[PATCH] Fix acct quoting in audit_log_acct_message())
Steve Grubb
sgrubb at redhat.com
Tue Mar 4 23:00:26 UTC 2008
On Tuesday 04 March 2008 17:21:05 Eric Paris wrote:
> > > > Of these, A0-4 is probably from the execve patch. I have no idea what
> > > > the status of this patch is and if its upstream. I've not seen the
> > > > records so this would be something very new.
> > >
> > > execve could always turn A0-infinity into hex.
> >
> > That's with a capital A0? Lower case a0 is numeric data in the syscalls
> > and might be a name collision.
>
> hmm, no execve uses lowercase a0-inifinity. I'll look for
> capitalization. But it doesn't appear to be the new execve at first
> glance.
This would be an interesting problem. If you move those to capital A0-infinity
it avoids a definite name collision with syscall fields. I think under the
hood the library is case sensitive, but the search fields are case
insensitive. So, I think it would get the interpretation right. I don't think
anything is looking at these records right now, so I think we can make the
change without much worry.
Any other opinions?
-Steve
More information about the Linux-audit
mailing list