[PATCH] Fix a bug of executing "aureport -tm"

[PATCH] Fix a bug of executing "aureport -tm"

[Peng Haitao]

Hello steve,

Use option "-tm" cannot report about terminals, when message type is USER_AVC.

For example:
# echo "type=USER_AVC msg=audit(1221880640.759:4904436): user pid=4748 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  received policyload notice (seqno=37) : exe=\"?\" (sauid=81, hostname=?, addr=?, terminal=?)'" | aureport -tm

Terminal Report
====================================
# date time term host exe auid event
====================================
<no events of interest were found>

Signed-off-by: Peng Haitao <penght@cn.fujitsu.com>

---
 src/ausearch-parse.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
index e3ffa8c..da1730f 100644
--- a/src/ausearch-parse.c
+++ b/src/ausearch-parse.c
@@ -850,8 +850,11 @@ static int parse_user(const lnode *n, search_items *s)
 		if (str) {
 			str += 9;
 			term = strchr(str, ' ');
-			if (term == NULL)
-				return 17;
+			if (term == NULL) {
+				term = strchr(str, ')');
+				if (term == NULL)
+					return 17;
+			}
 			*term = 0;
 			s->terminal = strdup(str);
 			*term = ' ';
-- 
1.5.4.2


-- 
Regards
Peng Haitao

Re: [PATCH] Fix a bug of executing "aureport -tm"

[Steve Grubb]

On Thursday 18 September 2008 07:05:47 Peng Haitao wrote:
> Use option "-tm" cannot report about terminals, when message type is
> USER_AVC.

Applied. Thanks for the patch.

-Steve