Re: auparse, stdin, and AUPARSE_CB_EVENT_READY
Below patch "fixes" it. The problem is that if you have a node name
included in the message, and that it's a long hostname, it's just not
copying a long enough string, and it will fail to parse the message
serial. When the serial is incorrect, auparse will fail to group them
and notify with AUPARSE_CB_EVENT_READY as a consequence.
Now, I write this "fixes" it because if you have a really, really long
hostname, it will fail in the same manner.
--- audit-2.1.3/auparse/auparse.c 2011-08-15 10:31:02.000000000 -0700
+++ audit-2.1.3-cef/auparse/auparse.c 2012-03-06 15:13:13.000000000 -0800
@@ -680,7 +680,7 @@
int rc = 1;
e->host = NULL;
- tmp = strndupa(b, 80);
+ tmp = strndupa(b, 100);
ptr = strtok(tmp, " ");
if (ptr) {
// Optionally grab the node - may or may not be included
A probably better fix is then:
- tmp = strndupa(b, 80);
+ tmp = strndupa(b, MAX_AUDIT_MESSAGE_LENGTH);
Or:
- tmp = strndupa(b, 80);
+ tmp = strndup(b); //potentially dangerous?
Or just do away with strtok and avoid duping strings.
Guillaume
On 03/05/2012 04:23 PM, dump(a)tzib.net wrote:
Hi,
I made a audispd plugin, which reads from stdin and sends the strings to
auparse_feed() (auditd-2.1.3).
This works fine on the command line.
When called from audispd however, it gives AUPARSE_CB_EVENT_READY for
each single message, instead of after a complete event has been parsed.
So when you have 4 messages for one event:
- each of them appear as a single event when the plugin is started via
audispd.
- a single even for all 4 messages appear when the plugin is started on
the command line (and the log data fed via stdin, like cat test |
audispd-testplugin)
Looking at the write code it looks ok (audisp/audispd.c):
static int write_to_plugin(event_t *e, const char *string, size_t
string_len,
.. (note that i'm using string type so its the string code part)
if (conf->p->format == F_STRING) {
do {
rc = write(conf->p->plug_pipe[1], string, string_len);
} while (rc < 0 && errno == EINTR);
}
Do you know what causes this behavior, and/or how to "fix" it?
Thanks
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit