Re: [PATCH] Fix acct quoting in audit_log_acct_message())

Steve Grubb
2008-03-04T18:57:11Z

On Tuesday 04 March 2008 13:10:48 Tomas Mraz wrote:
> This proposal is just for starting the discussion.

You need to ask the SE Linux folks if they would like to see their event
layout change. If there's no agreement with them, should we change anything?
auparse is working pretty good as is.

This is basically the parsing rules: The header was defined a long time ago,
It parses in its own way, once we hit msg=, everything is name=value. We do
this by repeatedly calling strtok. If the newly split string does not have a
= in it, we throw it away. We trim any trailing punctuation. I'll attach the
parser code at the end of this email just so you see its actually real
simple. I wouldn't mind dropping some of the punctuation since that would
save disk space.

What is missing perhaps is a schema file that tells the field name, its
format, and maybe its meaning. Not sure meaning is really needed. If we had a
schema file, then you could change things pretty easy and still parse it. But
that flexibility might cost performance.

The biggest question to me is how you handle any transition from one format to
another. It will take time for patches to get upstream and then back
downstream. Meanwhile we could have audit logs being aggregated from a couple
different releases. They all need to parse correctly. How do we handle that?
I suspect the answer is to make the audit parser handle old and new formats
which adds a whole lot of code and makes it more complicated.

-Steve

buf = strdup(r->record);
ptr = strtok_r(buf, " ", &saved);
if (ptr == NULL)
return -1;

do { // If there's an '=' sign, its a keeper
nvnode n;
char *val = strchr(ptr, '=');
if (val) {
int len;

// If name is 'msg=audit' throw it away
if (*ptr == 'm' && strncmp(ptr, "msg=", 4) == 0) {
if (ptr[4] == 'a')
continue;

// If name is 'msg='' chop off and see
// if there is still a = in the string.
else if (ptr[4] == '\'') {
ptr += 5;
val = strchr(ptr, '=');
if (val == NULL)
continue;
}
}

// Split the string
*val = 0;
val++;

// Remove beginning cruft of name
if (*ptr == '(')
ptr++;
n.name = strdup(ptr);
n.val = strdup(val);
// Remove trailing punctuation
len = strlen(n.val);
if (len && n.val[len-1] == ':') {
n.val[len-1] = 0;
len--;
}
if (len && n.val[len-1] == ',') {
n.val[len-1] = 0;
len--;
}
if (len && n.val[len-1] == '\'') {
n.val[len-1] = 0;
len--;
}
if (len && n.val[len-1] == ')') {
if (strcmp(n.val, "(none)") &&
strcmp(n.val, "(null)")) {
n.val[len-1] = 0;
len--;
}
}
nvlist_append(&r->nv, &n);