diff --git a/libraries/libapparmor/src/grammar.y b/libraries/libapparmor/src/grammar.y index b30890a71..80f659e6b 100644 --- a/libraries/libapparmor/src/grammar.y +++ b/libraries/libapparmor/src/grammar.y @@ -81,7 +81,7 @@ aa_record_event_type lookup_aa_event(unsigned int type) %type safe_string protocol %token TOK_DIGITS TOK_TYPE_UNKNOWN %token TOK_QUOTED_STRING TOK_ID TOK_MODE TOK_DMESG_STAMP -%token TOK_AUDIT_DIGITS TOK_DATE_MONTH TOK_DATE_TIME +%token TOK_AUDIT_DIGITS TOK_DATE_MONTH TOK_DATE TOK_TIME %token TOK_HEXSTRING TOK_TYPE_OTHER TOK_MSG_REST %token TOK_IP_ADDR @@ -203,7 +203,8 @@ audit_id: TOK_AUDIT TOK_OPEN_PAREN TOK_AUDIT_DIGITS TOK_PERIOD TOK_AUDIT_DIGITS free($7); } ; -syslog_date: TOK_DATE_MONTH TOK_DIGITS TOK_DATE_TIME { /* do nothing? */ } +syslog_date: TOK_DATE_MONTH TOK_DIGITS TOK_TIME { /* do nothing? */ } + | TOK_DATE TOK_TIME { /* do nothing */ } ; key_list: key diff --git a/libraries/libapparmor/src/scanner.l b/libraries/libapparmor/src/scanner.l index 6d7dae93f..0a619a2e4 100644 --- a/libraries/libapparmor/src/scanner.l +++ b/libraries/libapparmor/src/scanner.l @@ -75,10 +75,12 @@ void string_buf_append(unsigned int length, char *text) ws [ \t\r\n] equals "=" -digits [0-9]+ +digit [[:digit:]] +digits {digit}+ hex [A-F0-9] colon ":" minus "-" +plus "+" open_paren "(" close_paren ")" ID [^ \t\n\(\)="'!] @@ -144,8 +146,12 @@ ip_addr [a-f[:digit:].:]{3,} /* syslog tokens */ syslog_kernel kernel{colon} +syslog_yyyymmdd {digit}{4}{minus}{digit}{2}{minus}{digit}{2} +syslog_date {syslog_yyyymmdd} syslog_month Jan(uary)?|Feb(ruary)?|Mar(ch)?|Apr(il)?|May|Jun(e)?|Jul(y)?|Aug(ust)?|Sep(tember)?|Oct(ober)?|Nov(ember)?|Dec(ember)? -syslog_time {digits}{digits}{colon}{digits}{digits}{colon}{digits}{digits} +hhmmss {digit}{2}{colon}{digit}{2}{colon}{digit}{2} +timezone ({plus}|{minus}){digit}{2}{colon}{digit}{2} +syslog_time {hhmmss}({period}{digits})?{timezone}? syslog_hostname [[:alnum:]_-]+ dmesg_timestamp \[[[:digit:] ]{5,}\.[[:digit:]]{6,}\] @@ -291,7 +297,9 @@ yy_flex_debug = 0; {syslog_kernel} { BEGIN(dmesg_timestamp); return(TOK_SYSLOG_KERNEL); } {syslog_month} { yylval->t_str = strdup(yytext); return(TOK_DATE_MONTH); } -{syslog_time} { yylval->t_str = strdup(yytext); BEGIN(hostname); return(TOK_DATE_TIME); } +{syslog_date} { yylval->t_str = strdup(yytext); return(TOK_DATE); } +{syslog_date}T/{syslog_time} { yylval->t_str = strndup(yytext, strlen(yytext)-1); return(TOK_DATE); } +{syslog_time} { yylval->t_str = strdup(yytext); BEGIN(hostname); return(TOK_TIME); } {audit} { yy_push_state(audit_id, yyscanner); return(TOK_AUDIT); } diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_01.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_01.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_01.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_01.in new file mode 100644 index 000000000..d065d4a03 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_01.in @@ -0,0 +1 @@ +Jan 1 15:09:04 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_01.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_01.out new file mode 100644 index 000000000..0a9171869 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_01.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_01.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_02.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_02.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_02.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_02.in new file mode 100644 index 000000000..6eb4349bf --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_02.in @@ -0,0 +1 @@ +Jan 1 15:09:04+08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_02.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_02.out new file mode 100644 index 000000000..7bedfa56e --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_02.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_02.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_03.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_03.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_03.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_03.in new file mode 100644 index 000000000..526ab865f --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_03.in @@ -0,0 +1 @@ +Jan 1 15:09:04.562575 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_03.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_03.out new file mode 100644 index 000000000..71666d1bd --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_03.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_03.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_04.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_04.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_04.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_04.in new file mode 100644 index 000000000..56010d206 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_04.in @@ -0,0 +1 @@ +Jan 1 15:09:04.562575+08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_04.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_04.out new file mode 100644 index 000000000..21e73809b --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_04.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_04.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_05.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_05.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_05.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_05.in new file mode 100644 index 000000000..75d8b8b88 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_05.in @@ -0,0 +1 @@ +Jan 1 15:09:04-08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_05.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_05.out new file mode 100644 index 000000000..8a41faa10 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_05.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_05.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_06.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_06.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_06.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_06.in new file mode 100644 index 000000000..75ab73965 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_06.in @@ -0,0 +1 @@ +Jan 1 15:09:04.562575-08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_06.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_06.out new file mode 100644 index 000000000..bb842d2c5 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_06.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_06.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_07.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_07.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_07.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_07.in new file mode 100644 index 000000000..b4b27892e --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_07.in @@ -0,0 +1 @@ +2013-01-01 15:09:04 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_07.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_07.out new file mode 100644 index 000000000..b5dec1db2 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_07.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_07.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_08.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_08.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_08.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_08.in new file mode 100644 index 000000000..8d52c5e65 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_08.in @@ -0,0 +1 @@ +2013-01-01 15:09:04+08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_08.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_08.out new file mode 100644 index 000000000..d85d99475 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_08.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_08.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_09.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_09.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_09.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_09.in new file mode 100644 index 000000000..ddaad0383 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_09.in @@ -0,0 +1 @@ +2013-01-01 15:09:04.562575 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_09.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_09.out new file mode 100644 index 000000000..e1b4f1a5c --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_09.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_09.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_10.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_10.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_10.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_10.in new file mode 100644 index 000000000..8c97023d6 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_10.in @@ -0,0 +1 @@ +2013-01-01 15:09:04.562575+08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_10.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_10.out new file mode 100644 index 000000000..d3df8e9fc --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_10.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_10.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_11.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_11.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_11.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_11.in new file mode 100644 index 000000000..432cb5c6f --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_11.in @@ -0,0 +1 @@ +2013-01-01 15:09:04-08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_11.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_11.out new file mode 100644 index 000000000..ce45ff877 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_11.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_11.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_12.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_12.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_12.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_12.in new file mode 100644 index 000000000..fb86d8a0a --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_12.in @@ -0,0 +1 @@ +2013-01-01 15:09:04.562575-08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_12.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_12.out new file mode 100644 index 000000000..b4dc44751 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_12.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_12.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_13.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_13.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_13.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_13.in new file mode 100644 index 000000000..a857493d4 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_13.in @@ -0,0 +1 @@ +2013-01-01T15:09:04 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_13.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_13.out new file mode 100644 index 000000000..cdbd962e2 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_13.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_13.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_14.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_14.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_14.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_14.in new file mode 100644 index 000000000..6cdd18ed5 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_14.in @@ -0,0 +1 @@ +2013-01-01T15:09:04+08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_14.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_14.out new file mode 100644 index 000000000..292a46eeb --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_14.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_14.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_15.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_15.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_15.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_15.in new file mode 100644 index 000000000..c68c96193 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_15.in @@ -0,0 +1 @@ +2013-01-01T15:09:04.562575 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_15.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_15.out new file mode 100644 index 000000000..abe387c40 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_15.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_15.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_16.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_16.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_16.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_16.in new file mode 100644 index 000000000..89856d72b --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_16.in @@ -0,0 +1 @@ +2013-01-01T15:09:04.562575+08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_16.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_16.out new file mode 100644 index 000000000..c84453a87 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_16.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_16.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_17.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_17.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_17.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_17.in new file mode 100644 index 000000000..9503f5cc9 --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_17.in @@ -0,0 +1 @@ +2013-01-01T15:09:04-08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_17.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_17.out new file mode 100644 index 000000000..c80bfe40e --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_17.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_17.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_18.err b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_18.err new file mode 100644 index 000000000..e69de29bb diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_18.in b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_18.in new file mode 100644 index 000000000..dd679c46c --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_18.in @@ -0,0 +1 @@ +2013-01-01T15:09:04.562575-08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 diff --git a/libraries/libapparmor/testsuite/test_multi/syslog_datetime_18.out b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_18.out new file mode 100644 index 000000000..ccf969a3a --- /dev/null +++ b/libraries/libapparmor/testsuite/test_multi/syslog_datetime_18.out @@ -0,0 +1,16 @@ +START +File: test_multi/syslog_datetime_18.in +Event type: AA_RECORD_ALLOWED +Audit ID: 1357024144.556:6368 +Operation: open +Mask: r +Denied Mask: r +fsuid: 1000 +ouid: 0 +Profile: /usr/lib/virtualbox/VBoxSVC//null-2d +Name: /sys/class/power_supply/ +Command: ACPI Poller +Parent: 5390 +PID: 5457 +Epoch: 1357024144 +Audit subid: 6368