Bug 1406328

Summary: ausearch with '--raw' parameter outputs garbage character
Product: Red Hat Enterprise Linux 7 Reporter: adam winberg <adam.winberg>
Component: policycoreutilsAssignee: Petr Lautrbach <plautrba>
Status: CLOSED ERRATA QA Contact: Dalibor Pospíšil <dapospis>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.3CC: dapospis, dcritch, dwalsh, florian, icon, lvrabec, mgrepl, mmalik, plautrba, rhayden, sgrubb, ssekidde, todoleza, vmojzis
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: policycoreutils-2.5-16.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1406525 (view as bug list) Environment:
Last Closed: 2017-08-01 16:16:12 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1406525    
Attachments:
Description Flags
Reproducer including \x1d characters none

Description adam winberg 2016-12-20 09:50:21 UTC 
Description of problem:
After update to RHEL7.3 the ausearch command with the '--raw' parameter outputs a 'garbage' character at end of line, which makes it impossible to pipe into audit2allow. Since the 'sealert' utility in RHEL7.3 directs users to use the ausearch command to generate selinux policy rules this is a bit of a nuisance to us.

Could be something weird in our environment, but previous version of ausearch (audit-2.4.1-5.el7.x86_64) works fine for me.

Version-Release number of selected component (if applicable):
audit-2.6.5-3.el7.x86_64

How reproducible:


Steps to Reproduce:
1. Run 'ausearch --raw'
2. 
3.

Actual results:
At end of line of each log message there is a garbage character

Expected results:


Additional info:
Comment 2 Steve Grubb 2016-12-20 12:36:34 UTC 
This 'garbage' character is a group separator character that separates the event from translations. This is normal and to be expected if the system is using the enriched logging format. You can put the system back into the raw format for the time being.

I would say that the problem lies in the selinux tooling. It should take the record and stuff it "as is" into auparse. More info about the audit format is here in case it helps in fixing the bug:

https://github.com/linux-audit/audit-documentation/wiki/SPEC-Audit-Event-Enrichment
Comment 3 adam winberg 2016-12-20 12:43:44 UTC 
This is from my /etc/audit/auditd.conf:

log_format = RAW


So it seems I'm already using the raw format, not the enriched?
Comment 4 Steve Grubb 2016-12-20 15:13:17 UTC 
Tracked the issue down ausearch adding a separator when it shouldn't. Fixed in upstream commits 1446 & 1447. That said, I think audit2allow should correctly handle the output.
Comment 5 Steve Grubb 2016-12-20 19:37:15 UTC 
Since this looks like it might be two separate bugs I'll clone it and assign the clone to the audit package.
Comment 8 Petr Lautrbach 2017-02-21 18:03:50 UTC 
https://marc.info/?l=selinux&m=148768820128446&w=2
Comment 9 Vit Mojzis 2017-02-24 13:25:36 UTC 
Created attachment 1257213 [details]
Reproducer including \x1d characters

Reproducer including \x1d characters.
Comment 11 Petr Lautrbach 2017-03-29 13:51:23 UTC 
*** Bug 1408248 has been marked as a duplicate of this bug. ***
Comment 17 errata-xmlrpc 2017-08-01 16:16:12 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1883