Re: [userspace PATCH v2 2/2] Check exclude filter cred extension fields available in kernel

Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- trunk/lib/errormsg.h | 2 +- trunk/lib/libaudit.c | 39 ++++++++++++++++++++++----------------- trunk/lib/libaudit.h | 3 +++ 3 files changed, 26 insertions(+), 18 deletions(-) diff --git a/trunk/lib/errormsg.h b/trunk/lib/errormsg.h index 84bfdb3..4a897be 100644 --- a/trunk/lib/errormsg.h +++ b/trunk/lib/errormsg.h @@ -47,7 +47,7 @@ static const struct msg_tab err_msgtab[] = { { -9, 0, "msgtype field can only be used with exclude filter list" }, { -10, 0, "Failed upgrading rule" }, { -11, 0, "String value too long" }, - { -12, 0, "Only msgtype field can be used with exclude filter" }, + { -12, 0, "Only msgtype, uid, gid, auid*, subj* fields can be used with exclude filter" }, { -13, 1, "only takes = or != operators" }, { -14, 0, "Permission can only contain \'rwxa\'" }, { -15, 2, "-F unknown errno -"}, diff --git a/trunk/lib/libaudit.c b/trunk/lib/libaudit.c index 798b3c8..5ffc38c 100644 --- a/trunk/lib/libaudit.c +++ b/trunk/lib/libaudit.c @@ -1401,23 +1401,28 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, return -2; /* Exclude filter can be used only with MSGTYPE and cred fields */ - if (flags == AUDIT_FILTER_EXCLUDE) - switch(field) { - case AUDIT_PID: - case AUDIT_UID: - case AUDIT_GID: - case AUDIT_LOGINUID: - case AUDIT_LOGINUID_SET: - case AUDIT_MSGTYPE: - case AUDIT_SUBJ_USER: - case AUDIT_SUBJ_ROLE: - case AUDIT_SUBJ_TYPE: - case AUDIT_SUBJ_SEN: - case AUDIT_SUBJ_CLR: - break; - default: - return -12; - } + if (flags == AUDIT_FILTER_EXCLUDE) { + if ((features & AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND) == 0) {

+ if (field != AUDIT_MSGTYPE) + return -30; + } else + switch(field) { + case AUDIT_PID: + case AUDIT_UID: + case AUDIT_GID: + case AUDIT_LOGINUID: + case AUDIT_LOGINUID_SET: + case AUDIT_MSGTYPE: + case AUDIT_SUBJ_USER: + case AUDIT_SUBJ_ROLE: + case AUDIT_SUBJ_TYPE: + case AUDIT_SUBJ_SEN: + case AUDIT_SUBJ_CLR: + break; + default: + return -12; + } + } rule->fields[rule->field_count] = field; rule->fieldflags[rule->field_count] = op; diff --git a/trunk/lib/libaudit.h b/trunk/lib/libaudit.h index 0852bcc..f77691f 100644 --- a/trunk/lib/libaudit.h +++ b/trunk/lib/libaudit.h @@ -278,6 +278,9 @@ extern "C" { #ifndef AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH #define AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH 0x00000004 #endif +#ifndef AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND +#define AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND 0x00000008 +#endif /* Defines for interfield comparison update */ #ifndef AUDIT_OBJ_UID