Description of problem: interaction with seaudit's error log fails when the modify has been altered in any way. Version-Release number of selected component (if applicable): Audit Log Analysis Tool for Security Enhanced Linux Copyright (c) 2003-2006 Tresys Technology, LLC http://oss.tresys.com/projects/setools GUI version 3.0 libseaudit version 3.0.0 libapol version 3.0.0 How reproducible: very easy Steps to Reproduce: 1. start tool 2. sort by a column (eg Target Type) 3. select an item , right click and select 2nd option "Query Policy Using Message" Actual results: The three drop down fields contain incorrect values, which do not correspond to the message selected. Expected results: The drop down fields should contain the values that correspond to the message selected. Additional info: Okay, the actual vs expected is a little sketchy, and it occasionally works. Through some trial and error it becomes clear that when the view is modified, and you select the message on the first line, and "Query Policy using Message" that the >>unmodified<< view's message in line one is used as the source of the data. This becomes clearer even when you: 1. Modify View 2. Add 3. In Target Context, enter into "types" ... something that is found, eg udev_t 4. Close ; Apply ; Close In my scenario i now have ~15 items if i select the first one: Source Type setfiles_t and Target Type udev_t; right click, query upolicy using message my actial source type is rhgb_t and target type is file_t. 5. Modify view (again) 6. Select previously added view and delete 7. Apply; Close Scroll to top and the Message on Line 1 contains Source Type rhgb_t and Targe Type file_t. I'm guessing that the rightclick context is using the lists master dataobject for the source of the information, rather than the current view.
Upstream says that: This is not feasibly fixable under seaudit 3.0's design (it requires a massive change).