Commit 78122037 authored Sep 04, 2013 by Eric Paris

audit: do not reject all AUDIT_INODE filter types



commit ab61d38e tried to merge the
invalid filter checking into a single function.  However AUDIT_INODE
filters were not verified in the new generic checker.  Thus such rules
were being denied even though they were perfectly valid.

Ex:
$ auditctl -a exit,always -F arch=b64 -S open -F key=/foo -F inode=6955 -F devmajor=9 -F devminor=1
Error sending add rule data request (Invalid argument)

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>

parent a20b62bd

kernel/auditfilter.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -343,6 +343,7 @@ static int audit_field_valid(struct audit_entry entry, struct audit_field f)
		case AUDIT_DEVMINOR:
		case AUDIT_EXIT:
		case AUDIT_SUCCESS:
		case AUDIT_INODE:
		/* bit ops are only useful on syscall args */
		if (f->op == Audit_bitmask \|\| f->op == Audit_bittest)
		return -EINVAL;

Admin message