AVC parser overwrites existing syscall success status

parse_avc assigns s->success based on the AVC message whenever a
success filter is set, even if s->success already contains the
authoritative syscall result.

Updated parse_avc so the AVC result only sets s->success when it hasn't
already been determined, preserving earlier success values.

Author: stevegrubb

src/ausearch-parse.c

@@ -1959,12 +1959,12 @@ static int parse_avc(const lnode *n, search_items *s)
 			term = n->message;
 			goto other_avc;
 		}
-		if (event_success != S_UNSET) {
+		// Do not override syscall success if already set.
+		// Syscall pass/fail is the authoritative value.
+		if (event_success != S_UNSET && s->success == S_UNSET) {
 			*term = 0;
-			// FIXME. Do not override syscall success if already
-			// set. Syscall pass/fail is the authoritative value.
 			if (strstr(str, "denied")) {
-				s->success = S_FAILED; 
+				s->success = S_FAILED;
 				an.avc_result = AVC_DENIED;
 			} else {
 				s->success = S_SUCCESS;