Hello Steve, When field is AUDIT_FILTERKEY, it should need a watch or syscall given prior to it. So I add checking and error message "-19" to realize it. Do you agree with me? This is the patches for latest code in audit SVN project. Signed-off-by: Zhang Xiliang <zhangxiliang(a)cn.fujitsu.com&gt; --- lib/libaudit.c | 3 +++ src/auditctl.c | 7 ++++++- 2 files changed, 9 insertions(+), 1 deletions(-) diff --git a/lib/libaudit.c b/lib/libaudit.c index 4d20261..8dd5baa 100644 --- a/lib/libaudit.c +++ b/lib/libaudit.c @@ -75,6 +75,7 @@ static const struct nv_list failure_actions[] = { NULL, 0 } }; +int audit_permadded hidden = 0; int audit_archadded hidden = 0; int audit_syscalladded hidden = 0; unsigned int audit_elf hidden = 0U; @@ -920,6 +921,8 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, case AUDIT_SUBJ_SEN: case AUDIT_SUBJ_CLR: case AUDIT_FILTERKEY: + if (field == AUDIT_FILTERKEY && !(audit_syscalladded || audit_permadded)) + return -19; vlen = strlen(v); if (field == AUDIT_FILTERKEY && vlen > AUDIT_MAX_KEY_LEN) diff --git a/src/auditctl.c b/src/auditctl.c index 0d38ac1..2c99e09 100644 --- a/src/auditctl.c +++ b/src/auditctl.c @@ -67,7 +67,6 @@ enum { OLD, NEW }; int which; static struct audit_rule rule; static struct audit_rule_data *rule_new = NULL; -int audit_permadded; static char key[AUDIT_MAX_KEY_LEN+1]; static int keylen; static int printed; @@ -77,6 +76,7 @@ static const char key_sep[2] = { AUDIT_KEY_SEPARATOR, 0 }; extern int audit_archadded; extern int audit_syscalladded; extern unsigned int audit_elf; +extern int audit_permadded; /* * This function will reset everything used for each loop when loading @@ -799,6 +799,11 @@ static int setopt(int count, char *vars[]) "Field %s can not be used with exclude filter list\n", optarg); retval = -1; break; + case -19: + fprintf(stderr, + "Key field needs a watch or syscall given prior to it\n"); + retval = -1; + break; default: retval = -1; break; -- Regards Zhang Xiliang