mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-31 14:25:52 +00:00
Code Issues Releases Wiki Activity

libapparmor: allow parsing of logs with 0x1d + uppercase items

Browse Source 
audit.log lines on Arch have an additional FSUID="username" OUID="username",
separated from the previous part of the log line with 0x1d.

Extend the log parsing to accept 0x1d as whitespace, and to recognize
(and ignore) FSUID and OUID.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/271
This commit is contained in:
Christian Boltz
2022-10-27 21:01:37 +02:00
parent be61c5d22d
commit 87e4d302cd
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libraries/libapparmor/src/grammar.y
View File

@@ -159,7 +159,9 @@ aa_record_event_type lookup_aa_event(unsigned int type)
%token TOK_KEY_NAMESPACE
%token TOK_KEY_ERROR
%token TOK_KEY_FSUID
%token TOK_KEY_FSUID_UPPER
%token TOK_KEY_OUID
%token TOK_KEY_OUID_UPPER
%token TOK_KEY_UID
%token TOK_KEY_AUID
%token TOK_KEY_SAUID
@@ -351,6 +353,10 @@ key: TOK_KEY_OPERATION TOK_EQUALS TOK_QUOTED_STRING
{ ret_record->fsuid = $3;}
| TOK_KEY_OUID TOK_EQUALS TOK_DIGITS
{ ret_record->ouid = $3;}
| TOK_KEY_FSUID_UPPER TOK_EQUALS TOK_QUOTED_STRING
{ free($3);} /* Ignore - fsuid username */
| TOK_KEY_OUID_UPPER TOK_EQUALS TOK_QUOTED_STRING
{ free($3);} /* Ignore - ouid username */
| TOK_KEY_SAUID TOK_EQUALS TOK_DIGITS
{ /* Ignore - Source audit ID from user AVC messages */ }
| TOK_KEY_HOSTNAME TOK_EQUALS safe_string

6
libraries/libapparmor/src/scanner.l
View File

@@ -72,7 +72,7 @@ void string_buf_append(unsigned int length, char *text)
%}
ws [ \t\r\n]
ws [ \t\r\n\x1d]
equals "="
digit [[:digit:]]
@@ -138,7 +138,9 @@ key_sock_type "sock_type"
key_protocol "protocol"
key_error "error"
key_fsuid "fsuid"
key_fsuid_upper "FSUID"
key_ouid "ouid"
key_ouid_upper "OUID"
key_uid "uid"
key_auid "auid"
key_sauid "sauid"
@@ -324,7 +326,9 @@ yy_flex_debug = 0;
{key_protocol} { return(TOK_KEY_PROTOCOL); }
{key_error} { return(TOK_KEY_ERROR); }
{key_fsuid} { return(TOK_KEY_FSUID); }
{key_fsuid_upper} { return(TOK_KEY_FSUID_UPPER); }
{key_ouid} { return(TOK_KEY_OUID); }
{key_ouid_upper} { return(TOK_KEY_OUID_UPPER); }
{key_uid} { return(TOK_KEY_UID); }
{key_auid} { return(TOK_KEY_AUID); }
{key_sauid} { return(TOK_KEY_SAUID); }