Well, maybe things are even more interesting: - the log message doesn't specify the len, so a socket name ending with \0 _will_ cause trouble - for some reason, the log line above gets parsed as AA_RECORD_INVALID:
START File: testcase_syslog_unix_01.in Event type: AA_RECORD_INVALID Audit ID: 1450687759.549:3582 Operation: connect Mask: send receive connect Denied Mask: send connect Profile: /usr/sbin/cupsd Command: cupsd PID: 6049 Network family: unix Socket type: stream Protocol: ip Epoch: 1450687759 Audit subid: 3582
- the peer address isn't included in the parsed log - but that might be a side effect and/or reason for AA_RECORD_INVALID
Well, maybe things are even more interesting:
- the log message doesn't specify the len, so a socket name ending with \0 _will_ cause trouble
- for some reason, the log line above gets parsed as AA_RECORD_INVALID:
START syslog_ unix_01. in
File: testcase_
Event type: AA_RECORD_INVALID
Audit ID: 1450687759.549:3582
Operation: connect
Mask: send receive connect
Denied Mask: send connect
Profile: /usr/sbin/cupsd
Command: cupsd
PID: 6049
Network family: unix
Socket type: stream
Protocol: ip
Epoch: 1450687759
Audit subid: 3582
- the peer address isn't included in the parsed log - but that might be a side effect and/or reason for AA_RECORD_INVALID