diff -urp audit-2.3.3.orig/src/ausearch-parse.c audit-2.3.3/src/ausearch-parse.c --- audit-2.3.3.orig/src/ausearch-parse.c 2014-03-18 12:18:17.376764161 -0400 +++ audit-2.3.3/src/ausearch-parse.c 2014-03-18 12:21:10.924749548 -0400 @@ -1106,14 +1106,41 @@ static int parse_login(const lnode *n, s s->uid = strtoul(ptr, NULL, 10); if (errno) return 6; - // get loginuid *term = ' '; + // optionally get subj + if (event_subject) { + str = strstr(term, "subj="); + if (str) { + ptr = str + 5; + term = strchr(ptr, ' '); + if (term == NULL) + return 12; + *term = 0; + if (audit_avc_init(s) == 0) { + anode an; + + anode_init(&an); + an.scontext = strdup(str); + alist_append(s->avc, &an); + *term = ' '; + } else + return 13; + *term = ' '; + } + } + // get loginuid str = strstr(term, "new auid="); if (str == NULL) { - str = strstr(term, "new loginuid="); - if (str == NULL) - return 7; - ptr = str + 13; + // 3.14 kernel changed it to the next line + str = strstr(term, " auid="); + if (str == NULL) { + str = strstr(term, "new loginuid="); + if (str == NULL) + return 7; + ptr = str + 13; + } + else + ptr = str + 6; } else ptr = str + 9; term = strchr(ptr, ' '); @@ -1148,18 +1175,24 @@ static int parse_login(const lnode *n, s if (term == NULL) term = n->message; str = strstr(term, "new ses="); - if (str) { - ptr = str + 8; - term = strchr(ptr, ' '); - if (term) - *term = 0; - errno = 0; - s->session_id = strtoul(ptr, NULL, 10); - if (errno) - return 11; - if (term) - *term = ' '; + if (str == NULL) { + // The 3.14 kernel changed it to the next line + str = strstr(term, " ses="); + if (str == NULL) + return 14; + ptr = str + 5; } + else + ptr = str + 8; + term = strchr(ptr, ' '); + if (term) + *term = 0; + errno = 0; + s->session_id = strtoul(ptr, NULL, 10); + if (errno) + return 11; + if (term) + *term = ' '; } return 0; }