Re: [PATCH] Fix acct quoting in audit_log_acct_message())

On Tuesday 04 March 2008 13:10:48 Tomas Mraz wrote: You need to ask the SE Linux folks if they would like to see their event layout change. If there's no agreement with them, should we change anything? auparse is working pretty good as is. This is basically the parsing rules: The header was defined a long time ago, It parses in its own way, once we hit msg=, everything is name=value. We do this by repeatedly calling strtok. If the newly split string does not have a = in it, we throw it away. We trim any trailing punctuation. I'll attach the parser code at the end of this email just so you see its actually real simple. I wouldn't mind dropping some of the punctuation since that would save disk space. What is missing perhaps is a schema file that tells the field name, its format, and maybe its meaning. Not sure meaning is really needed. If we had a schema file, then you could change things pretty easy and still parse it. But that flexibility might cost performance. The biggest question to me is how you handle any transition from one format to another. It will take time for patches to get upstream and then back downstream. Meanwhile we could have audit logs being aggregated from a couple different releases. They all need to parse correctly. How do we handle that? I suspect the answer is to make the audit parser handle old and new formats which adds a whole lot of code and makes it more complicated. -Steve buf = strdup(r->record); ptr = strtok_r(buf, " ", &saved); if (ptr == NULL) return -1; do { // If there's an '=' sign, its a keeper nvnode n; char *val = strchr(ptr, '='); if (val) { int len; // If name is 'msg=audit' throw it away if (*ptr == 'm' && strncmp(ptr, "msg=", 4) == 0) { if (ptr[4] == 'a') continue; // If name is 'msg='' chop off and see // if there is still a = in the string. else if (ptr[4] == '\'') { ptr += 5; val = strchr(ptr, '='); if (val == NULL) continue; } } // Split the string *val = 0; val++; // Remove beginning cruft of name if (*ptr == '(') ptr++; n.name = strdup(ptr); n.val = strdup(val); // Remove trailing punctuation len = strlen(n.val); if (len && n.val[len-1] == ':') { n.val[len-1] = 0; len--; } if (len && n.val[len-1] == ',') { n.val[len-1] = 0; len--; } if (len && n.val[len-1] == '\'') { n.val[len-1] = 0; len--; } if (len && n.val[len-1] == ')') { if (strcmp(n.val, "(none)") && strcmp(n.val, "(null)")) { n.val[len-1] = 0; len--; } } nvlist_append(&r->nv, &n);