audit-3.1.2 has already fixed the 64bit time_t problem on 32bit platform
posted in
https://listman.redhat.com/archives/linux-audit/2022-October/019553.html
, but there was obscure remnant not applied.
====================
--- ./src/ausearch-checkpt.c.t64 2023-08-07 05:38:56.000000000 +0900
+++ ./src/ausearch-checkpt.c 2024-06-12 21:21:47.330473966 +0900
@@ -152,6 +152,7 @@ void save_ChkPt(const char *fn)
static int parse_checkpt_event(char *lbuf, int ndix, event *e)
{
char *rest;
+ unsigned long long t;
/*
* Find the space after the node, then make it '\0' so
@@ -178,13 +179,14 @@ static int parse_checkpt_event(char *lbu
return 1;
}
}
- if (sscanf(rest, TIME_T_SPECIFIER ".%03u:%lu 0x%X", &e->sec,
&e->milli,
+ if (sscanf(rest, TIME_T_SPECIFIER ".%03llu:%lu 0x%X", &t,
&e->milli,
&e->serial, &e->type) != 4) {
fprintf(stderr, "Malformed output/event checkpoint line "
"after node - [%s]\n", lbuf);
checkpt_failure |= CP_STATUSBAD;
return 1;
}
+ e->sec = t;
return 0;
}