Re: bug?: audit filtering on negative values

On Wednesday 18 January 2006 15:18, Timothy R. Chavez wrote: > What kernel are you testing on? I just checked the latest kernel > (lspp.6) and this does look like a problem: > > struct audit_field { > u32 type; > u32 val; > u32 op; > }; > > > We only allow unsigned val(ues). Eek Right and that's because this is what the context stores: 129 struct audit_context { 136 unsigned long argv[4]; /* syscall arguments */