Re: audit 1.2.7 released

2006-09-20 Thread Stephen Smalley
On Tue, 2006-09-19 at 17:05 -0400, Amy Griffis wrote: > Steve Grubb wrote: [Mon Sep 18 2006, 08:13:40PM EDT] > > Please let me know if there are any problems with this release. > > I'm seeing some truncated audit records, e.g. > > type=DAEMON_END msg=audit(1158669003.740:6165) auditd normal halt

Re: audit 1.2.7 released

2006-09-20 Thread Steve Grubb
On Wednesday 20 September 2006 15:12, Stephen Smalley wrote: > SELinux userland code isn't supposed to assume any fixed max. > libselinux does use an initial buffer size as a starting point when > calling e.g. getxattr, but will resize the buffer to a larger size if > necessary. I try very hard to

Re: audit 1.2.7 released

2006-09-20 Thread Paul Moore
Steve Grubb wrote: > On Wednesday 20 September 2006 15:12, Stephen Smalley wrote: > >>SELinux userland code isn't supposed to assume any fixed max. >>libselinux does use an initial buffer size as a starting point when >>calling e.g. getxattr, but will resize the buffer to a larger size if >>necess

Re: audit 1.2.7 released

2006-09-20 Thread Steve Grubb
On Wednesday 20 September 2006 15:26, Paul Moore wrote: > > I try very hard to not have any memory allocations in the audit system to > > prevent any possible failure due to fragmentation or leaks. I need to cap > > the buffer size at something to meet this design goal. > > If this buffer limitatio