[PATCH] Don't crash on unknown S_IFMT file modes

2009-03-26 Thread Miloslav Trmac
Hello, ausearch -i and libauparse currently crash (access NULL) if a mode= field contains an unknown file type. Such records are generated by the kernel for IPC, e.g. node=jcdx156 type=IPC msg=audit(1237915952.720:2294): ouid=500 ogid=1106 mode=0600

Re: [PATCH] Don't crash on unknown S_IFMT file modes

2009-03-26 Thread LC Bruzenak
On Thu, 2009-03-26 at 08:06 -0400, Miloslav Trmac wrote: Hello, ausearch -i and libauparse currently crash (access NULL) if a mode= field contains an unknown file type. Such records are generated by the kernel for IPC, e.g. node=jcdx156 type=IPC msg=audit(1237915952.720:2294):

Re: [PATCH] Don't crash on unknown S_IFMT file modes

2009-03-26 Thread Miloslav Trmac
- LC Bruzenak le...@magitekltd.com wrote: Thank you for this patch...wherever it may be. :) Ooops :/ Do you have a standard auparse test you use to track these down? No, I only have a small Python program to use auparse to interpret a supplied log file (attached). There is also (make

[Fwd: Re: [PATCH] database audit integration (Re: Some ideas in SE-PostgreSQL enhancement)]

2009-03-26 Thread Matthew Booth
I meant to send this to the list too. Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490 ---BeginMessage--- KaiGai Kohei wrote: Hello, I'm a developer of

Re: [PATCH] database audit integration (Re: Some ideas in SE-PostgreSQL enhancement)

2009-03-26 Thread KaiGai Kohei
Matthew Booth wrote: KaiGai Kohei wrote: Hello, I'm a developer of SE-PostgreSQL which is an enhancement of database security using SELinux. It enables to apply the security policy of the operating system on accesses to database objects also. It makes an access control decision and audit