[PATCH] make it match explicitly when use option '-a', '-A' and '-d' to specify "list,action"

Hello Steve, I know "list" and "action" can be changed, this is convenient. But wildcard match maybe make user confused, for example "auditctl -a noentry,noalways" will add a rule same with "auditctl -a entry,always". furthermore, comma must be used to seperate list and action according to manpage: "Please note the comma separating the two values. Omitting it will cause errors." but now, "auditctl -a entryalways" will add the same rule. So we'd better make it match explicitly. This is a patch for latest audit-1.7.4. Signed-off-by: Yu Zhiguo<yuzg(a)cn.fujitsu.com> --- src/auditctl.c | 25 ++++++++++++++++--------- 1 files changed, 16 insertions(+), 9 deletions(-) diff --git a/src/auditctl.c b/src/auditctl.c index 2c136ea..1aba437 100644 --- a/src/auditctl.c +++ b/src/auditctl.c @@ -168,27 +168,34 @@ static void usage(void) /* Returns 0 ok, 1 deprecated action, 2 error */ static int audit_rule_setup(const char *opt, int *flags, int *act) { - if (strstr(opt, "task")) + char *p; + if ((strchr(opt, ',') != strrchr(opt, ',')) || !strchr(opt, ',')) + return 2; + + p = strchr(opt, ','); + if (!strncmp(opt, "task,", p - opt + 1) || !strcmp(p, ",task")) *flags = AUDIT_FILTER_TASK; - else if (strstr(opt, "entry")) + else if (!strncmp(opt, "entry,", p - opt + 1) || !strcmp(p, ",entry")) *flags = AUDIT_FILTER_ENTRY; - else if (strstr(opt, "exit")) + else if (!strncmp(opt, "exit,", p - opt + 1) || !strcmp(p, ",exit")) *flags = AUDIT_FILTER_EXIT; - else if (strstr(opt, "user")) + else if (!strncmp(opt, "user,", p - opt + 1) || !strcmp(p, ",user")) *flags = AUDIT_FILTER_USER; - else if (strstr(opt, "exclude")) { + else if (!strncmp(opt, "exclude,", p - opt + 1) || !strcmp(p, ",exclude")) { *flags = AUDIT_FILTER_EXCLUDE; exclude = 1; } else return 2; - if (strstr(opt, "never")) + + if (!strncmp(opt, "always,", p - opt + 1) || !strcmp(p, ",always")) + *act = AUDIT_ALWAYS; + else if (!strncmp(opt, "never,", p - opt + 1) || !strcmp(p, ",never")) *act = AUDIT_NEVER; - else if (strstr(opt, "possible")) + else if (!strncmp(opt, "possible,", p - opt + 1) || !strcmp(p, ",possible")) return 1; - else if (strstr(opt, "always")) - *act = AUDIT_ALWAYS; else return 2; + return 0; }