From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peng Haitao Subject: [PATCH] Fix a bug of parsing "exe=" in function parse_user() Date: Thu, 28 Aug 2008 18:41:24 +0800 Message-ID: <48B680D4.7030006@cn.fujitsu.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: audit-list List-Id: linux-audit@redhat.com Hello steve, The value of "exe=" which is not in double quotation, cannot be right gotten. For example: # echo "type=USER_ROLE_CHANGE msg=audit(1219940034.985:363068): user pid=24741 uid=0 auid=0 subj=root:system_r:semanage_t:s0-s0:c0.c1023 msg='op=delete SELinux user mapping acct="sltester" old-seuser=? old-role=? old-range=? new-seuser=? new-role=? new-range=? exe=/usr/sbin/semanage (hostname=?, addr=?, terminal=? res=failed)'" | ausearch -x "/usr/sbin/semanage" Signed-off-by: Peng Haitao --- src/ausearch-parse.c | 22 ++++++++++++++++++++-- 1 files changed, 20 insertions(+), 2 deletions(-) diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c index b80b984..1bc598f 100644 --- a/src/ausearch-parse.c +++ b/src/ausearch-parse.c @@ -871,8 +871,26 @@ static int parse_user(const lnode *n, search_items *s) *term = 0; s->exe = strdup(str); *term = '"'; - } else - s->exe = unescape(str); + } else { + char *end = str; + int legacy = 0; + + while (*end != ' ') { + if (!isxdigit(*end)) { + legacy = 1; + } + end++; + } + term = end; + if (!legacy) + s->exe = unescape(str); + else { + saved = *term; + *term = 0; + s->exe = strdup(str); + *term = saved; + } + } } } -- 1.5.3 -- Regards Peng Haitao