Re: [PATCH] Fix acct quoting in audit_log_acct_message())

[Steve Grubb <sgrubb@redhat.com>]

On Tuesday 04 March 2008 16:55:20 Eric Paris wrote:
> but we both agree auparse doesn't get them all (for better or worse) and
> 2.6.24 only adds new stuff, it doesn't remove?

Right.


> > Of these, A0-4 is probably from the execve patch. I have no idea what the
> > status of this patch is and if its upstream. I've not seen the records so
> > this would be something very new.
>
> execve could always turn A0-infinity into hex. 

That's with a capital A0? Lower case a0 is numeric data in the syscalls and 
might be a name collision.


> > data, I need to go hunt this down. I don't like the name so it will
> > probably need to change in the kernel
>
> maybe audit tty stuff?  I don't see it in auditsc.c or audit.c (just a
> guess)

Could be. Whatever it is, its new and need integration. The name data sounds 
too generic though. Its got to be something more meaningful than data.


> > msg, name collision it has to change wherever it is in the kernel
>
> not sure what this means...  I only see msg used in one place, but it is
> a great example of non-standardization which should be cleaned up....
>
>                         if (msg_type != AUDIT_USER_TTY)
>                                 audit_log_format(ab, " msg='%.1024s'",
>                                                  (char *)data);
>                         else {
>                                 int size;
>
>                                 audit_log_format(ab, " msg=");
>                                 size = nlmsg_len(nlh);
>                                 audit_log_n_untrustedstring(ab, size,
>                                                             data);
>                         }

huh? That is new and doesn't seem right.


> The top case will surround these with '' which the bottom will surround
> with ""

Yes, that has got to change. msg=has only one use and its the way it used to 
be.


> > new, old, these sound like bugs. They need to get fixed in the kernel
>
> new and old are from audit config changes.

We probably need a '-' added or a couple words rearranged. I need to hunt 
those down to see which way they should go.


> Am i really expected to trust what came down the netlink socket from
> userspace was sane? 

That's not the issue to me, new and old are simply non-descriptive. New and 
old what? 


> > file & watch are probably legacy from RHEL4 I think. It can probably be
> > deleted.
>
> dont see them in my kernels

That's what I thought.

Thanks,
-Steve