Re: [PATCH] tests/filter_exclude: euid filtering now possible in exclude filter

From: Paul Moore <paul@paul-moore.com>
To: audit@vger.kernel.org, linux-audit@redhat.com
Subject: Re: [PATCH] tests/filter_exclude: euid filtering now possible in exclude filter
Date: Tue, 14 Feb 2023 14:26:00 -0500	[thread overview]
Message-ID: <CAHC9VhSiVBN_4EKdq3ZFMRQgqKWCHxORt1Ss4W-OUv760tF3yw@mail.gmail.com> (raw)
In-Reply-To: <20230214192326.239267-1-paul@paul-moore.com>

On Tue, Feb 14, 2023 at 2:23 PM Paul Moore <paul@paul-moore.com> wrote:
>
> Starting with Steve's audit userspace v3.1, an euid exclude filter no
> longer results in an error.  Adjust the test accordingly.
>
> Signed-off-by: Paul Moore <paul@paul-moore.com>
> ---
>  tests/filter_exclude/test | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

As we are nearing the next upstream kernel release I'm going to merge
this right now so the tests continue to run clear (making it easier to
catch other regressions quickly), but if anyone has any concerns over
this patch please still voice them and I'll be sure to fix them up.

> diff --git a/tests/filter_exclude/test b/tests/filter_exclude/test
> index 7a8e3fb..248fc54 100755
> --- a/tests/filter_exclude/test
> +++ b/tests/filter_exclude/test
> @@ -103,7 +103,7 @@ $result = system("auditctl -a exclude,always -F ppid=$ppid >/dev/null 2>&1");
>  ok( $result ne 0 );
>  system("auditctl -d exclude,always -F ppid=$ppid >/dev/null 2>&1");
>  $result = system("auditctl -a exclude,always -F euid=$euid >/dev/null 2>&1");
> -ok( $result ne 0 );
> +ok( $result, 0 );
>  system("auditctl -d exclude,always -F euid=$euid >/dev/null 2>&1");
>  $result =
>    system("auditctl -a exclude,always -F obj_user=$obj_user >/dev/null 2>&1");
> --
> 2.39.1

-- 
paul-moore.com

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit