Re: test patch for auditctl inter-field comparisons on euid/uid, egid/gid

Stephen Quinney
2011-12-15T06:55:53Z

On Wed, Dec 14, 2011 at 05:18:30PM -0800, Peter Moody wrote:

> diff --git a/trunk/auparse/typetab.h b/trunk/auparse/typetab.h
> index 746573c..cf13f4d 100644
> --- a/trunk/auparse/typetab.h
> +++ b/trunk/auparse/typetab.h
> @@ -32,6 +32,8 @@ _S(AUPARSE_TYPE_UID, "iuid" )
> _S(AUPARSE_TYPE_UID, "id" )
> _S(AUPARSE_TYPE_UID, "inode_uid" )
> _S(AUPARSE_TYPE_UID, "sauid" )
> +_S(AUPARSE_TYPE_UID, "obj_uid" )
> +_S(AUPARSE_TYPE_UID, "obj_gid" )
> _S(AUPARSE_TYPE_GID, "gid" )
> _S(AUPARSE_TYPE_GID, "egid" )
> _S(AUPARSE_TYPE_GID, "sgid" )

I don't know the code particularly well but from reading the patch it
strikes me that in this chunk "obj_gid" should probably be
AUPARSE_TYPE_GID rather than AUPARSE_TYPE_UID.

Stephen Quinney

--
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.