Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

10
  • I am tempted to mark this as the solution, but now face the security dilemma that Kusalananda was trying to avoid. On the one hand promoting knowledge is good, one the other ensuring that everybody reading it really reads it and understands the potential danger remains. Perhaps adding a big caution note at the beginning of the port would complement the one that is at the end? Commented Nov 1, 2024 at 1:19
  • @PRouleau Because the input is effectively validated as numeric-only in this case, I think with the printf version I just added, this should be safe against code-injection attacks. Commented Nov 1, 2024 at 1:39
  • You are correct, @Digital Trauma, the data validation is done by extracting the number (and in my original code I was giving context to where the number is located). Commented Nov 1, 2024 at 1:45
  • One point to highlight is that the beginning of the string of the first echo ends up being processed by the shell if not completely consumed. So if one would like to ensure that the number extracted is located at the right spot, the regexp would need to include 'syscall=' . To process lines of audit log and expand the system call # by its name the sed command could be: sed -E "s/^(.+ syscall=)([0-9]+) (.*)$/printf -- '\1%s \3' \$(ausyscall \2)/e". The -- in the printf handles a line taht starts with a dash. Commented Nov 1, 2024 at 2:13
  • Even your Update is highly unsafe. Single quoting doesn't help if the input may contain single quotes, %s are a problem for printf format. Beware [0-9] may match many characters besides 0123456789 depending on the locale. That e flag should really never be used. Commented Nov 1, 2024 at 12:38