Hi, I'm taking a look at the AVC records generated by apparmor and some fields in these records, such as "apparmor" and "operation", are quoted and are not listed in the auparse/typetab.h file. Searching in the kernel source, I've found the piece of code that generates the AVC records and I noticed that it uses the function audit_log_string, which just add quotes to the string, instead of audit_log_untrustedstring, which seems to be targeted to escaped fields. I'd like to know if these fields should be treated the same way as escaped fields by libauparse or maybe it should be changed in the kernel. If libauparse really needs to be changed, please consider this patch that includes the fields "apparmor" and "operation" in the file auparse/typetab.h as escaped fields. Regards, Marcelo --- auparse/typetab.h | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/auparse/typetab.h b/auparse/typetab.h index 7838c17..0a81e25 100644 --- a/auparse/typetab.h +++ b/auparse/typetab.h @@ -86,3 +86,5 @@ _S(AUPARSE_TYPE_NFPROTO, "family" ) _S(AUPARSE_TYPE_ICMPTYPE, "icmptype" ) _S(AUPARSE_TYPE_PROTOCOL, "proto" ) _S(AUPARSE_TYPE_ADDR, "addr" ) +_S(AUPARSE_TYPE_ESCAPED, "apparmor" ) +_S(AUPARSE_TYPE_ESCAPED, "operation" ) -- 1.7.1