Missing "nametype" field in audit PATH records

Missing "nametype" field in audit PATH records

[Nimrod Ostrovsky]

[-- Attachment #1.1: Type: text/plain, Size: 467 bytes --]

Hello,

I use the latest audit-userspace version on kernel 3.0.21, and  Im trying
to compile a dispatcher app for audispd.
The problem is that  PATH records  does not have the "nametype" field in in
this kernel version, and I want to be able to distinct between "parent"
PATH records and any other types.

Any ideas how to solve this issue?
(Without having to upgrade the kernel)

Cheers,
Nimrod.

-- 

 <https://automotive.knect365.com/tu-auto-detroit/registration>

[-- Attachment #1.2: Type: text/html, Size: 1189 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Missing "nametype" field in audit PATH records

[Steve Grubb]

On Tuesday, May 29, 2018 10:42:11 AM EDT Nimrod Ostrovsky wrote:
> Hello,
> 
> I use the latest audit-userspace version on kernel 3.0.21, and  Im trying
> to compile a dispatcher app for audispd.
> The problem is that  PATH records  does not have the "nametype" field in in
> this kernel version, and I want to be able to distinct between "parent"
> PATH records and any other types.
> 
> Any ideas how to solve this issue?
> (Without having to upgrade the kernel)

Looks like that landed in the 3.10 kernel. Short of backporting nametype 
support to your kernel, there is nothing else that you can do.

-Steve