Re: get_field_str() and interpret_field() bug with multi-word fields

[Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>]

On Wed, 2008-08-13 at 11:09 -0400, Eric Paris wrote:
> HAHAHA, kernel output xml?  dream on   :)   I'm willing to do
> wholesale
> output changes, but something that heavy in kernel is impossible to
> push.  I can just see Al cussing up a storm as he read that.

That's exactly my point. There's no sense in discussing a 'ideal' format
for audit stream coming out of the kernel, since it's well agreed
(thankfully) that the kernel part should be as minimal as possible.

I like Mathew's idea of having a binary format though. Maybe it's
possible to carry the legacy format for some time while we have a more
robust (and extensible) binary format in parallel? And then having a
binary format version tag within each record?

I know I know, at the time I have more questions than answers. I only
wanted to express my feeling that there is indeed a problem with the
current format.

I know you and Steve tried before to talk with the SELinux guys trying
to have a saner format for AVCs and stuff. Do you feel that's an
impossible barrier to cross or maybe we try again and convince them that
stricter formatting rules will bring more users for their audit data?

 -Klaus
-- 
Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
Linux Security Development, IBM Linux Technology Center