41 static void audit_fsnotify_mark_free(struct audit_fsnotify_mark *audit_mark)  in audit_fsnotify_mark_free()  argument
43 	kfree(audit_mark->path);  in audit_fsnotify_mark_free()
44 	kfree(audit_mark);  in audit_fsnotify_mark_free()
49 	struct audit_fsnotify_mark *audit_mark;  in audit_fsnotify_free_mark()  local
51 	audit_mark = container_of(mark, struct audit_fsnotify_mark, mark);  in audit_fsnotify_free_mark()
52 	audit_fsnotify_mark_free(audit_mark);  in audit_fsnotify_free_mark()
67 static void audit_update_mark(struct audit_fsnotify_mark *audit_mark,  in audit_update_mark()  argument
70 	audit_mark->dev = inode ? inode->i_sb->s_dev : AUDIT_DEV_UNSET;  in audit_update_mark()
71 	audit_mark->ino = inode ? inode->i_ino : AUDIT_INO_UNSET;  in audit_update_mark()
76 	struct audit_fsnotify_mark *audit_mark;  in audit_alloc_mark()  local
91 	audit_mark = kzalloc(sizeof(*audit_mark), GFP_KERNEL);  in audit_alloc_mark()
92 	if (unlikely(!audit_mark)) {  in audit_alloc_mark()
93 		audit_mark = ERR_PTR(-ENOMEM);  in audit_alloc_mark()
97 	fsnotify_init_mark(&audit_mark->mark, audit_fsnotify_group);  in audit_alloc_mark()
98 	audit_mark->mark.mask = AUDIT_FS_EVENTS;  in audit_alloc_mark()
99 	audit_mark->path = pathname;  in audit_alloc_mark()
100 	audit_update_mark(audit_mark, dentry->d_inode);  in audit_alloc_mark()
101 	audit_mark->rule = krule;  in audit_alloc_mark()
103 	ret = fsnotify_add_inode_mark(&audit_mark->mark, inode, true);  in audit_alloc_mark()
105 		audit_mark->path = NULL;  in audit_alloc_mark()
106 		fsnotify_put_mark(&audit_mark->mark);  in audit_alloc_mark()
107 		audit_mark = ERR_PTR(ret);  in audit_alloc_mark()
112 	return audit_mark;  in audit_alloc_mark()
115 static void audit_mark_log_rule_change(struct audit_fsnotify_mark *audit_mark, char *op)  in audit_mark_log_rule_change()  argument
118 	struct audit_krule *rule = audit_mark->rule;  in audit_mark_log_rule_change()
127 	audit_log_untrustedstring(ab, audit_mark->path);  in audit_mark_log_rule_change()
133 void audit_remove_mark(struct audit_fsnotify_mark *audit_mark)  in audit_remove_mark()  argument
135 	fsnotify_destroy_mark(&audit_mark->mark, audit_fsnotify_group);  in audit_remove_mark()
136 	fsnotify_put_mark(&audit_mark->mark);  in audit_remove_mark()
146 static void audit_autoremove_mark_rule(struct audit_fsnotify_mark *audit_mark)  in audit_autoremove_mark_rule()  argument
148 	struct audit_krule *rule = audit_mark->rule;  in audit_autoremove_mark_rule()
151 	audit_mark_log_rule_change(audit_mark, "autoremove_rule");  in audit_autoremove_mark_rule()
160 	struct audit_fsnotify_mark *audit_mark;  in audit_mark_handle_event()  local
162 	audit_mark = container_of(inode_mark, struct audit_fsnotify_mark, mark);  in audit_mark_handle_event()
169 		if (audit_compare_dname_path(dname, audit_mark->path, AUDIT_NAME_FULL))  in audit_mark_handle_event()
171 		audit_update_mark(audit_mark, inode);  in audit_mark_handle_event()
173 		audit_autoremove_mark_rule(audit_mark);  in audit_mark_handle_event()