From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peng Haitao Subject: [PATCH] Fix a bug of executing "aureport -a" Date: Sat, 20 Sep 2008 11:39:36 +0800 Message-ID: <48D47078.6010209@cn.fujitsu.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: audit-list List-Id: linux-audit@redhat.com Hello steve, Use option "-a" cannot report about avc messages, when message type is USER_AVC. # echo "type=USER_AVC msg=audit(1221967380.698:35458): user pid=8185 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc: received policyload notice (seqno=6) : exe=\"?\" (sauid=81, hostname=?, addr=?, terminal=?)'" | aureport -a AVC Report ======================================================== # date time comm subj syscall class permission obj event ======================================================== Signed-off-by: Peng Haitao --- src/aureport-scan.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/src/aureport-scan.c b/src/aureport-scan.c index f42cf12..9374a02 100644 --- a/src/aureport-scan.c +++ b/src/aureport-scan.c @@ -449,6 +449,9 @@ static int per_event_detailed(llist *l) if (list_find_msg(l, AUDIT_AVC)) { print_per_event_item(l); rc = 1; + } else if (list_find_msg(l, AUDIT_USER_AVC)) { + print_per_event_item(l); + rc = 1; } break; case RPT_MAC: -- 1.5.3 -- Regards Peng Haitao