From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peng Haitao Subject: [PATCH] Fix a bug of parsing "acct=" in function parse_user() Date: Thu, 28 Aug 2008 18:40:01 +0800 Message-ID: <48B68081.2020200@cn.fujitsu.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: audit-list List-Id: linux-audit@redhat.com Hello steve, The value of "acct=" which is not in double quotation, cannot be right gotten. The log is: type=USER_CHAUTHTOK msg=audit(1167580800.033:178653): user pid=23192 uid=0 auid=0 subj=root:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=adding user acct=aulog exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=pts/6 res=success)' Signed-off-by: Peng Haitao --- src/ausearch-parse.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c index d9c305a..b80b984 100644 --- a/src/ausearch-parse.c +++ b/src/ausearch-parse.c @@ -791,13 +791,12 @@ static int parse_user(const lnode *n, search_items *s) *term = saved; } else { /* Handle legacy accts */ - char *end = term; + char *end = ptr; int legacy = 0; while (*end != ' ') { if (!isxdigit(*end)) { legacy = 1; - break; } end++; } -- 1.5.3 -- Regards Peng Haitao