Strings encoding - Linux-audit - Linux-Audit List Archives

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Strings encoding

audit.rules setting

Adding New field into audit records

Lev Stipakov

Tuesday, 22 March 2016 Tue, 22 Mar '16

2:44 a.m.

Hello, The string values can be either enclosed in quotation marks or hex-encoded. Is it safe to assume that sequence of bytes after hex decoding is always utf-8 encoded string? -Lev

Reply

Show replies by date

Steve Grubb

Tuesday, 22 March Tue, 22 Mar

8:46 a.m.

Hello, On Tuesday, March 22, 2016 09:44:19 AM Lev Stipakov wrote:

The string values can be either enclosed in quotation marks or hex-encoded. Is it safe to assume that sequence of bytes after hex decoding is always utf-8 encoded string?

There are no guarantees what they are. This is used whenever the user could have controlled the input in a way to trick the audit parser. And in one case the hex encoding is an actual socket address structure. -Steve

Reply

3196

days inactive

3196

days old

linux-audit@lists.linux-audit.osci.io

Manage subscription

1 comments

2 participants

tags (0)

participants (2)

Lev Stipakov
Steve Grubb