Fwd: [patch for 2.6.27? 1/1] audit: ignore terminating NUL inAUDIT_USER_TTY messages

[Miloslav Trmac]

Hello,
this appears to have been lost somewhere...
    Mirek
> --- Begin Message ---
> From: Miloslav Trmac <mitr@xxxxxxxxxx>
>
> AUDIT_USER_TTY, like all other messages sent from user-space, is sent
> NUL-terminated.  Unlike other user-space audit messages, which come only
> from trusted sources, AUDIT_USER_TTY messages are processed using
> audit_log_n_untrustedstring().
>
> This patch modifies AUDIT_USER_TTY handling to ignore the trailing NUL
> and use the "quoted_string" representation of the message if possible.
>
> Signed-off-by: Miloslav Trmac <mitr@xxxxxxxxxx>
> Cc: Eric Paris <eparis@xxxxxxxxxx>
> Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
> Cc: Steve Grubb <sgrubb@xxxxxxxxxx>
> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> ---
>
>  kernel/audit.c |    3 +++
>  1 file changed, 3 insertions(+)
>
> diff -puN kernel/audit.c~audit-ignore-terminating-nul-in-audit_user_tty-messages kernel/audit.c
> --- a/kernel/audit.c~audit-ignore-terminating-nul-in-audit_user_tty-messages
> +++ a/kernel/audit.c
> @@ -763,6 +763,9 @@ static int audit_receive_msg(struct sk_b
>  
>  				audit_log_format(ab, " msg=");
>  				size = nlmsg_len(nlh);
> +				if (size > 0 &&
> +				    ((unsigned char *)data)[size - 1] == '\0')
> +					size--;
>  				audit_log_n_untrustedstring(ab, data, size);
>  			}
>  			audit_set_pid(ab, pid);
> _
>
> --- End Message ---