diff options
| author | Richard Guy Briggs <rgb@redhat.com> | 2013-09-17 00:20:42 +0200 |
|---|---|---|
| committer | Eric Paris <eparis@redhat.com> | 2013-11-05 17:06:49 +0100 |
| commit | b50eba7e2d534762a19a7207dda012f09302a8d2 (patch) | |
| tree | 3b9f2e1c2f591648d2e9c64a66e7d01bf4e47c3a /include | |
| parent | Linux 3.11 (diff) | |
| download | linux-b50eba7e2d534762a19a7207dda012f09302a8d2.tar.xz linux-b50eba7e2d534762a19a7207dda012f09302a8d2.zip | |
audit: format user messages to size of MAX_AUDIT_MESSAGE_LENGTH
Messages of type AUDIT_USER_TTY were being formatted to 1024 octets,
truncating messages approaching MAX_AUDIT_MESSAGE_LENGTH (8970 octets).
Set the formatting to 8560 characters, given maximum estimates for prefix and
suffix budgets.
See the problem discussion:
https://www.redhat.com/archives/linux-audit/2009-January/msg00030.html
And the new size rationale:
https://www.redhat.com/archives/linux-audit/2013-September/msg00016.html
Test ~8k messages with:
auditctl -m "$(for i in $(seq -w 001 820);do echo -n "${i}0______";done)"
Reported-by: LC Bruzenak <lenny@magitekltd.com>
Reported-by: Justin Stephenson <jstephen@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/uapi/linux/audit.h | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index 75cef3fd97ad..5dfcd85037e2 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -358,6 +358,12 @@ enum { #define AUDIT_PERM_READ 4 #define AUDIT_PERM_ATTR 8 +/* MAX_AUDIT_MESSAGE_LENGTH is set in audit:lib/libaudit.h as: + * 8970 // PATH_MAX*2+CONTEXT_SIZE*2+11+256+1 + * max header+body+tailer: 44 + 29 + 32 + 262 + 7 + pad + */ +#define AUDIT_MESSAGE_TEXT_MAX 8560 + struct audit_status { __u32 mask; /* Bit mask for valid entries */ __u32 enabled; /* 1 = enabled, 0 = disabled */ |