[PATCH] ausearch: Fix parsing of uid in user space events

[PATCH] ausearch: Fix parsing of uid in user space events

[Marcelo Cerri]

The function parse_user aborts when it tries to parse a record which contains
an uuid field (usually a VIRT_* record).
---
 src/ausearch-parse.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
index d38ed56..f83f84b 100644
--- a/src/ausearch-parse.c
+++ b/src/ausearch-parse.c
@@ -719,7 +719,7 @@ static int parse_user(const lnode *n, search_items *s)
 	str = strstr(term, "auid=");
 	if (str == NULL) { // Try the older one
 		str = strstr(term, "loginuid=");
-		if (str == NULL) 
+		if (str == NULL)
 			return 7;
 		ptr = str + 9;
 	} else
@@ -792,7 +792,7 @@ static int parse_user(const lnode *n, search_items *s)
 			term = str;
 			while (*term != ' ' && *term != ':')
 				term++;
-			if (term == str) 
+			if (term == str)
 				return 24;
 			saved = *term;
 			*term = 0;
@@ -804,9 +804,9 @@ static int parse_user(const lnode *n, search_items *s)
 	// USER_LOGIN for example.
 	str = strstr(term, "uid=");
 	if (str) {
-		if (*(str-1)=='a' || *(str-1)=='s')
+		if (*(str - 1) == 'a' || *(str - 1) == 's' || *(str - 1) == 'u')
 			goto skip;
-		if (!(*(str-1)=='\'' || *(str-1)==' '))
+		if (!(*(str - 1) == '\'' || *(str - 1) == ' '))
 			return 25;
 		ptr = str + 4;
 		term = ptr;
-- 
1.7.1

Re: [PATCH] ausearch: Fix parsing of uid in user space events

[Steve Grubb]

On Tuesday, February 07, 2012 11:30:19 AM Marcelo Cerri wrote:
> The function parse_user aborts when it tries to parse a record which
> contains an uuid field (usually a VIRT_* record).

Thanks, looks like one fix for the parser messed up uuid parsing. Applied.

-Steve