Steve Grubb comments

Repositories
Issues
Comments

Results 295 comments of


                                            Steve Grubb

Add entry for uretprobe syscall (6.11, x86_&4-only)

Thanks for the patch, but I don't see any benefit to supporting this syscall.

Possible memory leak in auparse

Probably the log is missing a newline and getline runs off the end. It uses memchr to look for newline. I used to fuzz the logs. But I realized hardening...

aureport/ausearch: check for non-input stdin pipes

There is the --input-logs option which tells it ignore the pipe and use the logs from auditd.conf

aureport/ausearch: check for non-input stdin pipes

I'll look at this next week.

aureport/ausearch: check for non-input stdin pipes

@Cropi The only drawback is that this is based on time. To test this, I used a log file from 2021 and piped that to aureport --log. It reported 2025...