Hello Mr. Steve, This is the patch, can you apply it? If there are some deficiencies, please give me your indication. Steve Grubb wrote: Now options '-a', '-A', '-d' can be used simultaneously in a rule, but just the last one of them is effective. This usage will make users confused. So it had better not allow these options be used simultaneously, otherwise an error message will be reported. Signed-off-by: Yu Zhiguo<yuzg(a)cn.fujitsu.com> --- src/auditctl.c | 27 +++++++++++++++++++++++---- 1 files changed, 23 insertions(+), 4 deletions(-) diff --git a/src/auditctl.c b/src/auditctl.c index 2c136ea..9f31067 100644 --- a/src/auditctl.c +++ b/src/auditctl.c @@ -165,9 +165,16 @@ static void usage(void) ); } -/* Returns 0 ok, 1 deprecated action, 2 error */ +/* + * Returns 0 ok, 1 deprecated action, 2 rule error, + * 3 multiple rule insert/delete + */ static int audit_rule_setup(const char *opt, int *flags, int *act) { + static int multiple = 0; + if (++multiple != 1) + return 3; + if (strstr(opt, "task")) *flags = AUDIT_FILTER_TASK; else if (strstr(opt, "entry")) @@ -530,7 +537,11 @@ static int setopt(int count, char *vars[]) retval = -1; } else { rc = audit_rule_setup(optarg, &add, &action); - if (rc > 1) { + if (rc == 3) { + fprintf(stderr, + "Multiple rule insert/delete operation is not allowed\n"); + retval = -1; + } else if (rc == 2) { fprintf(stderr, "Append rule - bad keyword %s\n", optarg); @@ -550,7 +561,11 @@ static int setopt(int count, char *vars[]) retval = -1; } else { rc = audit_rule_setup(optarg, &add, &action); - if (rc > 1) { + if (rc == 3) { + fprintf(stderr, + "Multiple rule insert/delete operation is not allowed\n"); + retval = -1; + } else if (rc == 2) { fprintf(stderr, "Add rule - bad keyword %s\n", optarg); retval = -1; @@ -566,7 +581,11 @@ static int setopt(int count, char *vars[]) break; case 'd': rc = audit_rule_setup(optarg, &del, &action); - if (rc > 1) { + if (rc == 3) { + fprintf(stderr, + "Multiple rule insert/delete operation is not allowed\n"); + retval = -1; + } else if (rc == 2) { fprintf(stderr, "Delete rule - bad keyword %s\n", optarg); retval = -1;