Re: get_field_str() and interpret_field() bug with multi-word fields
On Tuesday 12 August 2008 16:57:59 John Dennis wrote:
Let me give you a simple example, suppose this key/value pair was in
an
audit record:
foo=00
How does one know which of the possible values foo has:
1) it's the integer zero (but in what radix? does the leading zero imply
octal or is it just an insignificant digit?)
2) it's the hexadecimal encoding of a single character string containing
one null byte.
3) it's the 2 character string "00" consisting of two zero characters.
The fact is it's ambiguous, it could be any of the above. It's ambiguous
because the audit stream is an improperly specified protocol.
John, this is the way that the kernel works. The kernel and user space
utilities that interface to it are developed together with an understanding
of how the numbers are represented. Go take a look in /proc/1/stat. What does
any of that mean? Is it parsable? I'll guarantee its defined well enough
program can use it.
The point is that all of /proc is written without implicit parsing rules.
That's the way it is when dealing with kernel and its user space utilities.
There is no field in the kernel that is unhandled by the audit system and
without knowing specifically what's in it.
-Steve