rpms/audit
9
0
Fork 0
Code Issues Pull requests Releases Activity
0 releases 47 tags
  • imports/c10s/audit-4.2.1-3.el10 7812953dbe

    aureport: fix AVC result always showing "unset" without a success filter

    Ghost released this 2026-08-12 08:43:07 +00:00 | -533 commits to c8 since this release

    In parse_avc(), two unrelated concerns were bundled under one guard:

    if (event_success != S_UNSET && s->success == S_UNSET) {
    an.avc_result = AVC_DENIED / AVC_GRANTED; /* concern 1 /
    s->success = S_FAILED / S_SUCCESS; /     concern 2 */
    }

    The guard was correct for concern 2: only propagate the AVC verdict to
    s->success when the caller is filtering by success/failure and s->success
    hasn't been set yet (syscall pass/fail is authoritative).

    However, it also gated concern 1: populating an.avc_result, which is the
    field aureport -a prints in the "result" column. Without --success or
    --failed on the command line, event_success == S_UNSET, so the block was
    skipped entirely and an.avc_result stayed at its initial AVC_UNSET value.
    aulookup_result(AVC_UNSET) returns "unset", making the result column
    always show "unset" regardless of what the AVC record actually says.

    Fix: unconditionally extract the verdict from the record into an.avc_result,
    and move the event_success guard to cover only the s->success assignment.

    Resolves: RHEL-172047
    Signed-off-by: Cropi alakatos@redhat.com

    Downloads