[PATCH] Fix acct quoting in audit_log_acct_message())

John Dennis jdennis at redhat.com
Tue Mar 4 20:41:58 UTC 2008


Eric Paris wrote:
> But I admit, the parser would have to know that key is a string to
> change it back.

Adding two bytes to each string field (beginning and ending delimiters) 
is too big a burden? Instead we have to rely on difficult to manage 
tables to tell the parser it's a string? The 2 byte penalty might have 
had weight in 1970, but not in 2007.

If we're really arguing over how many bytes a record consumes then we 
should switch to a binary protocol instead of text. Oh and by the way, 
in a binary protocol you would likely prefix string data with a length 
field, so you're going to end up using a couple of bytes anyway.

-- 
John Dennis <jdennis at redhat.com>




More information about the Linux-audit mailing list