Audit Parsing Library Requirements

[schaufler-ca.com - Casey Schaufler]

"Steve Grubb" <sgrubb at redhat.com> wrote:


> The name will be 7-bit ASCII, however, I cannot
> guarantee what the value will be. It comes from
> the kernel. If someone in another country uses
> their native language to name files and it shows
> up in the audit record, what should we do? This
> subject has come up before and I believe we
> have to make an effort to support them. I don't
> believe CC requires this, our user's do.

Some UNIX audit systems provide mechanism
for (potentially) binary audit data that uses the
hex of the data. Not used when the data is known
to be well behaved text, of course.

     name=0x001122BEEF

ugly as it might be, it's character set
independent and always safe.


------------------------
Casey Schaufler
casey at schaufler-ca.com
650.906.1780