Re: [patch] Syscall auditing - move "name=" field to the end

I don't think this patch is enough -- either we need to escape the text completely or just dump it as hex instead of a string. One option would be to dump it in quotes as a string if all chars in the string are in the range 0x20-0x7e, and as hex otherwise. That slightly complicates the parsing, but not by much, and still gives you plain text in the majority of cases while protecting against abuse.