--- apparmor-2.3.1+1403.orig/libraries/libapparmor/testsuite/test_multi.c +++ apparmor-2.3.1+1403/libraries/libapparmor/testsuite/test_multi.c @@ -117,6 +117,10 @@ { printf("fsuid: %ld\n", record->fsuid); } + if (record->ouid != (unsigned long) -1) + { + printf("ouid: %ld\n", record->ouid); + } if (record->profile != NULL) { printf("Profile: %s\n", record->profile); --- apparmor-2.3.1+1403.orig/libraries/libapparmor/src/scanner.l +++ apparmor-2.3.1+1403/libraries/libapparmor/src/scanner.l @@ -107,6 +107,7 @@ key_protocol "protocol" key_error "error" key_fsuid "fsuid" +key_ouid "ouid" audit "audit" /* syslog tokens */ @@ -297,6 +298,7 @@ {key_protocol} { return(TOK_KEY_PROTOCOL); } {key_error} { return(TOK_KEY_ERROR); } {key_fsuid} { return(TOK_KEY_FSUID); } +{key_ouid} { return(TOK_KEY_OUID); } {syslog_kernel} { BEGIN(dmesg_timestamp); return(TOK_SYSLOG_KERNEL); } {syslog_month} { yylval->t_str = strdup(yytext); return(TOK_DATE_MONTH); } --- apparmor-2.3.1+1403.orig/libraries/libapparmor/src/grammar.y +++ apparmor-2.3.1+1403/libraries/libapparmor/src/grammar.y @@ -145,6 +145,7 @@ %token TOK_KEY_NAMESPACE %token TOK_KEY_ERROR %token TOK_KEY_FSUID +%token TOK_KEY_OUID %token TOK_SYSLOG_KERNEL @@ -417,6 +418,8 @@ { ret_record->error_code = $3;} | TOK_KEY_FSUID TOK_EQUALS TOK_DIGITS { ret_record->fsuid = $3;} + | TOK_KEY_OUID TOK_EQUALS TOK_DIGITS + { ret_record->ouid = $3;} ; key_pid: TOK_KEY_PID TOK_EQUALS TOK_DIGITS { ret_record->pid = $3; } --- apparmor-2.3.1+1403.orig/libraries/libapparmor/src/aalogparse.h +++ apparmor-2.3.1+1403/libraries/libapparmor/src/aalogparse.h @@ -127,6 +127,7 @@ char *denied_mask; /* "r", "w", etc. */ char *requested_mask; unsigned long fsuid; /* fsuid of task - if logged */ + unsigned long ouid; /* ouid of task - if logged */ char *profile; /* The name of the profile */ char *name; char *name2; --- apparmor-2.3.1+1403.orig/libraries/libapparmor/src/libaalogparse.c +++ apparmor-2.3.1+1403/libraries/libapparmor/src/libaalogparse.c @@ -93,6 +93,7 @@ record->version = AA_RECORD_SYNTAX_UNKNOWN; record->event = AA_RECORD_INVALID; record->fsuid = (unsigned long) -1; + record->ouid = (unsigned long) -1; return; }