Skip to contentSkip to conversation

delete redundant info from result of 'auditctl -l'

PATCH Applied Yu Zhiguo 2 participants 2 messages Aug 29, 2008

lore
Share & tools
lore

Yu Zhiguo

author
#0 lore raw

PATCH 1/1 delete redundant info from result of 'auditctl -l'

Hello steve,

The field of 'syscall=all' is redundant for fielter 'exclude', so it should be deleted, e.g.

  # auditctl -l
  LIST_RULES: exclude,always syscall=all

should be:
LIST_RULES: exclude,always

Signed-off-by Yu Zhiguo<[email protected]>
---
 src/auditctl.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
src/auditctl.c +3 -1
index 70a54f3..60c2a80 100644
@@ -1424,7 +1424,9 @@ static int audit_print_reply(struct audit_reply *rep)
 				((rep->rule->flags & AUDIT_FILTER_MASK) != 
 						AUDIT_FILTER_USER) &&
 				((rep->rule->flags & AUDIT_FILTER_MASK) !=
-						AUDIT_FILTER_TASK)) {
+						AUDIT_FILTER_TASK) &&
+				((rep->rule->flags & AUDIT_FILTER_MASK) !=
+						AUDIT_FILTER_EXCLUDE)) {
 				printf(" syscall=");
 				for (sparse = 0, i = 0; 
 					i < (AUDIT_BITMASK_SIZE-1); i++) {
Signature · 1 line
1.5.4.2
Applied
#1 lore raw
Quoted 7 lines · On Friday 29 August 2008 04:55:47 Yu Zhiguo wrote:

The field of 'syscall=all' is redundant for fielter 'exclude', so it should be deleted, e.g.

  # auditctl -l
  LIST_RULES: exclude,always syscall=all

should be:
  LIST_RULES: exclude,always

Applied. Thanks for the patch !

-Steve