Re: test patch for auditctl inter-field comparisons on euid/uid, egid/gid

Peter Moody
2011-12-16T23:35:14Z

On Thu, Dec 15, 2011 at 5:36 AM, Steve Grubb <sgrubb@redhat.com> wrote:

>
> Yeah, good catch. I can fix this when I apply the patch to svn. No need to re-
> send unless there is something else needing fixing as well.

I've got a sort of hacky way of getting -l to work.

In order to use fieldtab.h and audit_field_to_name, I had to move the
AUDIT_COMPARE_* defines to be unique WRT to the other audit fields in
include/linux/audit.h. Then I can add the AUDIT_COMPARE_* definitions
to fieldtab.h like:

_S(AUDIT_COMPARE_UID_TO_OBJ_UID, "uid,obj_uid" )
...
_S(AUDIT_COMPARE_SGID_TO_FSGID, "sgid,fsgid" )

then auditctl -l splits on the ','. This does mean that no matter what
order comparisons are entered on the command line, they'll only ever
be displayed in the order in which they appear in fieldtab.h

Does this sound reasonable? I can send my patches along if it does.

Cheers,
peter