[patch] Syscall auditing - move "name=" field to the end

David Woodhouse dwmw2 at infradead.org
Thu Mar 17 18:22:48 UTC 2005


On Thu, 2005-03-17 at 12:08 -0600, Kris Wilson wrote:
> <br>Dumping in hex instead of string would have a testing impact.
> Using a string in quotes would be a<br>smaller hit, but there still
> would be additional impact to test the "hex otherwise" case.
> <br><br><br>

A string in quotes isn't sufficient -- a file name can contain quotes as
well as carriage returns. The only safe option is hex -- it's just a
question of whether it's "string or fall back to hex if dangerous" or
whether it's "just hex".

-- 
dwmw2




More information about the Linux-audit mailing list