audit/audit-ausearch-do-not-require-tclass.patch

42 lines
1.2 KiB
Diff

From: William Preston <wpreston@suse.com>
Subject: ausearch is looking for the "tclass" field in the entries, which doesn't make sense for apparmor.
References: bnc#878687
References: https://www.redhat.com/archives/linux-audit/2014-May/msg00094.html https://www.redhat.com/archives/linux-audit/2014-June/msg00001.html
Upstream: never
Signed-off-by: Tony Jones <tonyj@suse.de>
---
src/ausearch-parse.c | 18 ++++++++----------
1 file changed, 8 insertions(+), 10 deletions(-)
Index: audit-3.1.1/src/ausearch-parse.c
===================================================================
--- audit-3.1.1.orig/src/ausearch-parse.c
+++ audit-3.1.1/src/ausearch-parse.c
@@ -2075,17 +2075,15 @@ other_avc:
// Now get the class...its at the end, so we do things different
str = strstr(term, "tclass=");
- if (str == NULL) {
- rc = 9;
- goto err;
+ if (str) {
+ str += 7;
+ term = strchr(str, ' ');
+ if (term)
+ *term = 0;
+ an.avc_class = strdup(str);
+ if (term)
+ *term = ' ';
}
- str += 7;
- term = strchr(str, ' ');
- if (term)
- *term = 0;
- an.avc_class = strdup(str);
- if (term)
- *term = ' ';
if (audit_avc_init(s) == 0) {
alist_append(s->avc, &an);