42402f11b7
* Includes fixes since v3.1.1
* Enhance support for newer (5.0+) kernels
- Update spec:
* Move rules-related files into new subpackage `audit-rules':
* Files moved:
- /sbin/auditctl, /sbin/augenrules,
/etc/audit/{audit.rules,rules.d/audit.rules,audit-stop.rules}
- manpages for auditctl, augenrules, and audit.rules
- /etc/audit is now owned by `audit-rules' as well
* Add new file /usr/lib/systemd/system/audit-rules.service
* Remove in-house create-augenrules-service.patch that generated
augenrules.service systemd unit service
* Remove ownership of /usr/share/audit
* Create /usr/share/audit-rules directory on %install
* Remove audit-userspace-517-compat.patch (fixed upstream)
* Remove libev-werror.patch (fixed upstream)
* Remove audit-allow-manual-stop.patch (fixed upstream)
* Add fix-auparse-test.patch (downstream):
Upstream tests uses a static value (42) for 'gdm' uid/gid (based
on Fedora values, apparently). Replace these occurrences with
'unknown(123456)'
* Replace '--with-python' with '--with-python3' on %configure
* Remove autrace and auvirt references (upstream)
* Replace README with README.md
- Drop `--enable-systemd' from %configure as SysV-style scripts
aren't supported in upstream since
113ae191758c ("Drop support for SysVinit")
- Update to 4.0
* Includes fixes since v3.1.1
* Enhance support for newer (5.0+) kernels
- Update spec:
* Add fix-auparse-test.patch (downstream):
Upstream tests uses a static value (42) for 'gdm' uid/gid (based
on Fedora values, apparently). Replace these occurrences with
'unknown(123456)'
* Replace '--with-python' with '--with-python3' on %configure
* Add new headers 'audit_logging.h' and 'audit-records.h' for
audit-devel
TODO: fix build for SLE/Leap
OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=153
42 lines
1.2 KiB
Diff
42 lines
1.2 KiB
Diff
From: William Preston <wpreston@suse.com>
|
|
Subject: ausearch is looking for the "tclass" field in the entries, which doesn't make sense for apparmor.
|
|
References: bnc#878687
|
|
References: https://www.redhat.com/archives/linux-audit/2014-May/msg00094.html https://www.redhat.com/archives/linux-audit/2014-June/msg00001.html
|
|
Upstream: never
|
|
Signed-off-by: Tony Jones <tonyj@suse.de>
|
|
|
|
---
|
|
src/ausearch-parse.c | 18 ++++++++----------
|
|
1 file changed, 8 insertions(+), 10 deletions(-)
|
|
|
|
Index: audit-3.1.1/src/ausearch-parse.c
|
|
===================================================================
|
|
--- audit-3.1.1.orig/src/ausearch-parse.c
|
|
+++ audit-3.1.1/src/ausearch-parse.c
|
|
@@ -2075,17 +2075,15 @@ other_avc:
|
|
|
|
// Now get the class...its at the end, so we do things different
|
|
str = strstr(term, "tclass=");
|
|
- if (str == NULL) {
|
|
- rc = 9;
|
|
- goto err;
|
|
+ if (str) {
|
|
+ str += 7;
|
|
+ term = strchr(str, ' ');
|
|
+ if (term)
|
|
+ *term = 0;
|
|
+ an.avc_class = strdup(str);
|
|
+ if (term)
|
|
+ *term = ' ';
|
|
}
|
|
- str += 7;
|
|
- term = strchr(str, ' ');
|
|
- if (term)
|
|
- *term = 0;
|
|
- an.avc_class = strdup(str);
|
|
- if (term)
|
|
- *term = ' ';
|
|
|
|
if (audit_avc_init(s) == 0) {
|
|
alist_append(s->avc, &an);
|