[PATCH] tests/filter_exclude: euid filtering now possible in exclude filter

[Paul Moore]

On Tue, Feb 14, 2023 at 2:23 PM Paul Moore <paul at paul-moore.com> wrote:
>
> Starting with Steve's audit userspace v3.1, an euid exclude filter no
> longer results in an error.  Adjust the test accordingly.
>
> Signed-off-by: Paul Moore <paul at paul-moore.com>
> ---
>  tests/filter_exclude/test | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

As we are nearing the next upstream kernel release I'm going to merge
this right now so the tests continue to run clear (making it easier to
catch other regressions quickly), but if anyone has any concerns over
this patch please still voice them and I'll be sure to fix them up.

> diff --git a/tests/filter_exclude/test b/tests/filter_exclude/test
> index 7a8e3fb..248fc54 100755
> --- a/tests/filter_exclude/test
> +++ b/tests/filter_exclude/test
> @@ -103,7 +103,7 @@ $result = system("auditctl -a exclude,always -F ppid=$ppid >/dev/null 2>&1");
>  ok( $result ne 0 );
>  system("auditctl -d exclude,always -F ppid=$ppid >/dev/null 2>&1");
>  $result = system("auditctl -a exclude,always -F euid=$euid >/dev/null 2>&1");
> -ok( $result ne 0 );
> +ok( $result, 0 );
>  system("auditctl -d exclude,always -F euid=$euid >/dev/null 2>&1");
>  $result =
>    system("auditctl -a exclude,always -F obj_user=$obj_user >/dev/null 2>&1");
> --
> 2.39.1

-- 
paul-moore.com