Bug 819445

Summary: available attributes for report_attributes are not working and documented
Product: Red Hat Enterprise Linux 5 Reporter: Karel Srot <ksrot>
Component: aideAssignee: Daniel Kopeček <dkopecek>
Status: CLOSED WONTFIX QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: low Docs Contact:
Priority: low    
Version: 5.6   
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-03-13 13:06:46 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Karel Srot 2012-05-07 09:48:24 UTC 
Description of problem:

While testing bug 
Bug 651917 - aide segfaults while processing report_attributes
I realized that almost none attribute can be used in report_attributes.

I have used following directive in aide.conf:

  report_attributes = EVERYTHING

but just Permissions, UID, GID were listed for a given file (in advance to attribute sha256 that was actually changed).
E.g. 
  report_attributes = s
should report file size but it doesn't.

Therefore these attributes are not working and/or properly documented.

Version-Release number of selected component (if applicable):
aide-0.13.1-6.el5

How reproducible:
Always

Steps to Reproduce:
1. set up aide to track changes in a given directory,
use
  report_attributes = s
in aide.conf and initiate a database using "aide -i" command.
2. rename created aide database to an expected name and change permissions of the tracked file. 
3. Execute the aide check using "aide -C"
The file size should be reported beside the permissions although it hasn't been changed but it is not.
  
Actual results:

--------------------------------------------------
Detailed information about changes:
---------------------------------------------------

File: /tmp/tmp.biIVAb4599/data/testfile
  Permissions: -rw-r--r--                       , -rwxrwxrwx


Expected results:
Size is listed too:

--------------------------------------------------
Detailed information about changes:
---------------------------------------------------

File: /tmp/tmp.biIVAb4599/data/testfile
  Size       : 12456
  Permissions: -rw-r--r--                       , -rwxrwxrwx


Additional info:

When using report_attributes = EVERYTHING I get:

File: /tmp/tmp.sTugfF4775/data/testfile
  Permissions: -rw-r--r--                       , -rwxrwxrwx
  Uid      :                                    0
  Gid      :                                    0