From mboxrd@z Thu Jan  1 00:00:00 1970
From: Miloslav Trmac <mitr@redhat.com>
Subject: [PATCH] Fix acct quoting in audit_log_acct_message())
Date: Tue, 04 Mar 2008 04:50:08 +0100
Message-ID: <47CCC6F0.1090005@redhat.com>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="------------070308030600050906000203"
Return-path: <linux-audit-bounces@redhat.com>
Received: from [10.32.4.12] (vpn-4-12.str.redhat.com [10.32.4.12])
	by pobox.stuttgart.redhat.com (8.13.1/8.13.1) with ESMTP id
	m243oDZn004927
	for <linux-audit@redhat.com>; Mon, 3 Mar 2008 22:50:14 -0500
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

This is a multi-part message in MIME format.
--------------070308030600050906000203
Content-Type: text/plain; charset=ISO-8859-2; format=flowed
Content-Transfer-Encoding: 7bit

Hello,
audit_log_acct_message() is currently quoting acct differently from all 
other users: it adds quotes to acct if it is represented in hexadecimal, 
not when it is represented as-is.

The attached patch fixes it - but it also changes the format of some of 
the most-often used messages.  It might be better to leave the message 
format alone, and add a special case to libauparse and other 
applications that parse the logs - I have no idea.
	Mirek

--------------070308030600050906000203
Content-Type: text/x-patch;
 name="audit_log_acct_message-quotes.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="audit_log_acct_message-quotes.patch"

diff -up audit-1.6.7/lib/audit_logging.c.quotes audit-1.6.7/lib/audit_logging.c
--- audit-1.6.7/lib/audit_logging.c.quotes	2008-03-04 04:34:38.000000000 +0100
+++ audit-1.6.7/lib/audit_logging.c	2008-03-04 04:35:33.000000000 +0100
@@ -378,10 +378,10 @@ int audit_log_acct_message(int audit_fd,
 		}
 		if (enc)
 			format = 
-	 "op=%s acct=\"%s\" exe=%s (hostname=%s, addr=%s, terminal=%s res=%s)";
+	 "op=%s acct=%s exe=%s (hostname=%s, addr=%s, terminal=%s res=%s)";
 		else
 			format = 
-	     "op=%s acct=%s exe=%s (hostname=%s, addr=%s, terminal=%s res=%s)";
+	     "op=%s acct=\"%s\" exe=%s (hostname=%s, addr=%s, terminal=%s res=%s)";
 
 		snprintf(buf, sizeof(buf), format,
 			op, user, pgname,

--------------070308030600050906000203
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--------------070308030600050906000203--