lkml.org 
[lkml]   [2019]   [Sep]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH ghau51/ghau40 v7 09/12] contid: interpret correctly CONTAINER_ID contid field csv
    Date
    The CONTAINER_ID record contid field can contain comma-separated values
    when accompanying a NETFILTER_PKT record. Records appeared interpreted
    as such:

    Wrong:
    CONTAINER_ID msg=audit(2019-04-10 13:20:18.746:1690) : contid=777 666,333
    Right:
    CONTAINER_ID msg=audit(2019-04-10 13:20:18.746:1690) : contid=777,666,333

    Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
    ---
    src/ausearch-report.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    diff --git a/src/ausearch-report.c b/src/ausearch-report.c
    index 416c2b13fa6a..82fa9579f972 100644
    --- a/src/ausearch-report.c
    +++ b/src/ausearch-report.c
    @@ -279,7 +279,7 @@ no_print:
    if (str && val && (str < val)) {
    // Value side has commas and another field exists
    // Known: LABEL_LEVEL_CHANGE banners=none,none
    - // Known: ROLL_ASSIGN new-role=r,r
    + // Known: ROLE_ASSIGN new-role=r,r
    // Known: any MAC LABEL can potentially have commas
    int ftype = auparse_interp_adjust_type(n->type,
    name, val);
    @@ -293,9 +293,11 @@ no_print:
    } else if (str && (val == NULL)) {
    // Goes all the way to the end. Done parsing
    // Known: MCS context in PATH rec obj=u:r:t:s0:c2,c7
    + // Known: CONTAINER_ID contid can be a comma-separated list
    int ftype = auparse_interp_adjust_type(n->type,
    name, ptr);
    - if (ftype == AUPARSE_TYPE_MAC_LABEL)
    + if (ftype == AUPARSE_TYPE_MAC_LABEL
    + || ftype == AUPARSE_TYPE_CONTID)
    str = NULL;
    else {
    *str++ = 0;
    --
    1.8.3.1
    \
     
     \ /
      Last update: 2019-09-19 03:29    [W:2.286 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site