = strtoull(n.val, NULL, 16);
 				if (errno)
 					r->a0 = -1LL;
-			} else if(r->nv.cnt == 7 && strcmp(n.name, "a1") == 0){
+			} else if (r->nv.cnt == (7 + offset) &&
+					strcmp(n.name, "a1") == 0){
 				errno = 0;
 				r->a1 = strtoull(n.val, NULL, 16);
 				if (errno)
@@ -152,12 +160,12 @@
 		} else if (r->type == AUDIT_AVC || r->type == AUDIT_USER_AVC) {
 			// We special case these 2 fields because selinux
 			// avc messages do not label these fields.
-			if (nvlist_get_cnt(&r->nv) == 1) {
+			if (nvlist_get_cnt(&r->nv) == (1 + offset)) {
 				// skip over 'avc:'
 				if (strncmp(ptr, "avc", 3) == 0)
 					continue;
 				n.name = strdup("seresult");
-			} else if (nvlist_get_cnt(&r->nv) == 2) {
+			} else if (nvlist_get_cnt(&r->nv) == (2 + offset)) {
 				// skip over open brace
 				if (*ptr == '{') {
 					int total = 0, len;