From: "Miloslav Trmač" <mitr@redhat.com>
To: viro@zeniv.linux.org.uk, Eric Paris <eparis@redhat.com>
Cc: linux-audit <linux-audit@redhat.com>,
linux-kernel <linux-kernel@vger.kernel.org>
Subject: [PATCH 2/2] audit: Handle embedded NUL in TTY input auditing
Date: Thu, 11 Sep 2008 00:29:33 +0200 [thread overview]
Message-ID: <1221085773.2705.25.camel@amilo> (raw)
From: Miloslav Trmac <mitr@redhat.com>
Data read from a TTY can contain an embedded NUL byte (e.g. after
pressing Ctrl-2, or sent to a PTY). After the previous patch, the data
would be logged only up to the first NUL.
This patch modifies the AUDIT_TTY record to always use the hexadecimal
format, which does not terminate at the first NUL byte. The vast
majority of recorded TTY input data will contain either ' ' or '\n', so
the hexadecimal format would have been used anyway.
Signed-off-by: Miloslav Trmac <mitr@redhat.com>
---
tty_audit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/tty_audit.c b/drivers/char/tty_audit.c
index 3582f43..5787249 100644
--- a/drivers/char/tty_audit.c
+++ b/drivers/char/tty_audit.c
@@ -93,7 +93,7 @@ static void tty_audit_buf_push(struct task_struct *tsk, uid_t loginuid,
get_task_comm(name, tsk);
audit_log_untrustedstring(ab, name);
audit_log_format(ab, " data=");
- audit_log_n_untrustedstring(ab, buf->data, buf->valid);
+ audit_log_n_hex(ab, buf->data, buf->valid);
audit_log_end(ab);
}
buf->valid = 0;
next reply other threads:[~2008-09-10 22:29 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-09-10 22:29 Miloslav Trmač [this message]
2008-09-11 14:25 ` [PATCH 2/2] audit: Handle embedded NUL in TTY input auditing Eric Paris
2008-09-11 14:25 ` Eric Paris
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1221085773.2705.25.camel@amilo \
--to=mitr@redhat.com \
--cc=eparis@redhat.com \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.