Steve Grubb d05050
diff -urp audit-1.7.2.orig/src/ausearch-parse.c audit-1.7.2/src/ausearch-parse.c
Steve Grubb d05050
--- audit-1.7.2.orig/src/ausearch-parse.c	2008-04-09 14:26:27.000000000 -0400
Steve Grubb d05050
+++ audit-1.7.2/src/ausearch-parse.c	2008-04-17 10:44:10.000000000 -0400
Steve Grubb d05050
@@ -1208,6 +1212,17 @@ static int parse_avc(const lnode *n, sea
Steve Grubb d05050
 			term = str + 6;
Steve Grubb d05050
 		}
Steve Grubb d05050
 	}
Steve Grubb d05050
+	if (event_filename) {
Steve Grubb d05050
+		// do we have a path?
Steve Grubb d05050
+		str = strstr(term, " path=");
Steve Grubb d05050
+		if (str) {
Steve Grubb d05050
+			str += 6;
Steve Grubb d05050
+			rc =  common_path_parser(s, str);
Steve Grubb d05050
+			if (rc)
Steve Grubb d05050
+				goto err;
Steve Grubb d05050
+			term += 7;
Steve Grubb d05050
+		}
Steve Grubb d05050
+	}
Steve Grubb d05050
 	if (event_subject) {
Steve Grubb d05050
 		// scontext
Steve Grubb d05050
 		str = strstr(term, "scontext=");