Hello,
Yu Zhiguo píše v Pá 18. 07. 2008 v 19:52 +0800:
Miloslav Trmač wrote:
>> I know "list" and "action" can be changed, this is
convenient.
> No, it is undocumented. As an author of system-config-audit I'd much
> prefer if audit rejected such options, replicating the exact code in
> auditctl in order to handle all undocumented behavior the same way as
> auditctl is rather impractical.
Indeed it is uncompatible with manpage, but it seems that Mr. Steve
like this convenient method:
Oh. OK.
>> - if (strstr(opt, "task"))
>> + if (!strncmp(opt, "task,", p - opt + 1) || !strcmp(p,
",task"))
>> *flags = AUDIT_FILTER_TASK;
> Each string should be recognized only in the documented position IMHO.
> The patch also replaces case-sensitive matching by case-insensitive,
> which is not described above.
Both strstr and strcmp are case-sensitive.
You're obviously right, I'm
sorry. I wasn't paying enough attention.
Mirek