• Eric Paris's avatar
    Audit: better estimation of execve record length · b87ce6e4
    Eric Paris authored
    
    
    The audit execve record splitting code estimates the length of the message
    generated.  But it forgot to include the "" that wrap each string in its
    estimation.  This means that execve messages with lots of tiny (1-2 byte)
    arguments could still cause records greater than 8k to be emitted.  Simply
    fix the estimate.
    Signed-off-by: default avatarEric Paris <eparis@redhat.com>
    b87ce6e4
auditsc.c 65.8 KB