Kernel handling of path length

[David Woodhouse]

On Wed, 2005-07-06 at 10:14 -0500, Loulwa Salem wrote:
> inserting watch on path with strlen()=4095 comes back with error from
> kernel
> Starting auditd:                                           [  OK  ]
> Error sending watch insert request (File name too long)

The problem here seems to be that auditctl is giving the length of the
string _including_ an extra zero character at the end. 

The kernel doesn't go checking for zero bytes in the string it's passed
-- it just checks the length, which in your case is actually 4096. And
that would make a string of length 4097 including the NUL termination
which the kernel is going to add, so the kernel returns -ENAMETOOLONG.

Try something like this...

--- src/auditctl.c.orig	2005-07-07 13:13:16.000000000 +0100
+++ src/auditctl.c	2005-07-07 13:14:04.000000000 +0100
@@ -212,7 +212,7 @@ static int audit_setup_watch_name(struct
 			fprintf(stderr, "Out of memory\n");
 			return -1;
 		}
-		req->namelen = strlen(req->name) + 1;
+		req->namelen = strlen(req->name) ;
 		*act = 1;
 		return 1;
 	}


-- 
dwmw2