Without this patch, auditd coredumps on 32bit when compiled with
-D_TIME_BITS=64:
Thread 1 "auditd" received signal SIGSEGV, Segmentation fault.
0xb7c7528f in strlen () from /lib/libc.so.6
(gdb) where
#0 0xb7c7528f in strlen () from /lib/libc.so.6
#1 0xb7cbe3c9 in __vfprintf_internal () from /lib/libc.so.6
#2 0xb7cce3a5 in __vsnprintf_internal () from /lib/libc.so.6
#3 0xb7d72180 in __snprintf_chk () from /lib/libc.so.6
#4 0x0040b3b5 in send_audit_event ()
#5 0x004047ff in main ()
diff -up ./src/auditd-event.c.t64 ./src/auditd-event.c
--- ./src/auditd-event.c.t64 2022-01-24 04:36:56.000000000 +0900
+++ ./src/auditd-event.c 2022-10-28 22:43:32.103854794 +0900
@@ -104,7 +104,7 @@ void write_logging_state(FILE *f)
int rc;
struct statfs buf;
- fprintf(f, "current log size = %lu KB\n", log_size/1024);
+ fprintf(f, "current log size = %llu KB\n", (unsigned long
long)log_size/1024);
fprintf(f, "max log size = %lu KB\n",
config->max_log_size * (MEGABYTE/1024));
fprintf(f,"logs detected last rotate/shift = %u\n", known_logs);
@@ -112,8 +112,8 @@ void write_logging_state(FILE *f)
fs_space_left ? "yes" : "no");
rc = fstatfs(log_fd, &buf);
if (rc == 0) {
- fprintf(f, "Logging partition free space %lu MB\n",
- (buf.f_bavail * buf.f_bsize)/MEGABYTE);
+ fprintf(f, "Logging partition free space %llu MB\n",
+ (unsigned long long)(buf.f_bavail *
buf.f_bsize)/MEGABYTE);
fprintf(f, "space_left setting %lu MB\n",
config->space_left);
fprintf(f, "admin_space_left setting %lu MB\n",
@@ -1632,7 +1632,7 @@ static void reconfigure(struct auditd_ev
srand(time(NULL));
seq_num = rand()%10000;
if (gettimeofday(&tv, NULL) == 0) {
- snprintf(date, sizeof(date), "audit(%lu.%03u:%u)", tv.tv_sec,
+ snprintf(date, sizeof(date), "audit(%llu.%03u:%u)", (unsigned
long long)tv.tv_sec,
(unsigned)(tv.tv_usec/1000), seq_num);
} else {
snprintf(date, sizeof(date),
diff -up ./src/auditd.c.t64 ./src/auditd.c
--- ./src/auditd.c.t64 2022-01-24 04:36:56.000000000 +0900
+++ ./src/auditd.c 2022-10-28 22:38:40.817495792 +0900
@@ -312,12 +312,12 @@ int send_audit_event(int type, const cha
// Write event into netlink area like normal events
if (gettimeofday(&tv, NULL) == 0) {
e->reply.len = snprintf((char *)e->reply.msg.data,
- DMSG_SIZE, "audit(%lu.%03u:%u): %s",
- tv.tv_sec, (unsigned)(tv.tv_usec/1000), seq_num, str);
+ DMSG_SIZE, "audit(%llu.%03u:%u): %s",
+ (long long)tv.tv_sec, (unsigned)(tv.tv_usec/1000),
seq_num, str);
} else {
e->reply.len = snprintf((char *)e->reply.msg.data,
- DMSG_SIZE, "audit(%lu.%03d:%u): %s",
- (unsigned long)time(NULL), 0, seq_num, str);
+ DMSG_SIZE, "audit(%llu.%03d:%u): %s",
+ (long long)time(NULL), 0, seq_num, str);
}
// Point message at the netlink buffer like normal events
e->reply.message = e->reply.msg.data;
diff -up ./src/ausearch-checkpt.c.t64 ./src/ausearch-checkpt.c
--- ./src/ausearch-checkpt.c.t64 2022-01-24 04:36:56.000000000 +0900
+++ ./src/ausearch-checkpt.c 2022-10-28 22:50:20.558201108 +0900
@@ -147,6 +147,7 @@ void save_ChkPt(const char *fn)
static int parse_checkpt_event(char *lbuf, int ndix, event *e)
{
char *rest;
+ unsigned long long t;
/*
* Find the space after the node, then make it '\0' so
@@ -173,13 +174,14 @@ static int parse_checkpt_event(char *lbu
return 1;
}
}
- if (sscanf(rest, "%lu.%03u:%lu 0x%X", &e->sec, &e->milli,
+ if (sscanf(rest, "%llu.%03u:%lu 0x%X", &t, &e->milli,
&e->serial, &e->type) != 4) {
fprintf(stderr, "Malformed output/event checkpoint line "
"after node - [%s]\n", lbuf);
checkpt_failure |= CP_STATUSBAD;
return 1;
}
+ e->sec = t;
return 0;
}
diff -up ./src/ausearch.c.t64 ./src/ausearch.c
--- ./src/ausearch.c.t64 2022-01-24 04:36:56.000000000 +0900
+++ ./src/ausearch.c 2022-10-28 22:48:03.676082763 +0900
@@ -472,10 +472,10 @@ static int process_log_fd(void)
output_event(entries);
} else if (do_output == 3) {
fprintf(stderr,
- "Corrupted checkpoint file. Inode match, but newer
complete event (%lu.%03u:%lu) found before loaded checkpoint %lu.%03u:%lu\n",
- entries->e.sec, entries->e.milli,
+ "Corrupted checkpoint file. Inode match, but newer
complete event (%llu.%03u:%lu) found before loaded checkpoint %llu.%03u:%lu\n",
+ (unsigned long long)entries->e.sec,
entries->e.milli,
entries->e.serial,
- chkpt_input_levent.sec,
+ (unsigned long
long)chkpt_input_levent.sec,
chkpt_input_levent.milli,
chkpt_input_levent.serial);
checkpt_failure |= CP_CORRUPTED;
diff -up ./tools/auvirt/auvirt.c.t64 ./tools/auvirt/auvirt.c
--- ./tools/auvirt/auvirt.c.t64 2022-01-24 04:36:56.000000000 +0900
+++ ./tools/auvirt/auvirt.c 2022-10-28 22:52:31.081335459 +0900
@@ -340,8 +340,8 @@ static int extract_virt_fields(auparse_s
error:
if (debug) {
fprintf(stderr, "Failed to get field \"%s\" for record "
- "%ld.%03u:%lu\n", field,
- auparse_get_time(au),
+ "%lld.%03u:%lu\n", field,
+ (long long)auparse_get_time(au),
auparse_get_milli(au),
auparse_get_serial(au));
}
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
