Fix a bug of executing "aureport -tm"

Hello steve,

Use option "-tm" cannot report about terminals, when message type is USER_AVC.

For example:

# echo "type=USER_AVC msg=audit(1221880640.759:4904436): user pid=4748 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  received policyload notice (seqno=37) : exe=\"?\" (sauid=81, hostname=?, addr=?, terminal=?)'" | aureport -tm

Terminal Report
====================================

# date time term host exe auid event
====================================
<no events of interest were found>

---
 src/ausearch-parse.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

index e3ffa8c..da1730f 100644
@@ -850,8 +850,11 @@ static int parse_user(const lnode *n, search_items *s)
 		if (str) {
 			str += 9;
 			term = strchr(str, ' ');
-			if (term == NULL)
-				return 17;
+			if (term == NULL) {
+				term = strchr(str, ')');
+				if (term == NULL)
+					return 17;
+			}
 			*term = 0;
 			s->terminal = strdup(str);
 			*term = ' ';

1.5.4.2


-- 
Regards
Peng Haitao

Applied. Thanks for the patch.

-Steve