lkml.org 
[lkml]   [2019]   [Nov]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 207/306] audit: print empty EXECVE args
    Date
    From: Richard Guy Briggs <rgb@redhat.com>

    [ Upstream commit ea956d8be91edc702a98b7fe1f9463e7ca8c42ab ]

    Empty executable arguments were being skipped when printing out the list
    of arguments in an EXECVE record, making it appear they were somehow
    lost. Include empty arguments as an itemized empty string.

    Reproducer:
    autrace /bin/ls "" "/etc"
    ausearch --start recent -m execve -i | grep EXECVE
    type=EXECVE msg=audit(10/03/2018 13:04:03.208:1391) : argc=3 a0=/bin/ls a2=/etc

    With fix:
    type=EXECVE msg=audit(10/03/2018 21:51:38.290:194) : argc=3 a0=/bin/ls a1= a2=/etc
    type=EXECVE msg=audit(1538617898.290:194): argc=3 a0="/bin/ls" a1="" a2="/etc"

    Passes audit-testsuite. GH issue tracker at
    https://github.com/linux-audit/audit-kernel/issues/99

    Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
    [PM: cleaned up the commit metadata]
    Signed-off-by: Paul Moore <paul@paul-moore.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    kernel/auditsc.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/kernel/auditsc.c b/kernel/auditsc.c
    index b2d1f043f17fb..1513873e23bd1 100644
    --- a/kernel/auditsc.c
    +++ b/kernel/auditsc.c
    @@ -1107,7 +1107,7 @@ static void audit_log_execve_info(struct audit_context *context,
    }

    /* write as much as we can to the audit log */
    - if (len_buf > 0) {
    + if (len_buf >= 0) {
    /* NOTE: some magic numbers here - basically if we
    * can't fit a reasonable amount of data into the
    * existing audit buffer, flush it and start with
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-11-27 22:04    [W:4.157 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site