aboutsummaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorDustin Kirkland <dustin.kirkland@us.ibm.com>2005-11-03 15:41:46 +0000
committerAl Viro <viro@zeniv.linux.org.uk>2006-03-20 14:08:53 -0500
commitb63862f46547487388e582e8ac9083830d34f058 (patch)
tree5aa0173c02535fdd9dfe302e9c8a8a225091ed56 /security
parentb0dd25a8263dde3c30b0d7d72a8bd92d7ba0e3f5 (diff)
downloadmrst-s0i3-test-b63862f46547487388e582e8ac9083830d34f058.tar.gz
mrst-s0i3-test-b63862f46547487388e582e8ac9083830d34f058.tar.xz
mrst-s0i3-test-b63862f46547487388e582e8ac9083830d34f058.zip
[PATCH] Filter rule comparators
Currently, audit only supports the "=" and "!=" operators in the -F filter rules. This patch reworks the support for "=" and "!=", and adds support for ">", ">=", "<", and "<=". This turned out to be a pretty clean, and simply process. I ended up using the high order bits of the "field", as suggested by Steve and Amy. This allowed for no changes whatsoever to the netlink communications. See the documentation within the patch in the include/linux/audit.h area, where there is a table that explains the reasoning of the bitmask assignments clearly. The patch adds a new function, audit_comparator(left, op, right). This function will perform the specified comparison (op, which defaults to "==" for backward compatibility) between two values (left and right). If the negate bit is on, it will negate whatever that result was. This value is returned. Signed-off-by: Dustin Kirkland <dustin.kirkland@us.ibm.com> Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Diffstat (limited to 'security')
0 files changed, 0 insertions, 0 deletions