Re: [PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log
On Wednesday, May 28, 2014 03:33:06 PM Tony Jones wrote:
This patch came from our L3 department. AppArmor LSM is logging
using the
common_lsm_audit() call but the audit userspace parsing code expects to see
an SELinux tclass field. This patch doesn't address the lack of support for
AppArmor in "aureport --avc". Talking to Seth Arnold, Canonical apparently
has patches for this; if this is true perhaps they can post for inclusion.
Based-on-work-by: William Preston <wpreston(a)suse.com>
Signed-off-by: Tony Jones <tonyj(a)suse.de>
I was looking at this patch and was wondering something. Does AppArmor produce
AUDIT_AVC events? If not, how does the code even get into parse_avc? IOW, is
there another part of the patch missing in the switch statement that direct
AUDIT_APPARMOR_* events into parse_avc?
-Steve
--- a/src/ausearch-parse.c 2014-05-21 14:45:22.000000000 +0200
+++ b/src/ausearch-parse.c 2014-05-21 14:53:55.000000000 +0200
@@ -1735,17 +1735,15 @@ static int parse_avc(const lnode *n, sea
// Now get the class...its at the end, so we do things different
str = strstr(term, "tclass=");
- if (str == NULL) {
- rc = 9;
- goto err;
+ if (str) {
+ str += 7;
+ term = strchr(str, ' ');
+ if (term)
+ *term = 0;
+ an.avc_class = strdup(str);
+ if (term)
+ *term = ' ';
}
- str += 7;
- term = strchr(str, ' ');
- if (term)
- *term = 0;
- an.avc_class = strdup(str);
- if (term)
- *term = ' ';
if (audit_avc_init(s) == 0) {
alist_append(s->avc, &an);