* Simple bug fix for PROCTITLE not being recognised with ausearch --debug check
@ 2015-12-18 3:20 Burn Alting
2015-12-18 14:00 ` Steve Grubb
0 siblings, 1 reply; 2+ messages in thread
From: Burn Alting @ 2015-12-18 3:20 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1: Type: text/plain, Size: 180 bytes --]
Steve,
When ausearch is given the --debug option, malformed events are written
to stderr. The PROCTITLE type record is considered to be malformed. This
patch corrects for this.
[-- Attachment #2: audit-2.4.4_debug_fix.patch --]
[-- Type: text/x-patch, Size: 455 bytes --]
diff -Npru audit-2.4.4/src/ausearch-parse.c audit-2.4.4_debug_fix/src/ausearch-parse.c
--- audit-2.4.4/src/ausearch-parse.c 2015-08-14 06:56:27.000000000 +1000
+++ audit-2.4.4_debug_fix/src/ausearch-parse.c 2015-12-18 13:52:32.103305466 +1100
@@ -162,6 +162,7 @@ int extract_search_items(llist *l)
case AUDIT_CAPSET:
case AUDIT_MMAP:
case AUDIT_NETFILTER_CFG:
+ case AUDIT_PROCTITLE:
// Nothing to parse
break;
case AUDIT_TTY:
[-- Attachment #3: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Simple bug fix for PROCTITLE not being recognised with ausearch --debug check
2015-12-18 3:20 Simple bug fix for PROCTITLE not being recognised with ausearch --debug check Burn Alting
@ 2015-12-18 14:00 ` Steve Grubb
0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2015-12-18 14:00 UTC (permalink / raw)
To: linux-audit, burn
On Friday, December 18, 2015 02:20:44 PM Burn Alting wrote:
> Steve,
>
> When ausearch is given the --debug option, malformed events are written
> to stderr. The PROCTITLE type record is considered to be malformed. This
> patch corrects for this.
Thanks! Applied.
-Steve
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-12-18 14:00 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-12-18 3:20 Simple bug fix for PROCTITLE not being recognised with ausearch --debug check Burn Alting
2015-12-18 14:00 ` Steve Grubb
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.