From mboxrd@z Thu Jan  1 00:00:00 1970
From: Stephen Quinney <squinney@inf.ed.ac.uk>
Subject: Re: test patch for auditctl inter-field comparisons on euid/uid,
	egid/gid
Date: Thu, 15 Dec 2011 06:55:53 +0000
Message-ID: <20111215065553.GA27897@hogwood.inf.ed.ac.uk>
References: <CALnj_=7X+DmQCBTkSiju=Uop1Eyxw74dRVtm1OyoHPS2McOuNQ@mail.gmail.com>
	<201112120940.39028.sgrubb@redhat.com>
	<CALnj_=7LqXyOA9qPnfYs9YaT282znRDNP+bD0XbzXENYaQy3sQ@mail.gmail.com>
	<CALnj_=4BuUT1YVW8dJokkQq=6+nyodNkcmTdqLGQYLdHPUJ5GA@mail.gmail.com>
	<CALnj_=4nGfW7G_hfAqhiOqPSDjDZ7h2ja68=meQ+hwX9X3fJFg@mail.gmail.com>
	<CALnj_=4mQ+CAW3ZznxE55Tb_X6G5kzUsQQLkaxA7jkgR8F3Ubw@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Content-Disposition: inline
In-Reply-To: <CALnj_=4mQ+CAW3ZznxE55Tb_X6G5kzUsQQLkaxA7jkgR8F3Ubw@mail.gmail.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Peter Moody <pmoody@google.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Wed, Dec 14, 2011 at 05:18:30PM -0800, Peter Moody wrote:

> diff --git a/trunk/auparse/typetab.h b/trunk/auparse/typetab.h
> index 746573c..cf13f4d 100644
> --- a/trunk/auparse/typetab.h
> +++ b/trunk/auparse/typetab.h
> @@ -32,6 +32,8 @@ _S(AUPARSE_TYPE_UID,		"iuid"		)
>  _S(AUPARSE_TYPE_UID,		"id"		)
>  _S(AUPARSE_TYPE_UID,		"inode_uid"	)
>  _S(AUPARSE_TYPE_UID,		"sauid"		)
> +_S(AUPARSE_TYPE_UID,		"obj_uid"	)
> +_S(AUPARSE_TYPE_UID,		"obj_gid"	)
>  _S(AUPARSE_TYPE_GID,		"gid"		)
>  _S(AUPARSE_TYPE_GID,		"egid"		)
>  _S(AUPARSE_TYPE_GID,		"sgid"		)

I don't know the code particularly well but from reading the patch it
strikes me that in this chunk "obj_gid" should probably be
AUPARSE_TYPE_GID rather than AUPARSE_TYPE_UID.


Stephen Quinney

-- 
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.