From mboxrd@z Thu Jan 1 00:00:00 1970 From: John Dennis Subject: Re: get_field_str() and interpret_field() bug with multi-word fields Date: Tue, 12 Aug 2008 17:09:18 -0400 Message-ID: <48A1FBFE.1000208@redhat.com> References: <0E43BF2D7491F0468B56B1A5C493866B020DD0F1@SAT4MX07.RACKSPACE.CORP> <48A1EB72.6070607@redhat.com> <1218571902.3540.2.camel@localhost.localdomain> <200808121632.55341.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2015853480==" Return-path: In-Reply-To: <200808121632.55341.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: William Kelly , linux-audit@redhat.com, Bret Piatt List-Id: linux-audit@redhat.com This is a multi-part message in MIME format. --===============2015853480== Content-Type: multipart/alternative; boundary="------------080507010607090304090600" This is a multi-part message in MIME format. --------------080507010607090304090600 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Steve Grubb wrote: > On Tuesday 12 August 2008 16:11:42 Eric Paris wrote: > >> As soon as you grasp that article send me the code and we'll work >> together to fix this problem! >> > > And any code created needs to be backwards compatible. you could have new user > space/new kernel, or new user space/old kernel, and new kernel/old user > space. The fact you can have any combination of kernel, user code, and historical log files is precisely why this need to be fixed ASAP. Why? Because there is no value in being backwards compatible with a data stream you can't read when any of the three components (kernel, user libraries, files) are permuted. The longer we archive log data with this problem the worse the problem gets. The fact the triplet have to be in sync is untenable in the long run. > You have no way of dictating which versions of anything people will > use. > > Thank you for making my point :-) > -Steve > -- John Dennis --------------080507010607090304090600 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit Steve Grubb wrote: 
On Tuesday 12 August 2008 16:11:42 Eric Paris wrote:
  
As soon as you grasp that article send me the code and we'll work
together to fix this problem!
    

And any code created needs to be backwards compatible. you could have new user 
space/new kernel, or new user space/old kernel, and new kernel/old user 
space.
The fact you can have any combination of kernel, user code, and historical log files is precisely why this need to be fixed ASAP. Why? Because there is no value in being backwards compatible with a data stream you can't read when any of the three components (kernel, user libraries, files) are permuted.

The longer we archive log data with this problem the worse the problem gets. The fact the triplet <kernel, user libraries, file> have to be in sync is untenable in the long run.

You have no way of dictating which versions of anything people will 
use.
Thank you for making my point :-)
-Steve
  

-- 
John Dennis <jdennis@redhat.com>
--------------080507010607090304090600-- --===============2015853480== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============2015853480==--