public inbox for linux-audit@redhat.com
 help / color / mirror / Atom feed
From: Steve Grubb <sgrubb@redhat.com>
To: Marcelo Cerri <mhcerri@linux.vnet.ibm.com>
Cc: linux-audit@redhat.com, gcwilson@us.ibm.com, bryntcor@us.ibm.com
Subject: Re: [PATCH 2/2] auvirt: Remove workaround for VM name searching
Date: Thu, 9 Feb 2012 08:35:06 -0500	[thread overview]
Message-ID: <201202090835.07008.sgrubb@redhat.com> (raw)
In-Reply-To: <4F33C89A.1030901@linux.vnet.ibm.com>

On Thursday, February 09, 2012 08:22:34 AM Marcelo Cerri wrote:
> Thanks for your explanation. I hadn't notice how escaped fields work.
> 
> Regarding the search algorithm fix, sorry but it is not clear to me 
> where you meant to say to add the type check and the escape. Did you 
> mean inside the ausearch_add_item or in the function which is calling 
> the ausearch_add_item function?

I think its best to put it inside the function so that app writers do not have 
to think about it. They just pass a string and its fixed up. I was also thinking 
about the alternative, which is to decode the fields during search and then 
compare. But this would be slower because we decode every field value whether it 
matches or not. So, we can just encode the item being searched for and then 
compare raw values. I suppose the man page should clarify this for app writers 
just in case.
 
> I'll submit a patch to libvirt instead and then update auvirt.

I wished I caught that sooner, too. As for auvirt, since you know vm is an 
escaped field, you don't actually need to put the "if" statement to check its 
type. You can just call the interpret function unconditionally and use its 
output.

Thanks,
-Steve

  reply	other threads:[~2012-02-09 13:35 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-02-08 17:04 [PATCH 1/2] auparse: Remove quotes from parsed fields Marcelo Cerri
2012-02-08 17:04 ` [PATCH 2/2] auvirt: Remove workaround for VM name searching Marcelo Cerri
2012-02-08 19:06   ` Steve Grubb
2012-02-09 13:22     ` Marcelo Cerri
2012-02-09 13:35       ` Steve Grubb [this message]
2012-02-09 17:51         ` Marcelo Cerri
2012-02-09 18:04           ` Steve Grubb
2012-02-08 18:54 ` [PATCH 1/2] auparse: Remove quotes from parsed fields Steve Grubb

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=201202090835.07008.sgrubb@redhat.com \
    --to=sgrubb@redhat.com \
    --cc=bryntcor@us.ibm.com \
    --cc=gcwilson@us.ibm.com \
    --cc=linux-audit@redhat.com \
    --cc=mhcerri@linux.vnet.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox