Red Hat Bugzilla – Bug 427957
seaudit message list view changes use unmodified view's data
Last modified: 2008-01-10 14:04:56 EST
Description of problem:
interaction with seaudit's error log fails when the modify has been altered in
Version-Release number of selected component (if applicable):
Audit Log Analysis Tool for Security
Copyright (c) 2003-2006
Tresys Technology, LLC
GUI version 3.0
libseaudit version 3.0.0
libapol version 3.0.0
Steps to Reproduce:
1. start tool
2. sort by a column (eg Target Type)
3. select an item , right click and select 2nd option "Query Policy Using Message"
The three drop down fields contain incorrect values, which do not correspond to
the message selected.
The drop down fields should contain the values that correspond to the message
Okay, the actual vs expected is a little sketchy, and it occasionally works.
Through some trial and error it becomes clear that when the view is modified,
and you select the message on the first line, and "Query Policy using Message"
that the >>unmodified<< view's message in line one is used as the source of the
This becomes clearer even when you:
1. Modify View
3. In Target Context, enter into "types" ... something that is found, eg udev_t
4. Close ; Apply ; Close
In my scenario i now have ~15 items
if i select the first one: Source Type setfiles_t and Target Type udev_t; right
click, query upolicy using message my actial source type is rhgb_t and target
type is file_t.
5. Modify view (again)
6. Select previously added view and delete
7. Apply; Close
Scroll to top and the Message on Line 1 contains Source Type rhgb_t and Targe
I'm guessing that the rightclick context is using the lists master dataobject
for the source of the information, rather than the current view.
Upstream says that:
This is not feasibly fixable under seaudit 3.0's design (it requires a massive