<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Jonathan Kelly wrote:
<blockquote
cite="mid:0E43BF2D7491F0468B56B1A5C493866B020DD0F1@SAT4MX07.RACKSPACE.CORP"
type="cite">
<meta http-equiv="Content-Type" content="text/html; ">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="Section1">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When using the python auparse library to call
AuParser.interpret_field() on a multi-word field, only the first word
in the
field is returned. Using get_field_str() instead of interpret_field()
yields
the same output. I have verified that this issue exists in the C
library, as
well as the Python. I suspect that this may be an issue for multi-word
fields
in general, but have not noticed any other than 'op'.<o:p></o:p></p>
</div>
</blockquote>
The thing to note here is that only the characters up to the first
white space were included in the field.<br>
<br>
Unfortunately string handling in audit is seriously broken and has been
for a long time. The audit code does not know how to handle strings
with embedded spaces, quotes, etc. The fundamental problem is the
format for string encoding was never defined. There is a horrible hack
the kernel uses when a string has a space in it, it converts the string
to a sequence of hex characters, thus there is no space in the value of
the key=value pair. Auparse has a hard coded list of keys it expects
might have hex encoded strings in it, if the key (msg in this instance)
is in the list then the interpret function will decode the hex string.<br>
<br>
You might try encoding the msg in hex to see if it starts working.<br>
<br>
Or you might try convincing the audit maintainers to adopt sane string
handling rules (but good luck on this front, there have been many many
complaints about this for a long time and nothing has happened :-(<br>
<pre class="moz-signature" cols="72">--
John Dennis <a class="moz-txt-link-rfc2396E" href="mailto:jdennis@redhat.com"><jdennis@redhat.com></a>
</pre>
</body>
</html>