auparse_interpret_field()
env: audit 1.6.2, s390x, RHEL5 in targeted policy, permissive mode
I'm trying to assign the field name + interpreted value to a variable
inside my dispatcher plugin. something along these lines:
do {
name = auparse_get_field_name(au);
value = auparse_interpret_field(au);
snprintf(data, 1023, "%s=%s", name, value);
} while (auparse_next_record(au) > 0);
but auparse is failing to interpret fields like arch and syscall. From
gdb:
(gdb) p name
$20 = 0x80037bd0 "arch"
(gdb) printf "%s\n",auparse_get_field_str(au)
80000016
(gdb) printf "%s\n",auparse_interpret_field(au)
unknown elf type(80000016)
---
(gdb) p name
$22 = 0x80037b90 "syscall"
(gdb) p auparse_get_field_str(au)
$23 = 0x8002acf0 "5"
(gdb) p auparse_interpret_field(au)
$24 = 0x8002ade0 "unknown syscall(-1)"
uid and auid are being correctly translated (at least for root). No AVCs
seen.
Am I missing something?
Thanks,
Klaus