diff options
author | Ondrej Mosnáček <omosnace@redhat.com> | 2018-04-09 10:00:06 +0200 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-08-03 07:55:25 +0200 |
commit | 5f5e70d7ec14d2b194f06e7ebe7f9396b4cdbb5f (patch) | |
tree | d5f8d7b69e5caab35c253370c424fb3324928069 /kernel/auditsc.c | |
parent | 3c90e828db81b22f37fa7d37b9759cd3f1d305ba (diff) |
audit: allow not equal op for audit by executable
[ Upstream commit 23bcc480dac204c7dbdf49d96b2c918ed98223c2 ]
Current implementation of auditing by executable name only implements
the 'equal' operator. This patch extends it to also support the 'not
equal' operator.
See: https://github.com/linux-audit/audit-kernel/issues/53
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel/auditsc.c')
-rw-r--r-- | kernel/auditsc.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 2cd5256dbff7..c2aaf539728f 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -469,6 +469,8 @@ static int audit_filter_rules(struct task_struct *tsk, break; case AUDIT_EXE: result = audit_exe_compare(tsk, rule->exe); + if (f->op == Audit_not_equal) + result = !result; break; case AUDIT_UID: result = audit_uid_comparator(cred->uid, f->op, f->uid); |