25 lines
773 B
Plaintext
25 lines
773 B
Plaintext
|
From: Steve Beattie <sbeattie@ubuntu.com>
|
||
|
|
Subject: apparmor-utils: Support newer auditd formatted messages.
|
||
|
|
|
||
|
|
Patch from mancha on irc.
|
||
|
|
|
||
|
|
This is lp:apparmor/2.5 commit r1444.
|
||
|
|
|
||
|
|
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
|
||
|
|
Acked-by: Jeff Mahoney <jeffm@suse.com>
|
||
|
|
---
|
||
|
|
utils/SubDomain.pm | 2 +-
|
||
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||
|
|
|
||
|
|
--- a/utils/SubDomain.pm
|
||
|
|
+++ b/utils/SubDomain.pm
|
||
|
|
@@ -2420,7 +2420,7 @@
|
||
|
|
my $RE_LOG_v2_1_audit =
|
||
|
|
qr/type=(UNKNOWN\[150[1-6]\]|APPARMOR_(AUDIT|ALLOWED|DENIED|HINT|STATUS|ERROR))/;
|
||
|
|
my $RE_LOG_v2_6_audit =
|
||
|
|
- qr/type=AVC\s+audit\([\d\.\:]+\):\s+apparmor=/;
|
||
|
|
+ qr/type=AVC\s+(msg=)?audit\([\d\.\:]+\):\s+apparmor=/;
|
||
|
|
|
||
|
|
sub prefetch_next_log_entry {
|
||
|
|
# if we already have an existing cache entry, something's broken
|