From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: [PATCH] Fix acct quoting in audit_log_acct_message()) Date: Tue, 4 Mar 2008 16:38:03 -0500 Message-ID: <200803041638.03430.sgrubb@redhat.com> References: <47CCC6F0.1090005@redhat.com> <1204663403.3216.126.camel@localhost.localdomain> <47CDBD3D.7030101@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <47CDBD3D.7030101@redhat.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: John Dennis Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday 04 March 2008 16:21:01 John Dennis wrote: > These are the encoded audit strings in kernel 2.6.24 (Fedora): Reorganized: Field 24 18 auparse a[0-9]+ X acct X cmd X comm X X X cwd X X X data X dir X X exe X X X file X key X X X msg X name X X X new X X old X X path X X X watch X Of these, A0-4 is probably from the execve patch. I have no idea what the status of this patch is and if its upstream. I've not seen the records so this would be something very new. acct & cmd is a userspace thing data, I need to go hunt this down. I don't like the name so it will probably need to change in the kernel msg, name collision it has to change wherever it is in the kernel new, old, these sound like bugs. They need to get fixed in the kernel file & watch are probably legacy from RHEL4 I think. It can probably be deleted. -Steve