Blame SOURCES/audit-2.7.1-rhel7-fixup.patch
|
 |
5c966f |
diff -urp audit-2.7.1.orig/auparse/classify.c audit-2.7.1/auparse/classify.c
|
|
|
5c966f |
--- audit-2.7.1.orig/auparse/normalize.c 2016-12-21 19:00:51.000000000 -0500
|
|
|
5c966f |
+++ audit-2.7.1/auparse/normalize.c 2016-12-22 12:22:21.259800153 -0500
|
|
|
5c966f |
@@ -241,7 +241,7 @@ static void simple_file_attr(auparse_sta
|
|
|
5c966f |
switch (type)
|
|
|
5c966f |
{
|
|
|
5c966f |
case AUDIT_PATH:
|
|
|
5c966f |
- f = auparse_find_field(au, "nametype");
|
|
|
5c966f |
+ f = auparse_find_field(au, "objtype");
|
|
|
5c966f |
if (f && strcmp(f, "PARENT") == 0) {
|
|
|
5c966f |
if (parent == 0)
|
|
|
5c966f |
parent = auparse_get_record_num(au);
|
|
|
5c966f |
@@ -280,7 +280,7 @@ static void set_file_object(auparse_stat
|
|
|
5c966f |
|
|
|
5c966f |
// Now double check that we picked the right one.
|
|
|
5c966f |
do {
|
|
|
5c966f |
- f = auparse_find_field(au, "nametype");
|
|
|
5c966f |
+ f = auparse_find_field(au, "objtype");
|
|
|
5c966f |
if (f) {
|
|
|
5c966f |
if (strcmp(f, "PARENT"))
|
|
|
5c966f |
break;
|