audit: invalid op= values for rules
Various audit events dealing with adding, removing and updating rules result in
invalid values set for the op keys which result in embedded spaces in op=
values.
The invalid values are
op="add rule" set in kernel/auditfilter.c
op="remove rule" set in kernel/auditfilter.c
op="remove rule" set in kernel/audit_tree.c
op="updated rules" set in kernel/audit_watch.c
op="remove rule" set in kernel/audit_watch.c
Replace the space in the above values with an underscore character ('_').
Coded-by: Burn Alting <burn@swtf.dyndns.org>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 8e9bc9c..b65a138 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -1060,7 +1060,7 @@
return PTR_ERR(entry);
err = audit_add_rule(entry);
- audit_log_rule_change("add rule", &entry->rule, !err);
+ audit_log_rule_change("add_rule", &entry->rule, !err);
if (err)
audit_free_rule(entry);
break;
@@ -1070,7 +1070,7 @@
return PTR_ERR(entry);
err = audit_del_rule(entry);
- audit_log_rule_change("remove rule", &entry->rule, !err);
+ audit_log_rule_change("remove_rule", &entry->rule, !err);
audit_free_rule(entry);
break;
default: