On Thu, 08 Jan 2009 10:33:18 -0500 Eric Paris <eparis(a)redhat.com&gt; wrote: > On Thu, 2009-01-08 at 15:38 +0100, Jiri Pirko wrote: > > EXECVE records contain a newline after every argument. auditd converts > > "\n" to " " so you cannot see newlines even in raw logs, but they're > > there nevertheless. If you're not using auditd, you need to work round > > them. These '\n' chars are can be easily replaced by spaces when > > creating record in kernel. Note there is no need for trailing '\n' in > > an audit record. > > While I completely agree the \n was my mistake and should be > dropped/fixed can you fix one more thing and look at another? First > arg_num_len is being miscalculated since I included the \n in that > calculation (might be the only place....) I think that calculation is correct only the comment needs to be changed like this: - /* how many digits are in arg_num? 3 is the length of a=\n */ + /* how many digits are in arg_num? 3 is the length of " a=" */ the count is still 3 - with '\n' or with ' '.

> and I remember not wanting to > follow convention and put the space at the beginning of the aX= for some > reason. If you add thousands of arguments so this is larger than > MAX_EXECVE_AUDIT_LEN do you end up with an extra space somewhere in the > second EXECVE record? Is this a problem? We can do some workaround but is it necessary?