Audit: better estimation of execve record length

Browse source

The audit execve record splitting code estimates the length of the message
generated.  But it forgot to include the "" that wrap each string in its
estimation.  This means that execve messages with lots of tiny (1-2 byte)
arguments could still cause records greater than 8k to be emitted.  Simply
fix the estimate.

Signed-off-by: Eric Paris <eparis@redhat.com>

...

This commit is contained in:

Eric Paris 2009-06-11 14:31:34 -04:00 • committed by Al Viro

parent 35aa901c0b

commit b87ce6e418

1 changed files with 2 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

kernel/auditsc.c

View file