lkml.org 
[lkml]   [2009]   [Jan]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subjectaudit: EXECVE record - removed bogus newline
    EXECVE records contain a newline after every argument. auditd converts
    "\n" to " " so you cannot see newlines even in raw logs, but they're
    there nevertheless. If you're not using auditd, you need to work round
    them. These '\n' chars are can be easily replaced by spaces when
    creating record in kernel. Note there is no need for trailing '\n' in
    an audit record.

    record before this patch:
    "type=EXECVE msg=audit(1231421801.566:31): argc=4 a0=\"./test\"\na1=\"a\"\na2=\"b\"\na3=\"c\"\n"

    record after this patch:
    "type=EXECVE msg=audit(1231421801.566:31): argc=4 a0=\"./test\" a1=\"a\" a2=\"b\" a3=\"c\""


    Signed-off-by: Jiri Pirko <jpirko@redhat.com>
    ---
    kernel/auditsc.c | 7 +++----
    1 files changed, 3 insertions(+), 4 deletions(-)

    diff --git a/kernel/auditsc.c b/kernel/auditsc.c
    index 8cbddff..c7012e0 100644
    --- a/kernel/auditsc.c
    +++ b/kernel/auditsc.c
    @@ -1109,7 +1109,7 @@ static int audit_log_single_execve_arg(struct audit_context *context,
    * so we can be sure nothing was lost.
    */
    if ((i == 0) && (too_long))
    - audit_log_format(*ab, "a%d_len=%zu ", arg_num,
    + audit_log_format(*ab, " a%d_len=%zu", arg_num,
    has_cntl ? 2*len : len);

    /*
    @@ -1129,7 +1129,7 @@ static int audit_log_single_execve_arg(struct audit_context *context,
    buf[to_send] = '\0';

    /* actually log it */
    - audit_log_format(*ab, "a%d", arg_num);
    + audit_log_format(*ab, " a%d", arg_num);
    if (too_long)
    audit_log_format(*ab, "[%d]", i);
    audit_log_format(*ab, "=");
    @@ -1137,7 +1137,6 @@ static int audit_log_single_execve_arg(struct audit_context *context,
    audit_log_n_hex(*ab, buf, to_send);
    else
    audit_log_format(*ab, "\"%s\"", buf);
    - audit_log_format(*ab, "\n");

    p += to_send;
    len_left -= to_send;
    @@ -1165,7 +1164,7 @@ static void audit_log_execve_info(struct audit_context *context,

    p = (const char __user *)axi->mm->arg_start;

    - audit_log_format(*ab, "argc=%d ", axi->argc);
    + audit_log_format(*ab, "argc=%d", axi->argc);

    /*
    * we need some kernel buffer to hold the userspace args. Just
    --
    1.5.6.5


    \
     
     \ /
      Last update: 2009-01-08 15:41    [W:2.364 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site