apparmor/libraries/libapparmor
Steve Beattie e56ed9a68a From: Jesse Michael <jesse.michael@comcast.net>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>

The format of audit messages that are redirected to syslog because
auditd isn't running changed between Hardy and Intrepid and now have
the type=NNNN field before the audit tag like--

Nov 1 22:24:43 box kernel: [ 158.113592] type=1503
audit(1225603483.635:5): operation="inode_permission" requested_mask="r::"
denied_mask="r::" fsuid=7 name="/proc/7034/net/" pid=7034
profile="/usr/sbin/cupsd"

I believe this patch will address the moved type=NNNN field as well as
capturing non-matching logfile input instead of printing it to stdout.

Patch modified by Steve Beattie <sbeattie@ubuntu.com> to take into
account a couple of different situations.

https://bugs.launchpad.net/bugs/271252
https://bugzilla.novell.com/show_bug.cgi?id=441381
2008-11-04 20:19:59 +00:00
..
doc move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
m4 move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
src From: Jesse Michael <jesse.michael@comcast.net> 2008-11-04 20:19:59 +00:00
swig move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
testsuite More testcases around syslog parsing. 2008-11-04 17:42:25 +00:00
AUTHORS move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
autogen.sh move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
ChangeLog move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
configure.in move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
COPYING.LGPL move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
INSTALL move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
libapparmor1.spec move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
Makefile.am move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
NEWS move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
README move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00

What little documentation exists is in src/aalogparse.h.  Please file bugs using http://bugzilla.novell.com under the AppArmor product.