From dd5edd8f9ff7debce2ba322e6a0bdb555b67210f Mon Sep 17 00:00:00 2001 From: Georgia Garcia Date: Wed, 6 Apr 2022 17:04:26 +0000 Subject: [PATCH] libapparmor: add support for requested and denied on logparsing In order to decrease the number of characters in the audit logs from the kernel, we will drop the "_mask" from the fields "requested_mask" and "denied_mask". Signed-off-by: Georgia Garcia (cherry picked from commit a05c9483f3b1176faf0b31786b12ca8fef750d22) Signed-off-by: John Johansen --- libraries/libapparmor/src/scanner.l | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libraries/libapparmor/src/scanner.l b/libraries/libapparmor/src/scanner.l index 5fb217607..65973a0df 100644 --- a/libraries/libapparmor/src/scanner.l +++ b/libraries/libapparmor/src/scanner.l @@ -121,6 +121,8 @@ key_namespace "namespace" key_mask "mask" key_denied_mask "denied_mask" key_requested_mask "requested_mask" +key_denied "denied" +key_requested "requested" key_attribute "attribute" key_task "task" key_parent "parent" @@ -310,6 +312,8 @@ yy_flex_debug = 0; {key_mask} { return(TOK_KEY_MASK); } {key_denied_mask} { return(TOK_KEY_DENIED_MASK); } {key_requested_mask} { return(TOK_KEY_REQUESTED_MASK); } +{key_denied} { return(TOK_KEY_DENIED_MASK); } +{key_requested} { return(TOK_KEY_REQUESTED_MASK); } {key_attribute} { BEGIN(sub_id); return(TOK_KEY_ATTRIBUTE); } {key_task} { return(TOK_KEY_TASK); } {key_parent} { return(TOK_KEY_PARENT); }