[PATCH 2/4] Add the checking for field AUDIT_FILETYPE and AUDIT_PPID

[PATCH 2/4] Add the checking for field AUDIT_FILETYPE and AUDIT_PPID

[zhangxiliang]

Hello Steve, 

When field is AUDIT_FILETYPET and AUDIT_PPID, it can only used for AUDIT_FILTER_EXIT and AUDIT_FILTER_ENTRY.
I think the fields shoud be check before send audit rule to kernel.
I add checking and error message "-17" to realize it.

Signed-off-by: Zhang Xiliang <zhangxiliang@cn.fujitsu.com>
---
 lib/deprecated.c |    6 ++++++
 lib/libaudit.c   |    7 +++++++
 src/auditctl.c   |    5 +++++
 3 files changed, 18 insertions(+), 0 deletions(-)

diff --git a/lib/deprecated.c b/lib/deprecated.c
index 4ad8253..695e5d6 100644
--- a/lib/deprecated.c
+++ b/lib/deprecated.c
@@ -403,6 +403,8 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags)
 			audit_archadded = 1;
 			break;
 		case AUDIT_FILETYPE:
+			if (flags != AUDIT_FILTER_EXIT || flags != AUDIT_FILTER_ENTRY)
+				return -17;
 			rule->values[rule->field_count] =
 				audit_name_to_ftype(v);
 			if (rule->values[rule->field_count] < 0) {
@@ -435,6 +437,10 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags)
 				if (!(op == AUDIT_NEGATE || op == 0))
 					return -13;
 			}
+			if (field == AUDIT_PPID && (flags != AUDIT_FILTER_EXIT
+				|| flags != AUDIT_FILTER_ENTRY))
+				return -17;
+
 			rule->values[rule->field_count] = strtol(v, NULL, 0);
 			break;
 	}
diff --git a/lib/libaudit.c b/lib/libaudit.c
index d439c2f..5b276f1 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -1063,6 +1063,8 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
 			}
 			break;
 		case AUDIT_FILETYPE:
+			if (flags != AUDIT_FILTER_EXIT || flags != AUDIT_FILTER_ENTRY)
+				return -17;
 			rule->values[rule->field_count] = 
 				audit_name_to_ftype(v);
 			if (rule->values[rule->field_count] < 0) {
@@ -1079,6 +1081,11 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
 				if (!(op == AUDIT_NEGATE || op == AUDIT_EQUAL))
 					return -13;
 			}
+
+			if (field == AUDIT_PPID && (flags != AUDIT_FILTER_EXIT 
+				|| flags != AUDIT_FILTER_ENTRY))
+				return -17;
+
 			rule->values[rule->field_count] = strtol(v, NULL, 0);
 			break;
 	}
diff --git a/src/auditctl.c b/src/auditctl.c
index 5b6de26..2e64d28 100644
--- a/src/auditctl.c
+++ b/src/auditctl.c
@@ -789,6 +789,11 @@ static int setopt(int count, char *vars[])
 					"-F unknown file type - %s\n", optarg);
 				retval = -1;
 				break;
+			case -17:
+				fprintf(stderr,
+					"Field %s can only be used with exit and entry filter list\n", optarg);
+				retval = -1;
+				break;
 			default:
 				retval = -1;
 				break;

-- 
Regards
Zhang Xiliang

Re: [PATCH 2/4] Add the checking for field AUDIT_FILETYPE and AUDIT_PPID

[Steve Grubb]

On Saturday 02 August 2008 06:09:15 zhangxiliang wrote:
> When field is AUDIT_FILETYPET and AUDIT_PPID, it can only used for
> AUDIT_FILTER_EXIT and AUDIT_FILTER_ENTRY. I think the fields shoud be check
> before send audit rule to kernel. I add checking and error message "-17" to
> realize it.

Applied. Thanks !

-Steve