max size of execve records

max size of execve records

[Eric Paris]

So I was banging on my new execve audit changes today and realized I
missed something.  If the argument is binary/has control characters it
gets logged in hex, which means each char in the execve argument lists
gets turned into 2 characters in the audit message.  Thus my current
execve message size of 7500 could be doubled to 15000 in audit_log_hex.
15000 will overflow userspace and that argument be silently dropped and
never written to disk   :(

Do we see a problem dropping the execve record size down to 3500?  The
downside to this is more overhead since we might be sending more
messages.  I wonder though how many programs get exec'd with > 3500
bytes of args.  I don't think we'll be flooding the audit system here,
its going to still be rare that we hit arguments of this size but not
unheard of.  (it turns out that just building a kernel can generate some
darn large arguments if you build lots and lots of modules)

I really don't want to have to rewrite all of the
audit_log_untrustedstring logic inside the execve audit info just so I
can tell the final size of the audit message.  I'd rather just be safe
and send a couple extra records on occasion....

As a side note I have no intention in the future of ever changing this
to be more than 8k just because order 2 allocations in the kernel are
reasonable even on a heavily loaded system, but asking for more than 2
pages can fail.  Needless to say, I think when possible userspace needs
to be able to handle these larger netlink messages.

-Eric

Re: max size of execve records

[Steve Grubb]

On Friday 12 October 2007 15:52:30 Eric Paris wrote:
> If the argument is binary/has control characters it gets logged in hex,
> which means each char in the execve argument lists gets turned into 2
> characters in the audit message.

Yep.

> Do we see a problem dropping the execve record size down to 3500?

Why not go to 3900? 3500 is just as arbitrary as 3900 but requires more 
records for large amounts of args. Also, can't you track the allocations more 
closely so that if there are no args with a space (or special character) in 
it, you can send a full 8k?

-Steve