[PATCH] Fix acct quoting in audit_log_acct_message())

John Dennis jdennis at redhat.com
Tue Mar 4 15:07:15 UTC 2008


Miloslav Trmac wrote:
> Hello,
> audit_log_acct_message() is currently quoting acct differently from all 
> other users: it adds quotes to acct if it is represented in hexadecimal, 
> not when it is represented as-is.

This isn't the only audit hexadecimal parsing issue, there are many 
more, see my previous posts. It is a sad fact audit output is impossible 
to parse correctly given only the output. Correct parsing of audit data 
demands private knowledge about the format of audit log messages on a 
per kernel version basis, this is very broken IMHO.
-- 
John Dennis <jdennis at redhat.com>




More information about the Linux-audit mailing list