audit: do not reject all AUDIT_INODE filter types
commit ab61d38ed8
tried to merge the
invalid filter checking into a single function. However AUDIT_INODE
filters were not verified in the new generic checker. Thus such rules
were being denied even though they were perfectly valid.
Ex:
$ auditctl -a exit,always -F arch=b64 -S open -F key=/foo -F inode=6955 -F devmajor=9 -F devminor=1
Error sending add rule data request (Invalid argument)
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
This commit is contained in:
Родитель
a20b62bdf7
Коммит
78122037b7
|
@ -343,6 +343,7 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
|
|||
case AUDIT_DEVMINOR:
|
||||
case AUDIT_EXIT:
|
||||
case AUDIT_SUCCESS:
|
||||
case AUDIT_INODE:
|
||||
/* bit ops are only useful on syscall args */
|
||||
if (f->op == Audit_bitmask || f->op == Audit_bittest)
|
||||
return -EINVAL;
|
||||
|
|
Загрузка…
Ссылка в новой задаче