Re: [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log

Steve Grubb
2016-04-29T13:39:04Z

On Friday, April 29, 2016 10:03:02 AM Vincas Dargis wrote:
> There was email about fixing ausearch for AppArmor:
>
> https://www.redhat.com/archives/linux-audit/2014-May/msg00094.html
>
> Is there any progress regarding that issue?

You'll have to ask the AppArmor folks. I gave them a whole block of numbers to
use for their own purposes so that we don't have any problems. If they instead
create malformed SE Linux events, then things will never work right unless
they patch them. I don't plan to carry a patch in the main utility because it
completely violates all audit assumptions.

The main rule is that all audit records of the same type have to have the
exact same fields, in the same order, with the same format or no one can
analyze the events. You have to think of each record as a database table. Each
record is a row, each field is a column.

> I have tried to search for AVC on Debian Testing (auditd 2.4.5), and
> it fails to "grep" me AppArmor related events.
>
> P.S. How do I actually reply to original thread that I did not
> received, since I just subscribed? I though I could maybe find raw
> message in archive https://www.redhat.com/archives/linux-audit/ but
> there aren't (no such message in 2014-May/Jun gz) . Oh how I hate
> using mailing lists so much... /rant.

Just start a new one. Why worry?

-Steve