Hello Steve, When field is AUDIT_EXIT, AUDIT_SUCCESS and so on, the entry,user,task,exclude filter list should be invalid on anything. So I think using "flags != AUDIT_FILTER_EXIT" is better than "flags == AUDIT_FILTER_ENTRY". The error message for "-7" is not suit in some conditions. For example, 1, auditctl -a task,always -F perm=r Error message is "Field perm cannot be checked at syscall entry". It should be task filter list. Signed-off-by: Zhang Xiliang <zhangxiliang(a)cn.fujitsu.com&gt; --- lib/deprecated.c | 5 ++--- lib/libaudit.c | 4 ++-- src/auditctl.c | 2 +- 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/lib/deprecated.c b/lib/deprecated.c index 4f0c14e..4ad8253 100644 --- a/lib/deprecated.c +++ b/lib/deprecated.c @@ -281,7 +281,7 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags) } break; case AUDIT_EXIT: - if (flags == AUDIT_FILTER_ENTRY) + if (flags != AUDIT_FILTER_EXIT) return -7; vlen = strlen(v); if (isdigit((char)*(v))) @@ -427,8 +427,7 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags) return -10; case AUDIT_DEVMAJOR...AUDIT_INODE: case AUDIT_SUCCESS...AUDIT_SUCCESS: - - if (flags == AUDIT_FILTER_ENTRY) + if (flags != AUDIT_FILTER_EXIT) return -7; /* fallthrough */ default: diff --git a/lib/libaudit.c b/lib/libaudit.c index 563b8ad..d439c2f 100644 --- a/lib/libaudit.c +++ b/lib/libaudit.c @@ -870,7 +870,7 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, } break; case AUDIT_EXIT: - if (flags == AUDIT_FILTER_ENTRY) + if (flags != AUDIT_FILTER_EXIT) return -7; vlen = strlen(v); if (isdigit((char)*(v))) @@ -1071,7 +1071,7 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, break; case AUDIT_DEVMAJOR...AUDIT_INODE: case AUDIT_SUCCESS...AUDIT_SUCCESS: - if (flags == AUDIT_FILTER_ENTRY) + if (flags != AUDIT_FILTER_EXIT) return -7; /* fallthrough */ default: diff --git a/src/auditctl.c b/src/auditctl.c index d740509..5b6de26 100644 --- a/src/auditctl.c +++ b/src/auditctl.c @@ -739,7 +739,7 @@ static int setopt(int count, char *vars[]) break; case -7: fprintf(stderr, - "Field %s cannot be checked at syscall entry\n", + "Field %s can only be used with exit filter list\n", optarg); retval = -1; break; -- Regards Zhang Xiliang