* [PATCH] delete redundant info from result of 'auditctl -l'
@ 2008-08-29 8:55 Yu Zhiguo
2008-08-29 14:52 ` Steve Grubb
0 siblings, 1 reply; 2+ messages in thread
From: Yu Zhiguo @ 2008-08-29 8:55 UTC (permalink / raw)
To: Steve Grubb; +Cc: audit-list
Hello steve,
The field of 'syscall=all' is redundant for fielter 'exclude',
so it should be deleted, e.g.
# auditctl -l
LIST_RULES: exclude,always syscall=all
should be:
LIST_RULES: exclude,always
Signed-off-by: Yu Zhiguo<yuzg@cn.fujitsu.com>
---
src/auditctl.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/src/auditctl.c b/src/auditctl.c
index 70a54f3..60c2a80 100644
--- a/src/auditctl.c
+++ b/src/auditctl.c
@@ -1424,7 +1424,9 @@ static int audit_print_reply(struct audit_reply *rep)
((rep->rule->flags & AUDIT_FILTER_MASK) !=
AUDIT_FILTER_USER) &&
((rep->rule->flags & AUDIT_FILTER_MASK) !=
- AUDIT_FILTER_TASK)) {
+ AUDIT_FILTER_TASK) &&
+ ((rep->rule->flags & AUDIT_FILTER_MASK) !=
+ AUDIT_FILTER_EXCLUDE)) {
printf(" syscall=");
for (sparse = 0, i = 0;
i < (AUDIT_BITMASK_SIZE-1); i++) {
--
1.5.4.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] delete redundant info from result of 'auditctl -l'
2008-08-29 8:55 [PATCH] delete redundant info from result of 'auditctl -l' Yu Zhiguo
@ 2008-08-29 14:52 ` Steve Grubb
0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2008-08-29 14:52 UTC (permalink / raw)
To: Yu Zhiguo; +Cc: audit-list
On Friday 29 August 2008 04:55:47 Yu Zhiguo wrote:
> The field of 'syscall=all' is redundant for fielter 'exclude',
> so it should be deleted, e.g.
> # auditctl -l
> LIST_RULES: exclude,always syscall=all
>
> should be:
> LIST_RULES: exclude,always
Applied. Thanks for the patch !
-Steve
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2008-08-29 14:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-08-29 8:55 [PATCH] delete redundant info from result of 'auditctl -l' Yu Zhiguo
2008-08-29 14:52 ` Steve Grubb
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox