Fix the bug of AUDIT_PERM field added without a watch

PATCH Applied Zhang Xiliang 2 participants 2 messages Aug 6, 2008

Subsystems (2)

Library code Audit

lore

Share & tools

lore

Zhang Xiliang

author

2008-08-06 08:15 UTC #0 lore raw

PATCH 4/5 Fix the bug of AUDIT_PERM field added without a watch

Hello Steve,

AUDIT_PERM field should used after a watch given.

For example,
auditctl -a exit,always -F perm=r

No error message is outputed.
I think we should add checking for it.

Signed-off-by Zhang Xiliang <[email protected]>

---
 lib/libaudit.c |    2 ++
 src/auditctl.c |    5 +++++
 2 files changed, 7 insertions(+), 0 deletions(-)

lib/libaudit.c +2 -0

index 3e2e28f..fd2c41b 100644
@@ -1046,6 +1046,8 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
 				return -7;
 			else if (op != AUDIT_EQUAL)
 				return -13;
+			else if (audit_permadded != 1)
+				return -22;
 			else {
 				unsigned int i, len, val = 0;

src/auditctl.c +5 -0

index 1455ee6..b356faa 100644
@@ -857,6 +857,11 @@ static int setopt(int count, char *vars[])
 					"-F value should be number for %s\n", optarg);
 				retval = -1;
 				break;
+			case -22:
+				fprintf(stderr,
+					"permission option needs a watch given prior to it\n");
+				retval = -1;
+				break;
 			default:
 				retval = -1;
 				break;

Steve Grubb

2008-08-06 19:13 UTC #1 lore raw

Quoted 7 lines · On Wednesday 06 August 2008 04:15:09 Zhang Xiliang wrote:

AUDIT_PERM field should used after a watch given.
For example,
auditctl -a exit,always -F perm=r
No error message is outputed.
I think we should add checking for it.

This is a legal rule. The kernel will pick the syscalls that satisfy the read permission. Typically, you would have other fields in addition. So...I'm not applying this patch.

Thanks,
-Steve