Lines Matching refs:ab
988 struct audit_buffer *ab; in audit_log_pid_context() local
993 ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID); in audit_log_pid_context()
994 if (!ab) in audit_log_pid_context()
997 audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid, in audit_log_pid_context()
1002 audit_log_format(ab, " obj=(none)"); in audit_log_pid_context()
1005 audit_log_format(ab, " obj=%s", ctx); in audit_log_pid_context()
1009 audit_log_format(ab, " ocomm="); in audit_log_pid_context()
1010 audit_log_untrustedstring(ab, comm); in audit_log_pid_context()
1011 audit_log_end(ab); in audit_log_pid_context()
1017 struct audit_buffer **ab) in audit_log_execve_info() argument
1053 audit_log_format(*ab, "argc=%d", context->execve.argc); in audit_log_execve_info()
1124 audit_log_end(*ab); in audit_log_execve_info()
1125 *ab = audit_log_start(context, in audit_log_execve_info()
1127 if (!*ab) in audit_log_execve_info()
1152 audit_log_format(*ab, "%s", abuf); in audit_log_execve_info()
1158 audit_log_n_hex(*ab, buf, len_tmp); in audit_log_execve_info()
1164 audit_log_n_string(*ab, buf, len_tmp); in audit_log_execve_info()
1190 static void audit_log_cap(struct audit_buffer *ab, char *prefix, in audit_log_cap() argument
1196 audit_log_format(ab, " %s=0", prefix); in audit_log_cap()
1199 audit_log_format(ab, " %s=", prefix); in audit_log_cap()
1201 audit_log_format(ab, "%08x", cap->cap[CAP_LAST_U32 - i]); in audit_log_cap()
1204 static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name) in audit_log_fcaps() argument
1207 audit_log_format(ab, " cap_fe=? cap_fver=? cap_fp=? cap_fi=?"); in audit_log_fcaps()
1210 audit_log_cap(ab, "cap_fp", &name->fcap.permitted); in audit_log_fcaps()
1211 audit_log_cap(ab, "cap_fi", &name->fcap.inheritable); in audit_log_fcaps()
1212 audit_log_format(ab, " cap_fe=%d cap_fver=%x cap_frootid=%d", in audit_log_fcaps()
1217 static void audit_log_time(struct audit_context *context, struct audit_buffer **ab) in audit_log_time() argument
1234 if (!*ab) { in audit_log_time()
1235 *ab = audit_log_start(context, in audit_log_time()
1238 if (!*ab) in audit_log_time()
1241 audit_log_format(*ab, "op=%s old=%lli new=%lli", in audit_log_time()
1245 audit_log_end(*ab); in audit_log_time()
1246 *ab = NULL; in audit_log_time()
1251 if (!*ab) { in audit_log_time()
1252 *ab = audit_log_start(context, GFP_KERNEL, in audit_log_time()
1254 if (!*ab) in audit_log_time()
1257 audit_log_format(*ab, "sec=%lli nsec=%li", in audit_log_time()
1259 audit_log_end(*ab); in audit_log_time()
1260 *ab = NULL; in audit_log_time()
1266 struct audit_buffer *ab; in show_special() local
1269 ab = audit_log_start(context, GFP_KERNEL, context->type); in show_special()
1270 if (!ab) in show_special()
1276 audit_log_format(ab, "nargs=%d", nargs); in show_special()
1278 audit_log_format(ab, " a%d=%lx", i, in show_special()
1284 audit_log_format(ab, "ouid=%u ogid=%u mode=%#ho", in show_special()
1292 audit_log_format(ab, " osid=%u", osid); in show_special()
1295 audit_log_format(ab, " obj=%s", ctx); in show_special()
1300 audit_log_end(ab); in show_special()
1301 ab = audit_log_start(context, GFP_KERNEL, in show_special()
1303 if (unlikely(!ab)) in show_special()
1305 audit_log_format(ab, in show_special()
1314 audit_log_format(ab, in show_special()
1324 audit_log_format(ab, in show_special()
1334 audit_log_format(ab, "mqdes=%d sigev_signo=%d", in show_special()
1340 audit_log_format(ab, in show_special()
1348 audit_log_format(ab, "pid=%d", context->capset.pid); in show_special()
1349 audit_log_cap(ab, "cap_pi", &context->capset.cap.inheritable); in show_special()
1350 audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted); in show_special()
1351 audit_log_cap(ab, "cap_pe", &context->capset.cap.effective); in show_special()
1352 audit_log_cap(ab, "cap_pa", &context->capset.cap.ambient); in show_special()
1355 audit_log_format(ab, "fd=%d flags=0x%x", context->mmap.fd, in show_special()
1359 audit_log_execve_info(context, &ab); in show_special()
1362 audit_log_format(ab, "name="); in show_special()
1364 audit_log_untrustedstring(ab, context->module.name); in show_special()
1366 audit_log_format(ab, "(null)"); in show_special()
1372 audit_log_time(context, &ab); in show_special()
1375 audit_log_end(ab); in show_special()
1401 struct audit_buffer *ab; in audit_log_name() local
1403 ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH); in audit_log_name()
1404 if (!ab) in audit_log_name()
1407 audit_log_format(ab, "item=%d", record_num); in audit_log_name()
1410 audit_log_d_path(ab, " name=", path); in audit_log_name()
1415 audit_log_format(ab, " name="); in audit_log_name()
1416 audit_log_untrustedstring(ab, n->name->name); in audit_log_name()
1422 audit_log_d_path(ab, " name=", &context->pwd); in audit_log_name()
1426 audit_log_format(ab, " name="); in audit_log_name()
1427 audit_log_n_untrustedstring(ab, n->name->name, in audit_log_name()
1431 audit_log_format(ab, " name=(null)"); in audit_log_name()
1434 audit_log_format(ab, " inode=%lu dev=%02x:%02x mode=%#ho ouid=%u ogid=%u rdev=%02x:%02x", in audit_log_name()
1449 audit_log_format(ab, " osid=%u", n->osid); in audit_log_name()
1453 audit_log_format(ab, " obj=%s", ctx); in audit_log_name()
1461 audit_log_format(ab, " nametype=NORMAL"); in audit_log_name()
1464 audit_log_format(ab, " nametype=PARENT"); in audit_log_name()
1467 audit_log_format(ab, " nametype=DELETE"); in audit_log_name()
1470 audit_log_format(ab, " nametype=CREATE"); in audit_log_name()
1473 audit_log_format(ab, " nametype=UNKNOWN"); in audit_log_name()
1477 audit_log_fcaps(ab, n); in audit_log_name()
1478 audit_log_end(ab); in audit_log_name()
1488 struct audit_buffer *ab; in audit_log_proctitle() local
1493 ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE); in audit_log_proctitle()
1494 if (!ab) in audit_log_proctitle()
1497 audit_log_format(ab, "proctitle="); in audit_log_proctitle()
1521 audit_log_n_untrustedstring(ab, msg, len); in audit_log_proctitle()
1522 audit_log_end(ab); in audit_log_proctitle()
1529 struct audit_buffer *ab; in audit_log_exit() local
1535 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL); in audit_log_exit()
1536 if (!ab) in audit_log_exit()
1538 audit_log_format(ab, "arch=%x syscall=%d", in audit_log_exit()
1541 audit_log_format(ab, " per=%lx", context->personality); in audit_log_exit()
1543 audit_log_format(ab, " success=%s exit=%ld", in audit_log_exit()
1547 audit_log_format(ab, in audit_log_exit()
1555 audit_log_task_info(ab); in audit_log_exit()
1556 audit_log_key(ab, context->filterkey); in audit_log_exit()
1557 audit_log_end(ab); in audit_log_exit()
1561 ab = audit_log_start(context, GFP_KERNEL, aux->type); in audit_log_exit()
1562 if (!ab) in audit_log_exit()
1569 audit_log_format(ab, "fver=%x", axs->fcap_ver); in audit_log_exit()
1570 audit_log_cap(ab, "fp", &axs->fcap.permitted); in audit_log_exit()
1571 audit_log_cap(ab, "fi", &axs->fcap.inheritable); in audit_log_exit()
1572 audit_log_format(ab, " fe=%d", axs->fcap.fE); in audit_log_exit()
1573 audit_log_cap(ab, "old_pp", &axs->old_pcap.permitted); in audit_log_exit()
1574 audit_log_cap(ab, "old_pi", &axs->old_pcap.inheritable); in audit_log_exit()
1575 audit_log_cap(ab, "old_pe", &axs->old_pcap.effective); in audit_log_exit()
1576 audit_log_cap(ab, "old_pa", &axs->old_pcap.ambient); in audit_log_exit()
1577 audit_log_cap(ab, "pp", &axs->new_pcap.permitted); in audit_log_exit()
1578 audit_log_cap(ab, "pi", &axs->new_pcap.inheritable); in audit_log_exit()
1579 audit_log_cap(ab, "pe", &axs->new_pcap.effective); in audit_log_exit()
1580 audit_log_cap(ab, "pa", &axs->new_pcap.ambient); in audit_log_exit()
1581 audit_log_format(ab, " frootid=%d", in audit_log_exit()
1587 audit_log_end(ab); in audit_log_exit()
1594 ab = audit_log_start(context, GFP_KERNEL, AUDIT_FD_PAIR); in audit_log_exit()
1595 if (ab) { in audit_log_exit()
1596 audit_log_format(ab, "fd0=%d fd1=%d", in audit_log_exit()
1598 audit_log_end(ab); in audit_log_exit()
1603 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SOCKADDR); in audit_log_exit()
1604 if (ab) { in audit_log_exit()
1605 audit_log_format(ab, "saddr="); in audit_log_exit()
1606 audit_log_n_hex(ab, (void *)context->sockaddr, in audit_log_exit()
1608 audit_log_end(ab); in audit_log_exit()
1633 ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD); in audit_log_exit()
1634 if (ab) { in audit_log_exit()
1635 audit_log_d_path(ab, "cwd=", &context->pwd); in audit_log_exit()
1636 audit_log_end(ab); in audit_log_exit()
1650 ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE); in audit_log_exit()
1651 if (ab) in audit_log_exit()
1652 audit_log_end(ab); in audit_log_exit()
2642 struct audit_buffer *ab; in __audit_log_nfcfg() local
2645 ab = audit_log_start(audit_context(), gfp, AUDIT_NETFILTER_CFG); in __audit_log_nfcfg()
2646 if (!ab) in __audit_log_nfcfg()
2648 audit_log_format(ab, "table=%s family=%u entries=%u op=%s", in __audit_log_nfcfg()
2651 audit_log_format(ab, " pid=%u", task_pid_nr(current)); in __audit_log_nfcfg()
2652 audit_log_task_context(ab); /* subj= */ in __audit_log_nfcfg()
2653 audit_log_format(ab, " comm="); in __audit_log_nfcfg()
2654 audit_log_untrustedstring(ab, get_task_comm(comm, current)); in __audit_log_nfcfg()
2655 audit_log_end(ab); in __audit_log_nfcfg()
2659 static void audit_log_task(struct audit_buffer *ab) in audit_log_task() argument
2670 audit_log_format(ab, "auid=%u uid=%u gid=%u ses=%u", in audit_log_task()
2675 audit_log_task_context(ab); in audit_log_task()
2676 audit_log_format(ab, " pid=%d comm=", task_tgid_nr(current)); in audit_log_task()
2677 audit_log_untrustedstring(ab, get_task_comm(comm, current)); in audit_log_task()
2678 audit_log_d_path_exe(ab, current->mm); in audit_log_task()
2690 struct audit_buffer *ab; in audit_core_dumps() local
2698 ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_ANOM_ABEND); in audit_core_dumps()
2699 if (unlikely(!ab)) in audit_core_dumps()
2701 audit_log_task(ab); in audit_core_dumps()
2702 audit_log_format(ab, " sig=%ld res=1", signr); in audit_core_dumps()
2703 audit_log_end(ab); in audit_core_dumps()
2720 struct audit_buffer *ab; in audit_seccomp() local
2722 ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_SECCOMP); in audit_seccomp()
2723 if (unlikely(!ab)) in audit_seccomp()
2725 audit_log_task(ab); in audit_seccomp()
2726 audit_log_format(ab, " sig=%ld arch=%x syscall=%ld compat=%d ip=0x%lx code=0x%x", in audit_seccomp()
2729 audit_log_end(ab); in audit_seccomp()
2735 struct audit_buffer *ab; in audit_seccomp_actions_logged() local
2740 ab = audit_log_start(audit_context(), GFP_KERNEL, in audit_seccomp_actions_logged()
2742 if (unlikely(!ab)) in audit_seccomp_actions_logged()
2745 audit_log_format(ab, in audit_seccomp_actions_logged()
2748 audit_log_end(ab); in audit_seccomp_actions_logged()