Index: trunk/src/sh_ignore.c
===================================================================
--- trunk/src/sh_ignore.c	(revision 436)
+++ trunk/src/sh_ignore.c	(revision 438)
@@ -33,4 +33,6 @@
 #endif
 
+#include <string.h>
+
 #include "samhain.h"
 #include "sh_mem.h"
@@ -59,4 +61,7 @@
 {
   struct sh_ignore_list * new;
+  char                  * reg_expr;
+  size_t                  len;
+
 #ifdef HAVE_REGEX_H
   int                     status = -1;
@@ -68,13 +73,18 @@
   SL_ENTER(_("sh_ignore_add"));
 
-  if (addpath == NULL)
+  if ( (addpath == NULL) || (sl_ok_adds(2, strlen(addpath)) == SL_FALSE) )
     {
       SL_RETURN(list, _("sh_ignore_add"));
     }
 
-  new  = SH_ALLOC(sizeof(struct sh_ignore_list));
-
-#ifdef HAVE_REGEX_H
-  status = regcomp(&(new->preg), addpath, REG_NOSUB|REG_EXTENDED);
+  new      = SH_ALLOC(sizeof(struct sh_ignore_list));
+
+  len      = 2 + strlen(addpath);
+  reg_expr = SH_ALLOC(len);
+  sl_strlcpy(reg_expr,     "^", len);
+  sl_strlcat(reg_expr, addpath, len);
+
+#ifdef HAVE_REGEX_H
+  status = regcomp(&(new->preg), reg_expr, REG_NOSUB|REG_EXTENDED);
   if (status != 0)  
     {
@@ -83,7 +93,8 @@
       errbuf[BUFSIZ] = '\0';
       sh_error_handle ((-1), FIL__, __LINE__, status, MSG_E_REGEX,
-                       errbuf, addpath);
+                       errbuf, reg_expr);
       SH_FREE(errbuf);
       SH_FREE(new);
+      SH_FREE(reg_expr);
       SL_RETURN(list, _("sh_ignore_add"));
     }
@@ -94,4 +105,5 @@
 #endif
 
+  SH_FREE(reg_expr);
   new->next = list;
 
@@ -253,4 +265,7 @@
   CuAssertTrue(tc, S_FALSE == ret);
 
+  ret = sh_ignore_chk_del ("/my/var/log/foo/test");
+  CuAssertTrue(tc, S_FALSE == ret);
+
   sh_ignore_clean();
   CuAssertTrue(tc, NULL == sh_del_ign);
@@ -274,4 +289,7 @@
   CuAssertTrue(tc, S_FALSE == ret);
 
+  ret = sh_ignore_chk_new ("/my/var/log/foo/test");
+  CuAssertTrue(tc, S_FALSE == ret);
+
   sh_ignore_clean();
   CuAssertTrue(tc, NULL == sh_new_ign);
@@ -295,4 +313,7 @@
   CuAssertTrue(tc, S_FALSE == ret);
 
+  ret = sh_ignore_chk_mod ("/my/var/log/foo/test");
+  CuAssertTrue(tc, S_FALSE == ret);
+
   sh_ignore_clean();
   CuAssertTrue(tc, NULL == sh_new_ign);