audit: format user messages to size of MAX_AUDIT_MESSAGE_LENGTH
authorRichard Guy Briggs <rgb@redhat.com>
Mon, 16 Sep 2013 22:20:42 +0000 (18:20 -0400)
committerEric Paris <eparis@redhat.com>
Tue, 5 Nov 2013 16:06:49 +0000 (11:06 -0500)
commitb50eba7e2d534762a19a7207dda012f09302a8d2
tree3b9f2e1c2f591648d2e9c64a66e7d01bf4e47c3a
parent6e4664525b1db28f8c4e1130957f70a94c19213e
audit: format user messages to size of MAX_AUDIT_MESSAGE_LENGTH

Messages of type AUDIT_USER_TTY were being formatted to 1024 octets,
truncating messages approaching MAX_AUDIT_MESSAGE_LENGTH (8970 octets).

Set the formatting to 8560 characters, given maximum estimates for prefix and
suffix budgets.

See the problem discussion:
https://www.redhat.com/archives/linux-audit/2009-January/msg00030.html

And the new size rationale:
https://www.redhat.com/archives/linux-audit/2013-September/msg00016.html

Test ~8k messages with:
auditctl -m "$(for i in $(seq -w 001 820);do echo -n "${i}0______";done)"

Reported-by: LC Bruzenak <lenny@magitekltd.com>
Reported-by: Justin Stephenson <jstephen@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
include/uapi/linux/audit.h
kernel/audit.c