Hello Steve,
I think the missing value for -F should be checking.
For example,
auditctl -a exit,always -F pid=
No error message is output and "pid=0" is added to rule.
Signed-off-by: Zhang Xiliang <[EMAIL PROTECTED]>
---
lib/deprecated.c | 3 +++
lib/libaudit.c | 3 +++
src/auditctl.c | 5 +++++
3 files changed, 11 insertions(+), 0 deletions(-)
diff --git a/lib/deprecated.c b/lib/deprecated.c
index e05e826..5a1c04f 100644
--- a/lib/deprecated.c
+++ b/lib/deprecated.c
@@ -230,6 +230,9 @@ int audit_rule_fieldpair(struct audit_rule *rule, const
char *pair, int flags)
if (v == NULL || f == v)
return -1;
+ if (*v == NULL)
+ return -20;
+
audit_msg(LOG_DEBUG,"pair=%s\n", f);
if ((field = audit_name_to_field(f)) < 0)
return -2;
diff --git a/lib/libaudit.c b/lib/libaudit.c
index 4bedfaf..6ec15d8 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -823,6 +823,9 @@ int audit_rule_fieldpair_data(struct audit_rule_data
**rulep, const char *pair,
if (v == NULL || f == v)
return -1;
+ if (*v == NULL)
+ return -20;
+
if ((field = audit_name_to_field(f)) < 0)
return -2;
diff --git a/src/auditctl.c b/src/auditctl.c
index 48f1369..3958afb 100644
--- a/src/auditctl.c
+++ b/src/auditctl.c
@@ -847,6 +847,11 @@ static int setopt(int count, char *vars[])
"Key field needs a watch or syscall
given prior to it\n");
retval = -1;
break;
+ case -20:
+ fprintf(stderr,
+ "-F missing value after opration for
%s\n", optarg);
+ retval = -1;
+ break;
default:
retval = -1;
break;
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
