From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: [PATCH] Fix acct quoting in audit_log_acct_message()) Date: Tue, 4 Mar 2008 18:00:26 -0500 Message-ID: <200803041800.27223.sgrubb@redhat.com> References: <47CCC6F0.1090005@redhat.com> <200803041714.05542.sgrubb@redhat.com> <1204669265.3216.169.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <1204669265.3216.169.camel@localhost.localdomain> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Eric Paris Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday 04 March 2008 17:21:05 Eric Paris wrote: > > > > Of these, A0-4 is probably from the execve patch. I have no idea = what > > > > the status of this patch is and if its upstream. I've not seen th= e > > > > records so this would be something very new. > > > > > > execve could always turn A0-infinity into hex. > > > > That's with a capital A0? Lower case a0 is numeric data in the syscal= ls > > and might be a name collision. > > hmm, no execve uses lowercase a0-inifinity. =C2=A0I'll look for > capitalization. =C2=A0But it doesn't appear to be the new execve at fir= st > glance. This would be an interesting problem. If you move those to capital A0-inf= inity=20 it avoids a definite name collision with syscall fields. I think under th= e=20 hood the library is case sensitive, but the search fields are case=20 insensitive. So, I think it would get the interpretation right. I don't t= hink=20 anything is looking at these records right now, so I think we can make th= e=20 change without much worry. Any other opinions? -Steve