Bug#272969: [Logcheck-devel] Bug#272969: logcheck-database: violations.ignore.d/logcheck-sudo can not handle spaces in directory names

maks attems debian at sternwelten.at
Sat Sep 25 20:44:49 UTC 2004


On Thu, 23 Sep 2004, Wouter Koolen-Wijkstra wrote:
..
> The problem is the part that maches the directory where sudo was
> executed by the user:
> PWD=[^[:space:]]+ ;
> 
> This regexp presupposes that directory names do not contain spaces.
> Spaces are not specially marked (e.g. '\ ') in the log. I propose to
> not bother about them and just match upto the next ';' instead.
> PWD=[^;]+;
my be were that linux users don't like spaces in their dir,
but you are right.
 
> This of course presupposes that directories do not contain ';'s. This
> problem will remain, as directory names can contain anything, and sudo
> does not mark the beginning or end. But directories containin ';' are (I
> suppose) far less common than those containing sp
> aces.
fully agreed, a path can contain any char beside the '\0',
i prefer to use 'PWD=.+;' to fullfill your wishes,
and will commit that soon to logcheck cvs, if nobody disagrees. :)

have a nice weekend.
--
maks






More information about the Logcheck-devel mailing list