hexified path in cwd audit message if dir no longer exists

Steve Grubb sgrubb at redhat.com
Mon May 7 17:49:22 UTC 2007


On Monday 07 May 2007 13:42, paul moore wrote:
> Aha - it actually says "xxxx (deleted)".

That's what I thought it would say.

> Which is OK I guess. But I would have thought that the unstrusted string
> routine would know that this is a string generated by the kernel audit
> system and so not escape it

Any space in a field value will cause parsing problems. That is the main 
reason its escaped.

-Steve




More information about the Linux-audit mailing list