On Thursday, February 09, 2012 02:18:40 PM Marcelo Cerri wrote: > With this patch, the workaround for creating the search criteria is removed > and escaped fields are properly retrieved.
Applied, but one comment down below... > The unexpected single quote at the beginning of MAC addresses is fixed by a > patch in libvirt: > > https://www.redhat.com/archives/libvir-list/2012-February/msg00502.html > --- > tools/auvirt/auvirt.c | 39 +++++++++++++++------------------------ > 1 files changed, 15 insertions(+), 24 deletions(-) > > diff --git a/tools/auvirt/auvirt.c b/tools/auvirt/auvirt.c > index c04780a..a89b097 100644 > --- a/tools/auvirt/auvirt.c > +++ b/tools/auvirt/auvirt.c > @@ -781,7 +768,9 @@ int process_resource_event(auparse_state_t *au) > } > } else if (strcmp("cgroup", res_type) == 0) { > auparse_first_record(au); > - const char *cgroup = auparse_find_field(au, "cgroup"); > + const char *cgroup = NULL; > + if (auparse_find_field(au, "cgroup")) > + cgroup = auparse_interpret_field(au); > rc += add_resource(au, uuid, uid, time, name, success, reason, > res_type, cgroup); So, if cgroup is NULL here, does anything go boom later? -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
