From mboxrd@z Thu Jan 1 00:00:00 1970 From: wangf Subject: Re: There is a bug on parsing file path in auditd-config.c and audispd-pconfig.c Date: Thu, 24 Jul 2008 12:12:51 +0800 Message-ID: <48880143.105@cn.fujitsu.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: sgrubb@redhat.com Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Hi Steve, What do think about this patch? When user defines path's dirname's length < 4bit in=20 /etc/audit/auditd.conf or in plugin configure file,this error always=20 happens. If you have other opinion, please tell me, thank you. -----Original Message----- From: wangf Sent: 2008-7-1 14:43 > Hi Steve, > > There is a bug in function dispatch_parser() and path_parser(). > > when we use dir =3D dirname (tdir), if tdir is not NULL, tdir and dir=20 > point to the same addr., so if we use free(tdir) before=20 > audit_msg(LOG_ERR, "The directory name: %s is too short - line %d",=20 > dir, line); we can not get the dir's correct value. Because dir's space has been freed, so the space can be used by others. when we get dir's value, it will be wrong. Please look the two examples: 1) define "dispatcher =3D /my/audispd" in /etc/audit/auditd.conf This error message will be printed into syslog such as: "Jul 11 10:39:04 localhost auditd: The directory name: /etc/localtime is=20 too short - line 12" but in fact it should be such error message: "Jul 11 10:39:04 localhost auditd: The directory name: /my is too short=20 - line 12" 2) The same problem in plugin configure file: define "path =3D /my/myplugin" in /etc/audisp/plugins.d/user.conf This error message will be printed into syslog such as: "Jul 11 10:38:39 localhost audispd: The directory name: 8=C3=B3=C3=B4=C2=B7= ^C is too=20 short - line 3" but in fact it should be such error message: "Jul 11 10:38:39 localhost audispd: The directory name: /my is too short=20 - line 3" > > This patch can solve this problem. > > Signed-off-by: Wang Fang > --- > diff -Nrup audit-1.7.4/audisp/audispd-pconfig.c=20 > audit-1.7.4-new/audisp/audispd-pconfig.c > --- audit-1.7.4/audisp/audispd-pconfig.c 2007-09-02=20 > 23:24:15.000000000 +0800 > +++ audit-1.7.4-new/audisp/audispd-pconfig.c 2008-06-21=20 > 18:33:14.000000000 +0800 > @@ -379,10 +379,10 @@ static int path_parser(struct nv_pair *n > if (tdir) > dir =3D dirname(tdir); > if (dir =3D=3D NULL || strlen(dir) < 4) { // '/var' is shortest di= rname > - free(tdir); > audit_msg(LOG_ERR, > "The directory name: %s is too short - line %d", > dir, line); > + free(tdir); > return 1; > } > > diff -Nrup audit-1.7.4/src/auditd-config.c=20 > audit-1.7.4-new/src/auditd-config.c > --- audit-1.7.4/src/auditd-config.c 2008-05-09 22:44:38.000000000=20 > +0800 > +++ audit-1.7.4-new/src/auditd-config.c 2008-06-21=20 > 18:39:58.000000000 +0800 > @@ -592,10 +592,10 @@ static int dispatch_parser(struct nv_pai > if (tdir) > dir =3D dirname(tdir); > if (dir =3D=3D NULL || strlen(dir) < 4) { // '/var' is shortest di= rname > - free(tdir); > audit_msg(LOG_ERR, > "The directory name: %s is too short - line %d", > dir, line); > + free(tdir); > return 1; > } > > --=20 > Best Regards, > Wang Fang > > > > --=20 > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit > >