get_field_str() and interpret_field() bug with multi-word fields

[Steve Grubb]

On Tuesday 12 August 2008 16:57:59 John Dennis wrote:
> Let me give you a simple example, suppose this key/value pair was in an
> audit record:
>
> foo=00
>
> How does one know which of the possible values foo has:
>
> 1) it's the integer zero (but in what radix? does the leading zero imply
> octal or is it just an insignificant digit?)
>
> 2) it's the hexadecimal encoding of a single character string containing
> one null byte.
>
> 3) it's the 2 character string "00" consisting of two zero characters.
>
> The fact is it's ambiguous, it could be any of the above. It's ambiguous
> because the audit stream is an improperly specified protocol.

John, this is the way that the kernel works. The kernel and user space 
utilities that interface to it are developed together with an understanding 
of how the numbers are represented. Go take a look in /proc/1/stat. What does 
any of that mean? Is it parsable? I'll guarantee its defined well enough 
program can use it.

The point is that all of /proc is written without implicit parsing rules. 
That's the way it is when dealing with kernel and its user space utilities. 
There is no field in the kernel that is unhandled by the audit system and 
without knowing specifically what's in it.

-Steve