test patch for auditctl inter-field comparisons on euid/uid, egid/gid

Peter Moody pmoody at google.com
Tue Feb 28 23:12:21 UTC 2012


On Tue, Feb 28, 2012 at 3:07 PM, Steve Grubb <sgrubb at redhat.com> wrote:
> On Wednesday, December 14, 2011 08:18:30 PM Peter Moody wrote:
>> > Testing has revealed a couple of bugs in this. Fixing these and
>> > testing some more now.
>>
>> Ok, this should be the last one. I was apparently a little more tired
>> riding the shuttle home than I thought I was. The patch last night was
>> missing a break and a number of the AUDIT_COMPARE_* fields were plain
>> wrong.
>>
>> This one tests good to me though.
>
> This patch + some changes and additions has been applied.
> https://fedorahosted.org/audit/changeset/642

Excellent, I was just about ask about this.

> If I could go back in time, I would have suggested using a bitmap for left and
> right side so we could avoid the big switch/case constructs. But it works fine
> the way it is. :)

ah, good point. oh well, thanks for applying it.

-- 
Peter Moody      Google    1.650.253.7306
Security Engineer  pgp:0xC3410038




More information about the Linux-audit mailing list