[PATCH] auparse: apparmor fields

[Marcelo Cerri]

Hi,

I'm taking a look at the AVC records generated by apparmor and some fields in
these records, such as "apparmor" and "operation", are quoted and are not listed
in the auparse/typetab.h file.

Searching in the kernel source, I've found the piece of code that generates the
AVC records and I noticed that it uses the function audit_log_string, which
just add quotes to the string, instead of audit_log_untrustedstring, which seems
to be targeted to escaped fields.

I'd like to know if these fields should be treated the same way as escaped
fields by libauparse or maybe it should be changed in the kernel.

If libauparse really needs to be changed, please consider this patch that
includes the fields "apparmor" and "operation" in the file auparse/typetab.h as
escaped fields.

Regards,
Marcelo
---
 auparse/typetab.h |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/auparse/typetab.h b/auparse/typetab.h
index 7838c17..0a81e25 100644
--- a/auparse/typetab.h
+++ b/auparse/typetab.h
@@ -86,3 +86,5 @@ _S(AUPARSE_TYPE_NFPROTO,	"family"	)
 _S(AUPARSE_TYPE_ICMPTYPE,	"icmptype"	)
 _S(AUPARSE_TYPE_PROTOCOL,	"proto"		)
 _S(AUPARSE_TYPE_ADDR,		"addr"		)
+_S(AUPARSE_TYPE_ESCAPED,	"apparmor"	)
+_S(AUPARSE_TYPE_ESCAPED,	"operation"	)
-- 
1.7.1