Re: get_field_str() and interpret_field() bug with multi-word fields
On Wed, 2008-08-13 at 11:09 -0400, Eric Paris wrote:
HAHAHA, kernel output xml? dream on :) I'm willing to do
wholesale
output changes, but something that heavy in kernel is impossible to
push. I can just see Al cussing up a storm as he read that.
That's exactly my point. There's no sense in discussing a 'ideal' format
for audit stream coming out of the kernel, since it's well agreed
(thankfully) that the kernel part should be as minimal as possible.
I like Mathew's idea of having a binary format though. Maybe it's
possible to carry the legacy format for some time while we have a more
robust (and extensible) binary format in parallel? And then having a
binary format version tag within each record?
I know I know, at the time I have more questions than answers. I only
wanted to express my feeling that there is indeed a problem with the
current format.
I know you and Steve tried before to talk with the SELinux guys trying
to have a saner format for AVCs and stuff. Do you feel that's an
impossible barrier to cross or maybe we try again and convince them that
stricter formatting rules will bring more users for their audit data?
-Klaus
--
Klaus Heinrich Kiwi <klausk(a)linux.vnet.ibm.com>
Linux Security Development, IBM Linux Technology Center