Hello,
ausearch -i and libauparse currently crash (access NULL) if a mode= field contains an
unknown file type. Such records are generated by the kernel for IPC, e.g.
node=jcdx156 type=IPC msg=audit(1237915952.720:2294): ouid=500 ogid=1106 mode=0600
obj=siterep_u:siterep_r:siterep_t:s0-s15:c0.c1023
The attached patch:
* Modifies ausearch and libauparse to output the file format in octal if it is unknown.
* Modifies libauparse to use the same interpreted field format as ausearch (without a
space in the middle).
* Modifies comma handling in libauparse to avoid a strcat() call.
Mirek