audit_filter_exe() copies the filtered executable path after the
audit_rule_data header in struct audit_message. The message buffer was
sized as PATH_MAX + 200 bytes with received records in mind, but
struct audit_rule_data alone takes 1040 bytes. That leaves only 3256
bytes for the path, while the kernel accepts up to PATH_MAX bytes, so a
long path overflows the message.
Size the buffer for an audit_rule_data followed by a PATH_MAX string.
This only makes the buffer larger, so received records still fit.
Also check that the request fits in the message and return -E2BIG
otherwise, in case exe_len does not match the filter's buffer.
Signed-off-by: Günther Noack <redacted>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261104-selftests-refactor-v2-0-c52f23f7ce33@gmail.com?part=14