Skip to contentSkip to conversation

Fix the bug of the error message for -7 when checking field

PATCH Applied zhangxiliang 2 participants 2 messages Aug 2, 2008 – Aug 4, 2008

Subsystems (2)
Library code Audit
lore
Share & tools
lore

zhangxiliang

author
#0 lore raw

PATCH 1/4 Fix the bug of the error message for -7 when checking field

Hello Steve,

When field is AUDIT_EXIT, AUDIT_SUCCESS and so on, the entry,user,task,exclude filter list should be invalid on anything. So I think using "flags != AUDIT_FILTER_EXIT" is better than "flags == AUDIT_FILTER_ENTRY".

The error message for "-7" is not suit in some conditions. For example,
1, auditctl -a task,always -F perm=r
Error message is "Field perm cannot be checked at syscall entry".

It should be task filter list.

Signed-off-by Zhang Xiliang <[email protected]>
---
 lib/deprecated.c |    5 ++---
 lib/libaudit.c   |    4 ++--
 src/auditctl.c   |    2 +-
 3 files changed, 5 insertions(+), 6 deletions(-)
lib/deprecated.c +2 -3
index 4f0c14e..4ad8253 100644
@@ -281,7 +281,7 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags)
 			}
 			break;
 		case AUDIT_EXIT:
-			if (flags == AUDIT_FILTER_ENTRY)
+			if (flags != AUDIT_FILTER_EXIT)
 				return -7;
 			vlen = strlen(v);
 			if (isdigit((char)*(v)))

@@ -427,8 +427,7 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags)
 			return -10;
                 case AUDIT_DEVMAJOR...AUDIT_INODE:
                 case AUDIT_SUCCESS...AUDIT_SUCCESS:
-
-			if (flags == AUDIT_FILTER_ENTRY)
+			if (flags != AUDIT_FILTER_EXIT)
 				return -7;
 			/* fallthrough */
 		default:
lib/libaudit.c +2 -2
index 563b8ad..d439c2f 100644
@@ -870,7 +870,7 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
 			}
 			break;
 		case AUDIT_EXIT:
-			if (flags == AUDIT_FILTER_ENTRY)
+			if (flags != AUDIT_FILTER_EXIT)
 				return -7;
 			vlen = strlen(v);
 			if (isdigit((char)*(v))) 

@@ -1071,7 +1071,7 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
 			break;
 		case AUDIT_DEVMAJOR...AUDIT_INODE:
 		case AUDIT_SUCCESS...AUDIT_SUCCESS:
-			if (flags == AUDIT_FILTER_ENTRY)
+			if (flags != AUDIT_FILTER_EXIT)
 				return -7;
 			/* fallthrough */
 		default:
src/auditctl.c +1 -1
index d740509..5b6de26 100644
@@ -739,7 +739,7 @@ static int setopt(int count, char *vars[])
 				break;
 			case -7:
 				fprintf(stderr,
-			 "Field %s cannot be checked at syscall entry\n",
+			 "Field %s can only be used with exit filter list\n",
 					 optarg);
 				retval = -1;
 				break;
Signature · 2 lines
Regards
Zhang Xiliang
Applied
#1 lore raw
Quoted 2 lines · On Saturday 02 August 2008 06:03:43 zhangxiliang wrote:

When field is AUDIT_EXIT, AUDIT_SUCCESS and so on, the entry,user,task,exclude filter list should be invalid on anything.

Applied. Thanks !

-Steve