<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Steve Grubb wrote:
<blockquote cite="mid:200809111508.13658.sgrubb@redhat.com" type="cite">
<pre wrap="">On Thursday 11 September 2008 14:10:12 Miloslav Trmač wrote:
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">As a side note I'm concerned there may be places in the user audit
code which treat string data as null terminated (at least that is my
recollection).
</pre>
</blockquote>
<pre wrap="">Yes, auditd adds a NUL terminator to the audit record, and then treats
it as a regular NUL-terminated string; if the audit record contains an
embedded NUL byte, the rest of the record is discarded by auditd.
</pre>
</blockquote>
<pre wrap=""><!---->
In every case where this occurs (kernel or user space), the field values are
expected to be encoded to prevent it from being discarded.
</pre>
</blockquote>
<br>
This is true. The proposed patch defeats the encoding of the entire
data block and thus fails the criteria Steve correctly states is a
requirement.<br>
<br>
The concern I have in the user level audit code is not with handling
the encoded string values which is fine, but rather with the handling
the decoded string block.<br>
<pre class="moz-signature" cols="72">--
John Dennis <a class="moz-txt-link-rfc2396E" href="mailto:jdennis@redhat.com"><jdennis@redhat.com></a>
</pre>
</body>
</html>