From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Paris Subject: Re: [PATCH] Fix acct quoting in audit_log_acct_message()) Date: Tue, 04 Mar 2008 14:05:36 -0500 Message-ID: <1204657536.3216.108.camel@localhost.localdomain> References: <47CCC6F0.1090005@redhat.com> <47CD65A3.8020204@redhat.com> <1204654248.12783.32.camel@vespa.frost.loc> <47CD9516.5070609@redhat.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <47CD9516.5070609@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: John Dennis Cc: linux-audit@redhat.com, Simo Sorce , Tomas Mraz List-Id: linux-audit@redhat.com On Tue, 2008-03-04 at 13:29 -0500, John Dennis wrote: > Tomas Mraz wrote: > > 1. Messages contain = pairs separated by spaces. > > 2. All are just alphanumeric sequences. > > 3. Values can be either: > > a) byte sequences with the following special characters encoded as %XX > > where XX is hexadecimal value of the encoded byte. Special characters > > are: bytes with value <= 0x20 or >= 0x7F, '%', '(', ')', and '='. > > b) recursively embedded messages enclosed in '(' and ')' parentheses. > > I think if a value is a string then the fact it is a string should be > explicit and the boundaries of the string should be delimited. > > The simplest way to achieve this is by enclosing string values in double > quotes and assuring any double quote contained in the string is escaped. > If a value is not enclosed in double quotes it is not a string and is > not subject to unescaping (decoding). You also need to start looking at where messages come from before we decide we can change them any way we want. Any message generated by the audit system should be encoded according to the audit system standards. Any message generated by a CONSUMER of the audit system is wholely responsible for their own encoding decisions (although we obviously should encourage them to follow standard practice.) The audit system has no 'right' to change those messages just to make a userspace library easier. I realize you don't want to ever look at the TYPE= part of the message to make decisions, but that's just too bad. Lets standardize syscall messages. Lets standardize audit config messages. Lets standardize every message the audit system itself generates. If the package owners so choose lets standardize each userspace audit message. But avc messages are wholely the responsibility of the selinux community and I don't want to see any patches which makes them fail to be backwards compatible. Like it or not I will not accept any kernel patch which causes a new kernel to break SELinux usability with FC2 userspace. read that again. -Eric