hexified path in cwd audit message if dir no longer exists
Steve Grubb
sgrubb at redhat.com
Mon May 7 17:49:22 UTC 2007
On Monday 07 May 2007 13:42, paul moore wrote:
> Aha - it actually says "xxxx (deleted)".
That's what I thought it would say.
> Which is OK I guess. But I would have thought that the unstrusted string
> routine would know that this is a string generated by the kernel audit
> system and so not escape it
Any space in a field value will cause parsing problems. That is the main
reason its escaped.
-Steve
More information about the Linux-audit
mailing list