[AUDIT] Allow filtering on system call success _or_ failure
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 488ba3d..88696f6 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -440,8 +440,12 @@
result = (ctx->return_code == value);
break;
case AUDIT_SUCCESS:
- if (ctx && ctx->return_valid)
- result = (ctx->return_valid == AUDITSC_SUCCESS);
+ if (ctx && ctx->return_valid) {
+ if (value)
+ result = (ctx->return_valid == AUDITSC_SUCCESS);
+ else
+ result = (ctx->return_valid == AUDITSC_FAILURE);
+ }
break;
case AUDIT_DEVMAJOR:
if (ctx) {