Skip to contentSkip to conversation

libaudit.c - add entry list check for the path filter

PATCH In review Michael C Thompson 2 participants 2 messages May 18, 2006

Subsystems (2)
Library code Audit
lore
Share & tools
lore

Michael C Thompson

author
#0 lore raw

PATCH 1/1 libaudit.c - add entry list check for the path filter

The auditctl filter "path" is only valid on the exit filter list, and the current version of auditctl does not perform this sanity check. Other values filter options which are required to be on the exit list have this sanity-check mechanism.

Below is a patch which adds this sanity check for the "path" filter keyword.

Thanks,
Mike

---

Signed-off-by Michael Thompson <[email protected]>
lib/libaudit.c 2006-05-17 14:56:55.000000000 -0500 renamed from lib/libaudit.c 2006-04-16 08:57:11.000000000 -0500 +4 -0
@@ -952,6 +952,10 @@
                case AUDIT_SE_SEN:
                case AUDIT_SE_CLR:
                case AUDIT_WATCH:
+                       /* Watch is invalid on entry */
+                       if ((flags == AUDIT_FILTER_ENTRY) &&
+                               (field == AUDIT_WATCH))
+                               return -7;
                        rule->values[rule->field_count] = strlen(v);
                        offset = rule->buflen;
                        rule->buflen += strlen(v);
#1 lore raw
Quoted 2 lines · Michael C Thompson

Below is a patch which adds this sanity check for the "path" filter keyword.

Thanks. I applied a slight variation of this. I changed it to be != AUDIT_FILTER_EXIT.

-Steve