Just an update for the last patch. This patch contains a complete list of apparmor avc fields.
Regards, Marcelo --- auparse/typetab.h | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/auparse/typetab.h b/auparse/typetab.h index 7838c17..27c0ffb 100644 --- a/auparse/typetab.h +++ b/auparse/typetab.h @@ -86,3 +86,10 @@ _S(AUPARSE_TYPE_NFPROTO, "family" ) _S(AUPARSE_TYPE_ICMPTYPE, "icmptype" ) _S(AUPARSE_TYPE_PROTOCOL, "proto" ) _S(AUPARSE_TYPE_ADDR, "addr" ) +_S(AUPARSE_TYPE_ESCAPED, "apparmor" ) +_S(AUPARSE_TYPE_ESCAPED, "operation" ) +_S(AUPARSE_TYPE_ESCAPED, "denied_mask" ) +_S(AUPARSE_TYPE_ESCAPED, "info" ) +_S(AUPARSE_TYPE_ESCAPED, "profile" ) +_S(AUPARSE_TYPE_ESCAPED, "requested_mask") + -- 1.7.1 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
