108 	struct audit_entry *entry;  in audit_init_entry()  local
111 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);  in audit_init_entry()
112 	if (unlikely(!entry))  in audit_init_entry()
117 		kfree(entry);  in audit_init_entry()
120 	entry->rule.fields = fields;  in audit_init_entry()
122 	return entry;  in audit_init_entry()
211 static int audit_match_signal(struct audit_entry *entry)  in audit_match_signal()  argument
213 	struct audit_field *arch = entry->rule.arch_f;  in audit_match_signal()
219 					       entry->rule.mask) &&  in audit_match_signal()
221 					       entry->rule.mask));  in audit_match_signal()
227 					       entry->rule.mask));  in audit_match_signal()
230 					       entry->rule.mask));  in audit_match_signal()
241 	struct audit_entry *entry;  in audit_to_entry_common()  local
272 	entry = audit_init_entry(rule->field_count);  in audit_to_entry_common()
273 	if (!entry)  in audit_to_entry_common()
276 	entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND;  in audit_to_entry_common()
277 	entry->rule.listnr = listnr;  in audit_to_entry_common()
278 	entry->rule.action = rule->action;  in audit_to_entry_common()
279 	entry->rule.field_count = rule->field_count;  in audit_to_entry_common()
282 		entry->rule.mask[i] = rule->mask[i];  in audit_to_entry_common()
286 		__u32 *p = &entry->rule.mask[AUDIT_WORD(bit)];  in audit_to_entry_common()
296 				entry->rule.mask[j] |= class[j];  in audit_to_entry_common()
300 	return entry;  in audit_to_entry_common()
327 static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)  in audit_field_valid()  argument
331 		if (entry->rule.listnr != AUDIT_FILTER_EXCLUDE &&  in audit_field_valid()
332 		    entry->rule.listnr != AUDIT_FILTER_USER)  in audit_field_valid()
336 		if (entry->rule.listnr != AUDIT_FILTER_FS)  in audit_field_valid()
340 		if (entry->rule.listnr == AUDIT_FILTER_URING_EXIT)  in audit_field_valid()
345 	switch (entry->rule.listnr) {  in audit_field_valid()
453 	struct audit_entry *entry;  in audit_data_to_entry()  local
460 	entry = audit_to_entry_common(data);  in audit_data_to_entry()
461 	if (IS_ERR(entry))  in audit_data_to_entry()
466 		struct audit_field *f = &entry->rule.fields[i];  in audit_data_to_entry()
482 			entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;  in audit_data_to_entry()
485 		err = audit_field_valid(entry, f);  in audit_data_to_entry()
512 			entry->rule.arch_f = f;  in audit_data_to_entry()
529 			entry->rule.buflen += f_val;  in audit_data_to_entry()
549 			err = audit_to_watch(&entry->rule, str, f_val, f->op);  in audit_data_to_entry()
554 			entry->rule.buflen += f_val;  in audit_data_to_entry()
562 			err = audit_make_tree(&entry->rule, str, f->op);  in audit_data_to_entry()
566 			entry->rule.buflen += f_val;  in audit_data_to_entry()
570 			err = audit_to_inode(&entry->rule, f);  in audit_data_to_entry()
575 			if (entry->rule.filterkey || f_val > AUDIT_MAX_KEY_LEN)  in audit_data_to_entry()
582 			entry->rule.buflen += f_val;  in audit_data_to_entry()
583 			entry->rule.filterkey = str;  in audit_data_to_entry()
586 			if (entry->rule.exe || f_val > PATH_MAX)  in audit_data_to_entry()
593 			audit_mark = audit_alloc_mark(&entry->rule, str, f_val);  in audit_data_to_entry()
599 			entry->rule.buflen += f_val;  in audit_data_to_entry()
600 			entry->rule.exe = audit_mark;  in audit_data_to_entry()
608 	if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal)  in audit_data_to_entry()
609 		entry->rule.inode_f = NULL;  in audit_data_to_entry()
612 	return entry;  in audit_data_to_entry()
615 	if (entry->rule.tree)  in audit_data_to_entry()
616 		audit_put_tree(entry->rule.tree); /* that's the temporary one */  in audit_data_to_entry()
617 	if (entry->rule.exe)  in audit_data_to_entry()
618 		audit_remove_mark(entry->rule.exe); /* that's the template one */  in audit_data_to_entry()
619 	audit_free_rule(entry);  in audit_data_to_entry()
824 	struct audit_entry *entry;  in audit_dupe_rule()  local
829 	entry = audit_init_entry(fcount);  in audit_dupe_rule()
830 	if (unlikely(!entry))  in audit_dupe_rule()
833 	new = &entry->rule;  in audit_dupe_rule()
886 			audit_free_rule(entry);  in audit_dupe_rule()
896 	return entry;  in audit_dupe_rule()
901 static struct audit_entry *audit_find_rule(struct audit_entry *entry,  in audit_find_rule()  argument
908 	if (entry->rule.inode_f) {  in audit_find_rule()
909 		h = audit_hash_ino(entry->rule.inode_f->val);  in audit_find_rule()
911 	} else if (entry->rule.watch) {  in audit_find_rule()
916 				if (!audit_compare_rule(&entry->rule, &e->rule)) {  in audit_find_rule()
923 		*p = list = &audit_filter_list[entry->rule.listnr];  in audit_find_rule()
927 		if (!audit_compare_rule(&entry->rule, &e->rule)) {  in audit_find_rule()
940 static inline int audit_add_rule(struct audit_entry *entry)  in audit_add_rule()  argument
943 	struct audit_watch *watch = entry->rule.watch;  in audit_add_rule()
944 	struct audit_tree *tree = entry->rule.tree;  in audit_add_rule()
951 	switch (entry->rule.listnr) {  in audit_add_rule()
960 	e = audit_find_rule(entry, &list);  in audit_add_rule()
972 		err = audit_add_watch(&entry->rule, &list);  in audit_add_rule()
985 		err = audit_add_tree_rule(&entry->rule);  in audit_add_rule()
992 	entry->rule.prio = ~0ULL;  in audit_add_rule()
993 	if (entry->rule.listnr == AUDIT_FILTER_EXIT ||  in audit_add_rule()
994 	    entry->rule.listnr == AUDIT_FILTER_URING_EXIT) {  in audit_add_rule()
995 		if (entry->rule.flags & AUDIT_FILTER_PREPEND)  in audit_add_rule()
996 			entry->rule.prio = ++prio_high;  in audit_add_rule()
998 			entry->rule.prio = --prio_low;  in audit_add_rule()
1001 	if (entry->rule.flags & AUDIT_FILTER_PREPEND) {  in audit_add_rule()
1002 		list_add(&entry->rule.list,  in audit_add_rule()
1003 			 &audit_rules_list[entry->rule.listnr]);  in audit_add_rule()
1004 		list_add_rcu(&entry->list, list);  in audit_add_rule()
1005 		entry->rule.flags &= ~AUDIT_FILTER_PREPEND;  in audit_add_rule()
1007 		list_add_tail(&entry->rule.list,  in audit_add_rule()
1008 			      &audit_rules_list[entry->rule.listnr]);  in audit_add_rule()
1009 		list_add_tail_rcu(&entry->list, list);  in audit_add_rule()
1015 	if (!audit_match_signal(entry))  in audit_add_rule()
1024 int audit_del_rule(struct audit_entry *entry)  in audit_del_rule()  argument
1027 	struct audit_tree *tree = entry->rule.tree;  in audit_del_rule()
1034 	switch (entry->rule.listnr) {  in audit_del_rule()
1043 	e = audit_find_rule(entry, &list);  in audit_del_rule()
1062 	if (!audit_match_signal(entry))  in audit_del_rule()
1137 	struct audit_entry *entry;  in audit_rule_change()  local
1141 		entry = audit_data_to_entry(data, datasz);  in audit_rule_change()
1142 		if (IS_ERR(entry))  in audit_rule_change()
1143 			return PTR_ERR(entry);  in audit_rule_change()
1144 		err = audit_add_rule(entry);  in audit_rule_change()
1145 		audit_log_rule_change("add_rule", &entry->rule, !err);  in audit_rule_change()
1148 		entry = audit_data_to_entry(data, datasz);  in audit_rule_change()
1149 		if (IS_ERR(entry))  in audit_rule_change()
1150 			return PTR_ERR(entry);  in audit_rule_change()
1151 		err = audit_del_rule(entry);  in audit_rule_change()
1152 		audit_log_rule_change("remove_rule", &entry->rule, !err);  in audit_rule_change()
1160 		if (entry->rule.exe)  in audit_rule_change()
1161 			audit_remove_mark(entry->rule.exe);  in audit_rule_change()
1162 		audit_free_rule(entry);  in audit_rule_change()
1404 	struct audit_entry *entry = container_of(r, struct audit_entry, rule);  in update_lsm_rule()  local
1412 	if (entry->rule.exe)  in update_lsm_rule()
1413 		audit_remove_mark(entry->rule.exe);  in update_lsm_rule()
1421 		list_del_rcu(&entry->list);  in update_lsm_rule()
1426 		list_replace_rcu(&entry->list, &nentry->list);  in update_lsm_rule()
1429 	call_rcu(&entry->rcu, audit_free_rule_rcu);  in update_lsm_rule()