Blame audit-1.7.2-avc.patch
|
Steve Grubb |
d05050 |
diff -urp audit-1.7.2.orig/src/ausearch-parse.c audit-1.7.2/src/ausearch-parse.c
|
|
Steve Grubb |
d05050 |
--- audit-1.7.2.orig/src/ausearch-parse.c 2008-04-09 14:26:27.000000000 -0400
|
|
Steve Grubb |
d05050 |
+++ audit-1.7.2/src/ausearch-parse.c 2008-04-17 10:44:10.000000000 -0400
|
|
Steve Grubb |
d05050 |
@@ -1208,6 +1212,17 @@ static int parse_avc(const lnode *n, sea
|
|
Steve Grubb |
d05050 |
term = str + 6;
|
|
Steve Grubb |
d05050 |
}
|
|
Steve Grubb |
d05050 |
}
|
|
Steve Grubb |
d05050 |
+ if (event_filename) {
|
|
Steve Grubb |
d05050 |
+ // do we have a path?
|
|
Steve Grubb |
d05050 |
+ str = strstr(term, " path=");
|
|
Steve Grubb |
d05050 |
+ if (str) {
|
|
Steve Grubb |
d05050 |
+ str += 6;
|
|
Steve Grubb |
d05050 |
+ rc = common_path_parser(s, str);
|
|
Steve Grubb |
d05050 |
+ if (rc)
|
|
Steve Grubb |
d05050 |
+ goto err;
|
|
Steve Grubb |
d05050 |
+ term += 7;
|
|
Steve Grubb |
d05050 |
+ }
|
|
Steve Grubb |
d05050 |
+ }
|
|
Steve Grubb |
d05050 |
if (event_subject) {
|
|
Steve Grubb |
d05050 |
// scontext
|
|
Steve Grubb |
d05050 |
str = strstr(term, "scontext=");
|