[PATCH 1/5] Add the field checking for missing value after opration

Zhang Xiliang
2008-08-06T08:12:42Z

Hello Steve,

I think the missing value for -F should be checking.

For example,
auditctl -a exit,always -F pid=

No error message is output and "pid=0" is added to rule.

Signed-off-by: Zhang Xiliang <zhangxiliang@cn.fujitsu.com>
---
lib/deprecated.c | 3 +++
lib/libaudit.c | 3 +++
src/auditctl.c | 5 +++++
3 files changed, 11 insertions(+), 0 deletions(-)

diff --git a/lib/deprecated.c b/lib/deprecated.c
index e05e826..5a1c04f 100644
--- a/lib/deprecated.c
+++ b/lib/deprecated.c
@@ -230,6 +230,9 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags)
if (v == NULL || f == v)
return -1;

+ if (*v == NULL)
+ return -20;
+
audit_msg(LOG_DEBUG,"pair=%s\n", f);
if ((field = audit_name_to_field(f)) < 0)
return -2;
diff --git a/lib/libaudit.c b/lib/libaudit.c
index 4bedfaf..6ec15d8 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -823,6 +823,9 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
if (v == NULL || f == v)
return -1;

+ if (*v == NULL)
+ return -20;
+
if ((field = audit_name_to_field(f)) < 0)
return -2;

diff --git a/src/auditctl.c b/src/auditctl.c
index 48f1369..3958afb 100644
--- a/src/auditctl.c
+++ b/src/auditctl.c
@@ -847,6 +847,11 @@ static int setopt(int count, char *vars[])
"Key field needs a watch or syscall given prior to it\n");
retval = -1;
break;
+ case -20:
+ fprintf(stderr,
+ "-F missing value after opration for %s\n", optarg);
+ retval = -1;
+ break;
default:
retval = -1;
break;