difficulty with TYPE

[James Antill]

On Tue, 2008-01-15 at 12:44 +0530, Abhishek Gupta wrote:
> i tried to run auditdispatcher from
> http://people.redhat.com/sgrubb/audit/audit-rt-events.txt with little
> modification.
> i converted TYPE numeric value to name using audit library function
> "audit_msg_type_to_name". 
> Then i printed audit TYPE number with corresponding name using above
> function.
> The program is running fine but i have little doubt.
[...]
>         /* Get header first. it is fixed size */
>         vec[0].iov_base = (void*)&hdr;
>         vec[0].iov_len = sizeof(hdr);
> 
>             // Next payload 
>         vec[1].iov_base = data;
>         vec[1].iov_len = MAX_AUDIT_MESSAGE_LENGTH;
> 
>         rc = readv(pipe_fd, vec, 2);
>         if (rc == 0 || rc == -1) {

 The second iovec above can't just be MAX_AUDIT_MESSAGE_LENGTH, or if
there are two messages you'll read some/all of the next one(s). You
either need to read the header first and then use hdr.size, or separate
the IO from the parsing.
 Also you can't just check for readv() as above, you need to check that
you've read the amount of data you want, and if you didn't get it all
yet then loop. 

-- 
James Antill <james.antill at redhat.com>
Red Hat
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20080115/71a8f4ec/attachment.sig>