diff -urp audit-2.3.3.orig/src/ausearch-parse.c audit-2.3.3/src/ausearch-parse.c
--- audit-2.3.3.orig/src/ausearch-parse.c 2014-03-18 12:18:17.376764161 -0400
+++ audit-2.3.3/src/ausearch-parse.c 2014-03-18 12:21:10.924749548 -0400
@@ -1106,14 +1106,41 @@ static int parse_login(const lnode *n, s
s->uid = strtoul(ptr, NULL, 10);
if (errno)
return 6;
- // get loginuid
*term = ' ';
+ // optionally get subj
+ if (event_subject) {
+ str = strstr(term, "subj=");
+ if (str) {
+ ptr = str + 5;
+ term = strchr(ptr, ' ');
+ if (term == NULL)
+ return 12;
+ *term = 0;
+ if (audit_avc_init(s) == 0) {
+ anode an;
+
+ anode_init(&an);
+ an.scontext = strdup(str);
+ alist_append(s->avc, &an);
+ *term = ' ';
+ } else
+ return 13;
+ *term = ' ';
+ }
+ }
+ // get loginuid
str = strstr(term, "new auid=");
if (str == NULL) {
- str = strstr(term, "new loginuid=");
- if (str == NULL)
- return 7;
- ptr = str + 13;
+ // 3.14 kernel changed it to the next line
+ str = strstr(term, " auid=");
+ if (str == NULL) {
+ str = strstr(term, "new loginuid=");
+ if (str == NULL)
+ return 7;
+ ptr = str + 13;
+ }
+ else
+ ptr = str + 6;
} else
ptr = str + 9;
term = strchr(ptr, ' ');
@@ -1148,18 +1175,24 @@ static int parse_login(const lnode *n, s
if (term == NULL)
term = n->message;
str = strstr(term, "new ses=");
- if (str) {
- ptr = str + 8;
- term = strchr(ptr, ' ');
- if (term)
- *term = 0;
- errno = 0;
- s->session_id = strtoul(ptr, NULL, 10);
- if (errno)
- return 11;
- if (term)
- *term = ' ';
+ if (str == NULL) {
+ // The 3.14 kernel changed it to the next line
+ str = strstr(term, " ses=");
+ if (str == NULL)
+ return 14;
+ ptr = str + 5;
}
+ else
+ ptr = str + 8;
+ term = strchr(ptr, ' ');
+ if (term)
+ *term = 0;
+ errno = 0;
+ s->session_id = strtoul(ptr, NULL, 10);
+ if (errno)
+ return 11;
+ if (term)
+ *term = ' ';
}
return 0;
}