Attachment 309801 Details for Bug 452044 – patch to audit config and script

[patch] patch to audit config and script

audit.patch (text/plain), 2.12 KB, created by Orion Poplawski on 2008-06-18 22:33:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Orion Poplawski

Created: 2008-06-18 22:33:36 UTC

Size: 2.12 KB

patch

obsolete

>Index: conf/services/audit.conf
>===================================================================
>RCS file: /var/cvs/logwatch/conf/services/audit.conf,v
>retrieving revision 1.2
>diff -u -r1.2 audit.conf
>--- conf/services/audit.conf	7 Jun 2005 18:17:20 -0000	1.2
>+++ conf/services/audit.conf	18 Jun 2008 20:51:12 -0000
>@@ -21,7 +21,8 @@
> # Note that audit lines may have something like audit(1114839915.618:0)
> # as the service name
> # (Some implementations might not precede it with "kernel:")
>-*OnlyService = (kernel:)?\s*audit.*
>+# (Linux 2.6.25+ adds "type=####"
>+*OnlyService = (kernel:)?\s*(type=\d+)?\s*audit.*
> *RemoveHeaders
> 
> ########################################################
>Index: scripts/services/audit
>===================================================================
>RCS file: /var/cvs/logwatch/scripts/services/audit,v
>retrieving revision 1.14
>diff -u -r1.14 audit
>--- scripts/services/audit	4 May 2008 14:15:39 -0000	1.14
>+++ scripts/services/audit	18 Jun 2008 20:51:12 -0000
>@@ -105,10 +105,10 @@
> 	( $ThisLine =~ /SELinux:  unrecognized netlink message type=[0-9]+ for sclass=[0-9]+/) or
> 	( $ThisLine =~ /audit$[0-9.]+:[0-9]+$: saddr=[0-9]+/) or
> 	( $ThisLine =~ /nargs=[0-9]+ a0=[0-9a-f]+ a1=[0-9a-f]+ a2=[0-9a-f]+ a3=[0-9a-f]+ a4=[0-9a-f]+ a5=[0-9a-f]+/) or
>-	( $ThisLine =~ /^audit$[0-9.]+:[0-9]+$: ( ?(path|cwd|item|name|flags)=["\/A-Za-z0-9]*)*$/) or
>+	( $ThisLine =~ /audit$[0-9.]+:[0-9]+$: ( ?(path|cwd|item|name|flags)=["\/A-Za-z0-9]*)*$/) or
> 	( $ThisLine =~ /: enforcing=[0-9]+ old_enforcing=[0-9]+ auid=[0-9]+/) or
> 	( $ThisLine =~ /: policy loaded auid=[0-9]+/) or
>-	( $ThisLine =~ /: user pid=[0-9]+ uid=[0-9]+ auid=[0-9]+ subj=system_u:system_r:system_dbusd_t:[0-9a-z]+ msg=/) or
>+	( $ThisLine =~ /: user pid=[0-9]+ uid=[0-9]+ auid=[0-9]+ subj=system_u:system_r:system_dbusd_t:[0-9a-z:.\-]+ msg=/) or
> 	( $ThisLine =~ /audit$[0-9.]+:[0-9]+$: (selinux=[0-9]+|auid=[0-9]+|prom=[0-9]+|old_prom=[0-9]+|dev=[^ ]+| )+$/) or
>         ( $ThisLine =~ /auditd[ ]+S [0-9A-F]+  [0-9]+  [0-9]+[ ]+[0-9]([ ]*[0-9]+[ ]*|[ ]*)[0-9]+  [0-9]+ $NOTLB$/) or
>         ( $ThisLine =~ /Started dispatcher: \/sbin\/audispd pid: [0-9]+/) or

Actions: View | Diff

Attachments on bug 452044: 309801