Lines Matching refs:ab
919 void audit_log_task_context(struct audit_buffer *ab) in audit_log_task_context() argument
937 audit_log_format(ab, " subj=%s", ctx); in audit_log_task_context()
948 static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk) in audit_log_task_info() argument
957 audit_log_format(ab, " comm="); in audit_log_task_info()
958 audit_log_untrustedstring(ab, name); in audit_log_task_info()
966 audit_log_d_path(ab, "exe=", in audit_log_task_info()
974 audit_log_task_context(ab); in audit_log_task_info()
981 struct audit_buffer *ab; in audit_log_pid_context() local
986 ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID); in audit_log_pid_context()
987 if (!ab) in audit_log_pid_context()
990 audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid, auid, in audit_log_pid_context()
993 audit_log_format(ab, " obj=(none)"); in audit_log_pid_context()
996 audit_log_format(ab, " obj=%s", ctx); in audit_log_pid_context()
999 audit_log_format(ab, " ocomm="); in audit_log_pid_context()
1000 audit_log_untrustedstring(ab, comm); in audit_log_pid_context()
1001 audit_log_end(ab); in audit_log_pid_context()
1018 struct audit_buffer **ab, in audit_log_single_execve_arg() argument
1101 audit_log_end(*ab); in audit_log_single_execve_arg()
1102 *ab = audit_log_start(context, GFP_KERNEL, AUDIT_EXECVE); in audit_log_single_execve_arg()
1103 if (!*ab) in audit_log_single_execve_arg()
1112 audit_log_format(*ab, "a%d_len=%zu ", arg_num, in audit_log_single_execve_arg()
1132 audit_log_format(*ab, "a%d", arg_num); in audit_log_single_execve_arg()
1134 audit_log_format(*ab, "[%d]", i); in audit_log_single_execve_arg()
1135 audit_log_format(*ab, "="); in audit_log_single_execve_arg()
1137 audit_log_n_hex(*ab, buf, to_send); in audit_log_single_execve_arg()
1139 audit_log_format(*ab, "\"%s\"", buf); in audit_log_single_execve_arg()
1140 audit_log_format(*ab, "\n"); in audit_log_single_execve_arg()
1155 struct audit_buffer **ab, in audit_log_execve_info() argument
1168 audit_log_format(*ab, "argc=%d ", axi->argc); in audit_log_execve_info()
1183 len = audit_log_single_execve_arg(context, ab, i, in audit_log_execve_info()
1192 static void audit_log_cap(struct audit_buffer *ab, char *prefix, kernel_cap_t *cap) in audit_log_cap() argument
1196 audit_log_format(ab, " %s=", prefix); in audit_log_cap()
1198 audit_log_format(ab, "%08x", cap->cap[(_KERNEL_CAPABILITY_U32S-1) - i]); in audit_log_cap()
1202 static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name) in audit_log_fcaps() argument
1209 audit_log_cap(ab, "cap_fp", perm); in audit_log_fcaps()
1213 audit_log_cap(ab, "cap_fi", inh); in audit_log_fcaps()
1218 audit_log_format(ab, " cap_fe=%d cap_fver=%x", name->fcap.fE, name->fcap_ver); in audit_log_fcaps()
1223 struct audit_buffer *ab; in show_special() local
1226 ab = audit_log_start(context, GFP_KERNEL, context->type); in show_special()
1227 if (!ab) in show_special()
1233 audit_log_format(ab, "nargs=%d", nargs); in show_special()
1235 audit_log_format(ab, " a%d=%lx", i, in show_special()
1241 audit_log_format(ab, "ouid=%u ogid=%u mode=%#o", in show_special()
1247 audit_log_format(ab, " osid=%u", osid); in show_special()
1250 audit_log_format(ab, " obj=%s", ctx); in show_special()
1255 audit_log_end(ab); in show_special()
1256 ab = audit_log_start(context, GFP_KERNEL, in show_special()
1258 audit_log_format(ab, in show_special()
1264 if (!ab) in show_special()
1269 audit_log_format(ab, in show_special()
1279 audit_log_format(ab, in show_special()
1289 audit_log_format(ab, "mqdes=%d sigev_signo=%d", in show_special()
1295 audit_log_format(ab, in show_special()
1303 audit_log_format(ab, "pid=%d", context->capset.pid); in show_special()
1304 audit_log_cap(ab, "cap_pi", &context->capset.cap.inheritable); in show_special()
1305 audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted); in show_special()
1306 audit_log_cap(ab, "cap_pe", &context->capset.cap.effective); in show_special()
1309 audit_log_end(ab); in show_special()
1316 struct audit_buffer *ab; in audit_log_exit() local
1335 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL); in audit_log_exit()
1336 if (!ab) in audit_log_exit()
1338 audit_log_format(ab, "arch=%x syscall=%d", in audit_log_exit()
1341 audit_log_format(ab, " per=%lx", context->personality); in audit_log_exit()
1343 audit_log_format(ab, " success=%s exit=%ld", in audit_log_exit()
1354 audit_log_format(ab, in audit_log_exit()
1374 audit_log_task_info(ab, tsk); in audit_log_exit()
1376 audit_log_format(ab, " key="); in audit_log_exit()
1377 audit_log_untrustedstring(ab, context->filterkey); in audit_log_exit()
1379 audit_log_format(ab, " key=(null)"); in audit_log_exit()
1380 audit_log_end(ab); in audit_log_exit()
1384 ab = audit_log_start(context, GFP_KERNEL, aux->type); in audit_log_exit()
1385 if (!ab) in audit_log_exit()
1392 audit_log_execve_info(context, &ab, axi); in audit_log_exit()
1397 audit_log_format(ab, "fver=%x", axs->fcap_ver); in audit_log_exit()
1398 audit_log_cap(ab, "fp", &axs->fcap.permitted); in audit_log_exit()
1399 audit_log_cap(ab, "fi", &axs->fcap.inheritable); in audit_log_exit()
1400 audit_log_format(ab, " fe=%d", axs->fcap.fE); in audit_log_exit()
1401 audit_log_cap(ab, "old_pp", &axs->old_pcap.permitted); in audit_log_exit()
1402 audit_log_cap(ab, "old_pi", &axs->old_pcap.inheritable); in audit_log_exit()
1403 audit_log_cap(ab, "old_pe", &axs->old_pcap.effective); in audit_log_exit()
1404 audit_log_cap(ab, "new_pp", &axs->new_pcap.permitted); in audit_log_exit()
1405 audit_log_cap(ab, "new_pi", &axs->new_pcap.inheritable); in audit_log_exit()
1406 audit_log_cap(ab, "new_pe", &axs->new_pcap.effective); in audit_log_exit()
1410 audit_log_end(ab); in audit_log_exit()
1417 ab = audit_log_start(context, GFP_KERNEL, AUDIT_FD_PAIR); in audit_log_exit()
1418 if (ab) { in audit_log_exit()
1419 audit_log_format(ab, "fd0=%d fd1=%d", in audit_log_exit()
1421 audit_log_end(ab); in audit_log_exit()
1426 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SOCKADDR); in audit_log_exit()
1427 if (ab) { in audit_log_exit()
1428 audit_log_format(ab, "saddr="); in audit_log_exit()
1429 audit_log_n_hex(ab, (void *)context->sockaddr, in audit_log_exit()
1431 audit_log_end(ab); in audit_log_exit()
1456 ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD); in audit_log_exit()
1457 if (ab) { in audit_log_exit()
1458 audit_log_d_path(ab, "cwd=", &context->pwd); in audit_log_exit()
1459 audit_log_end(ab); in audit_log_exit()
1465 ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH); in audit_log_exit()
1466 if (!ab) in audit_log_exit()
1469 audit_log_format(ab, "item=%d", i); in audit_log_exit()
1475 audit_log_format(ab, " name="); in audit_log_exit()
1476 audit_log_untrustedstring(ab, n->name); in audit_log_exit()
1481 audit_log_d_path(ab, " name=", &context->pwd); in audit_log_exit()
1485 audit_log_format(ab, " name="); in audit_log_exit()
1486 audit_log_n_untrustedstring(ab, n->name, in audit_log_exit()
1490 audit_log_format(ab, " name=(null)"); in audit_log_exit()
1493 audit_log_format(ab, " inode=%lu" in audit_log_exit()
1510 audit_log_format(ab, " osid=%u", n->osid); in audit_log_exit()
1513 audit_log_format(ab, " obj=%s", ctx); in audit_log_exit()
1518 audit_log_fcaps(ab, n); in audit_log_exit()
1520 audit_log_end(ab); in audit_log_exit()
1524 ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE); in audit_log_exit()
1525 if (ab) in audit_log_exit()
1526 audit_log_end(ab); in audit_log_exit()
2130 struct audit_buffer *ab; in audit_set_loginuid() local
2132 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN); in audit_set_loginuid()
2133 if (ab) { in audit_set_loginuid()
2134 audit_log_format(ab, "login pid=%d uid=%u " in audit_set_loginuid()
2140 audit_log_end(ab); in audit_set_loginuid()
2495 struct audit_buffer *ab; in audit_core_dumps() local
2507 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND); in audit_core_dumps()
2509 audit_log_format(ab, "auid=%u uid=%u gid=%u ses=%u", in audit_core_dumps()
2517 audit_log_format(ab, " ssid=%u", sid); in audit_core_dumps()
2519 audit_log_format(ab, " subj=%s", ctx); in audit_core_dumps()
2523 audit_log_format(ab, " pid=%d comm=", current->pid); in audit_core_dumps()
2524 audit_log_untrustedstring(ab, current->comm); in audit_core_dumps()
2525 audit_log_format(ab, " sig=%ld", signr); in audit_core_dumps()
2526 audit_log_end(ab); in audit_core_dumps()