audit: Handle embedded NUL in TTY input auditing
PATCH 2/2 audit: Handle embedded NUL in TTY input auditing
From: Miloslav Trmac <[email protected]>
Data read from a TTY can contain an embedded NUL byte (e.g. after pressing Ctrl-2, or sent to a PTY). After the previous patch, the data would be logged only up to the first NUL.
This patch modifies the AUDIT_TTY record to always use the hexadecimal format, which does not terminate at the first NUL byte. The vast majority of recorded TTY input data will contain either ' ' or '\n', so the hexadecimal format would have been used anyway.
--- tty_audit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/tty_audit.c +1 -1
@@ -93,7 +93,7 @@ static void tty_audit_buf_push(struct task_struct *tsk, uid_t loginuid,get_task_comm (name, tsk);audit_log_untrustedstring (ab, name);audit_log_format (ab," data=" ); -audit_log_n_untrustedstring (ab, buf->data, buf->valid); +audit_log_n_hex (ab, buf->data, buf->valid);audit_log_end (ab); } buf->valid =0 ;
Quoted 6 lines · Miloslav Trmač
From: Miloslav Trmac <[email protected]>
Data read from a TTY can contain an embedded NUL byte (e.g. after pressing Ctrl-2, or sent to a PTY). After the previous patch, the data would be logged only up to the first NUL.
Quoted 6 lines
This patch modifies the
AUDIT_TTYrecord to always use the hexadecimal format, which does not terminate at the first NUL byte. The vast majority of recorded TTY input data will contain either ' ' or '\n', so the hexadecimal format would have been used anyway.Signed-off-by Miloslav Trmac <[email protected]>
Quoted 18 lines
--- tty_audit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/char/tty_audit.c +1
-1@@ -93,7 +93,7 @@ static void tty_audit_buf_push(struct task_struct *tsk, uid_t loginuid,get_task_comm (name, tsk);audit_log_untrustedstring (ab, name);audit_log_format (ab," data=" ); -audit_log_n_untrustedstring (ab, buf->data, buf->valid); +audit_log_n_hex (ab, buf->data, buf->valid);audit_log_end (ab); } buf->valid =0 ;