[PATCH] delete redundant info from result of 'auditctl -l'

[PATCH] delete redundant info from result of 'auditctl -l'

[Yu Zhiguo]

Hello steve,

The field of 'syscall=all' is redundant for fielter 'exclude',
so it should be deleted, e.g.
  # auditctl -l
  LIST_RULES: exclude,always syscall=all

should be:
  LIST_RULES: exclude,always

Signed-off-by: Yu Zhiguo<yuzg@cn.fujitsu.com>
---
 src/auditctl.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/src/auditctl.c b/src/auditctl.c
index 70a54f3..60c2a80 100644
--- a/src/auditctl.c
+++ b/src/auditctl.c
@@ -1424,7 +1424,9 @@ static int audit_print_reply(struct audit_reply *rep)
 				((rep->rule->flags & AUDIT_FILTER_MASK) != 
 						AUDIT_FILTER_USER) &&
 				((rep->rule->flags & AUDIT_FILTER_MASK) !=
-						AUDIT_FILTER_TASK)) {
+						AUDIT_FILTER_TASK) &&
+				((rep->rule->flags & AUDIT_FILTER_MASK) !=
+						AUDIT_FILTER_EXCLUDE)) {
 				printf(" syscall=");
 				for (sparse = 0, i = 0; 
 					i < (AUDIT_BITMASK_SIZE-1); i++) {
-- 
1.5.4.2

Re: [PATCH] delete redundant info from result of 'auditctl -l'

[Steve Grubb]

On Friday 29 August 2008 04:55:47 Yu Zhiguo wrote:
> The field of 'syscall=all' is redundant for fielter 'exclude',
> so it should be deleted, e.g.
>   # auditctl -l
>   LIST_RULES: exclude,always syscall=all
>
> should be:
>   LIST_RULES: exclude,always

Applied. Thanks for the patch !

-Steve