|
 |
947d92 |
diff -urp audit-3.0.orig/src/ausearch-parse.c audit-3.0/src/ausearch-parse.c
|
|
|
947d92 |
--- audit-3.0.orig/src/ausearch-parse.c 2019-03-15 15:30:39.000000000 -0400
|
|
|
947d92 |
+++ audit-3.0/src/ausearch-parse.c 2019-04-16 16:08:52.862402589 -0400
|
|
|
947d92 |
@@ -49,7 +49,7 @@ static int parse_dir(const lnode *n, sea
|
|
|
947d92 |
static int common_path_parser(search_items *s, char *path);
|
|
|
947d92 |
static int avc_parse_path(const lnode *n, search_items *s);
|
|
|
947d92 |
static int parse_path(const lnode *n, search_items *s);
|
|
|
947d92 |
-static int parse_user(const lnode *n, search_items *s);
|
|
|
947d92 |
+static int parse_user(const lnode *n, search_items *s, anode *avc);
|
|
|
947d92 |
static int parse_obj(const lnode *n, search_items *s);
|
|
|
947d92 |
static int parse_login(const lnode *n, search_items *s);
|
|
|
947d92 |
static int parse_daemon1(const lnode *n, search_items *s);
|
|
|
947d92 |
@@ -105,7 +105,7 @@ int extract_search_items(llist *l)
|
|
|
947d92 |
case AUDIT_FIRST_USER_MSG...AUDIT_USER_END:
|
|
|
947d92 |
case AUDIT_USER_CHAUTHTOK...AUDIT_LAST_USER_MSG:
|
|
|
947d92 |
case AUDIT_FIRST_USER_MSG2...AUDIT_LAST_USER_MSG2:
|
|
|
947d92 |
- ret = parse_user(n, s);
|
|
|
947d92 |
+ ret = parse_user(n, s, NULL);
|
|
|
947d92 |
break;
|
|
|
947d92 |
case AUDIT_SOCKADDR:
|
|
|
947d92 |
ret = parse_sockaddr(n, s);
|
|
|
947d92 |
@@ -830,7 +830,7 @@ static int parse_obj(const lnode *n, sea
|
|
|
947d92 |
return 0;
|
|
|
947d92 |
}
|
|
|
947d92 |
|
|
|
947d92 |
-static int parse_user(const lnode *n, search_items *s)
|
|
|
947d92 |
+static int parse_user(const lnode *n, search_items *s, anode *avc)
|
|
|
947d92 |
{
|
|
|
947d92 |
char *ptr, *str, *term, saved, *mptr;
|
|
|
947d92 |
|
|
|
947d92 |
@@ -915,7 +915,10 @@ static int parse_user(const lnode *n, se
|
|
|
947d92 |
if (term == NULL)
|
|
|
947d92 |
return 12;
|
|
|
947d92 |
*term = 0;
|
|
|
947d92 |
- if (audit_avc_init(s) == 0) {
|
|
|
947d92 |
+ if (avc) {
|
|
|
947d92 |
+ avc->scontext = strdup(str);
|
|
|
947d92 |
+ *term = ' ';
|
|
|
947d92 |
+ } else if (audit_avc_init(s) == 0) {
|
|
|
947d92 |
anode an;
|
|
|
947d92 |
|
|
|
947d92 |
anode_init(&an);
|
|
|
947d92 |
@@ -926,6 +929,31 @@ static int parse_user(const lnode *n, se
|
|
|
947d92 |
return 13;
|
|
|
947d92 |
}
|
|
|
947d92 |
}
|
|
|
947d92 |
+ // optionally get tcontext
|
|
|
947d92 |
+ if (avc && event_object) {
|
|
|
947d92 |
+ // USER_AVC tcontext
|
|
|
947d92 |
+ str = strstr(term, "tcontext=");
|
|
|
947d92 |
+ if (str != NULL) {
|
|
|
947d92 |
+ str += 9;
|
|
|
947d92 |
+ term = strchr(str, ' ');
|
|
|
947d92 |
+ if (term) {
|
|
|
947d92 |
+ *term = 0;
|
|
|
947d92 |
+ avc->tcontext = strdup(str);
|
|
|
947d92 |
+ *term = ' ';
|
|
|
947d92 |
+ }
|
|
|
947d92 |
+ }
|
|
|
947d92 |
+ // Grab tclass if it exists
|
|
|
947d92 |
+ str = strstr(term, "tclass=");
|
|
|
947d92 |
+ if (str) {
|
|
|
947d92 |
+ str += 7;
|
|
|
947d92 |
+ term = strchr(str, ' ');
|
|
|
947d92 |
+ if (term) {
|
|
|
947d92 |
+ *term = 0;
|
|
|
947d92 |
+ avc->avc_class = strdup(str);
|
|
|
947d92 |
+ *term = ' ';
|
|
|
947d92 |
+ }
|
|
|
947d92 |
+ }
|
|
|
947d92 |
+ }
|
|
|
947d92 |
// optionally get gid
|
|
|
947d92 |
if (event_gid != -1) {
|
|
|
947d92 |
if (n->type == AUDIT_ADD_GROUP || n->type == AUDIT_DEL_GROUP ||
|
|
|
947d92 |
@@ -1880,7 +1908,7 @@ static int parse_avc(const lnode *n, sea
|
|
|
947d92 |
other_avc:
|
|
|
947d92 |
// User AVC's are not formatted like a kernel AVC
|
|
|
947d92 |
if (n->type == AUDIT_USER_AVC) {
|
|
|
947d92 |
- rc = parse_user(n, s);
|
|
|
947d92 |
+ rc = parse_user(n, s, &an);
|
|
|
947d92 |
if (rc > 20)
|
|
|
947d92 |
rc = 0;
|
|
|
947d92 |
if (audit_avc_init(s) == 0) {
|
|
|
947d92 |
diff -urp audit-3.0.orig/src/ausearch-string.c audit-3.0/src/ausearch-string.c
|
|
|
947d92 |
--- audit-3.0.orig/src/ausearch-string.c 2019-03-15 15:30:39.000000000 -0400
|
|
|
947d92 |
+++ audit-3.0/src/ausearch-string.c 2019-04-16 15:55:39.186487759 -0400
|
|
|
947d92 |
@@ -118,6 +118,9 @@ int slist_add_if_uniq(slist *l, const ch
|
|
|
947d92 |
snode sn;
|
|
|
947d92 |
register snode *cur;
|
|
|
947d92 |
|
|
|
947d92 |
+ if (str == NULL)
|
|
|
947d92 |
+ return -1;
|
|
|
947d92 |
+
|
|
|
947d92 |
cur = l->head;
|
|
|
947d92 |
while (cur) {
|
|
|
947d92 |
if (strcmp(str, cur->str) == 0) {
|