Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ca96a895 authored by Jiri Pirko's avatar Jiri Pirko Committed by Al Viro
Browse files

audit: EXECVE record - removed bogus newline 



(updated)
Added hunk that changes the comment, the rest is the same.

EXECVE records contain a newline after every argument. auditd converts
"\n" to " " so you cannot see newlines even in raw logs, but they're
there nevertheless. If you're not using auditd, you need to work round
them. These '\n' chars are can be easily replaced by spaces when
creating record in kernel. Note there is no need for trailing '\n' in
an audit record.

record before this patch:
"type=EXECVE msg=audit(1231421801.566:31): argc=4 a0=\"./test\"\na1=\"a\"\na2=\"b\"\na3=\"c\"\n"

record after this patch:
"type=EXECVE msg=audit(1231421801.566:31): argc=4 a0=\"./test\" a1=\"a\" a2=\"b\" a3=\"c\""

Signed-off-by: default avatarJiri Pirko <jpirko@redhat.com>
Acked-by: default avatarEric Paris <eparis@redhat.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 6bb59750

kernel/auditsc.c

+4 −5
Original line number Diff line number Diff line
@@ -1024,7 +1024,7 @@ static int audit_log_single_execve_arg(struct audit_context *context, 
{

	char arg_num_len_buf[12];

	const char __user *tmp_p = p;

	/* how many digits are in arg_num? 3 is the length of a=\n */

	/* how many digits are in arg_num? 3 is the length of " a=" */

	size_t arg_num_len = snprintf(arg_num_len_buf, 12, "%d", arg_num) + 3;

	size_t len, len_left, to_send;

	size_t max_execve_audit_len = MAX_EXECVE_AUDIT_LEN;
@@ -1138,7 +1138,6 @@ static int audit_log_single_execve_arg(struct audit_context *context, 
			audit_log_n_hex(*ab, buf, to_send);

		else

			audit_log_format(*ab, "\"%s\"", buf);

		audit_log_format(*ab, "\n");



		p += to_send;

		len_left -= to_send;