From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Paris Subject: Re: [PATCH] Fix acct quoting in audit_log_acct_message()) Date: Tue, 04 Mar 2008 14:15:29 -0500 Message-ID: <1204658129.3216.118.camel@localhost.localdomain> References: <47CCC6F0.1090005@redhat.com> <47CD65A3.8020204@redhat.com> <1204654248.12783.32.camel@vespa.frost.loc> <200803041356.19571.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200803041356.19571.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tue, 2008-03-04 at 13:56 -0500, Steve Grubb wrote: > On Tuesday 04 March 2008 13:10:48 Tomas Mraz wrote: > > This proposal is just for starting the discussion. > What is missing perhaps is a schema file that tells the field name, its > format, and maybe its meaning. Not sure meaning is really needed. If we had a > schema file, then you could change things pretty easy and still parse it. But > that flexibility might cost performance. Now this I really like. I'd much rather have the parsing library know that key= is always followed by a string and thus there would be 2 ways to send key=(null) key="(null)" key=286e756c6c29 Either a real string with " to start and stop or list of hex bytes which would be easily converted back to a string. The given propsal would have leave quotes key="((((((((" you way key="%28%28%28%28%28%28%28%28" my alt way key=2828282828282828 so, my choices are leave quotes x1.0 your way x2.6 my alt way x1.6 But I admit, the parser would have to know that key is a string to change it back. -Eric