Skip to content

Commit e5b0c9d

Browse files
authored
Correct output when displaying rules with exe/path/dir (#379)
Some audit operators were not displayed properly because auditctl used the "=" operator in all the scenarios mentioned above.
1 parent 613ccbd commit e5b0c9d

1 file changed

Lines changed: 8 additions & 3 deletions

File tree

src/auditctl-listing.c

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -380,20 +380,25 @@ static void print_rule(const struct audit_rule_data *r)
380380
printf("-w %.*s", r->values[i],
381381
&r->buf[boffset]);
382382
else
383-
printf(" -F path=%.*s", r->values[i],
383+
printf(" -F path%s%.*s",
384+
audit_operator_to_symbol(op),
385+
r->values[i],
384386
&r->buf[boffset]);
385387
boffset += r->values[i];
386388
} else if (field == AUDIT_DIR) {
387389
if (watch)
388390
printf("-w %.*s", r->values[i],
389391
&r->buf[boffset]);
390392
else
391-
printf(" -F dir=%.*s", r->values[i],
393+
printf(" -F dir%s%.*s",
394+
audit_operator_to_symbol(op),
395+
r->values[i],
392396
&r->buf[boffset]);
393397

394398
boffset += r->values[i];
395399
} else if (field == AUDIT_EXE) {
396-
printf(" -F exe=%.*s",
400+
printf(" -F exe%s%.*s",
401+
audit_operator_to_symbol(op),
397402
r->values[i], &r->buf[boffset]);
398403
boffset += r->values[i];
399404
} else if (field == AUDIT_FILTERKEY) {

0 commit comments

Comments
 (0)