So I was banging on my new execve audit changes today and realized I missed something. If the argument is binary/has control characters it gets logged in hex, which means each char in the execve argument lists gets turned into 2 characters in the audit message. Thus my current execve message size of 7500 could be doubled to 15000 in audit_log_hex. 15000 will overflow userspace and that argument be silently dropped and never written to disk :( Do we see a problem dropping the execve record size down to 3500? The downside to this is more overhead since we might be sending more messages. I wonder though how many programs get exec'd with > 3500 bytes of args. I don't think we'll be flooding the audit system here, its going to still be rare that we hit arguments of this size but not unheard of. (it turns out that just building a kernel can generate some darn large arguments if you build lots and lots of modules) I really don't want to have to rewrite all of the audit_log_untrustedstring logic inside the execve audit info just so I can tell the final size of the audit message. I'd rather just be safe and send a couple extra records on occasion.... As a side note I have no intention in the future of ever changing this to be more than 8k just because order 2 allocations in the kernel are reasonable even on a heavily loaded system, but asking for more than 2 pages can fail. Needless to say, I think when possible userspace needs to be able to handle these larger netlink messages. -Eric