Re: [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log

Tyler Hicks
2014-05-29T15:21:30Z

[-- Attachment #1.1: Type: text/plain, Size: 1826 bytes --]

On 2014-05-28 15:33:06, Tony Jones wrote:
> This patch came from our L3 department. AppArmor LSM is logging using the common_lsm_audit()
> call but the audit userspace parsing code expects to see an SELinux tclass field. This patch
> doesn't address the lack of support for AppArmor in "aureport --avc". Talking to Seth Arnold,
> Canonical apparently has patches for this; if this is true perhaps they can post for inclusion.
>
> Based-on-work-by: William Preston <wpreston@suse.com>
> Signed-off-by: Tony Jones <tonyj@suse.de>
>
> --- a/src/ausearch-parse.c 2014-05-21 14:45:22.000000000 +0200
> +++ b/src/ausearch-parse.c 2014-05-21 14:53:55.000000000 +0200
> @@ -1735,17 +1735,15 @@ static int parse_avc(const lnode *n, sea
>
> // Now get the class...its at the end, so we do things different
> str = strstr(term, "tclass=");
> - if (str == NULL) {
> - rc = 9;

It is nitpicky, but all error return codes after this should be
decremented (there is only one to do).

The rest of the patch looks fine to me.

Tyler

> - goto err;
> + if (str) {
> + str += 7;
> + term = strchr(str, ' ');
> + if (term)
> + *term = 0;
> + an.avc_class = strdup(str);
> + if (term)
> + *term = ' ';
> }
> - str += 7;
> - term = strchr(str, ' ');
> - if (term)
> - *term = 0;
> - an.avc_class = strdup(str);
> - if (term)
> - *term = ' ';
>
> if (audit_avc_init(s) == 0) {
> alist_append(s->avc, &an);
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

[-- Attachment #1.2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]