From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peng Haitao Subject: [PATCH] Fix a bug of executing "aureport -tm" Date: Thu, 18 Sep 2008 19:05:47 +0800 Message-ID: <48D2360B.90608@cn.fujitsu.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: audit-list List-Id: linux-audit@redhat.com Hello steve, Use option "-tm" cannot report about terminals, when message type is USER_AVC. For example: # echo "type=USER_AVC msg=audit(1221880640.759:4904436): user pid=4748 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc: received policyload notice (seqno=37) : exe=\"?\" (sauid=81, hostname=?, addr=?, terminal=?)'" | aureport -tm Terminal Report ==================================== # date time term host exe auid event ==================================== Signed-off-by: Peng Haitao --- src/ausearch-parse.c | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c index e3ffa8c..da1730f 100644 --- a/src/ausearch-parse.c +++ b/src/ausearch-parse.c @@ -850,8 +850,11 @@ static int parse_user(const lnode *n, search_items *s) if (str) { str += 9; term = strchr(str, ' '); - if (term == NULL) - return 17; + if (term == NULL) { + term = strchr(str, ')'); + if (term == NULL) + return 17; + } *term = 0; s->terminal = strdup(str); *term = ' '; -- 1.5.4.2 -- Regards Peng Haitao