Rules with field "inode=" belong in the inode hash.
Signed-off-by: Amy Griffis <[EMAIL PROTECTED]>
---
kernel/auditfilter.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
4d6785169aa274de9171ad2d34d2547412af4d4c
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index f35f535..d53a80d 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -248,6 +248,8 @@ static inline int audit_to_inode(struct
if (krule->listnr != AUDIT_FILTER_EXIT ||
krule->watch || krule->inode_f)
return -EINVAL;
+
+ krule->inode_f = f;
return 0;
}
--
1.3.0
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
