Messages in this thread | | | Date | Thu, 6 Sep 2012 11:56:16 -0400 | From | Dave Jones <> | Subject | Re: Check all returns from audit_log_start |
| |
On Thu, Sep 06, 2012 at 11:47:49AM -0400, Dave Jones wrote: > > Not certain because I haven't looked at what happens with the error > > code, but I think this might not be right. auditd can be explictly > > told not to audit certain events, in which case it is normal and > > expected that ab would come back NULL.... > > Ugh, that's a lot messier to have to audit every function that gets > passed 'ab' to make sure it has a NULL check, but ok I'll go look at it. > > hopefully audit_log_link_denied was a one off.
ok, from a quick look-over, that does seem to be the case. This still feels like a nasty trap waiting for someone to walk into again though.
Dave
| |