From: Jiri Pirko <jpirko@redhat.com>
Date: Mon, 12 Jan 2009 14:40:55 +0100
Subject: [audit] remove bogus newlines in EXECVE audit records
Message-id: 20090112144055.24b5e300@psychotron.englab.brq.redhat.com
O-Subject: [RHEL5.4 patch] BZ479412 remove bogus newlines in EXECVE audit records
Bugzilla: 479412
RH-Acked-by: Eric Paris <eparis@redhat.com>
RH-Acked-by: Tomas Henzl <thenzl@redhat.com>
RH-Acked-by: Anton Arapov <Anton@redhat.com>

BZ479412
https://bugzilla.redhat.com/show_bug.cgi?id=479412

Description:
EXECVE records contain a newline after every argument. auditd converts
"\n" to " " so you cannot see newlines even in raw logs, but they're
there nevertheless. If you're not using auditd, you need to work round
them. These '\n' chars are can be easily replaced by spaces when
creating record in kernel. Note there is no need for trailing '\n' in
an audit record.

record before this patch:
"type=EXECVE msg=audit(1231421801.566:31): argc=4 a0=\"./test\"\na1=\"a\"\na2=\"b\"\na3=\"c\"\n"

record after this patch:
"type=EXECVE msg=audit(1231421801.566:31): argc=4 a0=\"./test\" a1=\"a\" a2=\"b\" a3=\"c\""

Upstream status:

The patch is posted upstream and it will be likely included with no
problem.
http://lkml.org/lkml/2009/1/9/155

Brew build:
https://brewweb.devel.redhat.com/taskinfo?taskID=1644222

Test status:
Booted and tested on x86_64.

Jirka

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 1320dc5..5d3a2a8 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1006,7 +1006,7 @@ static int audit_log_single_execve_arg(struct audit_context *context,
 {
 	char arg_num_len_buf[12];
 	const char __user *tmp_p = p;
-	/* how many digits are in arg_num? 3 is the length of a=\n */
+	/* how many digits are in arg_num? 3 is the length of " a=" */
 	size_t arg_num_len = snprintf(arg_num_len_buf, 12, "%d", arg_num) + 3;
 	size_t len, len_left, to_send;
 	size_t max_execve_audit_len = MAX_EXECVE_AUDIT_LEN;
@@ -1092,7 +1092,7 @@ static int audit_log_single_execve_arg(struct audit_context *context,
 		 * so we can be sure nothing was lost.
 		 */
 		if ((i == 0) && (too_long))
-			audit_log_format(*ab, "a%d_len=%zu ", arg_num,
+			audit_log_format(*ab, " a%d_len=%zu", arg_num,
 					 has_cntl ? 2*len : len);
 
 		/*
@@ -1112,7 +1112,7 @@ static int audit_log_single_execve_arg(struct audit_context *context,
 		buf[to_send] = '\0';
 
 		/* actually log it */
-		audit_log_format(*ab, "a%d", arg_num);
+		audit_log_format(*ab, " a%d", arg_num);
 		if (too_long)
 			audit_log_format(*ab, "[%d]", i);
 		audit_log_format(*ab, "=");
@@ -1120,7 +1120,6 @@ static int audit_log_single_execve_arg(struct audit_context *context,
 			audit_log_hex(*ab, buf, to_send);
 		else
 			audit_log_format(*ab, "\"%s\"", buf);
-		audit_log_format(*ab, "\n");
 
 		p += to_send;
 		len_left -= to_send;
@@ -1148,7 +1147,7 @@ static void audit_log_execve_info(struct audit_context *context,
 
 	p = (const char __user *)axi->mm->arg_start;
 
-	audit_log_format(*ab, "argc=%d ", axi->argc);
+	audit_log_format(*ab, "argc=%d", axi->argc);
 
 	/*
 	 * we need some kernel buffer to hold the userspace args.  Just