linux-audit.redhat.com archive mirror
 help / color / mirror / Atom feed
* [PATCH] auditd: fix missing space with enriched log format
@ 2021-09-15  1:55 Enzo Matsumiya
  2021-09-15  3:32 ` Steve Grubb
  0 siblings, 1 reply; 5+ messages in thread
From: Enzo Matsumiya @ 2021-09-15  1:55 UTC (permalink / raw)
  To: linux-audit

When audit.log is opened with cat or less, for example, with log format
= ENRICHED, there's no space between data and the enriched part, only
AUDIT_INTERP_SEPARATOR (0x1d):

type=USER_CMD msg=audit(1631669179.082:2403): ... res=success'UID="enzo" AUID="unset"
						             ^ (0x1d)

sep_done should be checked if it's 1 as well, so a space is added before
the first enriched field.

Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
---
 src/auditd-event.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/auditd-event.c b/src/auditd-event.c
index 788c44a08197..636553187279 100644
--- a/src/auditd-event.c
+++ b/src/auditd-event.c
@@ -365,7 +365,7 @@ static int add_simple_field(auparse_state_t *au, size_t len_left, int encode)
 
 	// Setup pointer
 	ptr = &format_buf[FORMAT_BUF_LEN - len_left];
-	if (sep_done > 1) {
+	if (sep_done >= 1) {
 		*ptr = ' ';
 		ptr++;
 		num = 1;
-- 
2.33.0


--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit


^ permalink raw reply related	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2021-09-15 18:01 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-15  1:55 [PATCH] auditd: fix missing space with enriched log format Enzo Matsumiya
2021-09-15  3:32 ` Steve Grubb
2021-09-15 14:52   ` Enzo Matsumiya
2021-09-15 17:44     ` Steve Grubb
2021-09-15 17:55       ` Enzo Matsumiya

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).