saddr value in connect()

[lists_todd@mac.com]

I have a question about the SOCKADDR token in a SYSCALL record (syscall 42 -- connect())

Most of my records begin with one of the two values:
	saddr=0200
	saddr=0100

Followed by the port & IPv4 address or the file path.

QUESTION 1: The file path appears to be NULL terminated. Is this correct?

QUESTION 2: There is often additional characters after the 00 termination (and IP address). Is this just garbage that should be ignored?

QUESTION 3: Sometimes the first byte in a file path is 00 termination (e.g., saddr=0100002F…). Does this mean the string is empty and the content following it is garbage? Or is there a bug that accidentally prepends the 00 to the front of the saddr sequence?

Here is an example:

————————
type=SYSCALL msg=audit(1397089029.264:7407): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7fff3a7fdf70 a2=16 a3=7fff3a7fdd20 items=0 ppid=805 pid=1064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="initctl" exe="/sbin/initctl" key=(null)

type=SOCKADDR msg=audit(1397089029.264:7407): saddr=0100002F636F6D2F7562756E74752F75707374617274
————————

If I assume the first 00 is a bug, the string decodes to

	/com/ubuntu/upstart

Thanks,

Todd

PS. uname -r gives 3.13.0-24-generic (though, I think I collected these logs before the last software update)