Re: saddr value in connect()

I have a question about the SOCKADDR token in a SYSCALL record (syscall 42 -- connect()) Most of my records begin with one of the two values: saddr=0200 saddr=0100 Followed by the port & IPv4 address or the file path.

QUESTION 1: The file path appears to be NULL terminated. Is this correct?

QUESTION 2: There is often additional characters after the 00 termination (and IP address). Is this just garbage that should be ignored?

QUESTION 3: Sometimes the first byte in a file path is 00 termination (e.g., saddr=0100002F…). Does this mean the string is empty and the content following it is garbage? Or is there a bug that accidentally prepends the 00 to the front of the saddr sequence?

Here is an example: ———————— type=SYSCALL msg=audit(1397089029.264:7407): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7fff3a7fdf70 a2=16 a3=7fff3a7fdd20 items=0 ppid=805 pid=1064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="initctl" exe="/sbin/initctl" key=(null) type=SOCKADDR msg=audit(1397089029.264:7407): saddr=0100002F636F6D2F7562756E74752F75707374617274 ———————— If I assume the first 00 is a bug, the string decodes to /com/ubuntu/upstart Thanks, Todd PS. uname -r gives 3.13.0-24-generic (though, I think I collected these logs before the last software update) -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit