diff -urp audit-2.7.7.orig/src/aureport-scan.c audit-2.7.7/src/aureport-scan.c
--- audit-2.7.7.orig/src/aureport-scan.c 2017-03-27 18:21:19.000000000 -0400
+++ audit-2.7.7/src/aureport-scan.c 2017-06-08 16:06:48.232990012 -0400
@@ -452,7 +452,8 @@ static int per_event_summary(llist *l)
} else {
if (list_find_msg_range(l,
AUDIT_FIRST_KERN_ANOM_MSG,
- AUDIT_LAST_KERN_ANOM_MSG)) {
+ AUDIT_LAST_KERN_ANOM_MSG) ||
+ list_find_msg(l, AUDIT_SECCOMP) ) {
ilist_add_if_uniq(&sd.anom_list,
l->head->type, 0);
}
@@ -729,7 +730,8 @@ static int per_event_detailed(llist *l)
} else {
if (list_find_msg_range(l,
AUDIT_FIRST_KERN_ANOM_MSG,
- AUDIT_LAST_KERN_ANOM_MSG)) {
+ AUDIT_LAST_KERN_ANOM_MSG) ||
+ list_find_msg(l, AUDIT_SECCOMP) ) {
print_per_event_item(l);
rc = 1;
}
diff -urp audit-2.7.7.orig/src/ausearch-parse.c audit-2.7.7/src/ausearch-parse.c
--- audit-2.7.7.orig/src/ausearch-parse.c 2017-03-27 18:21:19.000000000 -0400
+++ audit-2.7.7/src/ausearch-parse.c 2017-06-08 16:00:13.856999833 -0400
@@ -2080,7 +2080,7 @@ static int parse_kernel_anom(const lnode
str = strstr(term, "exe=");
if (str) {
str += 4;
- if (*str == '"') {
+ if (*str == '"') {
str++;
term = strchr(str, '"');
if (term == NULL)
@@ -2090,7 +2090,7 @@ static int parse_kernel_anom(const lnode
*term = '"';
} else
s->exe = unescape(str);
- } else
+ } else if (n->type != AUDIT_ANOM_ABEND)
return 14;
}