From mboxrd@z Thu Jan  1 00:00:00 1970
From: Matthew Booth <mbooth@redhat.com>
Subject: Format of EXECVE
Date: Mon, 17 Sep 2007 17:50:16 +0100
Message-ID: <1190047816.14088.17.camel@localhost.localdomain>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1918901268=="
Return-path: <linux-audit-bounces@redhat.com>
Received: from [192.168.1.24] (sebastian-int.corp.redhat.com [172.16.52.221])
	by pobox.fab.redhat.com (8.13.1/8.13.1) with ESMTP id l8HHVjeC008117
	for <linux-audit@redhat.com>; Mon, 17 Sep 2007 13:31:47 -0400
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com


--===============1918901268==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="=-edx9x64ZdFobBSosA9CG"


--=-edx9x64ZdFobBSosA9CG
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Firstly, on RHEL4 U5, I've noticed that if an argument has spaces in it,
it won't be pretty printed in the EXECVE record. E.g.:

# /bin/echo foo
EXECVE... argv[1]=3D"foo"

# /bin/echo "foo bar"
EXECVE... argv[1]=3D1234ABCD

Is that a feature?

Secondly, I noticed that the sequence of messages is:
SYSCALL
EXECVE
CWD
PATH

I'm considering expanding argv[0] of EXECVE to be an absolute path.
However, that would mean either buffering things or moving EXECVE after
the PATH record. Would that break any contract, or reasonable
expectations that anyone's aware of?

Thanks,

Matt
--=20
Matthew Booth, RHCA, RHCSS
Red Hat, Global Professional Services

M:       +44 (0)7977 267231
GPG ID:  D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

--=-edx9x64ZdFobBSosA9CG
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQBG7rBINEHqGdM8NJARApcJAJ4hSjMxb4/Z/+wtiwv4MAiRuX5/6wCgl0R6
LTFJTuY/+W1WGVHXHidalB4=
=LOay
-----END PGP SIGNATURE-----

--=-edx9x64ZdFobBSosA9CG--


--===============1918901268==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============1918901268==--