[PATCH] Fix acct quoting in audit_log_acct_message())

[Steve Grubb]

On Tuesday 04 March 2008 13:10:48 Tomas Mraz wrote:
> This proposal is just for starting the discussion.

You need to ask the SE Linux folks if they would like to see their event 
layout change. If there's no agreement with them, should we change anything? 
auparse is working pretty good as is.

This is basically the parsing rules: The header was defined a long time ago, 
It parses in its own way, once we hit msg=, everything is name=value. We do 
this by repeatedly calling strtok. If the newly split string does not have a 
= in it, we throw it away. We trim any trailing punctuation. I'll attach the 
parser code at the end of this email just so you see its actually real 
simple. I wouldn't mind dropping some of the punctuation since that would 
save disk space.

What is missing perhaps is a schema file that tells the field name, its 
format, and maybe its meaning. Not sure meaning is really needed. If we had a 
schema file, then you could change things pretty easy and still parse it. But 
that flexibility might cost performance.

The biggest question to me is how you handle any transition from one format to 
another. It will take time for patches to get upstream and then back 
downstream. Meanwhile we could have audit logs being aggregated from a couple 
different releases. They all need to parse correctly. How do we handle that? 
I suspect the answer is to make the audit parser handle old and new formats 
which adds a whole lot of code and makes it more complicated.

-Steve


        buf = strdup(r->record);
        ptr = strtok_r(buf, " ", &saved);
        if (ptr == NULL)
                return -1;

        do {    // If there's an '=' sign, its a keeper
                nvnode n;
                char *val = strchr(ptr, '=');
                if (val) {
                        int len;

                        // If name is 'msg=audit' throw it away
                        if (*ptr == 'm' && strncmp(ptr, "msg=", 4) == 0) {
                                if (ptr[4] == 'a')
                                        continue;

                                // If name is 'msg='' chop off and see
                                // if there is still a = in the string.
                                else if (ptr[4] == '\'') {
                                        ptr += 5;
                                        val = strchr(ptr, '=');
                                        if (val == NULL)
                                                continue;
                                }
                        }

                        // Split the string
                        *val = 0;
                        val++;

                        // Remove beginning cruft of name
                        if (*ptr == '(')
                                ptr++;
                        n.name = strdup(ptr);
                        n.val = strdup(val);
                        // Remove trailing punctuation
                        len = strlen(n.val);
                        if (len && n.val[len-1] == ':') {
                                n.val[len-1] = 0;
                                len--;
                        }
                        if (len && n.val[len-1] == ',') {
                                n.val[len-1] = 0;
                                len--;
                        }
                        if (len && n.val[len-1] == '\'') {
                                n.val[len-1] = 0;
                                len--;
                        }
                        if (len && n.val[len-1] == ')') {
                                if (strcmp(n.val, "(none)") &&
                                        strcmp(n.val, "(null)")) {
                                        n.val[len-1] = 0;
                                        len--;
                                }
                        }
                        nvlist_append(&r->nv, &n);