Bug 991056

Summary:	ausearch ignores USER events with -ua option
Product:	Red Hat Enterprise Linux 7	Reporter:	Ondrej Moriš <omoris>
Component:	audit	Assignee:	Steve Grubb <sgrubb>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Ondrej Moriš <omoris>
Severity:	high	Docs Contact:
Priority:	high
Version:	7.0
Target Milestone:	beta
Target Release:	7.0
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	audit-2.3.2-2.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-06-13 12:40:35 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	717785, 994381

Description Ondrej Moriš 2013-08-01 13:29:41 UTC

Description of problem:

Since 2.3.2-1  ausearch ignores (at least) USER event types when it is invoked with -ua option. Unfortunately I am unable to map changes in 2.3.2-1 onto upstream, I just not see them there. 

I see USER record type has been removed (and not only it) from extract_search_items function in ausearch-parse.c (even though it did not happened in upstream - https://fedorahosted.org/audit/browser/trunk/src/ausearch-parse.c). Adding USER type back to switch statement solved the issue.

Version-Release number of selected component (if applicable):

audit-2.3.2-1.el7

How reproducible:

100%

Steps to Reproduce:

0. cat >audit.test<<EOF
   type=USER msg=audit(1133817257.347:49948): user pid=25504 uid=0 auid=10208 msg='testing 1-2-3 testing'
   EOF

1. ausearch -if audit.test -ua 10208 

Actual results:

<no matches>

Expected results:

----
time->Mon Dec  5 22:14:17 2005
type=USER msg=audit(1133817257.347:49948): user pid=25504 uid=0 auid=10208 msg='testing 1-2-3 testing'


Additional info:

In previous version (2.3.1-4) it works fine.

Comment 1 Steve Grubb 2013-08-01 13:41:42 UTC

The svn browser is somewhat broken. I have asked before why its not working and fedora admins did something to make it work. But I guess it didn't last long. I'll ask again to get it working off current code.

I started to remove AUDIT_USER from support because a comment in /usr/include/linux/audit.h says that its deprecated. But its not. So, the issue is that one more place was missed when restoring its support. Fixed in SVN. I will be doing another rebase to fix the problems reported on auvirt...it needs rewriting almost from scratch.

Comment 2 Steve Grubb 2013-08-29 19:26:09 UTC

Fixed in audit-2.3.2-2.el7.

Comment 3 Ondrej Moriš 2013-08-30 08:07:54 UTC

Successfully verified.

Comment 4 Ludek Smid 2014-06-13 12:40:35 UTC

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.