Bug 1406328 - ausearch with '--raw' parameter outputs garbage character
Summary: ausearch with '--raw' parameter outputs garbage character
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: policycoreutils
Version: 7.3
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Petr Lautrbach
QA Contact: Dalibor Pospíšil
: 1408248 (view as bug list)
Depends On:
Blocks: 1406525
TreeView+ depends on / blocked
Reported: 2016-12-20 09:50 UTC by adam winberg
Modified: 2017-08-01 16:16 UTC (History)
14 users (show)

Fixed In Version: policycoreutils-2.5-16.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1406525 (view as bug list)
Last Closed: 2017-08-01 16:16:12 UTC

Attachments (Terms of Use)
Reproducer including \x1d characters (2.42 KB, text/plain)
2017-02-24 13:25 UTC, Vit Mojzis
no flags Details

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:1883 normal SHIPPED_LIVE policycoreutils bug fix update 2017-08-01 17:53:54 UTC

Description adam winberg 2016-12-20 09:50:21 UTC
Description of problem:
After update to RHEL7.3 the ausearch command with the '--raw' parameter outputs a 'garbage' character at end of line, which makes it impossible to pipe into audit2allow. Since the 'sealert' utility in RHEL7.3 directs users to use the ausearch command to generate selinux policy rules this is a bit of a nuisance to us.

Could be something weird in our environment, but previous version of ausearch (audit-2.4.1-5.el7.x86_64) works fine for me.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Run 'ausearch --raw'

Actual results:
At end of line of each log message there is a garbage character

Expected results:

Additional info:

Comment 2 Steve Grubb 2016-12-20 12:36:34 UTC
This 'garbage' character is a group separator character that separates the event from translations. This is normal and to be expected if the system is using the enriched logging format. You can put the system back into the raw format for the time being.

I would say that the problem lies in the selinux tooling. It should take the record and stuff it "as is" into auparse. More info about the audit format is here in case it helps in fixing the bug:


Comment 3 adam winberg 2016-12-20 12:43:44 UTC
This is from my /etc/audit/auditd.conf:

log_format = RAW

So it seems I'm already using the raw format, not the enriched?

Comment 4 Steve Grubb 2016-12-20 15:13:17 UTC
Tracked the issue down ausearch adding a separator when it shouldn't. Fixed in upstream commits 1446 & 1447. That said, I think audit2allow should correctly handle the output.

Comment 5 Steve Grubb 2016-12-20 19:37:15 UTC
Since this looks like it might be two separate bugs I'll clone it and assign the clone to the audit package.

Comment 8 Petr Lautrbach 2017-02-21 18:03:50 UTC

Comment 9 Vit Mojzis 2017-02-24 13:25:36 UTC
Created attachment 1257213 [details]
Reproducer including \x1d characters

Reproducer including \x1d characters.

Comment 11 Petr Lautrbach 2017-03-29 13:51:23 UTC
*** Bug 1408248 has been marked as a duplicate of this bug. ***

Comment 17 errata-xmlrpc 2017-08-01 16:16:12 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.