[Apparmor-dev] [rfr] SubDomain.pm regex for audit message in syslog

[Mathias Gug]

Hi,

I've attached a diff that updates the regular expression used in
SubDomain.pm to match audit messages found in syslog.

On Ubuntu, the messages in syslog look like this:

Sep 24 11:55:59 gutsy-server kernel: [ 4850.131061] audit(1190649359.555:702):  type=1504 operation="ptrace" task=4387 parent=4389 pid=4389 profile="/usr/sbin/nscd"

--
Mathias
-------------- next part --------------
A non-text attachment was scrubbed...
Name: apparmor-audit-message-syslog-regex.diff
Type: text/x-diff
Size: 520 bytes
Desc: not available
Url : http://forge.novell.com/pipermail/apparmor-dev/attachments/20070924/71b439b2/apparmor-audit-message-syslog-regex.bin