Re: [PATCH] Fix acct quoting in audit_log_acct_message())

Eric Paris wrote: These are the encoded audit strings in kernel 2.6.24 (Fedora): a[0-9]+ comm cwd data dir exe key msg name new old path These are the encoded audit strings in kernel 2.6.18 (RHEL-5): comm cwd exe key name new ocomm old path This is what audit-1.6.5 checks for: acct cmd comm cwd exe file name path watch This list does not include strings which are not encoded, only those known to be subject to hexadecimal decoding! Absolutely none of the above fields should require special table driven logic in order to read their value as a string. Just to make life interesting I believe some of these field names appear in more than one record type. This is just two OS's. In real deployments a site might be running a much larger set of OS's all emitting audit data and probably not capturing the OS version along with the audit data. Every time we have a new release we compound the problem. Every time a new piece of audit data is added the problem is compounded. Any patch has the potential to modify the audit contents. -- John Dennis <jdennis(a)redhat.com&gt;