[PATCH] Handle timestamp 0.0 in auparse, was Re: audit-viewer help needed

[Miloslav Trmač]

Hello,
the attached patch modifies auparse not to handle timestamp 0.x
specially by using out-of-band information (parse_state == EVENT_EMPTY)
instead of assuming (au->le.e.sec == 0) has a special meaning.  As far
as I can see, this the two conditions are equivalent if no event has a
timestamp 0.x.

The patch also decreases the assumed minimal length of a timestamp.

I have tested this only minimally - I have checked that (make check)
succeeds, and that audit-viewer doesn't crash on startup.

This patch fixes handling of the following Lenny's audit record:

> node=hugo type=AVC msg=audit(0.000:6760): avc:  denied  { recvfrom }
> for  pid=2589 comm="lockd" saddr=127.0.0.1 src=687 daddr=127.0.0.1
> dest=111 netif=lo scontext=system_u:system_r:initrc_t:s0-s15:c0.c1023
> tcontext=system_u:system_r:kernel_t:s15:c0.c1023 tclass=association

I'm curious how this audit record could have been created (notabile is
that the previous record has a sequence ID 6758 and a reasonable
timestamp).  Lenny, Steve, any ideas?

Thank you,
	Mirek
-------------- next part --------------
A non-text attachment was scrubbed...
Name: audit-sec0.patch
Type: text/x-patch
Size: 2027 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20080922/9a43054f/attachment.bin>