From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peng Haitao Subject: [PATCH] fix a bug that output of "aureport -au" is imperfection Date: Tue, 22 Jul 2008 16:18:59 +0800 Message-ID: <488597F3.9060302@cn.fujitsu.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: sgrubb@redhat.com Cc: audit-list List-Id: linux-audit@redhat.com Hello Steve, Execute command "aureport -au", the output is imperfection. For example: [root@RHEL5 ~]# aureport -au Authentication Report ============================================ # date time acct host term exe success event ============================================ 1. 07/22/2008 09:24:39 acct="aulltest rhel5.2ga ssh /usr/sbin/sshd yes 5208350 The reports have a column label at the top to help with interpretation of the various fields, So 'acct="aulltest' should be modified to 'aulltest' in the line 1. Signed-off-by: Peng Haitao --- src/ausearch-parse.c | 7 ++++--- 1 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c index 5fdf8c7..141fdee 100644 --- a/src/ausearch-parse.c +++ b/src/ausearch-parse.c @@ -786,7 +786,8 @@ static int parse_user(const lnode *n, search_items *s) term++; saved = *term; *term = 0; - s->acct = strdup(str); + ptr++; + s->acct = strdup(ptr); *term = saved; } else { /* Handle legacy accts */ @@ -802,11 +803,11 @@ static int parse_user(const lnode *n, search_items *s) } term = end; if (!legacy) - s->acct = unescape(str); + s->acct = unescape(ptr); else { saved = *term; *term = 0; - s->acct = strdup(str); + s->acct = strdup(ptr); *term = saved; } } -- Regards Peng Haitao