Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

audit: print empty EXECVE args

Browse source 
[ Upstream commit ea956d8be91edc702a98b7fe1f9463e7ca8c42ab ]

Empty executable arguments were being skipped when printing out the list
of arguments in an EXECVE record, making it appear they were somehow
lost.  Include empty arguments as an itemized empty string.

Reproducer:
	autrace /bin/ls "" "/etc"
	ausearch --start recent -m execve -i | grep EXECVE
	type=EXECVE msg=audit(10/03/2018 13:04:03.208:1391) : argc=3 a0=/bin/ls a2=/etc

With fix:
	type=EXECVE msg=audit(10/03/2018 21:51:38.290:194) : argc=3 a0=/bin/ls a1= a2=/etc
	type=EXECVE msg=audit(1538617898.290:194): argc=3 a0="/bin/ls" a1="" a2="/etc"

Passes audit-testsuite.  GH issue tracker at
https://github.com/linux-audit/audit-kernel/issues/99

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
[PM: cleaned up the commit metadata]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Richard Guy Briggs 2018-10-10 16:22:57 -04:00 committed by Greg Kroah-Hartman
parent 5dc441fbef
commit 3c69a033b4
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
kernel/auditsc.c
View file

@ -1107,7 +1107,7 @@ static void audit_log_execve_info(struct audit_context *context,
} }
/* write as much as we can to the audit log */ /* write as much as we can to the audit log */
if (len_buf > 0) { if (len_buf >= 0) {
/* NOTE: some magic numbers here - basically if we /* NOTE: some magic numbers here - basically if we
* can't fit a reasonable amount of data into the * can't fit a reasonable amount of data into the
* existing audit buffer, flush it and start with * existing audit buffer, flush it and start with