Hello Steve, When field is AUDIT_FILETYPET and AUDIT_PPID, it can only used for AUDIT_FILTER_EXIT and AUDIT_FILTER_ENTRY. I think the fields shoud be check before send audit rule to kernel. I add checking and error message "-17" to realize it. Signed-off-by: Zhang Xiliang <zhangxiliang(a)cn.fujitsu.com&gt; --- lib/deprecated.c | 6 ++++++ lib/libaudit.c | 7 +++++++ src/auditctl.c | 5 +++++ 3 files changed, 18 insertions(+), 0 deletions(-) diff --git a/lib/deprecated.c b/lib/deprecated.c index 4ad8253..695e5d6 100644 --- a/lib/deprecated.c +++ b/lib/deprecated.c @@ -403,6 +403,8 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags) audit_archadded = 1; break; case AUDIT_FILETYPE: + if (flags != AUDIT_FILTER_EXIT || flags != AUDIT_FILTER_ENTRY) + return -17; rule->values[rule->field_count] = audit_name_to_ftype(v); if (rule->values[rule->field_count] < 0) { @@ -435,6 +437,10 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags) if (!(op == AUDIT_NEGATE || op == 0)) return -13; } + if (field == AUDIT_PPID && (flags != AUDIT_FILTER_EXIT + || flags != AUDIT_FILTER_ENTRY)) + return -17; + rule->values[rule->field_count] = strtol(v, NULL, 0); break; } diff --git a/lib/libaudit.c b/lib/libaudit.c index d439c2f..5b276f1 100644 --- a/lib/libaudit.c +++ b/lib/libaudit.c @@ -1063,6 +1063,8 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, } break; case AUDIT_FILETYPE: + if (flags != AUDIT_FILTER_EXIT || flags != AUDIT_FILTER_ENTRY) + return -17; rule->values[rule->field_count] = audit_name_to_ftype(v); if (rule->values[rule->field_count] < 0) { @@ -1079,6 +1081,11 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, if (!(op == AUDIT_NEGATE || op == AUDIT_EQUAL)) return -13; } + + if (field == AUDIT_PPID && (flags != AUDIT_FILTER_EXIT + || flags != AUDIT_FILTER_ENTRY)) + return -17; + rule->values[rule->field_count] = strtol(v, NULL, 0); break; } diff --git a/src/auditctl.c b/src/auditctl.c index 5b6de26..2e64d28 100644 --- a/src/auditctl.c +++ b/src/auditctl.c @@ -789,6 +789,11 @@ static int setopt(int count, char *vars[]) "-F unknown file type - %s\n", optarg); retval = -1; break; + case -17: + fprintf(stderr, + "Field %s can only be used with exit and entry filter list\n", optarg); + retval = -1; + break; default: retval = -1; break; -- Regards Zhang Xiliang