seclog: strip trailing whitespace from audit netlink message payload - #17384
Merged
sergiocazzolato merged 1 commit intoJul 24, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates seclog’s Linux audit netlink writer to strip trailing whitespace from the payload before constructing/sending the AUDIT_TRUSTED_APP message, preventing embedded newlines (e.g. from newline-appending loggers) from showing up in journald output.
Changes:
- Trim trailing
\t\r\nfromAuditWriter.Writepayloads while still returning the original input length to satisfyio.Writerexpectations for transformed writers. - Update
AuditWriter.Writedoc comment to clarify message expectations and trimming behavior. - Add a unit test covering trailing-whitespace stripping behavior.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
seclog/audit_linux.go |
Strips trailing whitespace from the payload before building/sending the netlink audit message, while preserving the reported byte count. |
seclog/audit_linux_test.go |
Adds coverage to ensure Write removes trailing whitespace and still reports the original input length. |
Comment on lines
+261
to
+285
| func (s *AuditSuite) TestWriteStripsTrailingWhitespace(c *C) { | ||
| for _, tc := range []struct { | ||
| input string | ||
| want string | ||
| }{ | ||
| {"{\"foo\":\"bar\"}\n", "{\"foo\":\"bar\"}"}, | ||
| {"{\"foo\":\"bar\"} \t\r\n", "{\"foo\":\"bar\"}"}, | ||
| {"{\"foo\":\"bar\"}", "{\"foo\":\"bar\"}"}, | ||
| } { | ||
| mock := &mockSyscallOps{socketFD: 7} | ||
| restore := seclog.MockSyscallOps(mock) | ||
| defer restore() | ||
|
|
||
| writer, err := seclog.OpenAuditWriter() | ||
| c.Assert(err, IsNil) | ||
|
|
||
| n, err := writer.Write([]byte(tc.input)) | ||
| c.Assert(err, IsNil) | ||
| c.Check(n, Equals, len(tc.input)) | ||
|
|
||
| payload := mock.sendtoData[syscall.SizeofNlMsghdr:] | ||
| c.Check(string(payload[:len(tc.want)]), Equals, tc.want) | ||
| c.Check(payload[len(tc.want)], Equals, byte(0)) | ||
| } | ||
| } |
Contributor
There was a problem hiding this comment.
I think copilot's suggestion makes sense
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #17384 +/- ##
==========================================
- Coverage 78.93% 78.83% -0.10%
==========================================
Files 1390 1408 +18
Lines 196047 196784 +737
Branches 2462 2462
==========================================
+ Hits 154740 155143 +403
- Misses 32024 32298 +274
- Partials 9283 9343 +60
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
Fri Jul 24 14:36:42 UTC 2026 Failures:Preparing:
Executing:
Restoring:
Skipped tests from snapd-testing-skipIf you wish to have any of the below tests run in your PR, in your PR description, add 'unskip:' followed by a copy-and-pasted list of the below tests you wish to run (unskip plus test list must be valid yaml)
|
bboozzoo
added
the
Auto rerun spread
valentindavid
approved these changes
Jul 21, 2026
sergiocazzolato
force-pushed
the
bboozzoo/seclog-trailing-audit-newline
branch
from
July 21, 2026 15:56
e7c1610 to
7904eb2
Compare
Should the payload be constructed using a logger that appends a newline (e.g. slog), the newline would be embedded verbatim in the netlink message and appear in journald output as a trailing newline inside the quoted message field (LP: #2160691). Strip all trailing whitespace in AuditWriter.Write before building the netlink message. The returned byte count still reflects the original input length to satisfy the io.Writer contract. Related: SNAPDENG-37246 Fixes: LP#2160691 Signed-off-by: Maciej Borzecki <maciej.borzecki@canonical.com>
sergiocazzolato
force-pushed
the
bboozzoo/seclog-trailing-audit-newline
branch
from
July 24, 2026 01:36
7904eb2 to
5e3f1ea
Compare
Contributor
|
Just openstack:ubuntu-core-24-64:tests/main/snap-debug-raa failing on required systems but this is also failing on othe prs. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Should the payload be constructed using a logger that appends a newline (e.g. slog), the newline would be embedded verbatim in the netlink message and appear in journald output as a trailing newline inside the quoted message field (LP: #2160691).
Strip all trailing whitespace in AuditWriter.Write before building the netlink message. The returned byte count still reflects the original input length to satisfy the io.Writer contract.
Related: SNAPDENG-37246
Fixes: LP#2160691