[AUDIT] Allow filtering on system call success _or_ failure

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

[AUDIT] Allow filtering on system call success _or_ failure
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
b01f2cc1 · David Woodhouse · 17888225 · b01f2cc1
Commit b01f2cc1 authored Aug 27, 2005 by David Woodhouse
Hide whitespace changes
Inline Side-by-side

Showing with 6 additions and 2 deletions

kernel/auditsc.c kernel/auditsc.c +6 -2

No files found.
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -440,8 +440,12 @@ static int audit_filter_rules(struct task_struct *tsk,
 				result = (ctx->return_code == value);
 			break;
 		case AUDIT_SUCCESS:
-			if (ctx && ctx->return_valid)
-				result = (ctx->return_valid == AUDITSC_SUCCESS);
+			if (ctx && ctx->return_valid) {
+				if (value)
+					result = (ctx->return_valid == AUDITSC_SUCCESS);
+				else
+					result = (ctx->return_valid == AUDITSC_FAILURE);
+			}
 			break;
 		case AUDIT_DEVMAJOR:
 			if (ctx) {