Bug 1320161

Bug present on RHEL-7 too, tested with audit-2.4.1-5.el7
As we are fixing it in 6.8 we should fix it in 7.3 too.

+++ This bug was initially created as a clone of Bug #1235457 +++

Description of problem:

  Since line buffer is too short for plugin config files, if user write a long comment in /etc/audisp/plugins.d/au-remote.conf, following errors can occur.

~~~
Jun 24 16:22:17 rhel6local audispd: Wrong number of arguments for line 2 in /etc/audisp/plugins.d/au-remote.conf
Jun 24 16:22:34 rhel6local audispd: Missing equal sign for line 2 in /etc/audisp/plugins.d/au-remote.conf
~~~


Version-Release number of selected component (if applicable):

  audit-2.3.7-5.el6.x86_64

How reproducible:

  Always

Steps to Reproduce:
1. Add the following line to "/etc/audisp/plugins.d/au-remote.conf"
~~~
# This file controls the audispd data path to the aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaall aaa aaaa
~~~
2. Restart auditd
  # service auditd restart
3. Check /var/log/messages
  # tail /var/log/messages

Actual results:

  Jun 24 16:44:20 rhel6local audispd: Missing equal sign for line 2 in /etc/audisp/plugins.d/au-remote.conf
  Jun 24 16:44:20 rhel6local audispd: Skipping au-remote.conf plugin due to errors


Expected results:

  no error

Additional info:

- audit-2.3.7/audisp/audispd-pconfig.c
~~~
int load_pconfig(plugin_conf_t *config, char *file)
{
        int fd, rc, mode, lineno = 1;
        struct stat st;
        FILE *f;
        char buf[128];
~~~

--- Additional comment from Yoshifumi Kinoshita on 2015-06-24 17:08:23 EDT ---

And line buffer for auditpd-config is robust.
If we add a long line, the following message is displayed.

~~~
Jun 24 16:49:22 rhel6local audispd: Skipping line 5 in /etc/audisp/audispd.conf: too long
~~~

- audit-2.3.7/audisp/audispd-config.c
~~~
int load_config(daemon_conf_t *config, const char *file)
{
        int fd, rc, mode, lineno = 1;
        struct stat st;
        FILE *f;
        char buf[160];
~~~

--- Additional comment from Steve Grubb on 2015-06-24 18:43:32 EDT ---

I updated the code to handle long lines just like audispd.conf and auditd.conf. Its fixed in upstream svn commit 1085.