From 3ea61d367cf4456be3513adcdbb84714eb89d1ed Mon Sep 17 00:00:00 2001
From: Steve Grubb <ausearch.1@gmail.com>
Date: Thu, 5 Jun 2025 22:07:31 -0400
Subject: [PATCH] af_unix plugin: Restore terminating newlines

---
 audisp/plugins/af_unix/audisp-af_unix.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/audisp/plugins/af_unix/audisp-af_unix.c b/audisp/plugins/af_unix/audisp-af_unix.c
index 3df6b61c9..ecaf30650 100644
--- a/audisp/plugins/af_unix/audisp-af_unix.c
+++ b/audisp/plugins/af_unix/audisp-af_unix.c
@@ -207,17 +207,17 @@ static int event_to_string(struct audit_dispatcher_header *hdr,
 					"UNKNOWN[%u]", hdr->type);
 				type = unknown;
 			}
-			len = asprintf(&v, "type=%s msg=%.*s",
+			len = asprintf(&v, "type=%s msg=%.*s\n",
 					type, hdr->size, data);
 		} else if (inbound_protocol == F_BINARY &&
 			   hdr->ver == AUDISP_PROTOCOL_VER2) {
 			// Protocol 2 events are already formatted
-			len = asprintf(&v, "%.*s", hdr->size, data);
+			len = asprintf(&v, "%.*s\n", hdr->size, data);
 		} else
 			len = 0;
 	} else if (inbound_protocol == F_STRING) {
 		// Inbound strings start at the hdr
-		len = asprintf(&v, "%s", (char *)hdr);
+		len = asprintf(&v, "%s\n", (char *)hdr);
 	} else
 		len = 0;
 	if (len <= 0) {
@@ -226,7 +226,7 @@ static int event_to_string(struct audit_dispatcher_header *hdr,
 		return -1;
 	}
 
-	/* Strip newlines from event record */
+	/* Strip newlines from event record except the last one */
 	ptr = v;
 	while ((ptr = strchr(ptr, 0x0A)) != NULL) {
 		if (ptr != &v[len-1])
