audit script patch
Ivana Varekova <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
I'm going through fedora logwatch patches and this one is not in upstream branch so I'm sending it here. Ivana Varekova _______________________________________________ Logwatch-Devel mailing list [email protected] http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel
audit.patch
(text/x-patch, 962 B)
diff -up ./audit.orig ./audit
--- ./audit.orig 2008-12-16 10:38:41.000000000 +0100
+++ ./audit 2008-12-16 10:43:38.000000000 +0100
@@ -108,7 +108,7 @@ while ($ThisLine = <STDIN>) {
( $ThisLine =~ /^audit\([0-9.]+:[0-9]+\): ( ?(path|cwd|item|name|flags)=["\/A-Za-z0-9]*)*$/) or
( $ThisLine =~ /: enforcing=[0-9]+ old_enforcing=[0-9]+ auid=[0-9]+/) or
( $ThisLine =~ /: policy loaded auid=[0-9]+/) or
- ( $ThisLine =~ /: user pid=[0-9]+ uid=[0-9]+ auid=[0-9]+ subj=system_u:system_r:system_dbusd_t:[0-9a-z]+ msg=/) or
+ ( $ThisLine =~ /: user pid=[0-9]+ uid=[0-9]+ auid=[0-9]+ subj=system_u:system_r:system_dbusd_t:[0-9a-z:.\-]+ msg=/) or
( $ThisLine =~ /audit\([0-9.]+:[0-9]+\): (selinux=[0-9]+|auid=[0-9]+|prom=[0-9]+|old_prom=[0-9]+|dev=[^ ]+| )+$/) or
( $ThisLine =~ /auditd[ ]+S [0-9A-F]+ [0-9]+ [0-9]+[ ]+[0-9]([ ]*[0-9]+[ ]*|[ ]*)[0-9]+ [0-9]+ \(NOTLB\)/) or
( $ThisLine =~ /Started dispatcher: \/sbin\/audispd pid: [0-9]+/) or