Re: Kernel audit output is inconsistent, hard to parse

Eric Paris wrote: I'm cool with not using quotes around everything, I very much see the appeal in that. But if you do that then *all* strings have to be quoted *and* you can't continue to use the current unquoted hexadecimal string encoding (case 3), it's ambiguous, you can't determine if its a string because the quotes would be missing. That means case 3 also must be eliminated. All strings have to be enclosed in quotes and what appears inside the quotes has to support encoding arbitrary bytes. FWIW backslash quoting meets this requirement, as does many other encodings in popular use. Eliminating both case 1 and case 3 would be necessary to make it moot. It would be a superb step forward and greatly appreciated. Encoding binary data is solved problem. Some encodings are more efficient than others, pick a standard encoding which satisfies your requirements. The only key is that when the input stream shifts into and out of encoded format it must be determinable only from the input stream. It cannot rely on private version specific knowledge that certain fields have this encoding. I shouldn't have to look at the field name, this violates basic parsing rules and is tied to specific kernel versions, see first comment, there is an easy solution. That would be a big step forward and would solve many of the problems, thanks. Just be aware audit_log_string has to use a different encoding other than bare hexadecimal. How does the parser know the field can be a string? See above. -- John Dennis <jdennis(a)redhat.com&gt;