From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: [PATCH] Fix acct quoting in audit_log_acct_message()) Date: Tue, 4 Mar 2008 13:56:19 -0500 Message-ID: <200803041356.19571.sgrubb@redhat.com> References: <47CCC6F0.1090005@redhat.com> <47CD65A3.8020204@redhat.com> <1204654248.12783.32.camel@vespa.frost.loc> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: Received: from vpn-15-61.rdu.redhat.com (vpn-15-61.rdu.redhat.com [10.11.15.61]) by mail.boston.redhat.com (8.13.1/8.13.1) with ESMTP id m24IvAle027282 for ; Tue, 4 Mar 2008 13:57:11 -0500 In-Reply-To: <1204654248.12783.32.camel@vespa.frost.loc> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday 04 March 2008 13:10:48 Tomas Mraz wrote: > This proposal is just for starting the discussion. You need to ask the SE Linux folks if they would like to see their event layout change. If there's no agreement with them, should we change anything? auparse is working pretty good as is. This is basically the parsing rules: The header was defined a long time ago, It parses in its own way, once we hit msg=, everything is name=value. We do this by repeatedly calling strtok. If the newly split string does not have a = in it, we throw it away. We trim any trailing punctuation. I'll attach the parser code at the end of this email just so you see its actually real simple. I wouldn't mind dropping some of the punctuation since that would save disk space. What is missing perhaps is a schema file that tells the field name, its format, and maybe its meaning. Not sure meaning is really needed. If we had a schema file, then you could change things pretty easy and still parse it. But that flexibility might cost performance. The biggest question to me is how you handle any transition from one format to another. It will take time for patches to get upstream and then back downstream. Meanwhile we could have audit logs being aggregated from a couple different releases. They all need to parse correctly. How do we handle that? I suspect the answer is to make the audit parser handle old and new formats which adds a whole lot of code and makes it more complicated. -Steve buf = strdup(r->record); ptr = strtok_r(buf, " ", &saved); if (ptr == NULL) return -1; do { // If there's an '=' sign, its a keeper nvnode n; char *val = strchr(ptr, '='); if (val) { int len; // If name is 'msg=audit' throw it away if (*ptr == 'm' && strncmp(ptr, "msg=", 4) == 0) { if (ptr[4] == 'a') continue; // If name is 'msg='' chop off and see // if there is still a = in the string. else if (ptr[4] == '\'') { ptr += 5; val = strchr(ptr, '='); if (val == NULL) continue; } } // Split the string *val = 0; val++; // Remove beginning cruft of name if (*ptr == '(') ptr++; n.name = strdup(ptr); n.val = strdup(val); // Remove trailing punctuation len = strlen(n.val); if (len && n.val[len-1] == ':') { n.val[len-1] = 0; len--; } if (len && n.val[len-1] == ',') { n.val[len-1] = 0; len--; } if (len && n.val[len-1] == '\'') { n.val[len-1] = 0; len--; } if (len && n.val[len-1] == ')') { if (strcmp(n.val, "(none)") && strcmp(n.val, "(null)")) { n.val[len-1] = 0; len--; } } nvlist_append(&r->nv, &n);