Bug 1200314 - ausearch can't parse time in non-US locale and UTF-8 enconding
Summary: ausearch can't parse time in non-US locale and UTF-8 enconding
Alias: None
Product: Fedora
Classification: Fedora
Component: audit
Version: 22
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Steve Grubb
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2015-03-10 09:53 UTC by Petr Lautrbach
Modified: 2015-05-04 15:24 UTC (History)
1 user (show)

Fixed In Version: audit-2.4.2-1.fc22
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2015-05-04 15:24:14 UTC
Type: Bug

Attachments (Terms of Use)

Description Petr Lautrbach 2015-03-10 09:53:13 UTC
Description of problem:

# export LANG="ja_JP.UTF8"

# python -c 'import locale; locale.setlocale(locale.LC_ALL, ""); import time; print time.strftime("%x %X", time.localtime(time.time()))'
2015年02月27日 22時38分08秒

# /sbin/ausearch -m avc -ts 2015年02月27日 22時38分08秒
Invalid start time (22時38分08秒). Hour, Minute, and Second are required.

Version-Release number of selected component (if applicable):

How reproducible:

Fix could be simple - just make tmp_t buffer bigger to be able hold 8 4bytes characters:

--- a/src/ausearch-time.c
+++ b/src/ausearch-time.c
@@ -289,7 +289,7 @@ int ausearch_time_start(const char *da, const char *ti)
        if (ti != NULL) {
-               char tmp_t[9];
+               char tmp_t[33];
                if (strlen(ti) <= 5) {
                        snprintf(tmp_t, sizeof(tmp_t), "%s:00", ti);

Comment 1 Steve Grubb 2015-03-10 14:23:05 UTC
There are a whole lot of assumptions throughout the code about lengths of things. For example, see the <=5 right below the buffer declaration? :-) I have a feeling a lot more is waiting to be discovered.

Comment 2 Petr Lautrbach 2015-03-10 14:43:44 UTC
I've seen that. For the case when strlen(ti) is less than 5, I'd quietly expect that ti is not in multibyte encoding therefore it could work for most cases. However I'm not sure how and if people use this auto detection.

But my main motivation was to fix 'audit2allow -b' first. It calls ausearch with -ts generated with %x %X strftime() format which doesn't work for some non-US locales as it's described in the reproducer.

Comment 3 Steve Grubb 2015-04-08 21:21:56 UTC
Increased buffer size in upstream commit 1069.

Comment 4 Fedora Update System 2015-04-30 19:12:06 UTC
audit-2.4.2-1.fc22 has been submitted as an update for Fedora 22.

Comment 5 Fedora Update System 2015-05-01 16:54:06 UTC
Package audit-2.4.2-1.fc22:
* should fix your issue,
* was pushed to the Fedora 22 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing audit-2.4.2-1.fc22'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).

Comment 6 Fedora Update System 2015-05-04 15:24:14 UTC
audit-2.4.2-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.