Re: [PATCH] Fix acct quoting in audit_log_acct_message())

[Eric Paris <eparis@redhat.com>]

On Tue, 2008-03-04 at 17:14 -0500, Steve Grubb wrote:
> On Tuesday 04 March 2008 16:55:20 Eric Paris wrote:
> > but we both agree auparse doesn't get them all (for better or worse) and
> > 2.6.24 only adds new stuff, it doesn't remove?
> 
> Right.
> 
> 
> > > Of these, A0-4 is probably from the execve patch. I have no idea what the
> > > status of this patch is and if its upstream. I've not seen the records so
> > > this would be something very new.
> >
> > execve could always turn A0-infinity into hex. 
> 
> That's with a capital A0? Lower case a0 is numeric data in the syscalls and 
> might be a name collision.

hmm, no execve uses lowercase a0-inifinity.  I'll look for
capitalization.  But it doesn't appear to be the new execve at first
glance.


> > > msg, name collision it has to change wherever it is in the kernel
> >
> > not sure what this means...  I only see msg used in one place, but it is
> > a great example of non-standardization which should be cleaned up....
> >
> >                         if (msg_type != AUDIT_USER_TTY)
> >                                 audit_log_format(ab, " msg='%.1024s'",
> >                                                  (char *)data);
> >                         else {
> >                                 int size;
> >
> >                                 audit_log_format(ab, " msg=");
> >                                 size = nlmsg_len(nlh);
> >                                 audit_log_n_untrustedstring(ab, size,
> >                                                             data);
> >                         }
> 
> huh? That is new and doesn't seem right.
> 
> 
> > The top case will surround these with '' which the bottom will surround
> > with ""
> 
> Yes, that has got to change. msg=has only one use and its the way it used to 
> be.

/me is pleased he didn't start really looking at audit until after audit
tty since that appears to be 2 of the problems left on the list  :)

> 
> 
> > > new, old, these sound like bugs. They need to get fixed in the kernel
> >
> > new and old are from audit config changes.
> 
> We probably need a '-' added or a couple words rearranged. I need to hunt 
> those down to see which way they should go.
> 
> 
> > Am i really expected to trust what came down the netlink socket from
> > userspace was sane? 
> 
> That's not the issue to me, new and old are simply non-descriptive. New and 
> old what?

AUDIT_MAKE_EQUIV, new names are probably a good idea....