Commit b50eba7e authored by Richard Guy Briggs's avatar Richard Guy Briggs Committed by Eric Paris

audit: format user messages to size of MAX_AUDIT_MESSAGE_LENGTH

Messages of type AUDIT_USER_TTY were being formatted to 1024 octets,
truncating messages approaching MAX_AUDIT_MESSAGE_LENGTH (8970 octets).

Set the formatting to 8560 characters, given maximum estimates for prefix and
suffix budgets.

See the problem discussion:
https://www.redhat.com/archives/linux-audit/2009-January/msg00030.html

And the new size rationale:
https://www.redhat.com/archives/linux-audit/2013-September/msg00016.html

Test ~8k messages with:
auditctl -m "$(for i in $(seq -w 001 820);do echo -n "${i}0______";done)"
Reported-by: default avatarLC Bruzenak <lenny@magitekltd.com>
Reported-by: default avatarJustin Stephenson <jstephen@redhat.com>
Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
parent 6e466452
...@@ -358,6 +358,12 @@ enum { ...@@ -358,6 +358,12 @@ enum {
#define AUDIT_PERM_READ 4 #define AUDIT_PERM_READ 4
#define AUDIT_PERM_ATTR 8 #define AUDIT_PERM_ATTR 8
/* MAX_AUDIT_MESSAGE_LENGTH is set in audit:lib/libaudit.h as:
* 8970 // PATH_MAX*2+CONTEXT_SIZE*2+11+256+1
* max header+body+tailer: 44 + 29 + 32 + 262 + 7 + pad
*/
#define AUDIT_MESSAGE_TEXT_MAX 8560
struct audit_status { struct audit_status {
__u32 mask; /* Bit mask for valid entries */ __u32 mask; /* Bit mask for valid entries */
__u32 enabled; /* 1 = enabled, 0 = disabled */ __u32 enabled; /* 1 = enabled, 0 = disabled */
......
...@@ -715,7 +715,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) ...@@ -715,7 +715,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
} }
audit_log_common_recv_msg(&ab, msg_type); audit_log_common_recv_msg(&ab, msg_type);
if (msg_type != AUDIT_USER_TTY) if (msg_type != AUDIT_USER_TTY)
audit_log_format(ab, " msg='%.1024s'", audit_log_format(ab, " msg='%.*s'",
AUDIT_MESSAGE_TEXT_MAX,
(char *)data); (char *)data);
else { else {
int size; int size;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment