[PATCH] Fix a bug of executing "aureport -tm"
Hello steve,
Use option "-tm" cannot report about terminals, when message type is USER_AVC.
For example:
# echo "type=USER_AVC msg=audit(1221880640.759:4904436): user pid=4748 uid=81
auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc: received
policyload notice (seqno=37) : exe=\"?\" (sauid=81, hostname=?, addr=?,
terminal=?)'" | aureport -tm
Terminal Report
====================================
# date time term host exe auid event
====================================
<no events of interest were found>
Signed-off-by: Peng Haitao <penght(a)cn.fujitsu.com>
---
src/ausearch-parse.c | 7 +++++--
1 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
index e3ffa8c..da1730f 100644
--- a/src/ausearch-parse.c
+++ b/src/ausearch-parse.c
@@ -850,8 +850,11 @@ static int parse_user(const lnode *n, search_items *s)
if (str) {
str += 9;
term = strchr(str, ' ');
- if (term == NULL)
- return 17;
+ if (term == NULL) {
+ term = strchr(str, ')');
+ if (term == NULL)
+ return 17;
+ }
*term = 0;
s->terminal = strdup(str);
*term = ' ';
--
1.5.4.2
--
Regards
Peng Haitao