PATCH: ausearch doesn't correcly act as a filter when no EOF on input

Tony Jones
2008-11-18T00:17:54Z

This was filed as a bug in our bugzilla.

works : cat /var/log/audit/audit.log | ausearch -i -if /dev/stdin | cat
doesnt: tail -f /var/log/audit/audit.log | ausearch -i -if /dev/stdin | cat

Obviously it's a contrived example, they have more interesting processes each
side of the filter. Issue is that tail -f never indicates EOF and if ausearch
stdout is a pipe (versus a file), the output can remain queued in the pipebuf.

Following patch fixes it, or a simpler patch could unconditionally flush stdout.

I've not looked for similar issues elsewhere.

Tony

--- ausearch.c.old 2008-11-17 15:55:47.000000000 -0800
+++ ausearch.c 2008-11-17 16:06:54.000000000 -0800
@@ -58,11 +58,11 @@
extern int match(llist *l);
extern void output_record(llist *l);

-static int input_is_pipe(void)
+static int is_pipe(int fd)
{
struct stat st;

- if (fstat(0, &st) == 0) {
+ if (fstat(fd, &st) == 0) {
if (S_ISFIFO(st.st_mode))
pipe_mode = 1;
}
@@ -92,7 +92,7 @@
rc = process_file(user_file);
else if (force_logs)
rc = process_logs();
- else if (input_is_pipe())
+ else if (is_pipe(0))
rc = process_stdin();
else
rc = process_logs();
@@ -175,6 +175,7 @@
{
llist entries; // entries in a record
int ret;
+ int flush = is_pipe(1);

/* For each record in file */
list_create(&entries);
@@ -185,6 +186,8 @@
}
if (match(&entries)) {
output_record(&entries);
+ if (flush)
+ fflush(stdout);
found = 1;
if (just_one) {
list_clear(&entries);