Re: [PATCH 2/2] Audit: remove the limit on execve arguments when audit is running

On Tue, 2007-10-02 at 17:29 -0400, Eric Paris wrote: I think I need to pull this patch. (uggh) Turns out that one argument is allowed to be 32 pages long. Which is almost guaranteed to OOM a running i686 in audit_expand when we try to get that much memory. My 1/2 patch in this series doesn't address the SINGLE argument that is huge case. Just that a list of arguments is huge. My belief is that the solution to this problem is to allow audit to break individual arguments down to a size <8k. I guess my syntax would be something like a0[0]=(first 8k of a single huge argument) a0[1]=(second 8k of a single huge argument) .... My 1/2 patch in this series keeps lists or arguments <8k and if people are ok with that syntax of messages getting sent to userspace we can audit single message >8k. If this is a good syntax I'll send a patch for it. Note that I doubt there are very many programs that can handle a single argument that big, but the kernel allows it so we need some syntax to support it.... I guess the other options might be to change this audit_bprm hook to only limit execve args the way it does now if audit is running AND we are auditing execve, but i'd rather fix this 'right' rather than keep around this little wart.... who has a problem with that syntax? will userspace puke? -Eric