get_field_str() and interpret_field() bug with multi-word fields

[Stephen Smalley]

On Wed, 2008-08-13 at 13:25 -0300, Klaus Heinrich Kiwi wrote:
> On Wed, 2008-08-13 at 11:09 -0400, Eric Paris wrote:
> > HAHAHA, kernel output xml?  dream on   :)   I'm willing to do
> > wholesale
> > output changes, but something that heavy in kernel is impossible to
> > push.  I can just see Al cussing up a storm as he read that.
> 
> That's exactly my point. There's no sense in discussing a 'ideal' format
> for audit stream coming out of the kernel, since it's well agreed
> (thankfully) that the kernel part should be as minimal as possible.
> 
> I like Mathew's idea of having a binary format though. Maybe it's
> possible to carry the legacy format for some time while we have a more
> robust (and extensible) binary format in parallel? And then having a
> binary format version tag within each record?
> 
> I know I know, at the time I have more questions than answers. I only
> wanted to express my feeling that there is indeed a problem with the
> current format.
> 
> I know you and Steve tried before to talk with the SELinux guys trying
> to have a saner format for AVCs and stuff. Do you feel that's an
> impossible barrier to cross or maybe we try again and convince them that
> stricter formatting rules will bring more users for their audit data?

If you want to ask the "SELinux guys", ask on the selinux at tycho.nsa.gov
list.  But in this case:  we've always been willing to take changes to
the AVC audit format; we have merely pointed out that it has to be done
in a way that provides full backward compatibility both in kernel and in
the userland, as we are not allowed to break existing userland with new
kernel and we'd like new userland to still work on old kernels.  Patches
that meet those standards accepted.

-- 
Stephen Smalley
National Security Agency