From mboxrd@z Thu Jan 1 00:00:00 1970 From: James Antill Subject: Re: difficulty with TYPE Date: Tue, 15 Jan 2008 08:33:59 -0500 Message-ID: <1200404039.30787.4.camel@code.and.org> References: <18436f8f0801142314g46f77485x311cfb2826f2dff4@mail.gmail.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0862032781==" Return-path: Received: from mail.and.org (vpn-248-3.boston.redhat.com [10.13.248.3]) by pobox.corp.redhat.com (8.13.1/8.13.1) with ESMTP id m0FDY0EV017355 for ; Tue, 15 Jan 2008 08:34:00 -0500 In-Reply-To: <18436f8f0801142314g46f77485x311cfb2826f2dff4@mail.gmail.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Abhishek Gupta Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============0862032781== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-V61+fSHq3/naHtPUkqUP" --=-V61+fSHq3/naHtPUkqUP Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Tue, 2008-01-15 at 12:44 +0530, Abhishek Gupta wrote: > i tried to run auditdispatcher from > http://people.redhat.com/sgrubb/audit/audit-rt-events.txt with little > modification. > i converted TYPE numeric value to name using audit library function > "audit_msg_type_to_name".=20 > Then i printed audit TYPE number with corresponding name using above > function. > The program is running fine but i have little doubt. [...] > /* Get header first. it is fixed size */ > vec[0].iov_base =3D (void*)&hdr; > vec[0].iov_len =3D sizeof(hdr); >=20 > // Next payload=20 > vec[1].iov_base =3D data; > vec[1].iov_len =3D MAX_AUDIT_MESSAGE_LENGTH; >=20 > rc =3D readv(pipe_fd, vec, 2); > if (rc =3D=3D 0 || rc =3D=3D -1) { The second iovec above can't just be MAX_AUDIT_MESSAGE_LENGTH, or if there are two messages you'll read some/all of the next one(s). You either need to read the header first and then use hdr.size, or separate the IO from the parsing. Also you can't just check for readv() as above, you need to check that you've read the amount of data you want, and if you didn't get it all yet then loop.=20 --=20 James Antill Red Hat --=-V61+fSHq3/naHtPUkqUP Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQBHjLZC11eXTEMrxtQRAlCcAJ4h0U7SCvb9JuTWEBLYlZpYIMgGEACfVnwL 8d3li2/+ieOu/xarBo0CgGI= =QGo1 -----END PGP SIGNATURE----- --=-V61+fSHq3/naHtPUkqUP-- --===============0862032781== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0862032781==--