Delete some invalid code from auditctl.c

PATCH Applied Zhang Xiliang 2 participants 2 messages Aug 6, 2008

lore

Share & tools

lore

Zhang Xiliang

author

2008-08-06 08:15 UTC #0 lore raw

PATCH 5/5 Delete some invalid code from auditctl.c

Hello Steve,

I found some code is invalid in auditctl.
So I suggested to delete it.

Signed-off-by Zhang Xiliang <[email protected]>

---
 src/auditctl.c |   10 ++--------
 1 files changed, 2 insertions(+), 8 deletions(-)

src/auditctl.c +2 -8

index b356faa..93e84a0 100644
@@ -737,12 +737,7 @@ static int setopt(int count, char *vars[])
 		switch (rc)
 		{
 			case 0:
-				if (which == OLD && 
-				    	rule.fields[rule.field_count-1] ==
-						AUDIT_PERM)
-					audit_permadded = 1;
-				else if (which == NEW &&
-				    rule_new->fields[rule_new->field_count-1] ==
+				if (rule_new->fields[rule_new->field_count-1] ==
 						AUDIT_PERM)
 					audit_permadded = 1;
 				break;

@@ -1385,8 +1380,7 @@ int key_match(struct audit_reply *rep)
 		}
 		if (((field >= AUDIT_SUBJ_USER && field <= AUDIT_OBJ_LEV_HIGH)
                      && field != AUDIT_PPID) || field == AUDIT_WATCH ||
-			field == AUDIT_WATCH || field == AUDIT_DIR ||
-			field == AUDIT_FILTERKEY) {
+			field == AUDIT_DIR || field == AUDIT_FILTERKEY) {
 				boffset += rep->ruledata->values[i];
 		}
 	}

Steve Grubb

2008-08-06 19:35 UTC #1 lore raw

Quoted 2 lines · On Wednesday 06 August 2008 04:15:17 Zhang Xiliang wrote:

I found some code is invalid in auditctl.
So I suggested to delete it.

OK, I guess this needs cleanup after changing PERM to require new rule format.

Quoted 11 lines

src/auditctl.c +0 -0
index b356faa..93e84a0 100644
@@ -737,12 +737,7 @@ static int setopt(int count, char *vars[])
                 switch (rc)
                 {
                        case 0:
-                               if (which == OLD &&
-                                     rule.fields[rule.field_count-1] == -                                               AUDIT_PERM)

Quoted 8 lines

- audit_permadded = 1; - else if (which == NEW && -
rule_new->fields[rule_new->field_count-1] ==
+ if (rule_new->fields[rule_new->field_count-1] == AUDIT_PERM) audit_permadded = 1; break;

I think I want to "and" this with which == NEW to make sure we don't index past something if the rules were still the old form.

Updated and applied. Thanks for the patch !

-Steve