[apparmor] [Patch] Fix date time log parsing for 2.8.1
John Johansen
john.johansen at canonical.com
Tue Jan 8 12:18:31 UTC 2013
The following patch extends the libraries log parsing to support more date
time formats.
currently the only supported format is
<Month> ## hh:mm:ss
extend this to
<Month> ## hh:mm:ss(.ms)?((+|-)timezone)?
yyyy-mm-dd hh:mm:ss(.ms)?((+|-)timezone)?
yyyy-mm-ddThh:mm:ss(.ms)?((+|-)timezone)?
---
=== modified file 'libraries/libapparmor/src/grammar.y'
--- libraries/libapparmor/src/grammar.y 2012-04-06 22:59:04 +0000
+++ libraries/libapparmor/src/grammar.y 2013-01-08 11:44:18 +0000
@@ -81,7 +81,7 @@
%type <t_str> safe_string protocol
%token <t_long> TOK_DIGITS TOK_TYPE_UNKNOWN
%token <t_str> TOK_QUOTED_STRING TOK_ID TOK_MODE TOK_DMESG_STAMP
-%token <t_str> TOK_AUDIT_DIGITS TOK_DATE_MONTH TOK_DATE_TIME
+%token <t_str> TOK_AUDIT_DIGITS TOK_DATE_MONTH TOK_DATE TOK_TIME
%token <t_str> TOK_HEXSTRING TOK_TYPE_OTHER TOK_MSG_REST
%token <t_str> TOK_IP_ADDR
@@ -203,7 +203,8 @@
free($7);
} ;
-syslog_date: TOK_DATE_MONTH TOK_DIGITS TOK_DATE_TIME { /* do nothing? */ }
+syslog_date: TOK_DATE_MONTH TOK_DIGITS TOK_TIME { /* do nothing? */ }
+ | TOK_DATE TOK_TIME { /* do nothing */ }
;
key_list: key
=== modified file 'libraries/libapparmor/src/scanner.l'
--- libraries/libapparmor/src/scanner.l 2012-04-06 22:59:04 +0000
+++ libraries/libapparmor/src/scanner.l 2013-01-08 11:42:08 +0000
@@ -75,10 +75,12 @@
ws [ \t\r\n]
equals "="
-digits [0-9]+
+digit [[:digit:]]
+digits {digit}+
hex [A-F0-9]
colon ":"
minus "-"
+plus "+"
open_paren "("
close_paren ")"
ID [^ \t\n\(\)="'!]
@@ -144,8 +146,12 @@
/* syslog tokens */
syslog_kernel kernel{colon}
+syslog_yyyymmdd {digit}{4}{minus}{digit}{2}{minus}{digit}{2}
+syslog_date {syslog_yyyymmdd}
syslog_month Jan(uary)?|Feb(ruary)?|Mar(ch)?|Apr(il)?|May|Jun(e)?|Jul(y)?|Aug(ust)?|Sep(tember)?|Oct(ober)?|Nov(ember)?|Dec(ember)?
-syslog_time {digits}{digits}{colon}{digits}{digits}{colon}{digits}{digits}
+hhmmss {digit}{2}{colon}{digit}{2}{colon}{digit}{2}
+timezone ({plus}|{minus}){digit}{2}{colon}{digit}{2}
+syslog_time {hhmmss}({period}{digits})?{timezone}?
syslog_hostname [[:alnum:]_-]+
dmesg_timestamp \[[[:digit:] ]{5,}\.[[:digit:]]{6,}\]
@@ -291,7 +297,9 @@
{syslog_kernel} { BEGIN(dmesg_timestamp); return(TOK_SYSLOG_KERNEL); }
{syslog_month} { yylval->t_str = strdup(yytext); return(TOK_DATE_MONTH); }
-{syslog_time} { yylval->t_str = strdup(yytext); BEGIN(hostname); return(TOK_DATE_TIME); }
+{syslog_date} { yylval->t_str = strdup(yytext); return(TOK_DATE); }
+{syslog_date}T/{syslog_time} { yylval->t_str = strndup(yytext, strlen(yytext)-1); return(TOK_DATE); }
+{syslog_time} { yylval->t_str = strdup(yytext); BEGIN(hostname); return(TOK_TIME); }
{audit} { yy_push_state(audit_id, yyscanner); return(TOK_AUDIT); }
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_01.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_01.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_01.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_01.in 2013-01-08 11:50:39 +0000
@@ -0,0 +1,1 @@
+Jan 1 15:09:04 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_01.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_01.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_01.out 2013-01-08 12:10:48 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_01.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_02.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_02.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_02.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_02.in 2013-01-08 11:51:02 +0000
@@ -0,0 +1,1 @@
+Jan 1 15:09:04+08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_02.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_02.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_02.out 2013-01-08 12:10:52 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_02.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_03.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_03.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_03.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_03.in 2013-01-08 11:51:32 +0000
@@ -0,0 +1,1 @@
+Jan 1 15:09:04.562575 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_03.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_03.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_03.out 2013-01-08 12:10:57 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_03.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_04.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_04.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_04.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_04.in 2013-01-08 11:50:16 +0000
@@ -0,0 +1,1 @@
+Jan 1 15:09:04.562575+08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_04.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_04.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_04.out 2013-01-08 12:11:00 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_04.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_05.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_05.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_05.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_05.in 2013-01-08 11:53:54 +0000
@@ -0,0 +1,1 @@
+Jan 1 15:09:04-08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_05.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_05.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_05.out 2013-01-08 12:11:04 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_05.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_06.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_06.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_06.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_06.in 2013-01-08 11:54:08 +0000
@@ -0,0 +1,1 @@
+Jan 1 15:09:04.562575-08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_06.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_06.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_06.out 2013-01-08 12:11:08 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_06.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_07.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_07.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_07.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_07.in 2013-01-08 11:56:09 +0000
@@ -0,0 +1,1 @@
+2013-01-01 15:09:04 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_07.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_07.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_07.out 2013-01-08 12:11:11 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_07.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_08.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_08.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_08.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_08.in 2013-01-08 11:56:22 +0000
@@ -0,0 +1,1 @@
+2013-01-01 15:09:04+08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_08.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_08.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_08.out 2013-01-08 12:11:15 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_08.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_09.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_09.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_09.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_09.in 2013-01-08 11:56:33 +0000
@@ -0,0 +1,1 @@
+2013-01-01 15:09:04.562575 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_09.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_09.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_09.out 2013-01-08 12:11:18 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_09.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_10.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_10.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_10.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_10.in 2013-01-08 11:56:45 +0000
@@ -0,0 +1,1 @@
+2013-01-01 15:09:04.562575+08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_10.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_10.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_10.out 2013-01-08 12:11:22 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_10.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_11.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_11.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_11.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_11.in 2013-01-08 11:56:54 +0000
@@ -0,0 +1,1 @@
+2013-01-01 15:09:04-08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_11.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_11.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_11.out 2013-01-08 12:11:25 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_11.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_12.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_12.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_12.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_12.in 2013-01-08 11:57:05 +0000
@@ -0,0 +1,1 @@
+2013-01-01 15:09:04.562575-08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_12.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_12.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_12.out 2013-01-08 12:11:30 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_12.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_13.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_13.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_13.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_13.in 2013-01-08 11:58:21 +0000
@@ -0,0 +1,1 @@
+2013-01-01T15:09:04 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_13.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_13.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_13.out 2013-01-08 12:11:32 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_13.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_14.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_14.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_14.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_14.in 2013-01-08 11:58:32 +0000
@@ -0,0 +1,1 @@
+2013-01-01T15:09:04+08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_14.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_14.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_14.out 2013-01-08 12:11:35 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_14.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_15.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_15.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_15.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_15.in 2013-01-08 11:58:45 +0000
@@ -0,0 +1,1 @@
+2013-01-01T15:09:04.562575 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_15.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_15.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_15.out 2013-01-08 12:11:38 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_15.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_16.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_16.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_16.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_16.in 2013-01-08 11:58:58 +0000
@@ -0,0 +1,1 @@
+2013-01-01T15:09:04.562575+08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_16.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_16.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_16.out 2013-01-08 12:11:42 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_16.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_17.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_17.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_17.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_17.in 2013-01-08 11:59:08 +0000
@@ -0,0 +1,1 @@
+2013-01-01T15:09:04-08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_17.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_17.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_17.out 2013-01-08 12:11:45 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_17.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_18.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_18.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_18.in 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_18.in 2013-01-08 11:59:17 +0000
@@ -0,0 +1,1 @@
+2013-01-01T15:09:04.562575-08:00 localhost kernel: [ 1911.569682] type=1400 audit(1357024144.556:6368): apparmor="ALLOWED" operation="open" parent=5390 profile="/usr/lib/virtualbox/VBoxSVC//null-2d" name="/sys/class/power_supply/" pid=5457 comm=4143504920506F6C6C6572 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_datetime_18.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_datetime_18.out 1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_datetime_18.out 2013-01-08 12:11:48 +0000
@@ -0,0 +1,16 @@
+START
+File: test_multi/syslog_datetime_18.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1357024144.556:6368
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/lib/virtualbox/VBoxSVC//null-2d
+Name: /sys/class/power_supply/
+Command: ACPI Poller
+Parent: 5390
+PID: 5457
+Epoch: 1357024144
+Audit subid: 6368
More information about the AppArmor
mailing list