49 lines
1.8 KiB
Diff
49 lines
1.8 KiB
Diff
|
From 7cdcfd30c6122acc6b2e54e1ad8cd1a12dd537d2 Mon Sep 17 00:00:00 2001
|
|||
|
|
From: Attila Lakatos <Cropi@users.noreply.github.com>
|
|||
|
|
Date: Mon, 21 Oct 2024 04:25:37 +0200
|
|||
|
|
Subject: [PATCH] ausearch format: Fix display of renamed file (#411)
|
|||
|
|
MIME-Version: 1.0
|
|||
|
|
Content-Type: text/plain; charset=UTF-8
|
|||
|
|
Content-Transfer-Encoding: 8bit
|
|||
|
|
|
|||
|
|
In some cases, ausearch was not correctly showing
|
|||
|
|
the new name of a renamed file when searching for
|
|||
|
|
audit events. If the target file didn’t exist prior
|
|||
|
|
to the rename, ausearch was unable to parse the new
|
|||
|
|
file name. This occurred because ausearch attempted
|
|||
|
|
to retrieve this information from the 7th record,
|
|||
|
|
which is absent when the target file does not exist.
|
|||
|
|
---
|
|||
|
|
auparse/normalize.c | 15 ++++++++++++++-
|
|||
|
|
1 file changed, 14 insertions(+), 1 deletion(-)
|
|||
|
|
|
|||
|
|
diff --git a/auparse/normalize.c b/auparse/normalize.c
|
|||
|
|
index 036c0b86..f1a07d18 100644
|
|||
|
|
--- a/auparse/normalize.c
|
|||
|
|
+++ b/auparse/normalize.c
|
|||
|
|
@@ -693,7 +693,20 @@ static int normalize_syscall(auparse_state_t *au, const char *syscall)
|
|||
|
|
case NORM_FILE_RENAME:
|
|||
|
|
act = "renamed";
|
|||
|
|
D.thing.what = NORM_WHAT_FILE; // this gets overridden
|
|||
|
|
- set_prime_object2(au, "name", 4);
|
|||
|
|
+ /* A sucessfull syscall from the rename family will provide
|
|||
|
|
+ * the following items:
|
|||
|
|
+ * 0 - new dir, in which the file will be located
|
|||
|
|
+ * 1 - old dir, in which the file was located
|
|||
|
|
+ * 2 - old name, the name of the original file
|
|||
|
|
+ * if the file was already present in the new dir:
|
|||
|
|
+ * 3 - removal of the new file
|
|||
|
|
+ * 4 - creation of the new file
|
|||
|
|
+ * otherwise:
|
|||
|
|
+ * 3 - creation of the new file
|
|||
|
|
+ */
|
|||
|
|
+
|
|||
|
|
+ // The 3rd record will always contain the name of the new file
|
|||
|
|
+ set_prime_object2(au, "name", 3);
|
|||
|
|
set_file_object(au, 2); // Thing renamed is 2 after
|
|||
|
|
simple_file_attr(au);
|
|||
|
|
break;
|
|||
|
|
--
|
|||
|
|
2.33.0
|
|||
|
|
|