Commit 29c1372d authored May 30, 2018 by Ondrej Mosnáček Committed by Paul Moore Jun 19, 2018

audit: allow other filter list types for AUDIT_EXE

This patch removes the restriction of the AUDIT_EXE field to only
SYSCALL filter and teaches audit_filter to recognize this field.

This makes it possible to write rule lists such as:

    auditctl -a exit,always [some general rule]
    # Filter out events with executable name /bin/exe1 or /bin/exe2:
    auditctl -a exclude,always -F exe=/bin/exe1
    auditctl -a exclude,always -F exe=/bin/exe2

See: https://github.com/linux-audit/audit-kernel/issues/54



Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

parent ce397d21

kernel/auditfilter.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -428,8 +428,6 @@ static int audit_field_valid(struct audit_entry entry, struct audit_field f)
		case AUDIT_EXE:
		if (f->op != Audit_not_equal && f->op != Audit_equal)
		return -EINVAL;
		if (entry->rule.listnr != AUDIT_FILTER_EXIT)
		return -EINVAL;
		break;
		}
		return 0;
		@@ -1360,6 +1358,11 @@ int audit_filter(int msgtype, unsigned int listtype)
		f->type, f->op, f->lsm_rule, NULL);
		}
		break;
		case AUDIT_EXE:
		result = audit_exe_compare(current, e->rule.exe);
		if (f->op == Audit_not_equal)
		result = !result;
		break;
		default:
		goto unlock_and_return;
		}

Admin message