summaryrefslogtreecommitdiffstats
path: root/kernel
diff options
context:
space:
mode:
authorRichard Guy Briggs <rgb@redhat.com>2013-09-16 18:20:42 -0400
committerEric Paris <eparis@redhat.com>2013-11-05 11:06:49 -0500
commitb50eba7e2d534762a19a7207dda012f09302a8d2 (patch)
tree3b9f2e1c2f591648d2e9c64a66e7d01bf4e47c3a /kernel
parent6e4664525b1db28f8c4e1130957f70a94c19213e (diff)
downloadop-kernel-dev-b50eba7e2d534762a19a7207dda012f09302a8d2.zip
op-kernel-dev-b50eba7e2d534762a19a7207dda012f09302a8d2.tar.gz
audit: format user messages to size of MAX_AUDIT_MESSAGE_LENGTH
Messages of type AUDIT_USER_TTY were being formatted to 1024 octets, truncating messages approaching MAX_AUDIT_MESSAGE_LENGTH (8970 octets). Set the formatting to 8560 characters, given maximum estimates for prefix and suffix budgets. See the problem discussion: https://www.redhat.com/archives/linux-audit/2009-January/msg00030.html And the new size rationale: https://www.redhat.com/archives/linux-audit/2013-September/msg00016.html Test ~8k messages with: auditctl -m "$(for i in $(seq -w 001 820);do echo -n "${i}0______";done)" Reported-by: LC Bruzenak <lenny@magitekltd.com> Reported-by: Justin Stephenson <jstephen@redhat.com> Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'kernel')
-rw-r--r--kernel/audit.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/audit.c b/kernel/audit.c
index 91e53d0..dd63d2f 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -715,7 +715,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
}
audit_log_common_recv_msg(&ab, msg_type);
if (msg_type != AUDIT_USER_TTY)
- audit_log_format(ab, " msg='%.1024s'",
+ audit_log_format(ab, " msg='%.*s'",
+ AUDIT_MESSAGE_TEXT_MAX,
(char *)data);
else {
int size;
OpenPOWER on IntegriCloud