In normalizer, pickup subject kind for user_login events

Author: RH-steve-grubb

ChangeLog

@@ -3,6 +3,7 @@
 - Fix a segfault in auditd when dns resolution isn't available
 - Make a reload legacy service for auditd
 - In auparse python bindings, expose some new types that were missing
+- In normalizer, pickup subject kind for user_login events
 
 2.8.2
 - Update tables for 4.14 kernel

auparse/normalize.c

@@ -1,5 +1,5 @@
 /* normalize.c --
- * Copyright 2016-17 Red Hat Inc., Durham, North Carolina.
+ * Copyright 2016-18 Red Hat Inc., Durham, North Carolina.
  * All Rights Reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ -1566,7 +1566,8 @@ static int normalize_simple(auparse_state_t *au)
 		if (set_prime_subject(au, "id", 0)) {
 			auparse_first_record(au);
 			set_prime_subject(au, "acct", 0);
-		}
+		} else // If id found, set the subjkind
+			set_subject_what(au);
 		auparse_first_record(au);
 	} else {
 		// Subject - alias, uid comes before auid