| /kernel/ |
| D | audit.c | 387 struct audit_buffer *ab; in audit_log_config_change() local
390 ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONFIG_CHANGE); in audit_log_config_change()
391 if (unlikely(!ab)) in audit_log_config_change()
393 audit_log_format(ab, "op=set %s=%u old=%u ", function_name, new, old); in audit_log_config_change()
394 audit_log_session_info(ab); in audit_log_config_change()
395 rc = audit_log_task_context(ab); in audit_log_config_change()
398 audit_log_format(ab, " res=%d", allow_changes); in audit_log_config_change()
399 audit_log_end(ab); in audit_log_config_change()
1088 struct audit_buffer **ab, u16 msg_type) in audit_log_common_recv_msg() argument
1094 *ab = NULL; in audit_log_common_recv_msg()
[all …]
|
| D | auditsc.c | 1089 struct audit_buffer *ab; in audit_log_pid_context() local
1094 ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID); in audit_log_pid_context()
1095 if (!ab) in audit_log_pid_context()
1098 audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid, in audit_log_pid_context()
1103 audit_log_format(ab, " obj=(none)"); in audit_log_pid_context()
1106 audit_log_format(ab, " obj=%s", ctx); in audit_log_pid_context()
1110 audit_log_format(ab, " ocomm="); in audit_log_pid_context()
1111 audit_log_untrustedstring(ab, comm); in audit_log_pid_context()
1112 audit_log_end(ab); in audit_log_pid_context()
1118 struct audit_buffer **ab) in audit_log_execve_info() argument
[all …]
|
| D | audit_fsnotify.c | 117 struct audit_buffer *ab; in audit_mark_log_rule_change() local
122 ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE); in audit_mark_log_rule_change()
123 if (unlikely(!ab)) in audit_mark_log_rule_change()
125 audit_log_session_info(ab); in audit_mark_log_rule_change()
126 audit_log_format(ab, " op=%s path=", op); in audit_mark_log_rule_change()
127 audit_log_untrustedstring(ab, audit_mark->path); in audit_mark_log_rule_change()
128 audit_log_key(ab, rule->filterkey); in audit_mark_log_rule_change()
129 audit_log_format(ab, " list=%d res=1", rule->listnr); in audit_mark_log_rule_change()
130 audit_log_end(ab); in audit_mark_log_rule_change()
|
| D | audit_watch.c | 229 struct audit_buffer *ab; in audit_watch_log_rule_change() local
233 ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE); in audit_watch_log_rule_change()
234 if (!ab) in audit_watch_log_rule_change()
236 audit_log_session_info(ab); in audit_watch_log_rule_change()
237 audit_log_format(ab, "op=%s path=", op); in audit_watch_log_rule_change()
238 audit_log_untrustedstring(ab, w->path); in audit_watch_log_rule_change()
239 audit_log_key(ab, r->filterkey); in audit_watch_log_rule_change()
240 audit_log_format(ab, " list=%d res=1", r->listnr); in audit_watch_log_rule_change()
241 audit_log_end(ab); in audit_watch_log_rule_change()
|
| D | audit_tree.c | 528 struct audit_buffer *ab; in audit_tree_log_remove_rule() local
532 ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONFIG_CHANGE); in audit_tree_log_remove_rule()
533 if (unlikely(!ab)) in audit_tree_log_remove_rule()
535 audit_log_format(ab, "op=remove_rule dir="); in audit_tree_log_remove_rule()
536 audit_log_untrustedstring(ab, rule->tree->pathname); in audit_tree_log_remove_rule()
537 audit_log_key(ab, rule->filterkey); in audit_tree_log_remove_rule()
538 audit_log_format(ab, " list=%d res=1", rule->listnr); in audit_tree_log_remove_rule()
539 audit_log_end(ab); in audit_tree_log_remove_rule()
|
| D | auditfilter.c | 1109 struct audit_buffer *ab; in audit_log_rule_change() local
1114 ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONFIG_CHANGE); in audit_log_rule_change()
1115 if (!ab) in audit_log_rule_change()
1117 audit_log_session_info(ab); in audit_log_rule_change()
1118 audit_log_task_context(ab); in audit_log_rule_change()
1119 audit_log_format(ab, " op=%s", action); in audit_log_rule_change()
1120 audit_log_key(ab, rule->filterkey); in audit_log_rule_change()
1121 audit_log_format(ab, " list=%d res=%d", rule->listnr, res); in audit_log_rule_change()
1122 audit_log_end(ab); in audit_log_rule_change()
|
| D | audit.h | 215 extern void audit_log_session_info(struct audit_buffer *ab);
255 extern void audit_log_d_path_exe(struct audit_buffer *ab,
|
| /kernel/bpf/ |
| D | syscall.c | 1963 struct audit_buffer *ab; in bpf_audit_prog() local
1971 ab = audit_log_start(ctx, GFP_ATOMIC, AUDIT_BPF); in bpf_audit_prog()
1972 if (unlikely(!ab)) in bpf_audit_prog()
1974 audit_log_format(ab, "prog-id=%u op=%s", in bpf_audit_prog()
1976 audit_log_end(ab); in bpf_audit_prog()
|