[PATCH] userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log

[Tyler Hicks]

On 2014-05-28 15:33:06, Tony Jones wrote:
> This patch came from our L3 department.  AppArmor LSM is logging using the common_lsm_audit() 
> call but the audit userspace parsing code expects to see an SELinux tclass field. This patch 
> doesn't address the lack of support for AppArmor in "aureport --avc".  Talking to Seth Arnold, 
> Canonical apparently has patches for this; if this is true perhaps they can post for inclusion.

Making the audit tools work with AppArmor generated events has been on
my todo list for quite a while, but no patches exist.

I'm surprised that this patch makes ausearch work correctly for AppArmor
AVC events. The first thing that parse_avc() does is look for the
"avc: " term in the AVCs that SELinux generates. AppArmor's AVCs don't
include that string, so an.avc_result and an.avc_perm would not be set,
would they?

Tyler

> 
> Based-on-work-by: William Preston <wpreston at suse.com>
> Signed-off-by: Tony Jones <tonyj at suse.de>
> 
> --- a/src/ausearch-parse.c      2014-05-21 14:45:22.000000000 +0200
> +++ b/src/ausearch-parse.c      2014-05-21 14:53:55.000000000 +0200
> @@ -1735,17 +1735,15 @@ static int parse_avc(const lnode *n, sea
> 
>         // Now get the class...its at the end, so we do things different
>         str = strstr(term, "tclass=");
> -       if (str == NULL) {
> -               rc = 9;
> -               goto err;
> +       if (str) {
> +               str += 7;
> +               term = strchr(str, ' ');
> +               if (term)
> +                       *term = 0;
> +               an.avc_class = strdup(str);
> +               if (term)
> +                       *term = ' ';
>         }
> -       str += 7;
> -       term = strchr(str, ' ');
> -       if (term)
> -               *term = 0;
> -       an.avc_class = strdup(str);
> -       if (term)
> -               *term = ' ';
> 
>         if (audit_avc_init(s) == 0) {
>                 alist_append(s->avc, &an);
> 
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20140529/519e017a/attachment.sig>