1. 24 Jun, 2009 2 commits
    • Eric Paris's avatar
      Audit: better estimation of execve record length · b87ce6e4
      Eric Paris authored
      The audit execve record splitting code estimates the length of the message
      generated.  But it forgot to include the "" that wrap each string in its
      estimation.  This means that execve messages with lots of tiny (1-2 byte)
      arguments could still cause records greater than 8k to be emitted.  Simply
      fix the estimate.
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      b87ce6e4
    • Eric Paris's avatar
      Audit: fix audit watch use after free · 35aa901c
      Eric Paris authored
      When an audit watch is added to a parent the temporary watch inside the
      original krule from userspace is freed.  Yet the original watch is used after
      the real watch was created in audit_add_rules()
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      35aa901c
  2. 23 Jun, 2009 38 commits