Skip to contentSkip to conversation

Fix the bug for missing field name before operator

PATCH Applied Zhang Xiliang 2 participants 2 messages Aug 7, 2008

Subsystems (2)
Library code Audit
lore
Share & tools
lore

Zhang Xiliang

author
#0 lore raw

PATCH 1/2 Fix the bug for missing field name before operator

Hello Steve,

Steve Grubb said the following on 2008-08-07 3:19:

Quoted 6 lines
Quoted 6 lines

Yes, this was in attempt to make sure that they didn't type -F =10. In that case v will equal f because they start at the same address.

-Steve

I think the way "f == v" can't make sure that they didn't type -F =10. After "v = strstr(pair, "=")" and v++. The v will not equal to f.

For example,
auditctl -a exit,always -F =10
Error message "-F unknown field: =10" is output.

It is checked by "audit_name_to_field()", but not "f == v".
Because before v++, the "*v" is set to 0. we can use "*f == 0" to check out the case. The patch is for it.

Signed-off-by Zhang Xiliang <[email protected]>
---
 lib/deprecated.c |    5 ++++-
 lib/libaudit.c   |    5 ++++-
 src/auditctl.c   |    4 ++++
 3 files changed, 12 insertions(+), 2 deletions(-)
lib/deprecated.c +4 -1
index af1780b..6bf42dd 100644
@@ -227,8 +227,11 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags)
 		// op = AUDIT_EQUAL;
 	}
 
-	if (v == NULL || f == v)
+	if (v == NULL)
 		return -1;
+	
+	if (*f == 0)
+		return -22;
 
 	if (*v == 0)
 		return -20;
lib/libaudit.c +4 -1
index 42c2176..e0f108a 100644
@@ -820,8 +820,11 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
 		op = AUDIT_BIT_MASK;
 	}
 
-	if (v == NULL || f == v)
+	if (v == NULL)
 		return -1;
+	
+	if (*f == 0)
+		return -22;
 
 	if (*v == 0)
 		return -20;
src/auditctl.c +4 -0
index 10894f9..6144795 100644
@@ -852,6 +852,10 @@ static int setopt(int count, char *vars[])
 					"-F value should be a number for %s\n", optarg);
 				retval = -1;
 				break;
+			case -22:
+				fprintf(stderr,
+					"-F missing field name before operator for %s\n", optarg);
+				retval = -1;
 			default:
 				retval = -1;
 				break;
Applied
#1 lore raw
Quoted 6 lines · On Thursday 07 August 2008 06:32:01 Zhang Xiliang wrote:

I think the way "f == v" can't make sure that they didn't type -F =10. After "v = strstr(pair, "=")" and v++. The v will not equal to f.

It is checked by "audit_name_to_field()", but not "f == v". Because before v++, the "*v" is set to 0. we can use "*f == 0" to check out the case. The patch is for it.

Applied. Thanks for the patch !

-Steve