[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [PATCH] Fix acct quoting in audit_log_acct_message())



Eric Paris wrote:
Can you show some example of which kernels had one thing and which
kernels another?

These are the encoded audit strings in kernel 2.6.24 (Fedora):

a[0-9]+
comm
cwd
data
dir
exe
key
msg
name
new
old
path

These are the encoded audit strings in kernel 2.6.18 (RHEL-5):

comm
cwd
exe
key
name
new
ocomm
old
path

This is what audit-1.6.5 checks for:

acct
cmd
comm
cwd
exe
file
name
path
watch

This list does not include strings which are not encoded, only those known to be subject to hexadecimal decoding!

Absolutely none of the above fields should require special table driven logic in order to read their value as a string.

Just to make life interesting I believe some of these field names appear in more than one record type.

This is just two OS's. In real deployments a site might be running a much larger set of OS's all emitting audit data and probably not capturing the OS version along with the audit data. Every time we have a new release we compound the problem. Every time a new piece of audit data is added the problem is compounded. Any patch has the potential to modify the audit contents.
--
John Dennis <jdennis redhat com>


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]