New subject: There is a bug on parsing file path in auditd-config.c and audispd-pconfig.c

Wednesday, 23 July 2008

Hi Steve,

What do think about this patch?
When user defines path's dirname's length < 4bit in 
/etc/audit/auditd.conf or in plugin configure file,this error always 
happens.
If you have other opinion, please tell me, thank you.

-----Original Message-----
From: wangf
Sent: 2008-7-1 14:43
...
 Hi Steve,

 There is a bug in function dispatch_parser() and path_parser().

 when we use dir = dirname (tdir), if tdir is not NULL, tdir and dir 
 point to the same addr., so if we use free(tdir) before 
 audit_msg(LOG_ERR, "The directory name: %s is too short - line %d", 
 dir, line); we can not get the dir's correct value. 
Because dir's space has been freed, so the space can be used by others.
when we get dir's value, it will be wrong.
Please look the two examples:

1)
define "dispatcher = /my/audispd" in /etc/audit/auditd.conf
This error message will be printed into syslog such as:
"Jul 11 10:39:04 localhost auditd: The directory name: /etc/localtime is 
too short - line 12"

but in fact it should be such error message:
"Jul 11 10:39:04 localhost auditd: The directory name: /my is too short 
- line 12"

2)
The same problem in plugin configure file:
define "path = /my/myplugin" in /etc/audisp/plugins.d/user.conf

This error message will be printed into syslog such as:
"Jul 11 10:38:39 localhost audispd: The directory name: 8óô·^C is too 
short - line 3"

but in fact it should be such error message:
"Jul 11 10:38:39 localhost audispd: The directory name: /my is too short 
- line 3"

...

 This patch can solve this problem.

 Signed-off-by: Wang Fang <wangf(a)cn.fujitsu.com&gt;
 ---
 diff -Nrup audit-1.7.4/audisp/audispd-pconfig.c 
 audit-1.7.4-new/audisp/audispd-pconfig.c
 --- audit-1.7.4/audisp/audispd-pconfig.c    2007-09-02 
 23:24:15.000000000 +0800
 +++ audit-1.7.4-new/audisp/audispd-pconfig.c    2008-06-21 
 18:33:14.000000000 +0800
 @@ -379,10 +379,10 @@ static int path_parser(struct nv_pair *n
     if (tdir)
         dir = dirname(tdir);
     if (dir == NULL || strlen(dir) < 4) { //  '/var' is shortest dirname
 -        free(tdir);
         audit_msg(LOG_ERR,
             "The directory name: %s is too short - line %d",
             dir, line);
 +        free(tdir);
         return 1;
     }

 diff -Nrup audit-1.7.4/src/auditd-config.c 
 audit-1.7.4-new/src/auditd-config.c
 --- audit-1.7.4/src/auditd-config.c    2008-05-09 22:44:38.000000000 
 +0800
 +++ audit-1.7.4-new/src/auditd-config.c    2008-06-21 
 18:39:58.000000000 +0800
 @@ -592,10 +592,10 @@ static int dispatch_parser(struct nv_pai
     if (tdir)
         dir = dirname(tdir);
     if (dir == NULL || strlen(dir) < 4) { //  '/var' is shortest dirname
 -        free(tdir);
         audit_msg(LOG_ERR,
             "The directory name: %s is too short - line %d",
             dir, line);
 +        free(tdir);
         return 1;
     }

 -- 
 Best Regards,
 Wang Fang

 -- 
 Linux-audit mailing list
 Linux-audit(a)redhat.com
 https://www.redhat.com/mailman/listinfo/linux-audit

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Re: There is a bug on parsing file path in auditd-config.c and audispd-pconfig.c