Blob Blame History Raw
diff -urp audit-2.3.3.orig/src/ausearch-parse.c audit-2.3.3/src/ausearch-parse.c
--- audit-2.3.3.orig/src/ausearch-parse.c	2014-03-18 12:18:17.376764161 -0400
+++ audit-2.3.3/src/ausearch-parse.c	2014-03-18 12:21:10.924749548 -0400
@@ -1106,14 +1106,41 @@ static int parse_login(const lnode *n, s
 	s->uid = strtoul(ptr, NULL, 10);
 	if (errno)
 		return 6;
-	// get loginuid
 	*term = ' ';
+	// optionally get subj
+	if (event_subject) {
+		str = strstr(term, "subj=");
+		if (str) {
+			ptr = str + 5;
+			term = strchr(ptr, ' ');
+			if (term == NULL)
+				return 12;
+			*term = 0;
+			if (audit_avc_init(s) == 0) {
+				anode an;
+
+				anode_init(&an);
+				an.scontext = strdup(str);
+				alist_append(s->avc, &an);
+				*term = ' ';
+			} else
+				return 13;
+			*term = ' ';
+		}
+	}
+	// get loginuid
 	str = strstr(term, "new auid=");
 	if (str == NULL) {
-		str = strstr(term, "new loginuid=");
-		if (str == NULL)
-			return 7;
-		ptr = str + 13;
+		// 3.14 kernel changed it to the next line
+		str = strstr(term, " auid=");
+		if (str == NULL) {
+			str = strstr(term, "new loginuid=");
+			if (str == NULL)
+				return 7;
+			ptr = str + 13;
+		}
+		else
+			ptr = str + 6;
 	} else
 		ptr = str + 9;
 	term = strchr(ptr, ' ');
@@ -1148,18 +1175,24 @@ static int parse_login(const lnode *n, s
 		if (term == NULL)
 			term = n->message;
 		str = strstr(term, "new ses=");
-		if (str) {
-			ptr = str + 8;
-			term = strchr(ptr, ' ');
-			if (term)
-				*term = 0;
-			errno = 0;
-			s->session_id = strtoul(ptr, NULL, 10);
-			if (errno)
-				return 11;
-			if (term)
-				*term = ' ';
+		if (str == NULL) {
+			// The 3.14 kernel changed it to the next line
+			str = strstr(term, " ses=");
+			if (str == NULL)
+				return 14;
+			ptr = str + 5;
 		}
+		else
+			ptr = str + 8;
+		term = strchr(ptr, ' ');
+		if (term)
+			*term = 0;
+		errno = 0;
+		s->session_id = strtoul(ptr, NULL, 10);
+		if (errno)
+			return 11;
+		if (term)
+			*term = ' ';
 	}
 	return 0;
 }