Re: [PATCH] Fix acct quoting in audit_log_acct_message())

On Tuesday 04 March 2008 16:55:20 Eric Paris wrote: > but we both agree auparse doesn't get them all (for better or worse) and > 2.6.24 only adds new stuff, it doesn't remove? Right. > > Of these, A0-4 is probably from the execve patch. I have no idea what the > > status of this patch is and if its upstream. I've not seen the records so > > this would be something very new. > > execve could always turn A0-infinity into hex. That's with a capital A0? Lower case a0 is numeric data in the syscalls and might be a name collision.

> > msg, name collision it has to change wherever it is in the kernel > > not sure what this means... I only see msg used in one place, but it is > a great example of non-standardization which should be cleaned up.... > > if (msg_type != AUDIT_USER_TTY) > audit_log_format(ab, " msg='%.1024s'", > (char *)data); > else { > int size; > > audit_log_format(ab, " msg="); > size = nlmsg_len(nlh); > audit_log_n_untrustedstring(ab, size, > data); > } huh? That is new and doesn't seem right. > The top case will surround these with '' which the bottom will surround > with "" Yes, that has got to change. msg=has only one use and its the way it used to be.

> > new, old, these sound like bugs. They need to get fixed in the kernel > > new and old are from audit config changes. We probably need a '-' added or a couple words rearranged. I need to hunt those down to see which way they should go. > Am i really expected to trust what came down the netlink socket from > userspace was sane? That's not the issue to me, new and old are simply non-descriptive. New and old what?