Commit b01f2cc1 authored by David Woodhouse's avatar David Woodhouse

[AUDIT] Allow filtering on system call success _or_ failure

Signed-off-by: default avatarDavid Woodhouse <dwmw2@infradead.org>
parent 17888225
......@@ -440,8 +440,12 @@ static int audit_filter_rules(struct task_struct *tsk,
result = (ctx->return_code == value);
break;
case AUDIT_SUCCESS:
if (ctx && ctx->return_valid)
result = (ctx->return_valid == AUDITSC_SUCCESS);
if (ctx && ctx->return_valid) {
if (value)
result = (ctx->return_valid == AUDITSC_SUCCESS);
else
result = (ctx->return_valid == AUDITSC_FAILURE);
}
break;
case AUDIT_DEVMAJOR:
if (ctx) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment