On Thursday, August 18, 2016 2:33:20 PM EDT Richard Guy Briggs wrote:
> Signed-off-by: Richard Guy Briggs <[email protected]>
> ---
> trunk/lib/errormsg.h | 2 +-
> trunk/lib/libaudit.c | 39 ++++++++++++++++++++++-----------------
> trunk/lib/libaudit.h | 3 +++
> 3 files changed, 26 insertions(+), 18 deletions(-)
>
> diff --git a/trunk/lib/errormsg.h b/trunk/lib/errormsg.h
> index 84bfdb3..4a897be 100644
> --- a/trunk/lib/errormsg.h
> +++ b/trunk/lib/errormsg.h
> @@ -47,7 +47,7 @@ static const struct msg_tab err_msgtab[] = {
> { -9, 0, "msgtype field can only be used with exclude filter
> list" }, { -10, 0, "Failed upgrading rule" },
> { -11, 0, "String value too long" },
> - { -12, 0, "Only msgtype field can be used with exclude filter" },
> + { -12, 0, "Only msgtype, uid, gid, auid*, subj* fields can be
> used with exclude filter" }, { -13, 1, "only takes = or != operators"
> },
> { -14, 0, "Permission can only contain \'rwxa\'" },
> { -15, 2, "-F unknown errno -"},
> diff --git a/trunk/lib/libaudit.c b/trunk/lib/libaudit.c
> index 798b3c8..5ffc38c 100644
> --- a/trunk/lib/libaudit.c
> +++ b/trunk/lib/libaudit.c
> @@ -1401,23 +1401,28 @@ int audit_rule_fieldpair_data(struct audit_rule_data
> **rulep, const char *pair, return -2;
>
> /* Exclude filter can be used only with MSGTYPE and cred fields */
> - if (flags == AUDIT_FILTER_EXCLUDE)
> - switch(field) {
> - case AUDIT_PID:
> - case AUDIT_UID:
> - case AUDIT_GID:
> - case AUDIT_LOGINUID:
> - case AUDIT_LOGINUID_SET:
> - case AUDIT_MSGTYPE:
> - case AUDIT_SUBJ_USER:
> - case AUDIT_SUBJ_ROLE:
> - case AUDIT_SUBJ_TYPE:
> - case AUDIT_SUBJ_SEN:
> - case AUDIT_SUBJ_CLR:
> - break;
> - default:
> - return -12;
> - }
> + if (flags == AUDIT_FILTER_EXCLUDE) {
> + if ((features & AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND) == 0) {
One question, why is this being and'ed directly? I was told that we have to go
through AUDIT_FEATURE_TO_MASK() to convert the value to a mask which can then
be and'ed. Is this macro now deprecated?
-Steve
> + if (field != AUDIT_MSGTYPE)
> + return -30;
> + } else
> + switch(field) {
> + case AUDIT_PID:
> + case AUDIT_UID:
> + case AUDIT_GID:
> + case AUDIT_LOGINUID:
> + case AUDIT_LOGINUID_SET:
> + case AUDIT_MSGTYPE:
> + case AUDIT_SUBJ_USER:
> + case AUDIT_SUBJ_ROLE:
> + case AUDIT_SUBJ_TYPE:
> + case AUDIT_SUBJ_SEN:
> + case AUDIT_SUBJ_CLR:
> + break;
> + default:
> + return -12;
> + }
> + }
>
> rule->fields[rule->field_count] = field;
> rule->fieldflags[rule->field_count] = op;
> diff --git a/trunk/lib/libaudit.h b/trunk/lib/libaudit.h
> index 0852bcc..f77691f 100644
> --- a/trunk/lib/libaudit.h
> +++ b/trunk/lib/libaudit.h
> @@ -278,6 +278,9 @@ extern "C" {
> #ifndef AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH
> #define AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH 0x00000004
> #endif
> +#ifndef AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND
> +#define AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND 0x00000008
> +#endif
>
> /* Defines for interfield comparison update */
> #ifndef AUDIT_OBJ_UID
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
