• Home
  • Raw
  • Download

Lines Matching refs:rule

86 	struct audit_krule *erule = &e->rule;  in audit_free_rule()
120 entry->rule.fields = fields; in audit_init_entry()
213 struct audit_field *arch = entry->rule.arch_f; in audit_match_signal()
219 entry->rule.mask) && in audit_match_signal()
221 entry->rule.mask)); in audit_match_signal()
227 entry->rule.mask)); in audit_match_signal()
230 entry->rule.mask)); in audit_match_signal()
238 static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule) in audit_to_entry_common() argument
245 listnr = rule->flags & ~AUDIT_FILTER_PREPEND; in audit_to_entry_common()
262 if (unlikely(rule->action == AUDIT_POSSIBLE)) { in audit_to_entry_common()
266 if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS) in audit_to_entry_common()
268 if (rule->field_count > AUDIT_MAX_FIELDS) in audit_to_entry_common()
272 entry = audit_init_entry(rule->field_count); in audit_to_entry_common()
276 entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND; in audit_to_entry_common()
277 entry->rule.listnr = listnr; in audit_to_entry_common()
278 entry->rule.action = rule->action; in audit_to_entry_common()
279 entry->rule.field_count = rule->field_count; in audit_to_entry_common()
282 entry->rule.mask[i] = rule->mask[i]; in audit_to_entry_common()
286 __u32 *p = &entry->rule.mask[AUDIT_WORD(bit)]; in audit_to_entry_common()
296 entry->rule.mask[j] |= class[j]; in audit_to_entry_common()
331 if (entry->rule.listnr != AUDIT_FILTER_EXCLUDE && in audit_field_valid()
332 entry->rule.listnr != AUDIT_FILTER_USER) in audit_field_valid()
336 if (entry->rule.listnr != AUDIT_FILTER_FS) in audit_field_valid()
340 if (entry->rule.listnr == AUDIT_FILTER_URING_EXIT) in audit_field_valid()
345 switch (entry->rule.listnr) { in audit_field_valid()
466 struct audit_field *f = &entry->rule.fields[i]; in audit_data_to_entry()
482 entry->rule.pflags |= AUDIT_LOGINUID_LEGACY; in audit_data_to_entry()
512 entry->rule.arch_f = f; in audit_data_to_entry()
529 entry->rule.buflen += f_val; in audit_data_to_entry()
548 err = audit_to_watch(&entry->rule, str, f_val, f->op); in audit_data_to_entry()
553 entry->rule.buflen += f_val; in audit_data_to_entry()
561 err = audit_make_tree(&entry->rule, str, f->op); in audit_data_to_entry()
565 entry->rule.buflen += f_val; in audit_data_to_entry()
569 err = audit_to_inode(&entry->rule, f); in audit_data_to_entry()
574 if (entry->rule.filterkey || f_val > AUDIT_MAX_KEY_LEN) in audit_data_to_entry()
581 entry->rule.buflen += f_val; in audit_data_to_entry()
582 entry->rule.filterkey = str; in audit_data_to_entry()
585 if (entry->rule.exe || f_val > PATH_MAX) in audit_data_to_entry()
592 audit_mark = audit_alloc_mark(&entry->rule, str, f_val); in audit_data_to_entry()
598 entry->rule.buflen += f_val; in audit_data_to_entry()
599 entry->rule.exe = audit_mark; in audit_data_to_entry()
607 if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal) in audit_data_to_entry()
608 entry->rule.inode_f = NULL; in audit_data_to_entry()
614 if (entry->rule.tree) in audit_data_to_entry()
615 audit_put_tree(entry->rule.tree); /* that's the temporary one */ in audit_data_to_entry()
616 if (entry->rule.exe) in audit_data_to_entry()
617 audit_remove_mark(entry->rule.exe); /* that's the template one */ in audit_data_to_entry()
831 new = &entry->rule; in audit_dupe_rule()
906 if (entry->rule.inode_f) { in audit_find_rule()
907 h = audit_hash_ino(entry->rule.inode_f->val); in audit_find_rule()
909 } else if (entry->rule.watch) { in audit_find_rule()
914 if (!audit_compare_rule(&entry->rule, &e->rule)) { in audit_find_rule()
921 *p = list = &audit_filter_list[entry->rule.listnr]; in audit_find_rule()
925 if (!audit_compare_rule(&entry->rule, &e->rule)) { in audit_find_rule()
941 struct audit_watch *watch = entry->rule.watch; in audit_add_rule()
942 struct audit_tree *tree = entry->rule.tree; in audit_add_rule()
949 switch(entry->rule.listnr) { in audit_add_rule()
970 err = audit_add_watch(&entry->rule, &list); in audit_add_rule()
983 err = audit_add_tree_rule(&entry->rule); in audit_add_rule()
990 entry->rule.prio = ~0ULL; in audit_add_rule()
991 if (entry->rule.listnr == AUDIT_FILTER_EXIT || in audit_add_rule()
992 entry->rule.listnr == AUDIT_FILTER_URING_EXIT) { in audit_add_rule()
993 if (entry->rule.flags & AUDIT_FILTER_PREPEND) in audit_add_rule()
994 entry->rule.prio = ++prio_high; in audit_add_rule()
996 entry->rule.prio = --prio_low; in audit_add_rule()
999 if (entry->rule.flags & AUDIT_FILTER_PREPEND) { in audit_add_rule()
1000 list_add(&entry->rule.list, in audit_add_rule()
1001 &audit_rules_list[entry->rule.listnr]); in audit_add_rule()
1003 entry->rule.flags &= ~AUDIT_FILTER_PREPEND; in audit_add_rule()
1005 list_add_tail(&entry->rule.list, in audit_add_rule()
1006 &audit_rules_list[entry->rule.listnr]); in audit_add_rule()
1025 struct audit_tree *tree = entry->rule.tree; in audit_del_rule()
1032 switch(entry->rule.listnr) { in audit_del_rule()
1047 if (e->rule.watch) in audit_del_rule()
1048 audit_remove_watch_rule(&e->rule); in audit_del_rule()
1050 if (e->rule.tree) in audit_del_rule()
1051 audit_remove_tree_rule(&e->rule); in audit_del_rule()
1053 if (e->rule.exe) in audit_del_rule()
1054 audit_remove_mark_rule(&e->rule); in audit_del_rule()
1065 list_del(&e->rule.list); in audit_del_rule()
1107 static void audit_log_rule_change(char *action, struct audit_krule *rule, int res) in audit_log_rule_change() argument
1120 audit_log_key(ab, rule->filterkey); in audit_log_rule_change()
1121 audit_log_format(ab, " list=%d res=%d", rule->listnr, res); in audit_log_rule_change()
1143 audit_log_rule_change("add_rule", &entry->rule, !err); in audit_rule_change()
1150 audit_log_rule_change("remove_rule", &entry->rule, !err); in audit_rule_change()
1158 if (entry->rule.exe) in audit_rule_change()
1159 audit_remove_mark(entry->rule.exe); in audit_rule_change()
1338 for (i = 0; i < e->rule.field_count; i++) { in audit_filter()
1339 struct audit_field *f = &e->rule.fields[i]; in audit_filter()
1377 result = audit_exe_compare(current, e->rule.exe); in audit_filter()
1390 if (e->rule.action == AUDIT_NEVER || listtype == AUDIT_FILTER_EXCLUDE) in audit_filter()
1402 struct audit_entry *entry = container_of(r, struct audit_entry, rule); in update_lsm_rule()
1410 if (entry->rule.exe) in update_lsm_rule()
1411 audit_remove_mark(entry->rule.exe); in update_lsm_rule()
1423 list_replace_init(&r->rlist, &nentry->rule.rlist); in update_lsm_rule()
1425 list_replace(&r->list, &nentry->rule.list); in update_lsm_rule()