[PATCH 1/5] Add the field checking for missing value after opration

[Zhang Xiliang]

Hello Steve, 

I think the missing value for -F should be checking. 

For example,
auditctl -a exit,always -F pid=

No error message is output and "pid=0" is added to rule.


Signed-off-by: Zhang Xiliang <zhangxiliang at cn.fujitsu.com>
---
 lib/deprecated.c |    3 +++
 lib/libaudit.c   |    3 +++
 src/auditctl.c   |    5 +++++
 3 files changed, 11 insertions(+), 0 deletions(-)

diff --git a/lib/deprecated.c b/lib/deprecated.c
index e05e826..5a1c04f 100644
--- a/lib/deprecated.c
+++ b/lib/deprecated.c
@@ -230,6 +230,9 @@ int audit_rule_fieldpair(struct audit_rule *rule, const char *pair, int flags)
 	if (v == NULL || f == v)
 		return -1;
 
+	if (*v == NULL)
+		return -20;
+
 	audit_msg(LOG_DEBUG,"pair=%s\n", f);
 	if ((field = audit_name_to_field(f)) < 0) 
 		return -2;
diff --git a/lib/libaudit.c b/lib/libaudit.c
index 4bedfaf..6ec15d8 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -823,6 +823,9 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
 	if (v == NULL || f == v)
 		return -1;
 
+	if (*v == NULL)
+		return -20;
+
 	if ((field = audit_name_to_field(f)) < 0) 
 		return -2;
 
diff --git a/src/auditctl.c b/src/auditctl.c
index 48f1369..3958afb 100644
--- a/src/auditctl.c
+++ b/src/auditctl.c
@@ -847,6 +847,11 @@ static int setopt(int count, char *vars[])
 					"Key field needs a watch or syscall given prior to it\n");
 				retval = -1;
 				break;
+			case -20:
+				fprintf(stderr,
+					"-F missing value after opration for %s\n", optarg);
+				retval = -1;
+				break;
 			default:
 				retval = -1;
 				break;