[PATCH ghak28/ghak25 user 2/2] ausearch-parse: mod parser for YAASAO for NETFILTER_CFG
Modify the YAASAO parser to accomodate the ghak25 NETFILTER_CFG record.
Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>
---
src/ausearch-parse.c | 42 ++++++++++++++++++++++--------------------
1 file changed, 22 insertions(+), 20 deletions(-)
diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
index 147b1fa7acaf..7feabe40b6fa 100644
--- a/src/ausearch-parse.c
+++ b/src/ausearch-parse.c
@@ -173,11 +173,11 @@ int extract_search_items(llist *l)
case AUDIT_BPRM_FCAPS:
case AUDIT_CAPSET:
case AUDIT_MMAP:
- case AUDIT_NETFILTER_CFG:
case AUDIT_PROCTITLE:
case AUDIT_REPLACE...AUDIT_BPF:
// Nothing to parse
break;
+ case AUDIT_NETFILTER_CFG:
case AUDIT_EVENT_LISTENER:
ret = parse_yaasao(n, s);
break;
@@ -2620,23 +2620,23 @@ static int parse_yaasao(lnode *n, search_items *s)
// get loginuid if not already filled
if ((s->loginuid == -2 && !s->tauid) && (event_loginuid != -2 ||
event_tauid)) {
str = strstr(term, "auid=");
- if (str == NULL) {
- return 59;
- } else
+ if (str) {
ptr = str + 5;
- term = strchr(ptr, ' ');
- if (term == NULL)
- return 60;
- *term = 0;
- errno = 0;
- s->loginuid = strtoul(ptr, NULL, 10);
- if (errno)
+ term = strchr(ptr, ' ');
+ if (term == NULL)
+ return 59;
+ *term = 0;
+ errno = 0;
+ s->loginuid = strtoul(ptr, NULL, 10);
+ if (errno)
+ return 60;
+ *term = ' ';
+ if (s->tauid) free((void *)s->tauid);
+ s->tauid = lookup_uid("auid", s->loginuid);
+ } else
return 61;
- *term = ' ';
- if (s->tauid) free((void *)s->tauid);
- s->tauid = lookup_uid("auid", s->loginuid);
}
- // get tty if not already filled
+ // optionally get tty if not already filled
if (!s->terminal && event_terminal) {
// dont do this search unless needed
str = strstr(term, "tty=");
@@ -2650,9 +2650,10 @@ static int parse_yaasao(lnode *n, search_items *s)
free(s->terminal);
s->terminal = strdup(str);
*term = ' ';
- }
+ } else
+ s->terminal = strdup("(none)");
}
- // get ses if not already filled
+ // optionally get ses if not already filled
if (s->session_id == -2 && event_session_id != -2 ) {
str = strstr(term, "ses=");
if (str) {
@@ -2666,7 +2667,8 @@ static int parse_yaasao(lnode *n, search_items *s)
if (errno)
return 64;
*term = ' ';
- }
+ } else
+ s->session_id = (unsigned long)-1;
}
// get subject if not already filled
if (!s->avc && event_subject) {
@@ -2712,7 +2714,7 @@ static int parse_yaasao(lnode *n, search_items *s)
} else
return 69;
}
- // get exe if not already filled
+ // optionally get exe if not already filled
if (!s->exe && event_exe) {
// dont do this search unless needed
str = strstr(n->message, "exe=");
@@ -2729,7 +2731,7 @@ static int parse_yaasao(lnode *n, search_items *s)
} else
s->exe = unescape(str);
} else
- return 71;
+ s->exe = strdup("(null)");
}
return 0;
}
--
1.8.3.1