From mboxrd@z Thu Jan 1 00:00:00 1970 From: Yu Zhiguo Subject: Re: [PATCH] make it match explicitly when use option '-a', '-A' and '-d' to specify "list,action" Date: Fri, 18 Jul 2008 19:52:26 +0800 Message-ID: <488083FA.5080504@cn.fujitsu.com> References: <48803E3C.4060209@cn.fujitsu.com> <1216370953.2664.23.camel@amilo> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <1216370953.2664.23.camel@amilo> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: =?UTF-8?B?TWlsb3NsYXYgVHJtYcSN?= Cc: audit-list List-Id: linux-audit@redhat.com Hello Miloslav, CC Steve, Thanks for you comment, Miloslav Trma=C4=8D wrote: >> I know "list" and "action" can be changed, this is convenient. > No, it is undocumented. As an author of system-config-audit I'd much > prefer if audit rejected such options, replicating the exact code in > auditctl in order to handle all undocumented behavior the same way as > auditctl is rather impractical. Indeed it is uncompatible with manpage, but it seems that Mr. Steve like this convenient method: =3D=3D=3D=3D=3D=3D=3Drefer to mail from Steve(2008/05/08)=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > I am a little surprised that the "-a always,exit" doesn't cause an > > error. I wonder if it works correctly - maybe auditctl code is smar= t > > enough to overcome syntactic dyslexia? :) I was always mixing up the order when writing rules, so I fixed auditct= l to take it in either order. Its been like this for 3-4 years. > p =3D strchr(opt, ','); > if (p =3D=3D NULL || strchr(p + 1, ',') !=3D NULL) > return 2; > would be simpler. I think so, thanks.. >=20 >> - if (strstr(opt, "task")) >> + if (!strncmp(opt, "task,", p - opt + 1) || !strcmp(p, ",task")) >> *flags =3D AUDIT_FILTER_TASK; > Each string should be recognized only in the documented position IMHO. > The patch also replaces case-sensitive matching by case-insensitive, > which is not described above. Both strstr and strcmp are case-sensitive. >=20 > If such changes in the semantics of the parameter are accepted, at > minimum the auditctl.8 man page should be updated as well. I think the manpage should introduce that the order of "list" and "action" can be changed. What's the opinion of Mr. Steve? If you think the manpage is right, we should correct the code to compatible with it, and I'll make another patch. if order insensitive is right, the simpler patch now: --- src/auditctl.c | 26 +++++++++++++++++--------- 1 files changed, 17 insertions(+), 9 deletions(-) diff --git a/src/auditctl.c b/src/auditctl.c index 2c136ea..a268bcf 100644 --- a/src/auditctl.c +++ b/src/auditctl.c @@ -168,27 +168,35 @@ static void usage(void) /* Returns 0 ok, 1 deprecated action, 2 error */ static int audit_rule_setup(const char *opt, int *flags, int *act) { - if (strstr(opt, "task")) + char *p; + + p =3D strchr(opt, ','); + if (!p || strchr(p + 1, ',')) + return 2; + + if (!strncmp(opt, "task,", p - opt + 1) || !strcmp(p, ",task")) *flags =3D AUDIT_FILTER_TASK; - else if (strstr(opt, "entry")) + else if (!strncmp(opt, "entry,", p - opt + 1) || !strcmp(p, ",entry")) *flags =3D AUDIT_FILTER_ENTRY; - else if (strstr(opt, "exit")) + else if (!strncmp(opt, "exit,", p - opt + 1) || !strcmp(p, ",exit")) *flags =3D AUDIT_FILTER_EXIT; - else if (strstr(opt, "user")) + else if (!strncmp(opt, "user,", p - opt + 1) || !strcmp(p, ",user")) *flags =3D AUDIT_FILTER_USER; - else if (strstr(opt, "exclude")) { + else if (!strncmp(opt, "exclude,", p - opt + 1) || !strcmp(p, ",exclude= ")) { *flags =3D AUDIT_FILTER_EXCLUDE; exclude =3D 1; } else return 2; - if (strstr(opt, "never")) + + if (!strncmp(opt, "always,", p - opt + 1) || !strcmp(p, ",always")) + *act =3D AUDIT_ALWAYS; + else if (!strncmp(opt, "never,", p - opt + 1) || !strcmp(p, ",never")) *act =3D AUDIT_NEVER; - else if (strstr(opt, "possible")) + else if (!strncmp(opt, "possible,", p - opt + 1) || !strcmp(p, ",possib= le")) return 1; - else if (strstr(opt, "always")) - *act =3D AUDIT_ALWAYS; else return 2; + return 0; }