<snip> > > Ugh. That's not so easy to read... Slightly longer, how about this? > > diff --git a/kernel/audit.c b/kernel/audit.c > index 8378c5e..3f569d1 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -824,11 +824,13 @@ static int audit_receive_msg(struct sk_buff *skb, > struct nlmsghdr *nlh) > break; > } > audit_log_common_recv_msg(&ab, msg_type); > - if (msg_type != AUDIT_USER_TTY) > - audit_log_format(ab, > - " > msg='%.AUDIT_MESSAGE_TEXT_MAXs'", > - (char *)data); > - else { > + if (msg_type != AUDIT_USER_TTY) { > + char fmt[64]; > + strcat(fmt, " msg='%."); > + strcat(fmt, "AUDIT_MESSAGE_TEXT_MAX"); > + strcat(fmt, "s'"); > + audit_log_format(ab, fmt, (char *)data); > + } else { > int size; > > audit_log_format(ab, " data="); >
I am ok with this. In fact I was going to do this the first time, but I thought their would be some explicit reason to avoid the additional run time overhead as the concat could be made at compile time. <snip>
-- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit