|
Steve Grubb |
00064e |
diff -urp audit-1.7.2.orig/audisp/plugins/prelude/audisp-prelude.c audit-1.7.2/audisp/plugins/prelude/audisp-prelude.c
|
|
Steve Grubb |
00064e |
--- audit-1.7.2.orig/audisp/plugins/prelude/audisp-prelude.c 2008-04-07 16:57:12.000000000 -0400
|
|
Steve Grubb |
f25903 |
+++ audit-1.7.2/audisp/plugins/prelude/audisp-prelude.c 2008-04-18 10:18:46.000000000 -0400
|
|
Steve Grubb |
00064e |
@@ -228,7 +228,8 @@ int main(int argc, char *argv[])
|
|
Steve Grubb |
00064e |
return -1;
|
|
Steve Grubb |
00064e |
}
|
|
Steve Grubb |
00064e |
|
|
Steve Grubb |
00064e |
- syslog(LOG_INFO, "audisp-prelude is ready for events");
|
|
Steve Grubb |
00064e |
+ if (mode != M_TEST)
|
|
Steve Grubb |
00064e |
+ syslog(LOG_INFO, "audisp-prelude is ready for events");
|
|
Steve Grubb |
00064e |
do {
|
|
Steve Grubb |
00064e |
/* Load configuration */
|
|
Steve Grubb |
00064e |
if (hup) {
|
|
Steve Grubb |
00064e |
@@ -248,9 +249,10 @@ int main(int argc, char *argv[])
|
|
Steve Grubb |
00064e |
/* Flush any accumulated events from queue */
|
|
Steve Grubb |
00064e |
auparse_flush_feed(au);
|
|
Steve Grubb |
00064e |
|
|
Steve Grubb |
00064e |
- syslog(LOG_INFO, "audisp-prelude is exiting on stop request");
|
|
Steve Grubb |
00064e |
if (mode == M_TEST)
|
|
Steve Grubb |
00064e |
puts("audisp-prelude is exiting on stop request");
|
|
Steve Grubb |
00064e |
+ else
|
|
Steve Grubb |
00064e |
+ syslog(LOG_INFO, "audisp-prelude is exiting on stop request");
|
|
Steve Grubb |
00064e |
|
|
Steve Grubb |
00064e |
/* Cleanup subsystems */
|
|
Steve Grubb |
00064e |
if (client)
|
|
Steve Grubb |
d1b4f5 |
@@ -1811,7 +1811,7 @@ static void handle_event(auparse_state_t
|
|
Steve Grubb |
d1b4f5 |
rc = 0;
|
|
Steve Grubb |
d1b4f5 |
switch (type) {
|
|
Steve Grubb |
d1b4f5 |
case AUDIT_AVC:
|
|
Steve Grubb |
d1b4f5 |
- case AUDIT_USER_AVC:
|
|
Steve Grubb |
d1b4f5 |
+// case AUDIT_USER_AVC:
|
|
Steve Grubb |
d1b4f5 |
if (config.avcs == E_NO)
|
|
Steve Grubb |
d1b4f5 |
break;
|
|
Steve Grubb |
d1b4f5 |
if (config.avcs_act != A_IDMEF)
|
|
Steve Grubb |
3f63ff |
diff -urp audit-1.7.2.orig/auparse/auparse.c audit-1.7.2/auparse/auparse.c
|
|
Steve Grubb |
3f63ff |
--- audit-1.7.2.orig/auparse/auparse.c 2008-04-08 12:37:09.000000000 -0400
|
|
Steve Grubb |
f25903 |
+++ audit-1.7.2/auparse/auparse.c 2008-04-18 10:43:49.000000000 -0400
|
|
Steve Grubb |
3f63ff |
@@ -1130,6 +1130,7 @@ int auparse_first_record(auparse_state_t
|
|
Steve Grubb |
3f63ff |
return rc;
|
|
Steve Grubb |
3f63ff |
}
|
|
Steve Grubb |
3f63ff |
aup_list_first(&au->le);
|
|
Steve Grubb |
3f63ff |
+ aup_list_first_field(&au->le);
|
|
Steve Grubb |
3f63ff |
|
|
Steve Grubb |
3f63ff |
return 1;
|
|
Steve Grubb |
3f63ff |
}
|
|
Steve Grubb |
f25903 |
@@ -1236,7 +1237,22 @@ const char *auparse_find_field(auparse_s
|
|
Steve Grubb |
f25903 |
{
|
|
Steve Grubb |
f25903 |
free(au->find_field);
|
|
Steve Grubb |
f25903 |
au->find_field = strdup(name);
|
|
Steve Grubb |
f25903 |
- return auparse_find_field_next(au);
|
|
Steve Grubb |
f25903 |
+
|
|
Steve Grubb |
f25903 |
+ if (au->le.e.sec) {
|
|
Steve Grubb |
f25903 |
+ const char *cur_name;
|
|
Steve Grubb |
f25903 |
+ rnode *r;
|
|
Steve Grubb |
f25903 |
+
|
|
Steve Grubb |
f25903 |
+ // look at current record before moving
|
|
Steve Grubb |
f25903 |
+ r = aup_list_get_cur(&au->le);
|
|
Steve Grubb |
f25903 |
+ if (r == NULL)
|
|
Steve Grubb |
f25903 |
+ return NULL;
|
|
Steve Grubb |
f25903 |
+ cur_name = nvlist_get_cur_name(&r->nv);
|
|
Steve Grubb |
f25903 |
+ if (cur_name && strcmp(cur_name, name) == 0)
|
|
Steve Grubb |
f25903 |
+ return nvlist_get_cur_val(&r->nv);
|
|
Steve Grubb |
f25903 |
+
|
|
Steve Grubb |
f25903 |
+ return auparse_find_field_next(au);
|
|
Steve Grubb |
f25903 |
+ }
|
|
Steve Grubb |
f25903 |
+ return NULL;
|
|
Steve Grubb |
f25903 |
}
|
|
Steve Grubb |
f25903 |
|
|
Steve Grubb |
f25903 |
/* Increment 1 location and then scan for next field */
|
|
Steve Grubb |
f25903 |
@@ -1258,6 +1274,8 @@ const char *auparse_find_field_next(aupa
|
|
Steve Grubb |
3f63ff |
if (nvlist_find_name(&r->nv, au->find_field))
|
|
Steve Grubb |
3f63ff |
return nvlist_get_cur_val(&r->nv);
|
|
Steve Grubb |
3f63ff |
r = aup_list_next(&au->le);
|
|
Steve Grubb |
3f63ff |
+ if (r)
|
|
Steve Grubb |
3f63ff |
+ aup_list_first_field(&au->le);
|
|
Steve Grubb |
3f63ff |
}
|
|
Steve Grubb |
3f63ff |
}
|
|
Steve Grubb |
3f63ff |
return NULL;
|