[PATCH] tests/filter_exclude: euid filtering now possible in exclude filter

[PATCH] tests/filter_exclude: euid filtering now possible in exclude filter

[Paul Moore]

Starting with Steve's audit userspace v3.1, an euid exclude filter no
longer results in an error.  Adjust the test accordingly.

Signed-off-by: Paul Moore <paul@paul-moore.com>
---
 tests/filter_exclude/test | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/filter_exclude/test b/tests/filter_exclude/test
index 7a8e3fb..248fc54 100755
--- a/tests/filter_exclude/test
+++ b/tests/filter_exclude/test
@@ -103,7 +103,7 @@ $result = system("auditctl -a exclude,always -F ppid=$ppid >/dev/null 2>&1");
 ok( $result ne 0 );
 system("auditctl -d exclude,always -F ppid=$ppid >/dev/null 2>&1");
 $result = system("auditctl -a exclude,always -F euid=$euid >/dev/null 2>&1");
-ok( $result ne 0 );
+ok( $result, 0 );
 system("auditctl -d exclude,always -F euid=$euid >/dev/null 2>&1");
 $result =
   system("auditctl -a exclude,always -F obj_user=$obj_user >/dev/null 2>&1");
-- 
2.39.1

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: [PATCH] tests/filter_exclude: euid filtering now possible in exclude filter

[Paul Moore]

On Tue, Feb 14, 2023 at 2:23 PM Paul Moore <paul@paul-moore.com> wrote:
>
> Starting with Steve's audit userspace v3.1, an euid exclude filter no
> longer results in an error.  Adjust the test accordingly.
>
> Signed-off-by: Paul Moore <paul@paul-moore.com>
> ---
>  tests/filter_exclude/test | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

As we are nearing the next upstream kernel release I'm going to merge
this right now so the tests continue to run clear (making it easier to
catch other regressions quickly), but if anyone has any concerns over
this patch please still voice them and I'll be sure to fix them up.

> diff --git a/tests/filter_exclude/test b/tests/filter_exclude/test
> index 7a8e3fb..248fc54 100755
> --- a/tests/filter_exclude/test
> +++ b/tests/filter_exclude/test
> @@ -103,7 +103,7 @@ $result = system("auditctl -a exclude,always -F ppid=$ppid >/dev/null 2>&1");
>  ok( $result ne 0 );
>  system("auditctl -d exclude,always -F ppid=$ppid >/dev/null 2>&1");
>  $result = system("auditctl -a exclude,always -F euid=$euid >/dev/null 2>&1");
> -ok( $result ne 0 );
> +ok( $result, 0 );
>  system("auditctl -d exclude,always -F euid=$euid >/dev/null 2>&1");
>  $result =
>    system("auditctl -a exclude,always -F obj_user=$obj_user >/dev/null 2>&1");
> --
> 2.39.1

-- 
paul-moore.com

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit