* [PATCH] auditd: fix missing space with enriched log format
@ 2021-09-15 1:55 Enzo Matsumiya
2021-09-15 3:32 ` Steve Grubb
0 siblings, 1 reply; 5+ messages in thread
From: Enzo Matsumiya @ 2021-09-15 1:55 UTC (permalink / raw)
To: linux-audit
When audit.log is opened with cat or less, for example, with log format
= ENRICHED, there's no space between data and the enriched part, only
AUDIT_INTERP_SEPARATOR (0x1d):
type=USER_CMD msg=audit(1631669179.082:2403): ... res=success'UID="enzo" AUID="unset"
^ (0x1d)
sep_done should be checked if it's 1 as well, so a space is added before
the first enriched field.
Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
---
src/auditd-event.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/auditd-event.c b/src/auditd-event.c
index 788c44a08197..636553187279 100644
--- a/src/auditd-event.c
+++ b/src/auditd-event.c
@@ -365,7 +365,7 @@ static int add_simple_field(auparse_state_t *au, size_t len_left, int encode)
// Setup pointer
ptr = &format_buf[FORMAT_BUF_LEN - len_left];
- if (sep_done > 1) {
+ if (sep_done >= 1) {
*ptr = ' ';
ptr++;
num = 1;
--
2.33.0
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] auditd: fix missing space with enriched log format
2021-09-15 1:55 [PATCH] auditd: fix missing space with enriched log format Enzo Matsumiya
@ 2021-09-15 3:32 ` Steve Grubb
2021-09-15 14:52 ` Enzo Matsumiya
0 siblings, 1 reply; 5+ messages in thread
From: Steve Grubb @ 2021-09-15 3:32 UTC (permalink / raw)
To: linux-audit, Enzo Matsumiya
On Tuesday, September 14, 2021 9:55:48 PM EDT Enzo Matsumiya wrote:
> When audit.log is opened with cat or less, for example, with log format
> = ENRICHED, there's no space between data and the enriched part, only
> AUDIT_INTERP_SEPARATOR (0x1d):
This is by design.
> type=USER_CMD msg=audit(1631669179.082:2403): ... res=success'UID="enzo"
> AUID="unset" ^ (0x1d)
>
> sep_done should be checked if it's 1 as well, so a space is added before
> the first enriched field.
Why?
Thanks,
-Steve
> Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
> ---
> src/auditd-event.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/auditd-event.c b/src/auditd-event.c
> index 788c44a08197..636553187279 100644
> --- a/src/auditd-event.c
> +++ b/src/auditd-event.c
> @@ -365,7 +365,7 @@ static int add_simple_field(auparse_state_t *au, size_t
> len_left, int encode)
>
> // Setup pointer
> ptr = &format_buf[FORMAT_BUF_LEN - len_left];
> - if (sep_done > 1) {
> + if (sep_done >= 1) {
> *ptr = ' ';
> ptr++;
> num = 1;
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] auditd: fix missing space with enriched log format
2021-09-15 3:32 ` Steve Grubb
@ 2021-09-15 14:52 ` Enzo Matsumiya
2021-09-15 17:44 ` Steve Grubb
0 siblings, 1 reply; 5+ messages in thread
From: Enzo Matsumiya @ 2021-09-15 14:52 UTC (permalink / raw)
To: Steve Grubb; +Cc: linux-audit
On 09/14, Steve Grubb wrote:
>On Tuesday, September 14, 2021 9:55:48 PM EDT Enzo Matsumiya wrote:
>> When audit.log is opened with cat or less, for example, with log format
>> = ENRICHED, there's no space between data and the enriched part, only
>> AUDIT_INTERP_SEPARATOR (0x1d):
>
>This is by design.
I understand that, and the patch doesn't break it.
>> type=USER_CMD msg=audit(1631669179.082:2403): ... res=success'UID="enzo"
>> AUID="unset" ^ (0x1d)
>>
>> sep_done should be checked if it's 1 as well, so a space is added before
>> the first enriched field.
>
>Why?
Some people still rely on opening audit.log with tools that are not aware
of the log format.
As far as I could test, the change is only cosmetic, as I expected. I did a
basic test with ausearch and it was ok.
Please clarify if you expect anything else to be affected by this
change.
Cheers,
Enzo
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] auditd: fix missing space with enriched log format
2021-09-15 14:52 ` Enzo Matsumiya
@ 2021-09-15 17:44 ` Steve Grubb
2021-09-15 17:55 ` Enzo Matsumiya
0 siblings, 1 reply; 5+ messages in thread
From: Steve Grubb @ 2021-09-15 17:44 UTC (permalink / raw)
To: Enzo Matsumiya; +Cc: linux-audit
On Wednesday, September 15, 2021 10:52:28 AM EDT Enzo Matsumiya wrote:
> On 09/14, Steve Grubb wrote:
> >On Tuesday, September 14, 2021 9:55:48 PM EDT Enzo Matsumiya wrote:
> >> When audit.log is opened with cat or less, for example, with log format
> >> = ENRICHED, there's no space between data and the enriched part, only
> >
> >> AUDIT_INTERP_SEPARATOR (0x1d):
> >This is by design.
>
> I understand that, and the patch doesn't break it.
>
> >> type=USER_CMD msg=audit(1631669179.082:2403): ... res=success'UID="enzo"
> >> AUID="unset" ^ (0x1d)
> >>
> >> sep_done should be checked if it's 1 as well, so a space is added before
> >> the first enriched field.
> >
> >Why?
>
> Some people still rely on opening audit.log with tools that are not aware
> of the log format.
There is another log format, RAW, which should be suitable for the old tools.
Also, I don't understand what problems that causes. You haven't exactly
explained what the problem is and why this is needed. The ENRICHED format has
been documented for over 5 years. Plenty of time for tools to become aware.
> As far as I could test, the change is only cosmetic, as I expected. I did a
> basic test with ausearch and it was ok.
>
> Please clarify if you expect anything else to be affected by this
> change.
Without more context, I am reluctant to change a documented standard that has
existed for over 5 years.
https://github.com/linux-audit/audit-documentation/wiki/SPEC-Audit-Event-Enrichment
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] auditd: fix missing space with enriched log format
2021-09-15 17:44 ` Steve Grubb
@ 2021-09-15 17:55 ` Enzo Matsumiya
0 siblings, 0 replies; 5+ messages in thread
From: Enzo Matsumiya @ 2021-09-15 17:55 UTC (permalink / raw)
To: Steve Grubb; +Cc: linux-audit
On 09/15, Steve Grubb wrote:
>There is another log format, RAW, which should be suitable for the old tools.
>Also, I don't understand what problems that causes. You haven't exactly
>explained what the problem is and why this is needed. The ENRICHED format has
>been documented for over 5 years. Plenty of time for tools to become aware.
> ...
Again, the change was only cosmetic for when you "cat
/var/log/audit/audit.log" -- no problems otherwise.
>Without more context, I am reluctant to change a documented standard that has
>existed for over 5 years.
>
>https://github.com/linux-audit/audit-documentation/wiki/SPEC-Audit-Event-Enrichment
Please drop it then. I'll work on changing the default log_format back to
RAW for future SLES releases.
Cheers,
Enzo
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-09-15 18:01 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-15 1:55 [PATCH] auditd: fix missing space with enriched log format Enzo Matsumiya
2021-09-15 3:32 ` Steve Grubb
2021-09-15 14:52 ` Enzo Matsumiya
2021-09-15 17:44 ` Steve Grubb
2021-09-15 17:55 ` Enzo Matsumiya
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.