audit: allow not equal op for audit by executable
authorOndrej Mosnáček <omosnace@redhat.com>
Mon, 9 Apr 2018 08:00:06 +0000 (10:00 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 3 Aug 2018 05:50:39 +0000 (07:50 +0200)
commit06d6d1ad241d9df531e1d8af4be6c468cb830d8b
treee7ce91161fbf80694eb3fbf608a6462b9cc1326c
parente7cb8f11f6e2341a167c1b23c58716171f3fcfb9
audit: allow not equal op for audit by executable

[ Upstream commit 23bcc480dac204c7dbdf49d96b2c918ed98223c2 ]

Current implementation of auditing by executable name only implements
the 'equal' operator. This patch extends it to also support the 'not
equal' operator.

See: https://github.com/linux-audit/audit-kernel/issues/53

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/auditfilter.c
kernel/auditsc.c