Hello Steve, Steve Grubb said the following on 2008-08-07 3:19: I think the way "f == v" can't make sure that they didn't type -F =10. After "v = strstr(pair, "=")" and v++. The v will not equal to f. For example, auditctl -a exit,always -F =10 Error message "-F unknown field: =10" is output. It is checked by "audit_name_to_field()", but not "f == v". Because before v++, the "*v" is set to 0. we can use "*f == 0" to check out the case. The patch is for it. Signed-off-by: Zhang Xiliang <zhangxiliang(a)cn.fujitsu.com&gt; --- lib/deprecated.c | 5 ++++- lib/libaudit.c | 5 ++++- src/auditctl.c | 4 ++++ 3 files changed, 12 insertions(+), 2 deletions(-) diff --git a/lib/deprecated.c b/lib/deprecated.c index af1780b..6bf42dd 100644 --- a/lib/deprecated.c +++ b/lib/deprecated.c @@ -227,8 +227,11 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags) // op = AUDIT_EQUAL; } - if (v == NULL || f == v) + if (v == NULL) return -1; + + if (*f == 0) + return -22; if (*v == 0) return -20; diff --git a/lib/libaudit.c b/lib/libaudit.c index 42c2176..e0f108a 100644 --- a/lib/libaudit.c +++ b/lib/libaudit.c @@ -820,8 +820,11 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, op = AUDIT_BIT_MASK; } - if (v == NULL || f == v) + if (v == NULL) return -1; + + if (*f == 0) + return -22; if (*v == 0) return -20; diff --git a/src/auditctl.c b/src/auditctl.c index 10894f9..6144795 100644 --- a/src/auditctl.c +++ b/src/auditctl.c @@ -852,6 +852,10 @@ static int setopt(int count, char *vars[]) "-F value should be a number for %s\n", optarg); retval = -1; break; + case -22: + fprintf(stderr, + "-F missing field name before operator for %s\n", optarg); + retval = -1; default: retval = -1; break;