Index: trunk/src/auditctl.c =================================================================== --- trunk/src/auditctl.c (revision 606) +++ trunk/src/auditctl.c (working copy) @@ -481,7 +481,7 @@ keylen = AUDIT_MAX_KEY_LEN; while ((retval >= 0) && (c = getopt(count, vars, - "hislDvte:f:r:b:a:A:d:S:F:m:R:w:W:k:p:q:")) != EOF) { + "hislDvtCe:f:r:b:a:A:d:S:F:m:R:w:W:k:p:q:")) != EOF) { int flags = AUDIT_FILTER_UNSET; rc = 10; // Init to something impossible to see if unused. switch (c) { @@ -742,6 +742,12 @@ } break; + case 'C': + rule_new->fields[rule_new->field_count] = AUDIT_FIELD_COMPARE; + rule_new->fieldflags[rule_new->field_count] = AUDIT_NOT_EQUAL; + rule_new->values[rule_new->field_count] = AUDIT_COMPARE_UID_TO_OBJ_UID; + rule_new->field_count++; + break; case 'm': if (count > 3) { fprintf(stderr, Index: trunk/src/ausearch-report.c =================================================================== --- trunk/src/ausearch-report.c (revision 606) +++ trunk/src/ausearch-report.c (working copy) @@ -333,6 +333,7 @@ {T_UID, "id"}, {T_UID, "inode_uid"}, {T_UID, "sauid"}, + {T_UID, "obj_uid"}, {T_GID, "gid"}, {T_GID, "egid"}, {T_GID, "sgid"}, Index: trunk/auparse/typetab.h =================================================================== --- trunk/auparse/typetab.h (revision 606) +++ trunk/auparse/typetab.h (working copy) @@ -32,6 +32,7 @@ _S(AUPARSE_TYPE_UID, "id" ) _S(AUPARSE_TYPE_UID, "inode_uid" ) _S(AUPARSE_TYPE_UID, "sauid" ) +_S(AUPARSE_TYPE_UID, "obj_uid" ) _S(AUPARSE_TYPE_GID, "gid" ) _S(AUPARSE_TYPE_GID, "egid" ) _S(AUPARSE_TYPE_GID, "sgid" ) Index: trunk/lib/fieldtab.h =================================================================== --- trunk/lib/fieldtab.h (revision 606) +++ trunk/lib/fieldtab.h (working copy) @@ -55,6 +55,7 @@ _S(AUDIT_PERM, "perm" ) _S(AUDIT_DIR, "dir" ) _S(AUDIT_FILETYPE, "filetype" ) +_S(AUDIT_OBJ_UID, "obj_uid" ) _S(AUDIT_ARG0, "a0" ) _S(AUDIT_ARG1, "a1" ) Index: trunk/lib/libaudit.c =================================================================== --- trunk/lib/libaudit.c (revision 606) +++ trunk/lib/libaudit.c (working copy) @@ -857,6 +857,8 @@ case AUDIT_SUID: case AUDIT_FSUID: case AUDIT_LOGINUID: + case AUDIT_OBJ_UID: + case AUDIT_OBJ_GID: // Do positive & negative separate for 32 bit systems vlen = strlen(v); if (isdigit((char)*(v)))