From mboxrd@z Thu Jan 1 00:00:00 1970 From: John Dennis Subject: Re: difficulty with TYPE Date: Tue, 15 Jan 2008 09:41:38 -0500 Message-ID: <478CC622.6070703@redhat.com> References: <18436f8f0801142314g46f77485x311cfb2826f2dff4@mail.gmail.com> <1200404039.30787.4.camel@code.and.org> <478CBBFC.8090303@redhat.com> <1200406831.30787.8.camel@code.and.org> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1200406831.30787.8.camel@code.and.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: James Antill Cc: linux-audit@redhat.com, Abhishek Gupta List-Id: linux-audit@redhat.com James Antill wrote: > On Tue, 2008-01-15 at 08:58 -0500, John Dennis wrote: >> James Antill wrote: >>> The second iovec above can't just be MAX_AUDIT_MESSAGE_LENGTH, or if >>> there are two messages you'll read some/all of the next one(s). You >>> either need to read the header first and then use hdr.size, or separate >>> the IO from the parsing. >>> Also you can't just check for readv() as above, you need to check that >>> you've read the amount of data you want, and if you didn't get it all >>> yet then loop. >> This is why we provide libraries to do things like this, it can be >> tricky to get right. The feed() interface to auparse consumes arbitrary > > auparse_feed() works off log files and the audispd "string" format. The > above code was using the auditd -> audispd format, so that API doesn't > work. Then it needs to be fixed to also work with the old binary protocol. But on the other hand, the binary protocol is deprecated and won't be used with the new audispd so perhaps it's moot. FWIW, setroubleshoot supports automatic detection of the audispd protocol and utilizes a feed interface so if backwards compatibility is important for auparse we already have a proof of concept implementation of how to do this. -- John Dennis