Re: ausearch results differ with "-i" flag

[Steve Grubb <sgrubb@redhat.com>]

On Wednesday 17 March 2010 03:15:30 pm LC Bruzenak wrote:
> On Wed, 2010-03-17 at 14:57 -0400, Steve Grubb wrote:
> > This particular avc originates from user space. The application needs
> > to follow the rules correctly so it doesn't mess up the logs.
> 
> User space, yes, but from the Xorg server. Because X controls accesses
> internally it apparently audits stuff using the USER_AVC in this way.
> My confusion is that I thought any freetext should be allowed inside the
> "msg=" field and not interpreted by ausearch.

It depends on the name of the field. If they use comm, then it has to be 
properly encoded as any other provider of the comm field's value has to do it.

 
> I remember a while back though you told me why this can happen...so I
> need to look back and see. I suspect because the parse libs work as I
> think and the ausearch/aureport doesn't use those.?.

I'm not sure why you are getting a difference in output. But the field's value 
is not encoded correctly.

-Steve