| commit | b87ce6e4187c24b06483c8266822ce5e6b7fa7f3 | [log] [tgz] |
|---|---|---|
| author | Eric Paris <eparis@redhat.com> | Thu Jun 11 14:31:34 2009 -0400 |
| committer | Al Viro <viro@zeniv.linux.org.uk> | Tue Jun 23 23:50:34 2009 -0400 |
| tree | 24b56d53dc03b0a6c8434ad2250c1c40d179d0ce | |
| parent | 35aa901c0b66cb3c2eeee23f13624014825a44a8 [diff] |
Audit: better estimation of execve record length The audit execve record splitting code estimates the length of the message generated. But it forgot to include the "" that wrap each string in its estimation. This means that execve messages with lots of tiny (1-2 byte) arguments could still cause records greater than 8k to be emitted. Simply fix the estimate. Signed-off-by: Eric Paris <eparis@redhat.com>