diff options
| author | Eric Paris <eparis@redhat.com> | 2013-09-04 15:01:43 -0400 |
|---|---|---|
| committer | Eric Paris <eparis@redhat.com> | 2013-11-05 11:09:16 -0500 |
| commit | 78122037b7e8febbd3116ab0da3ee6c34756bde9 (patch) | |
| tree | bdbe6a4546fec7b142de93e59bb6ab628f746db3 | |
| parent | a20b62bdf7a1ed1a334eff3c4cafa97f5826006b (diff) | |
audit: do not reject all AUDIT_INODE filter types
commit ab61d38ed8cf670946d12dc46b9198b521c790ea tried to merge the
invalid filter checking into a single function. However AUDIT_INODE
filters were not verified in the new generic checker. Thus such rules
were being denied even though they were perfectly valid.
Ex:
$ auditctl -a exit,always -F arch=b64 -S open -F key=/foo -F inode=6955 -F devmajor=9 -F devminor=1
Error sending add rule data request (Invalid argument)
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
| -rw-r--r-- | kernel/auditfilter.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 8a344cebd8bf..51f3fd4c1ed3 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -343,6 +343,7 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f) case AUDIT_DEVMINOR: case AUDIT_EXIT: case AUDIT_SUCCESS: + case AUDIT_INODE: /* bit ops are only useful on syscall args */ if (f->op == Audit_bitmask || f->op == Audit_bittest) return -EINVAL; |