This seems to fix a crash I was seeing.
Trying to reproduce for the logs.
Merge branch 'ossecalert_decoder_crash'
Active response was not passing the filename in file events, ie,
syscheck.  The Eventinfo struct only included file data for builds with
Prelude integration.  This prevented the AR from handing filename off
anyways.
* Eventinfo now contains file data always
* Added *expect* option for 'filename'
* Added FILENAME to ar.h
* Filename validation is tricky, so shell escape instead
  * Added os_shell_escape() to string_op.h, allocates memory for an
    escaped string and passes the pointer back to caller. Caller must
    cleanup that memory.
  * Call os_shell_escape() before passing to execd.
* Added string_test.c to test the os_shell_escape() function.
Fixes to exec.c by Micha Nasriachi
Revert "Revert "Bug fix for AR Response with Filenames""

This reverts commit d81bbb0d228155d46f6b66d44bb08ad1d7392af2.
Removing English install message to email Daniel Cid. I'll leave the other languages to someone else.
Fixing hard-coded paths
Lines sent to SMTP server need to be terminated with \r\n, not \n.

Lines sent to SMTP server need \r\n, not just \n
fix crash in is_simple_http_request

Under some conditions is_simple_http_request access lf->url unchecked. If lf->url is null, it will segfault.
Merge pull request #232 from navtej/master

fix crash in is_simple_http_request

Under some conditions is_simple_http_request access lf->url unchecked. If lf->url is null, it will segfault.
Ensure free(*dst) doesn't dereference a null pointer.
Merge pull request #233 from reyjrar/fix/accumulator-null-check

Fix/accumulator null check
Add a VERY basic deoccder for apparmor, and a couple of rules to
basically ignore things.
The IDs for the rules are in the user range, but that can change later.
Sample log message is from RealRancor on github #234. Hopefully he
can help expand the rules.
Update copyright date
Update the decoder to add the operation. This seems important for
determining how malicious some action is.
Add arule to alert on DENIED messages.

The examples provided by @RealRancor illustrate an issue. The
original examples that were provided were in a syslog format
with "kernel" as the program_name. This made them identify as
iptables log messages. The DENIED examples did not have the syslog
header, and identified as auditd log messages. This work should
probably duplicate what was already done for auditd.
Add a couple of rules for breaking down the operations in the
DENIED log samples. I don't know how much value something like this
really has, but I don't have a lot of experience with apparmor.

On another note, but British may be right. Armour feels more right
than armor.
fix comment in decoder.xml
Merge pull request #241 from cgzones/fix_decoder

Fix comment in decoder.xml
[os_crypto] update makefiles
[os_crypto] add const qualifiers and use explicit os_md5 and os_sha1 instead of char *