audit_encode_nv_string − encode a name/value pair in a string


#include <libaudit.h>

char *audit_encode_nv_string(const char *name, const char *value, unsigned int vlen)


This function is used to encode a name/value pair. This should be used on any field being logged that potentially contains a space, a double-quote, or a control character. Any value containing those have to be specially encoded for the auparse library to correctly handle the value. The encoding method is designed to prevent log injection attacks where malicious values could cause parsing errors.

To use this function, pass the name string and value strings on their respective arguments. If the value is likely to have a NUL value embedded within it, you will need to pass a value length that tells in bytes how big the value is. Otherwise, you can pass a 0 for vlen and the function will simply use strlen against the value pointer. Also be aware that the name of the field will cause auparse to do certain things when interpretting the value. If the name is uid, a user id value in decimal is expected. Make sure that well known names are used for their intended purpose or that there is no chance of name collision with something new.


Returns a freshly malloc’ed string that the caller must free or NULL on error.


audit_log_user_message(3), audit_log_user_comm_message(3), audit_log_user_avc_message(3), audit_log_semanage_message(3).


Steve Grubb

More Linux Commands

lber-sockbuf(3) - OpenLDAP LBER I/O infrastructure (ManPage)
These routines are used to manage the low level I/O operations performed by the Lightweight BER library. They are called implicitly by the other libraries and u

add_module_replacement(3) - netsnmp_mib_api functions.......
The functions dealing with MIB modules fall into four groups - those dealing with initialisation and shutdown, with reading in and parsing MIB files, with searc

resolveip(1) - resolve host name to IP address or vice versa
The resolveip utility resolves host names to IP addresses and vice versa. Invoke resolveip like this: shell&gt; resolveip [options] {host_name|ip-addr} ... resolve

git-describe(1) - Show the most recent tag that is reachable
The command finds the most recent tag that is reachable from a commit. If the tag points to the commit, then only the tag is shown. Otherwise, it suffixes the t

glTexImage3D(3gl) - specify a three-dimensional texture imag
glTexImage3D.3gl - Texturing maps a portion of a specified texture image onto each graphical primitive for which texturing is enabled. To enable and disable thr

Tcl_AppendUnicodeToObj(3) - manipulate Tcl objects as string
The procedures described in this manual entry allow Tcl objects to be manipulated as string values. They use the internal representation of the object to store

FcStrStr(3) - locate UTF-8 substring - Linux manual page....
Returns the location of s2 in s1. Returns NULL if s2 is not present in s1. This test will operate properly with UTF8 encoded strings. VERSION Fontconfig version

terminfo_variables(3ncurses) - curses terminfo global variab
This page summarizes variables provided by the curses librarys low-level terminfo interface. A more complete description is given in the curs_terminfo(3X) manua

glIndex(3gl) - set the current color index - Linux man page
glIndex updates the current (single-valued) color index. It takes one argument, the new value for the current color index. The current index is stored as a floa

ptsname_r(3) - get the name of the slave pseudoterminal.....
The ptsname() function returns the name of the slave pseudoterminal device corresponding to the master referred to by fd. The ptsname_r() function is the reentr

XtResizeWidget(3) - move and resize widgets - Linux man page
The XtConfigureWidget function returns immediately if the specified geometry fields are the same as the old values. Otherwise, XtConfigureWidget writes the new

a64l(3) - convert between long and base-64 - Linux man page
These functions provide a conversion between 32-bit long integers and little-endian base-64 ASCII strings (of length zero to six). If the string used as argumen

We can't live, work or learn in freedom unless the software we use is free.