[PATCH 1/5] Add the field checking for missing value after opration

[PATCH 1/5] Add the field checking for missing value after opration

[Zhang Xiliang]

Hello Steve, 

I think the missing value for -F should be checking. 

For example,
auditctl -a exit,always -F pid=

No error message is output and "pid=0" is added to rule.


Signed-off-by: Zhang Xiliang <zhangxiliang@cn.fujitsu.com>
---
 lib/deprecated.c |    3 +++
 lib/libaudit.c   |    3 +++
 src/auditctl.c   |    5 +++++
 3 files changed, 11 insertions(+), 0 deletions(-)

diff --git a/lib/deprecated.c b/lib/deprecated.c
index e05e826..5a1c04f 100644
--- a/lib/deprecated.c
+++ b/lib/deprecated.c
@@ -230,6 +230,9 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags)
 	if (v == NULL || f == v)
 		return -1;
 
+	if (*v == NULL)
+		return -20;
+
 	audit_msg(LOG_DEBUG,"pair=%s\n", f);
 	if ((field = audit_name_to_field(f)) < 0) 
 		return -2;
diff --git a/lib/libaudit.c b/lib/libaudit.c
index 4bedfaf..6ec15d8 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -823,6 +823,9 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
 	if (v == NULL || f == v)
 		return -1;
 
+	if (*v == NULL)
+		return -20;
+
 	if ((field = audit_name_to_field(f)) < 0) 
 		return -2;
 
diff --git a/src/auditctl.c b/src/auditctl.c
index 48f1369..3958afb 100644
--- a/src/auditctl.c
+++ b/src/auditctl.c
@@ -847,6 +847,11 @@ static int setopt(int count, char *vars[])
 					"Key field needs a watch or syscall given prior to it\n");
 				retval = -1;
 				break;
+			case -20:
+				fprintf(stderr,
+					"-F missing value after opration for %s\n", optarg);
+				retval = -1;
+				break;
 			default:
 				retval = -1;
 				break;

Re: [PATCH 1/5] Add the field checking for missing value after opration

[Zhang Xiliang]

Hello Steve,

>  	if (v == NULL || f == v)
>  		return -1;

I have some questions for "f == v".

I think it only checks the address of "f" and "v". It seems unuseful.
If we need to check whether the value is equal to the field, I think we should use strcmp().
What your opinion about it?
If you agree with me, I will make another patch for it.

Re: [PATCH 1/5] Add the field checking for missing value after opration

[Steve Grubb]

On Wednesday 06 August 2008 04:46:27 Zhang Xiliang wrote:
> Hello Steve,
>
> >  	if (v == NULL || f == v)
> >  		return -1;
>
> I have some questions for "f == v".
>
> I think it only checks the address of "f" and "v".

Yes, this was in attempt to make sure that they didn't type -F =10. In that 
case v will equal f because they start at the same address.

-Steve

Re: [PATCH 1/5] Add the field checking for missing value after opration

[Steve Grubb]

On Wednesday 06 August 2008 04:12:42 Zhang Xiliang wrote:
>I think the missing value for -F should be checking. 
>
>For example,
>auditctl -a exit,always -F pid=

<snip>

> +       if (*v == NULL)
> +               return -20;

I changed these to (*v == 0) since it is a char and not a pointer. Thanks for 
the patch! Applied

-Steve