74 static void audit_free_lsm_field(struct audit_field *f)  in audit_free_lsm_field()  argument
76 	switch (f->type) {  in audit_free_lsm_field()
87 		kfree(f->lsm_str);  in audit_free_lsm_field()
88 		security_audit_rule_free(f->lsm_rule);  in audit_free_lsm_field()
163 				 struct audit_field *f)  in audit_to_inode()  argument
167 	    (f->op != Audit_equal && f->op != Audit_not_equal))  in audit_to_inode()
170 	krule->inode_f = f;  in audit_to_inode()
333 static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)  in audit_field_valid()  argument
335 	switch(f->type) {  in audit_field_valid()
343 	switch(f->type) {  in audit_field_valid()
367 		if (f->op == Audit_bitmask || f->op == Audit_bittest)  in audit_field_valid()
389 		if ((f->val != 0) && (f->val != 1))  in audit_field_valid()
393 		if (f->op != Audit_not_equal && f->op != Audit_equal)  in audit_field_valid()
397 		if (f->val & ~15)  in audit_field_valid()
401 		if (f->val & ~S_IFMT)  in audit_field_valid()
405 		if (f->val > AUDIT_MAX_FIELD_COMPARE)  in audit_field_valid()
429 		struct audit_field *f = &entry->rule.fields[i];  in audit_data_to_entry()  local
433 		f->op = audit_to_op(data->fieldflags[i]);  in audit_data_to_entry()
434 		if (f->op == Audit_bad)  in audit_data_to_entry()
437 		f->type = data->fields[i];  in audit_data_to_entry()
438 		f->val = data->values[i];  in audit_data_to_entry()
441 		if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) {  in audit_data_to_entry()
442 			f->type = AUDIT_LOGINUID_SET;  in audit_data_to_entry()
443 			f->val = 0;  in audit_data_to_entry()
447 		err = audit_field_valid(entry, f);  in audit_data_to_entry()
452 		switch (f->type) {  in audit_data_to_entry()
459 			f->uid = make_kuid(current_user_ns(), f->val);  in audit_data_to_entry()
460 			if (!uid_valid(f->uid))  in audit_data_to_entry()
468 			f->gid = make_kgid(current_user_ns(), f->val);  in audit_data_to_entry()
469 			if (!gid_valid(f->gid))  in audit_data_to_entry()
473 			entry->rule.arch_f = f;  in audit_data_to_entry()
485 			str = audit_unpack_string(&bufp, &remain, f->val);  in audit_data_to_entry()
488 			entry->rule.buflen += f->val;  in audit_data_to_entry()
490 			err = security_audit_rule_init(f->type, f->op, str,  in audit_data_to_entry()
491 						       (void **)&f->lsm_rule);  in audit_data_to_entry()
503 				f->lsm_str = str;  in audit_data_to_entry()
506 			str = audit_unpack_string(&bufp, &remain, f->val);  in audit_data_to_entry()
509 			entry->rule.buflen += f->val;  in audit_data_to_entry()
511 			err = audit_to_watch(&entry->rule, str, f->val, f->op);  in audit_data_to_entry()
518 			str = audit_unpack_string(&bufp, &remain, f->val);  in audit_data_to_entry()
521 			entry->rule.buflen += f->val;  in audit_data_to_entry()
523 			err = audit_make_tree(&entry->rule, str, f->op);  in audit_data_to_entry()
529 			err = audit_to_inode(&entry->rule, f);  in audit_data_to_entry()
534 			if (entry->rule.filterkey || f->val > AUDIT_MAX_KEY_LEN)  in audit_data_to_entry()
536 			str = audit_unpack_string(&bufp, &remain, f->val);  in audit_data_to_entry()
539 			entry->rule.buflen += f->val;  in audit_data_to_entry()
588 		struct audit_field *f = &krule->fields[i];  in audit_krule_to_data()  local
590 		data->fields[i] = f->type;  in audit_krule_to_data()
591 		data->fieldflags[i] = audit_ops[f->op];  in audit_krule_to_data()
592 		switch(f->type) {  in audit_krule_to_data()
604 				audit_pack_string(&bufp, f->lsm_str);  in audit_krule_to_data()
621 			if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {  in audit_krule_to_data()
628 			data->values[i] = f->val;  in audit_krule_to_data()
1260 		struct audit_field *f = &rule->fields[i];  in audit_filter_user_rules()  local
1265 		switch (f->type) {  in audit_filter_user_rules()
1268 			result = audit_comparator(pid, f->op, f->val);  in audit_filter_user_rules()
1271 			result = audit_uid_comparator(current_uid(), f->op, f->uid);  in audit_filter_user_rules()
1274 			result = audit_gid_comparator(current_gid(), f->op, f->gid);  in audit_filter_user_rules()
1278 						  f->op, f->uid);  in audit_filter_user_rules()
1282 						  f->op, f->val);  in audit_filter_user_rules()
1285 			result = audit_comparator(type, f->op, f->val);  in audit_filter_user_rules()
1292 			if (f->lsm_rule) {  in audit_filter_user_rules()
1295 								   f->type,  in audit_filter_user_rules()
1296 								   f->op,  in audit_filter_user_rules()
1297 								   f->lsm_rule,  in audit_filter_user_rules()
1348 			struct audit_field *f = &e->rule.fields[i];  in audit_filter_type()  local
1349 			if (f->type == AUDIT_MSGTYPE) {  in audit_filter_type()
1350 				result = audit_comparator(type, f->op, f->val);  in audit_filter_type()