Hello, On Tuesday, March 22, 2016 09:44:19 AM Lev Stipakov wrote: > The string values can be either enclosed in quotation marks or > hex-encoded. Is it safe to assume that sequence of bytes after hex > decoding is always utf-8 encoded string?
There are no guarantees what they are. This is used whenever the user could have controlled the input in a way to trick the audit parser. And in one case the hex encoding is an actual socket address structure. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
