path: root/kernel/audit_tree.c
diff options
authorEric Paris <>2009-06-11 14:31:37 -0400
committerAl Viro <>2009-06-24 00:00:52 -0400
commit9d9609851003ebed15957f0f2ce18492739ee124 (patch)
tree2c116865d2f239b5596b22a3a79eecc82f5e1299 /kernel/audit_tree.c
parent35fe4d0b1b12286a81938e9c5fdfaf639ac0ce5b (diff)
Audit: clean up all op= output to include string quoting
A number of places in the audit system we send an op= followed by a string that includes spaces. Somehow this works but it's just wrong. This patch moves all of those that I could find to be quoted. Example: Change From: type=CONFIG_CHANGE msg=audit(1244666690.117:31): auid=0 ses=1 subj=unconfined_u:unconfined_r:auditctl_t:s0-s0:c0.c1023 op=remove rule key="number2" list=4 res=0 Change To: type=CONFIG_CHANGE msg=audit(1244666690.117:31): auid=0 ses=1 subj=unconfined_u:unconfined_r:auditctl_t:s0-s0:c0.c1023 op="remove rule" key="number2" list=4 res=0 Signed-off-by: Eric Paris <>
Diffstat (limited to 'kernel/audit_tree.c')
1 files changed, 4 insertions, 6 deletions
diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index 1f6396d76687..3ff0731284a1 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -441,13 +441,11 @@ static void kill_rules(struct audit_tree *tree)
if (rule->tree) {
/* not a half-baked one */
ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
- audit_log_format(ab, "op=remove rule dir=");
+ audit_log_format(ab, "op=");
+ audit_log_string(ab, "remove rule");
+ audit_log_format(ab, " dir=");
audit_log_untrustedstring(ab, rule->tree->pathname);
- if (rule->filterkey) {
- audit_log_format(ab, " key=");
- audit_log_untrustedstring(ab, rule->filterkey);
- } else
- audit_log_format(ab, " key=(null)");
+ audit_log_key(ab, rule->filterkey);
audit_log_format(ab, " list=%d res=1", rule->listnr);
rule->tree = NULL;