# Re: \[PATCH v2 14/27\] selftests/landlock: Make audit\_message large enough for any exe filter

- From: sashiko-bot@kernel.org
- Date: 2026-11-04 21:15:28 
- List: linux-security-module
- Page: https://ratatoskr.run/linux-security-module/2026/11/17864929
- Thread: https://ratatoskr.run/linux-security-module/2026/11/17864489/t.md

```text
> audit_filter_exe() copies the filtered executable path after the
> audit_rule_data header in struct audit_message.  The message buffer was
> sized as PATH_MAX + 200 bytes with received records in mind, but
> struct audit_rule_data alone takes 1040 bytes.  That leaves only 3256
> bytes for the path, while the kernel accepts up to PATH_MAX bytes, so a
> long path overflows the message.
> 
> Size the buffer for an audit_rule_data followed by a PATH_MAX string.
> This only makes the buffer larger, so received records still fit.
> 
> Also check that the request fits in the message and return -E2BIG
> otherwise, in case exe_len does not match the filter's buffer.
> 
> Signed-off-by: Günther Noack <redacted>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104-selftests-refactor-v2-0-c52f23f7ce33@gmail.com?part=14

```