• Richard Guy Briggs's avatar
    audit: print empty EXECVE args · ea956d8b
    Richard Guy Briggs authored
    Empty executable arguments were being skipped when printing out the list
    of arguments in an EXECVE record, making it appear they were somehow
    lost.  Include empty arguments as an itemized empty string.
    
    Reproducer:
    	autrace /bin/ls "" "/etc"
    	ausearch --start recent -m execve -i | grep EXECVE
    	type=EXECVE msg=audit(10/03/2018 13:04:03.208:1391) : argc=3 a0=/bin/ls a2=/etc
    
    With fix:
    	type=EXECVE msg=audit(10/03/2018 21:51:38.290:194) : argc=3 a0=/bin/ls a1= a2=/etc
    	type=EXECVE msg=audit(1538617898.290:194): argc=3 a0="/bin/ls" a1="" a2="/etc"
    
    Passes audit-testsuite.  GH issue tracker at
    https://github.com/linux-audit/audit-kernel/issues/99Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
    [PM: cleaned up the commit metadata]
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
    ea956d8b
auditsc.c 67 KB