User space tools for 2.6 kernel auditing
7812953dbe
In parse_avc(), two unrelated concerns were bundled under one guard:
if (event_success != S_UNSET && s->success == S_UNSET) {
an.avc_result = AVC_DENIED / AVC_GRANTED; /* concern 1 */
s->success = S_FAILED / S_SUCCESS; /* concern 2 */
}
The guard was correct for concern 2: only propagate the AVC verdict to
s->success when the caller is filtering by success/failure and s->success
hasn't been set yet (syscall pass/fail is authoritative).
However, it also gated concern 1: populating an.avc_result, which is the
field aureport -a prints in the "result" column. Without --success or
--failed on the command line, event_success == S_UNSET, so the block was
skipped entirely and an.avc_result stayed at its initial AVC_UNSET value.
aulookup_result(AVC_UNSET) returns "unset", making the result column
always show "unset" regardless of what the AVC record actually says.
Fix: unconditionally extract the verdict from the record into an.avc_result,
and move the event_success guard to cover only the s->success assignment.
Resolves: RHEL-172047
Signed-off-by: Cropi <alakatos@redhat.com>
|
||
|---|---|---|
| .fmf | ||
| .gitignore | ||
| audit.spec | ||
| auditd-fix-16-byte-truncation-v1.patch | ||
| auditd-fix-16-byte-truncation-v2.patch | ||
| aureport-fix-AVC-unset-result.patch | ||
| ci_tests.fmf | ||
| gating.yaml | ||
| lgpl-2.1.txt | ||
| revert-audit-run-dir.patch | ||
| sources | ||