From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Paris Subject: Re: [PATCH] Fix acct quoting in audit_log_acct_message()) Date: Tue, 04 Mar 2008 17:21:05 -0500 Message-ID: <1204669265.3216.169.camel@localhost.localdomain> References: <47CCC6F0.1090005@redhat.com> <200803041638.03430.sgrubb@redhat.com> <1204667720.3216.161.camel@localhost.localdomain> <200803041714.05542.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200803041714.05542.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tue, 2008-03-04 at 17:14 -0500, Steve Grubb wrote: > On Tuesday 04 March 2008 16:55:20 Eric Paris wrote: > > but we both agree auparse doesn't get them all (for better or worse) and > > 2.6.24 only adds new stuff, it doesn't remove? > > Right. > > > > > Of these, A0-4 is probably from the execve patch. I have no idea what the > > > status of this patch is and if its upstream. I've not seen the records so > > > this would be something very new. > > > > execve could always turn A0-infinity into hex. > > That's with a capital A0? Lower case a0 is numeric data in the syscalls and > might be a name collision. hmm, no execve uses lowercase a0-inifinity. I'll look for capitalization. But it doesn't appear to be the new execve at first glance. > > > msg, name collision it has to change wherever it is in the kernel > > > > not sure what this means... I only see msg used in one place, but it is > > a great example of non-standardization which should be cleaned up.... > > > > if (msg_type != AUDIT_USER_TTY) > > audit_log_format(ab, " msg='%.1024s'", > > (char *)data); > > else { > > int size; > > > > audit_log_format(ab, " msg="); > > size = nlmsg_len(nlh); > > audit_log_n_untrustedstring(ab, size, > > data); > > } > > huh? That is new and doesn't seem right. > > > > The top case will surround these with '' which the bottom will surround > > with "" > > Yes, that has got to change. msg=has only one use and its the way it used to > be. /me is pleased he didn't start really looking at audit until after audit tty since that appears to be 2 of the problems left on the list :) > > > > > new, old, these sound like bugs. They need to get fixed in the kernel > > > > new and old are from audit config changes. > > We probably need a '-' added or a couple words rearranged. I need to hunt > those down to see which way they should go. > > > > Am i really expected to trust what came down the netlink socket from > > userspace was sane? > > That's not the issue to me, new and old are simply non-descriptive. New and > old what? AUDIT_MAKE_EQUIV, new names are probably a good idea....