[PATCH 1/2] Fix the bug for missing field name before operator

[PATCH 1/2] Fix the bug for missing field name before operator

[Zhang Xiliang]

Hello Steve,

Steve Grubb said the following on 2008-08-07 3:19:
> > 
> > Yes, this was in attempt to make sure that they didn't type -F =10. In that 
> > case v will equal f because they start at the same address.
> > 
> > -Steve
> > 

I think the way "f == v" can't make sure that they didn't type -F =10.
After "v = strstr(pair, "=")" and v++. The v will not equal to f.

For example,
auditctl -a exit,always -F =10
Error message "-F unknown field: =10" is output. 

It is checked by "audit_name_to_field()", but not "f == v".
Because before v++, the "*v" is set to 0. we can use "*f == 0" to check out the case. The patch is for it.

Signed-off-by: Zhang Xiliang <zhangxiliang@cn.fujitsu.com>
---
 lib/deprecated.c |    5 ++++-
 lib/libaudit.c   |    5 ++++-
 src/auditctl.c   |    4 ++++
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/lib/deprecated.c b/lib/deprecated.c
index af1780b..6bf42dd 100644
--- a/lib/deprecated.c
+++ b/lib/deprecated.c
@@ -227,8 +227,11 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags)
 		// op = AUDIT_EQUAL;
 	}
 
-	if (v == NULL || f == v)
+	if (v == NULL)
 		return -1;
+	
+	if (*f == 0)
+		return -22;
 
 	if (*v == 0)
 		return -20;
diff --git a/lib/libaudit.c b/lib/libaudit.c
index 42c2176..e0f108a 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -820,8 +820,11 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
 		op = AUDIT_BIT_MASK;
 	}
 
-	if (v == NULL || f == v)
+	if (v == NULL)
 		return -1;
+	
+	if (*f == 0)
+		return -22;
 
 	if (*v == 0)
 		return -20;
diff --git a/src/auditctl.c b/src/auditctl.c
index 10894f9..6144795 100644
--- a/src/auditctl.c
+++ b/src/auditctl.c
@@ -852,6 +852,10 @@ static int setopt(int count, char *vars[])
 					"-F value should be a number for %s\n", optarg);
 				retval = -1;
 				break;
+			case -22:
+				fprintf(stderr,
+					"-F missing field name before operator for %s\n", optarg);
+				retval = -1;
 			default:
 				retval = -1;
 				break;

Re: [PATCH 1/2] Fix the bug for missing field name before operator

[Steve Grubb]

On Thursday 07 August 2008 06:32:01 Zhang Xiliang wrote:
> I think the way "f == v" can't make sure that they didn't type -F =10.
> After "v = strstr(pair, "=")" and v++. The v will not equal to f.
>
> It is checked by "audit_name_to_field()", but not "f == v".
> Because before v++, the "*v" is set to 0. we can use "*f == 0" to check out
> the case. The patch is for it.

Applied. Thanks for the patch !

-Steve