[PATCH] Fix acct quoting in audit_log_acct_message())
John Dennis
jdennis at redhat.com
Tue Mar 4 20:41:58 UTC 2008
Eric Paris wrote:
> But I admit, the parser would have to know that key is a string to
> change it back.
Adding two bytes to each string field (beginning and ending delimiters)
is too big a burden? Instead we have to rely on difficult to manage
tables to tell the parser it's a string? The 2 byte penalty might have
had weight in 1970, but not in 2007.
If we're really arguing over how many bytes a record consumes then we
should switch to a binary protocol instead of text. Oh and by the way,
in a binary protocol you would likely prefix string data with a length
field, so you're going to end up using a couple of bytes anyway.
--
John Dennis <jdennis at redhat.com>
More information about the Linux-audit
mailing list