Searched refs:rule (Results 1 – 6 of 6) sorted by relevance
| /kernel/ |
| D | auditfilter.c | 84 struct audit_krule *erule = &e->rule; in audit_free_rule()
118 entry->rule.fields = fields; in audit_init_entry()
210 struct audit_field *arch = entry->rule.arch_f; in audit_match_signal()
216 entry->rule.mask) && in audit_match_signal()
218 entry->rule.mask)); in audit_match_signal()
224 entry->rule.mask)); in audit_match_signal()
227 entry->rule.mask)); in audit_match_signal()
235 static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule) in audit_to_entry_common() argument
242 listnr = rule->flags & ~AUDIT_FILTER_PREPEND; in audit_to_entry_common()
258 if (unlikely(rule->action == AUDIT_POSSIBLE)) { in audit_to_entry_common()
[all …]
|
| D | audit_tree.c | 526 struct audit_krule *rule) in audit_tree_log_remove_rule() argument
536 audit_log_untrustedstring(ab, rule->tree->pathname); in audit_tree_log_remove_rule()
537 audit_log_key(ab, rule->filterkey); in audit_tree_log_remove_rule()
538 audit_log_format(ab, " list=%d res=1", rule->listnr); in audit_tree_log_remove_rule()
544 struct audit_krule *rule, *next; in kill_rules() local
547 list_for_each_entry_safe(rule, next, &tree->rules, rlist) { in kill_rules()
548 entry = container_of(rule, struct audit_entry, rule); in kill_rules()
550 list_del_init(&rule->rlist); in kill_rules()
551 if (rule->tree) { in kill_rules()
553 audit_tree_log_remove_rule(context, rule); in kill_rules()
[all …]
|
| D | audit_fsnotify.c | 31 struct audit_krule *rule; member
101 audit_mark->rule = krule; in audit_alloc_mark()
118 struct audit_krule *rule = audit_mark->rule; in audit_mark_log_rule_change() local
128 audit_log_key(ab, rule->filterkey); in audit_mark_log_rule_change()
129 audit_log_format(ab, " list=%d res=1", rule->listnr); in audit_mark_log_rule_change()
148 struct audit_krule *rule = audit_mark->rule; in audit_autoremove_mark_rule() local
149 struct audit_entry *entry = container_of(rule, struct audit_entry, rule); in audit_autoremove_mark_rule()
|
| D | audit_watch.c | 278 oentry = container_of(r, struct audit_entry, rule); in audit_update_watch()
279 list_del(&oentry->rule.rlist); in audit_update_watch()
282 nentry = audit_dupe_rule(&oentry->rule); in audit_update_watch()
284 list_del(&oentry->rule.list); in audit_update_watch()
294 audit_put_watch(nentry->rule.watch); in audit_update_watch()
296 nentry->rule.watch = nwatch; in audit_update_watch()
297 list_add(&nentry->rule.rlist, &nwatch->rules); in audit_update_watch()
299 list_replace(&oentry->rule.list, in audit_update_watch()
300 &nentry->rule.list); in audit_update_watch()
302 if (oentry->rule.exe) in audit_update_watch()
[all …]
|
| D | audit.h | 48 struct audit_krule rule; member
284 extern int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op);
285 extern int audit_add_tree_rule(struct audit_krule *rule);
286 extern int audit_remove_tree_rule(struct audit_krule *rule);
315 #define audit_remove_tree_rule(rule) BUG() argument
316 #define audit_add_tree_rule(rule) -EINVAL argument
317 #define audit_make_tree(rule, str, op) -EINVAL argument
321 #define audit_tree_path(rule) "" /* never called */ argument
|
| D | auditsc.c | 468 struct audit_krule *rule, in audit_filter_rules() argument
481 for (i = 0; i < rule->field_count; i++) { in audit_filter_rules()
482 struct audit_field *f = &rule->fields[i]; in audit_filter_rules()
500 result = audit_exe_compare(tsk, rule->exe); in audit_filter_rules()
634 result = audit_watch_compare(rule->watch, in audit_filter_rules()
643 result = match_tree_refs(ctx, rule->tree); in audit_filter_rules()
746 if (rule->prio <= ctx->prio) in audit_filter_rules()
748 if (rule->filterkey) { in audit_filter_rules()
750 ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC); in audit_filter_rules()
752 ctx->prio = rule->prio; in audit_filter_rules()
[all …]
|