From mboxrd@z Thu Jan 1 00:00:00 1970 From: Miloslav =?UTF-8?Q?Trma=C4=8D?= Subject: Re: [PATCH] make it match explicitly when use option '-a', '-A' and '-d' to specify "list,action" Date: Fri, 18 Jul 2008 13:56:32 +0200 Message-ID: <1216382192.2699.12.camel@amilo> References: <48803E3C.4060209@cn.fujitsu.com> <1216370953.2664.23.camel@amilo> <488083FA.5080504@cn.fujitsu.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <488083FA.5080504@cn.fujitsu.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Yu Zhiguo Cc: audit-list List-Id: linux-audit@redhat.com Hello, Yu Zhiguo p=C3=AD=C5=A1e v P=C3=A1 18. 07. 2008 v 19:52 +0800: > Miloslav Trma=C4=8D wrote: > >> I know "list" and "action" can be changed, this is convenient. > > No, it is undocumented. As an author of system-config-audit I'd much > > prefer if audit rejected such options, replicating the exact code in > > auditctl in order to handle all undocumented behavior the same way as > > auditctl is rather impractical. >=20 > Indeed it is uncompatible with manpage, but it seems that Mr. Steve > like this convenient method: Oh. OK. > >> - if (strstr(opt, "task")) > >> + if (!strncmp(opt, "task,", p - opt + 1) || !strcmp(p, ",task")) > >> *flags =3D AUDIT_FILTER_TASK; > > Each string should be recognized only in the documented position IMHO= . > > The patch also replaces case-sensitive matching by case-insensitive, > > which is not described above. >=20 > Both strstr and strcmp are case-sensitive. You're obviously right, I'm sorry. I wasn't paying enough attention. Mirek