1:52 p.m.
Hello,
My test case is testing the following:
attempt to insert a watch on a path with strlen() = 4095.
My test case is expecting this to pass ...
but here is what I get:
DEBUG PRINT: Expected path length = 4095: Actual is 4095 (Not counting
terminating null)
Starting auditd: [ OK ]
Error sending watch insert request (File name too long)
Error sending watch to kernel
Fail - auditctl command returns 255
FAIL : Path length =PATH_MAX(without null) generated error
I thought the kernel should allow a watch to be inserted ... Is the
above a correct behavior?
- Loulwa
2:04 p.m.
On Tuesday 28 June 2005 14:52, Loulwa Salem wrote:
Error sending watch insert request (File name too long)
Was the file name < 255 bytes?
I thought the kernel should allow a watch to be inserted ... Is the
above a correct behavior?
That depends. This is in /usr/include/linux/limits.h
#define NAME_MAX 255 /* # chars in a file name */
#define PATH_MAX 4096 /* # chars in a path name including nul */
if (req->pathlen >= PATH_MAX)
goto audit_receive_watch_exit;
Looks like it should allow only 4095 byte names through.
-Steve
2:19 p.m.
Steve Grubb wrote:
Was the file name < 255 bytes?
Yes .. it was 71 chars long
in my case
if (req->pathlen >= PATH_MAX)
goto audit_receive_watch_exit;
Looks like it should allow only 4095 byte names through.
Since the strlen() of what I passed it is 4095, it should go through ..I
believe ..
- Loulwa
10:14 a.m.
I just thought to follow up on this problem .... I am still seeing it
using kernel.74 and audit.0.9.14
I noticed that when inserting a watch on a path strlen()=4095 but with a
space in the path, no error is generated and the case passes ...
Brief recap of problem:
inserting watch on path with strlen()=4095 comes back with error from kernel
Starting auditd: [ OK ]
Error sending watch insert request (File name too long)
Error sending watch to kernel
Fail - auditctl command returns 255
FAIL : Path length =PATH_MAX(without null) generated error
- Loulwa
11:14 a.m.
On Wednesday 06 July 2005 11:14, Loulwa Salem wrote:
I just thought to follow up on this problem .... I am still seeing
it
using kernel.74 and audit.0.9.14
I believe this is a generic linux kernel problem. The documentation
in /usr/include/limits.h clearly says:
#define PATH_MAX 4096 /* # chars in a path name including nul */
However, the LTP test suite does not check the boundary correctly as you do.
They use 4098 which is obviously bad and then check for failure. As a result
of not checking the boundary correctly - no one knows that this is a problem.
In real life its not a problem...its only a problem for people doing
conformance test.
I noticed that when inserting a watch on a path strlen()=4095 but
with a
space in the path, no error is generated and the case passes ...
You may need to adjust the test to use a path that is 1 byte smaller just so
we can get past this. The problem can be corrected by either changing the
documentation in limits.h or fixing the problem in the kernel. This is up to
the kernel guys.
-Steve
7:21 a.m.
On Wed, 2005-07-06 at 10:14 -0500, Loulwa Salem wrote:
inserting watch on path with strlen()=4095 comes back with error
from
kernel
Starting auditd: [ OK ]
Error sending watch insert request (File name too long)
The problem here seems to be that auditctl is giving the length of the
string _including_ an extra zero character at the end.
The kernel doesn't go checking for zero bytes in the string it's passed
-- it just checks the length, which in your case is actually 4096. And
that would make a string of length 4097 including the NUL termination
which the kernel is going to add, so the kernel returns -ENAMETOOLONG.
Try something like this...
--- src/auditctl.c.orig 2005-07-07 13:13:16.000000000 +0100
+++ src/auditctl.c 2005-07-07 13:14:04.000000000 +0100
@@ -212,7 +212,7 @@ static int audit_setup_watch_name(struct
fprintf(stderr, "Out of memory\n");
return -1;
}
- req->namelen = strlen(req->name) + 1;
+ req->namelen = strlen(req->name) ;
*act = 1;
return 1;
}
--
dwmw2
7116
days inactive
7125
days old
linux-audit@lists.linux-audit.osci.io
5 comments
3 participants
participants (3)
-
David Woodhouse -
Loulwa Salem -
Steve Grubb