Hello,
auparse would crash if there was an interpreted filter item defined and
the field could not be interpreted (e.g. it had an invalid format).
The attached patch modifies auparse to use the raw value in such cases.
Mirek
diff -ur audit/auparse/auparse.c
On Thursday 31 January 2008 04:02:06 Miloslav Trmac wrote:
auparse would crash if there was an interpreted filter item defined and
the field could not be interpreted (e.g. it had an invalid format).
Applied, thanks!
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
