Description of problem: * if you trigger an { ioctl } AVC and display it via "ausearch -m avc -i" then the ioctlcmd part of the audit event starts with 0x0x Version-Release number of selected component (if applicable): audit-2.8.2-1.fc27.x86_64 audit-libs-python-2.8.2-1.fc27.x86_64 audit-libs-python3-2.8.2-1.fc27.x86_64 audit-libs-2.8.2-1.fc27.x86_64 How reproducible: * always Actual results: * relevant part of audit.log type=AVC msg=audit(1517389685.161:384): avc: denied { ioctl } for pid=13431 comm="pads" path="/dev/bus/usb/001/002" dev="devtmpfs" ino=12021 ioctlcmd=0x5500 scontext=system_u:system_r:pads_t:s0 tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file permissive=1 * ausearch -m avc ---- time->Wed Jan 31 04:08:05 2018 type=AVC msg=audit(1517389685.161:384): avc: denied { ioctl } for pid=13431 comm="pads" path="/dev/bus/usb/001/002" dev="devtmpfs" ino=12021 ioctlcmd=0x5500 scontext=system_u:system_r:pads_t:s0 tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file permissive=1 ---- * ausearch -m avc -i ---- type=AVC msg=audit(01/31/2018 04:08:05.161:384) : avc: denied { ioctl } for pid=13431 comm=pads path=/dev/bus/usb/001/002 dev="devtmpfs" ino=12021 ioctlcmd=0x0x5500 scontext=system_u:system_r:pads_t:s0 tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file permissive=1 ---- Expected results: * "0x" should be displayed only once
Thanks for the report. Any chance you can repost the audit event using the --raw commandline option? This remove the light processing done by the normal display mode and give me the raw event that I can use on my system to debug it. Thanks!
Thanks. This has been fixed in upstream commit: https://github.com/linux-audit/audit-userspace/commit/71aaf242f921fa1511c424bc2f0d9f39ce4c5bb6
This bug appears to have been reported against 'rawhide' during the Fedora 28 development cycle. Changing version to '28'.
audit-2.8.3-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-2c1484e4cd
audit-2.8.3-1.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-ea91f55218
audit-2.8.3-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-2c1484e4cd
audit-2.8.3-1.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-ea91f55218
audit-2.8.3-1.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.
audit-2.8.3-2.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-2c1484e4cd
audit-2.8.3-2.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-2c1484e4cd
audit-2.8.3-2.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.