audit 1.7.18 and auparse_feed_has_data

Hi,

I have a Debian 7.9 which includes libaudit-devel-1.7.18. That version does not have auparse_feed_has_data(). Its implementation looks simple, however it uses au_lo, which is declared as static in auparse.c and therefore cannot be accessed outside of that file.

I took auparse_feed_has_data() usage from audisp-example.c

	tv.tv_sec = 5;
	tv.tv_usec = 0;
	FD_ZERO(&read_mask);
	FD_SET(0, &read_mask);
	if (auparse_feed_has_data(au))
		retval= select(1, &read_mask, NULL, NULL, &tv);
	else
		retval= select(1, &read_mask, NULL, NULL, NULL);

I noticed that old version of example plugin doesn't have auparse_feed_has_data() or select() calls (https://github.com/gdestuynder/audit-cef/blob/master/contrib/plugin/audisp-example.c#L104)

What is the purpose of select/auparse_feed_has_data? Is it some kind of optimization or bug fix? Since I have to support Debian 7 and probably have to stick to audit 1.7 headers, is it safe to use the "old way"?

-Lev

A little of both. See this thread for the background:
https://www.redhat.com/archives/linux-audit/2012-August/msg00025.html