From mboxrd@z Thu Jan  1 00:00:00 1970
From: John Dennis <jdennis@redhat.com>
Subject: Re: [PATCH] Fix acct quoting in audit_log_acct_message())
Date: Tue, 04 Mar 2008 10:07:15 -0500
Message-ID: <47CD65A3.8020204@redhat.com>
References: <47CCC6F0.1090005@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-2; format=flowed
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <47CCC6F0.1090005@redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Miloslav Trmac <mitr@redhat.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

Miloslav Trmac wrote:
> Hello,
> audit_log_acct_message() is currently quoting acct differently from all 
> other users: it adds quotes to acct if it is represented in hexadecimal, 
> not when it is represented as-is.

This isn't the only audit hexadecimal parsing issue, there are many 
more, see my previous posts. It is a sad fact audit output is impossible 
to parse correctly given only the output. Correct parsing of audit data 
demands private knowledge about the format of audit log messages on a 
per kernel version basis, this is very broken IMHO.
-- 
John Dennis <jdennis@redhat.com>