Description of problem:
After update to RHEL7.3 the ausearch command with the '--raw' parameter outputs a 'garbage' character at end of line, which makes it impossible to pipe into audit2allow. Since the 'sealert' utility in RHEL7.3 directs users to use the ausearch command to generate selinux policy rules this is a bit of a nuisance to us.
Could be something weird in our environment, but previous version of ausearch (audit-2.4.1-5.el7.x86_64) works fine for me.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Run 'ausearch --raw'
At end of line of each log message there is a garbage character
This 'garbage' character is a group separator character that separates the event from translations. This is normal and to be expected if the system is using the enriched logging format. You can put the system back into the raw format for the time being.
I would say that the problem lies in the selinux tooling. It should take the record and stuff it "as is" into auparse. More info about the audit format is here in case it helps in fixing the bug:
This is from my /etc/audit/auditd.conf:
log_format = RAW
So it seems I'm already using the raw format, not the enriched?
Tracked the issue down ausearch adding a separator when it shouldn't. Fixed in upstream commits 1446 & 1447. That said, I think audit2allow should correctly handle the output.
Since this looks like it might be two separate bugs I'll clone it and assign the clone to the audit package.
Created attachment 1257213 [details]
Reproducer including \x1d characters
Reproducer including \x1d characters.
*** Bug 1408248 has been marked as a duplicate of this bug. ***
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.