Messages of type AUDIT_USER_TTY were being formatted to 1024 octets, truncating messages approaching MAX_AUDIT_MESSAGE_LENGTH (8970 octets). Set the formatting to 8560 characters, given maximum estimates for prefix and suffix budgets. See the problem discussion: https://www.redhat.com/archives/linux-audit/2009-January/msg00030.html And the new size rationale: https://www.redhat.com/archives/linux-audit/2013-September/msg00016.html Test ~8k messages with: auditctl -m "$(for i in $(seq -w 001 820);do echo -n "${i}0______";done)"
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -358,6 +358,12 @@ enum { · 357 unmodified lines | |||
| 358 | #define AUDIT_PERM_READ 4 | 358 | #define AUDIT_PERM_READ 4 |
| 359 | #define AUDIT_PERM_ATTR 8 | 359 | #define AUDIT_PERM_ATTR 8 |
| 360 | 360 | ||
| 361 | /* MAX_AUDIT_MESSAGE_LENGTH is set in audit:lib/libaudit.h as: | ||
| 362 | * 8970 // PATH_MAX*2+CONTEXT_SIZE*2+11+256+1 | ||
| 363 | * max header+body+tailer: 44 + 29 + 32 + 262 + 7 + pad | ||
| 364 | */ | ||
| 365 | #define AUDIT_MESSAGE_TEXT_MAX 8560 | ||
| 366 | |||
| 361 | struct audit_status { | 367 | struct audit_status { |
| 362 | __u32 mask; /* Bit mask for valid entries */ | 368 | __u32 mask; /* Bit mask for valid entries */ |
| 363 | __u32 enabled; /* 1 = enabled, 0 = disabled */ | 369 | __u32 enabled; /* 1 = enabled, 0 = disabled */ |