Hello Steve,
When field is AUDIT_FILETYPET and AUDIT_PPID, it can only used for
AUDIT_FILTER_EXIT and AUDIT_FILTER_ENTRY.
I think the fields shoud be check before send audit rule to kernel.
I add checking and error message "-17" to realize it.
Signed-off-by: Zhang Xiliang <[EMAIL PROTECTED]>
---
lib/deprecated.c | 6 ++++++
lib/libaudit.c | 7 +++++++
src/auditctl.c | 5 +++++
3 files changed, 18 insertions(+), 0 deletions(-)
diff --git a/lib/deprecated.c b/lib/deprecated.c
index 4ad8253..695e5d6 100644
--- a/lib/deprecated.c
+++ b/lib/deprecated.c
@@ -403,6 +403,8 @@ int audit_rule_fieldpair(struct audit_rule *rule, const
char *pair, int flags)
audit_archadded = 1;
break;
case AUDIT_FILETYPE:
+ if (flags != AUDIT_FILTER_EXIT || flags !=
AUDIT_FILTER_ENTRY)
+ return -17;
rule->values[rule->field_count] =
audit_name_to_ftype(v);
if (rule->values[rule->field_count] < 0) {
@@ -435,6 +437,10 @@ int audit_rule_fieldpair(struct audit_rule *rule, const
char *pair, int flags)
if (!(op == AUDIT_NEGATE || op == 0))
return -13;
}
+ if (field == AUDIT_PPID && (flags != AUDIT_FILTER_EXIT
+ || flags != AUDIT_FILTER_ENTRY))
+ return -17;
+
rule->values[rule->field_count] = strtol(v, NULL, 0);
break;
}
diff --git a/lib/libaudit.c b/lib/libaudit.c
index d439c2f..5b276f1 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -1063,6 +1063,8 @@ int audit_rule_fieldpair_data(struct audit_rule_data
**rulep, const char *pair,
}
break;
case AUDIT_FILETYPE:
+ if (flags != AUDIT_FILTER_EXIT || flags !=
AUDIT_FILTER_ENTRY)
+ return -17;
rule->values[rule->field_count] =
audit_name_to_ftype(v);
if (rule->values[rule->field_count] < 0) {
@@ -1079,6 +1081,11 @@ int audit_rule_fieldpair_data(struct audit_rule_data
**rulep, const char *pair,
if (!(op == AUDIT_NEGATE || op == AUDIT_EQUAL))
return -13;
}
+
+ if (field == AUDIT_PPID && (flags != AUDIT_FILTER_EXIT
+ || flags != AUDIT_FILTER_ENTRY))
+ return -17;
+
rule->values[rule->field_count] = strtol(v, NULL, 0);
break;
}
diff --git a/src/auditctl.c b/src/auditctl.c
index 5b6de26..2e64d28 100644
--- a/src/auditctl.c
+++ b/src/auditctl.c
@@ -789,6 +789,11 @@ static int setopt(int count, char *vars[])
"-F unknown file type - %s\n", optarg);
retval = -1;
break;
+ case -17:
+ fprintf(stderr,
+ "Field %s can only be used with exit
and entry filter list\n", optarg);
+ retval = -1;
+ break;
default:
retval = -1;
break;
--
Regards
Zhang Xiliang
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
