Hello Steve, When field is not AUDIT_MSGTYPE, it is invalid for exclude filter list. I think the fields shoud be check before sending to kernel. I add checking and error message "-18" to realize it. Signed-off-by: Zhang Xiliang <zhangxiliang(a)cn.fujitsu.com&gt; --- lib/deprecated.c | 3 +++ lib/libaudit.c | 3 +++ src/auditctl.c | 5 +++++ 3 files changed, 11 insertions(+), 0 deletions(-) diff --git a/lib/deprecated.c b/lib/deprecated.c index 695e5d6..e7047df 100644 --- a/lib/deprecated.c +++ b/lib/deprecated.c @@ -440,6 +440,9 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags) if (field == AUDIT_PPID && (flags != AUDIT_FILTER_EXIT || flags != AUDIT_FILTER_ENTRY)) return -17; + + if (flags == AUDIT_FILTER_EXCLUDE) + return -18; rule->values[rule->field_count] = strtol(v, NULL, 0); break; diff --git a/lib/libaudit.c b/lib/libaudit.c index 5b276f1..4d20261 100644 --- a/lib/libaudit.c +++ b/lib/libaudit.c @@ -1085,6 +1085,9 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, if (field == AUDIT_PPID && (flags != AUDIT_FILTER_EXIT || flags != AUDIT_FILTER_ENTRY)) return -17; + + if (flags == AUDIT_FILTER_EXCLUDE) + return -18; rule->values[rule->field_count] = strtol(v, NULL, 0); break; diff --git a/src/auditctl.c b/src/auditctl.c index 2e64d28..0d38ac1 100644 --- a/src/auditctl.c +++ b/src/auditctl.c @@ -794,6 +794,11 @@ static int setopt(int count, char *vars[]) "Field %s can only be used with exit and entry filter list\n", optarg); retval = -1; break; + case -18: + fprintf(stderr, + "Field %s can not be used with exclude filter list\n", optarg); + retval = -1; + break; default: retval = -1; break; -- Regards Zhang Xiliang