From df4ec48f45f518b6926e02ef4d77c8ed1a8b4e2c Mon Sep 17 00:00:00 2001 From: YmrDtnJu Date: Fri, 21 Jan 2022 18:21:27 +0100 Subject: [PATCH] Fix journald audit logging with fields > N_IOVEC_AUDIT_FIELDS. ELEMENTSOF(iovec) is not the correct value for the newly introduced parameter m to function map_all_fields because it is the maximum number of elements in the iovec array, including those reserved for N_IOVEC_META_FIELDS. The correct value is the current number of already used elements in the array plus the maximum number to use for fields decoded from the kernel audit message. --- src/journal/journald-audit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/journal/journald-audit.c b/src/journal/journald-audit.c index a8e3b175ac4..ea535a27af7 100644 --- a/src/journal/journald-audit.c +++ b/src/journal/journald-audit.c @@ -399,7 +399,7 @@ void process_audit_string(Server *s, int type, const char *data, size_t size) { z = n; - map_all_fields(p, map_fields_kernel, "_AUDIT_FIELD_", true, iovec, &n, ELEMENTSOF(iovec)); + map_all_fields(p, map_fields_kernel, "_AUDIT_FIELD_", true, iovec, &n, n + N_IOVEC_AUDIT_FIELDS); server_dispatch_message(s, iovec, n, ELEMENTSOF(iovec), NULL, NULL, LOG_NOTICE, 0); -- 2.47.3