Per Steve Grubb's observation that there are some remaining cases where avc_audit() directly logs untrusted strings without escaping them, here is a patch that changes avc_audit() to use audit_log_untrustedstring() or audit_log_hex() as appropriate. Note that d_name.name is nul- terminated by d_alloc(), and that sun_path is nul-terminated by unix_mkname(), so it is not necessary for the AVC to create nul- terminated copies or to alter audit_log_untrustedstring to take a length argument. In the case of an abstract name, we use audit_log_hex() with an explicit length. Signed-off-by: Stephen Smalley <sds(a)tycho.nsa.gov&gt; --- selinux/avc.c | 22 +++++++++------------- 1 files changed, 9 insertions(+), 13 deletions(-) Index: security/selinux/avc.c =================================================================== --- 6cad4f59214ed4563ddc189bc98f05d1e2b1a5cc/security/selinux/avc.c (mode:100644) +++ uncommitted/security/selinux/avc.c (mode:100644) @@ -575,16 +575,16 @@ struct dentry *dentry = a->u.fs.dentry; if (a->u.fs.mnt) audit_avc_path(dentry, a->u.fs.mnt); - audit_log_format(ab, " name=%s", - dentry->d_name.name); + audit_log_format(ab, " name="); + audit_log_untrustedstring(ab, dentry->d_name.name); inode = dentry->d_inode; } else if (a->u.fs.inode) { struct dentry *dentry; inode = a->u.fs.inode; dentry = d_find_alias(inode); if (dentry) { - audit_log_format(ab, " name=%s", - dentry->d_name.name); + audit_log_format(ab, " name="); + audit_log_untrustedstring(ab, dentry->d_name.name); dput(dentry); } } @@ -628,23 +628,19 @@ u = unix_sk(sk); if (u->dentry) { audit_avc_path(u->dentry, u->mnt); - audit_log_format(ab, " name=%s", - u->dentry->d_name.name); - + audit_log_format(ab, " name="); + audit_log_untrustedstring(ab, u->dentry->d_name.name); break; } if (!u->addr) break; len = u->addr->len-sizeof(short); p = &u->addr->name->sun_path[0]; + audit_log_format(ab, " path="); if (*p) - audit_log_format(ab, - "path=%*.*s", len, - len, p); + audit_log_untrustedstring(ab, p); else - audit_log_format(ab, - &quot;path=(a)%*.*s&quot;, len-1, - len-1, p+1); + audit_log_hex(ab, p, len); break; } } -- Stephen Smalley National Security Agency