On Thu, 2006-12-14 at 11:48 -0500, Steve Grubb wrote:
> Hi,
>
> I was looking at parsing some of these messages and found that I wanted what
> it was doing next to an op= for the parser to key on. Also missing was the
> list
> number and results.
>
> Signed-off-by: Steve Grubb <[EMAIL PROTECTED]>
Would you mind explaining why we had to drop the chuck from the original
patch to auditfilter.c which had:
if (r->filterkey) {
audit_log_format(ab, " key=");
audit_log_untrustedstring(ab, r->filterkey);
} else
audit_log_format(ab, " key=(null)");
Also, can someone whack me with a clue bat? Do we have a process for
getting audit patches into mainline kernel? Do they still go through
viro's tree? Should it go right to akpm?
-Eric
>
> diff -urp linux-2.6.18.x86_64.orig/kernel/auditfilter.c
> linux-2.6.18.x86_64/kernel/auditfilter.c
> --- linux-2.6.18.x86_64.orig/kernel/auditfilter.c 2006-12-14
> 09:59:04.000000000 -0500
> +++ linux-2.6.18.x86_64/kernel/auditfilter.c 2006-12-14 10:02:39.000000000
> -0500
> @@ -938,9 +938,10 @@ static void audit_update_watch(struct au
> }
>
> ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
> - audit_log_format(ab, "audit updated rules specifying path=");
> + audit_log_format(ab, "op=updated rules specifying path=");
> audit_log_untrustedstring(ab, owatch->path);
> audit_log_format(ab, " with dev=%u ino=%lu\n", dev, ino);
> + audit_log_format(ab, " list=%d res=1", r->listnr);
> audit_log_end(ab);
>
> audit_remove_watch(owatch);
> @@ -970,14 +971,14 @@ static void audit_remove_parent_watches(
> e = container_of(r, struct audit_entry, rule);
>
> ab = audit_log_start(NULL, GFP_KERNEL,
> AUDIT_CONFIG_CHANGE);
> - audit_log_format(ab, "audit implicitly removed rule
> path=");
> + audit_log_format(ab, "op=remove rule path=");
> audit_log_untrustedstring(ab, w->path);
> if (r->filterkey) {
> audit_log_format(ab, " key=");
> audit_log_untrustedstring(ab, r->filterkey);
> } else
> audit_log_format(ab, " key=(null)");
> - audit_log_format(ab, " list=%d", r->listnr);
> + audit_log_format(ab, " list=%d res=1", r->listnr);
> audit_log_end(ab);
>
> list_del(&r->rlist);
> @@ -1411,7 +1412,7 @@ static void audit_log_rule_change(uid_t
> audit_log_format(ab, " subj=%s", ctx);
> kfree(ctx);
> }
> - audit_log_format(ab, " %s rule key=", action);
> + audit_log_format(ab, " op=%s rule key=", action);
> if (rule->filterkey)
> audit_log_untrustedstring(ab, rule->filterkey);
> else
>
> --
> Linux-audit mailing list
> [email protected]
> https://www.redhat.com/mailman/listinfo/linux-audit
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
