[PATCH 1/4] Fix the bug of the error message for -7 when checking field

[zhangxiliang]

Hello Steve, 

When field is AUDIT_EXIT, AUDIT_SUCCESS and so on, the entry,user,task,exclude filter list should be invalid on anything.
So I think using "flags != AUDIT_FILTER_EXIT" is better than "flags == AUDIT_FILTER_ENTRY".

The error message for "-7" is not suit in some conditions.
For example,
1, auditctl -a task,always -F perm=r
Error message is "Field perm cannot be checked at syscall entry".

It should be task filter list.

Signed-off-by: Zhang Xiliang <zhangxiliang at cn.fujitsu.com>
---
 lib/deprecated.c |    5 ++---
 lib/libaudit.c   |    4 ++--
 src/auditctl.c   |    2 +-
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/lib/deprecated.c b/lib/deprecated.c
index 4f0c14e..4ad8253 100644
--- a/lib/deprecated.c
+++ b/lib/deprecated.c
@@ -281,7 +281,7 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags)
 			}
 			break;
 		case AUDIT_EXIT:
-			if (flags == AUDIT_FILTER_ENTRY)
+			if (flags != AUDIT_FILTER_EXIT)
 				return -7;
 			vlen = strlen(v);
 			if (isdigit((char)*(v)))
@@ -427,8 +427,7 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags)
 			return -10;
                 case AUDIT_DEVMAJOR...AUDIT_INODE:
                 case AUDIT_SUCCESS...AUDIT_SUCCESS:
-
-			if (flags == AUDIT_FILTER_ENTRY)
+			if (flags != AUDIT_FILTER_EXIT)
 				return -7;
 			/* fallthrough */
 		default:
diff --git a/lib/libaudit.c b/lib/libaudit.c
index 563b8ad..d439c2f 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -870,7 +870,7 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
 			}
 			break;
 		case AUDIT_EXIT:
-			if (flags == AUDIT_FILTER_ENTRY)
+			if (flags != AUDIT_FILTER_EXIT)
 				return -7;
 			vlen = strlen(v);
 			if (isdigit((char)*(v))) 
@@ -1071,7 +1071,7 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
 			break;
 		case AUDIT_DEVMAJOR...AUDIT_INODE:
 		case AUDIT_SUCCESS...AUDIT_SUCCESS:
-			if (flags == AUDIT_FILTER_ENTRY)
+			if (flags != AUDIT_FILTER_EXIT)
 				return -7;
 			/* fallthrough */
 		default:
diff --git a/src/auditctl.c b/src/auditctl.c
index d740509..5b6de26 100644
--- a/src/auditctl.c
+++ b/src/auditctl.c
@@ -739,7 +739,7 @@ static int setopt(int count, char *vars[])
 				break;
 			case -7:
 				fprintf(stderr,
-			 "Field %s cannot be checked at syscall entry\n",
+			 "Field %s can only be used with exit filter list\n",
 					 optarg);
 				retval = -1;
 				break;


-- 
Regards
Zhang Xiliang