From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: [Patch]Fix the bug of using "-S syscall -a list, action",
	no errors will be reported.
Date: Mon, 4 Aug 2008 20:18:40 -0400
Message-ID: <200808042018.41069.sgrubb@redhat.com>
References: <000901c8f2ae$209adb30$958da70a@truly>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <000901c8f2ae$209adb30$958da70a@truly>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: chuli <chul@cn.fujitsu.com>
Cc: 'linux-audit' <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

Hi,

On Wednesday 30 July 2008 21:38:26 chuli wrote:
>   When I use "-a user,always -S open", errors will be reported. But when I
> use "-S open -a user,always", no errors will report. There is no
> corresponding codes to deal with the later format.

I'm still thinking about this patch. I'll look at it again tomorrow.

Thanks,
-Steve


>   Here is my patch. Hope for your opinion about such modification.
>   (I move the code for checking "task" list to the handle_request().)
>
> Signed-off-by: Chu Li <chul@cn.fujitsu.com>
> ---
> diff --git a/src/auditctl.c b/src/auditctl.c
> index d740509..9cc3df0 100755
> --- a/src/auditctl.c
> +++ b/src/auditctl.c
> @@ -532,52 +532,40 @@ static int setopt(int count, char *vars[])
>  		retval = -2;
>  		break;
>          case 'a':
> -		if (strstr(optarg, "task") && audit_syscalladded) {
> +		rc = audit_rule_setup(optarg, &add, &action);
> +		if (rc == 3) {
> +			fprintf(stderr,
> +			"Multiple rule insert/delete operations are not allowed\n");
> +			retval = -1;
> +		} else if (rc == 2) {
>  			fprintf(stderr,
> -				"Syscall auditing requested for task list\n");
> +			"Append rule - bad keyword %s\n",
> +			optarg);
>  			retval = -1;
> -		} else {
> -			rc = audit_rule_setup(optarg, &add, &action);
> -			if (rc == 3) {
> -				fprintf(stderr,
> -		"Multiple rule insert/delete operations are not allowed\n");
> -				retval = -1;
> -			} else if (rc == 2) {
> -				fprintf(stderr,
> -					"Append rule - bad keyword %s\n",
> -					optarg);
> -				retval = -1;
> -			} else if (rc == 1) {
> -				fprintf(stderr,
> -				    "Append rule - possible is deprecated\n");
> -				return -3; /* deprecated - eat it */
> -			} else
> -				retval = 1; /* success - please send */
> -		}
> +		} else if (rc == 1) {
> +			fprintf(stderr,
> +		 	"Append rule - possible is deprecated\n");
> +			return -3; /* deprecated - eat it */
> +		} else
> +			retval = 1; /* success - please send */
>  		break;
>          case 'A':
> -		if (strstr(optarg, "task") && audit_syscalladded) {
> -			fprintf(stderr,
> -			   "Error: syscall auditing requested for task list\n");
> +		rc = audit_rule_setup(optarg, &add, &action);
> +		if (rc == 3) {
> +			fprintf(stderr,
> +			"Multiple rule insert/delete operations are not allowed\n");
>  			retval = -1;
> +		} else if (rc == 2) {
> +			fprintf(stderr,
> +			"Add rule - bad keyword %s\n", optarg);
> +			retval = -1;
> +		} else if (rc == 1) {
> +			fprintf(stderr,
> +			"Append rule - possible is deprecated\n");
> +			return -3; /* deprecated - eat it */
>  		} else {
> -			rc = audit_rule_setup(optarg, &add, &action);
> -			if (rc == 3) {
> -				fprintf(stderr,
> -		"Multiple rule insert/delete operations are not allowed\n");
> -				retval = -1;
> -			} else if (rc == 2) {
> -				fprintf(stderr,
> -				"Add rule - bad keyword %s\n", optarg);
> -				retval = -1;
> -			} else if (rc == 1) {
> -				fprintf(stderr,
> -				    "Append rule - possible is deprecated\n");
> -				return -3; /* deprecated - eat it */
> -			} else {
> -				add |= AUDIT_FILTER_PREPEND;
> -				retval = 1; /* success - please send */
> -			}
> +			add |= AUDIT_FILTER_PREPEND;
> +			retval = 1; /* success - please send */
>  		}
>  		break;
>          case 'd':
> @@ -1167,6 +1155,27 @@ static int handle_request(int status)
>  					audit_rule_syscallbyname_data(
>  							rule_new, "all");
>  			}
> +			if(audit_syscalladded == 1){
> +				if (((add & (AUDIT_FILTER_MASK|AUDIT_FILTER_UNSET)) ==
> +					AUDIT_FILTER_TASK || (del &
> +					(AUDIT_FILTER_MASK|AUDIT_FILTER_UNSET)) ==
> +					AUDIT_FILTER_TASK)) {
> +					fprintf(stderr,
> +					"Error: syscall auditing being added to task list\n");
> +					return -1;
> +				} else if (((add & (AUDIT_FILTER_MASK|AUDIT_FILTER_UNSET)) ==
> +					AUDIT_FILTER_USER || (del &
> +					(AUDIT_FILTER_MASK|AUDIT_FILTER_UNSET)) ==
> +					AUDIT_FILTER_USER)) {
> +					fprintf(stderr,
> +					"Error: syscall auditing being added to user list\n");
> +					return -1;
> +				} else if (exclude) {
> +					fprintf(stderr,
> +					"Error: syscall auditing cannot be put on exclude list\n");
> +					return -1;
> +				}
> +			}
>  			if (which == OLD) {
>  				rc = audit_add_rule(fd, &rule, add, action);
>  			} else {
>
> Regards
> Chu Li