50 static void audit_fsnotify_mark_free(struct audit_fsnotify_mark *audit_mark)  in audit_fsnotify_mark_free()  argument
52 	kfree(audit_mark->path);  in audit_fsnotify_mark_free()
53 	kfree(audit_mark);  in audit_fsnotify_mark_free()
58 	struct audit_fsnotify_mark *audit_mark;  in audit_fsnotify_free_mark()  local
60 	audit_mark = container_of(mark, struct audit_fsnotify_mark, mark);  in audit_fsnotify_free_mark()
61 	audit_fsnotify_mark_free(audit_mark);  in audit_fsnotify_free_mark()
76 static void audit_update_mark(struct audit_fsnotify_mark *audit_mark,  in audit_update_mark()  argument
79 	audit_mark->dev = inode ? inode->i_sb->s_dev : AUDIT_DEV_UNSET;  in audit_update_mark()
80 	audit_mark->ino = inode ? inode->i_ino : AUDIT_INO_UNSET;  in audit_update_mark()
85 	struct audit_fsnotify_mark *audit_mark;  in audit_alloc_mark()  local
100 	audit_mark = kzalloc(sizeof(*audit_mark), GFP_KERNEL);  in audit_alloc_mark()
101 	if (unlikely(!audit_mark)) {  in audit_alloc_mark()
102 		audit_mark = ERR_PTR(-ENOMEM);  in audit_alloc_mark()
106 	fsnotify_init_mark(&audit_mark->mark, audit_fsnotify_free_mark);  in audit_alloc_mark()
107 	audit_mark->mark.mask = AUDIT_FS_EVENTS;  in audit_alloc_mark()
108 	audit_mark->path = pathname;  in audit_alloc_mark()
109 	audit_update_mark(audit_mark, dentry->d_inode);  in audit_alloc_mark()
110 	audit_mark->rule = krule;  in audit_alloc_mark()
112 	ret = fsnotify_add_mark(&audit_mark->mark, audit_fsnotify_group, inode, NULL, true);  in audit_alloc_mark()
114 		audit_fsnotify_mark_free(audit_mark);  in audit_alloc_mark()
115 		audit_mark = ERR_PTR(ret);  in audit_alloc_mark()
120 	return audit_mark;  in audit_alloc_mark()
123 static void audit_mark_log_rule_change(struct audit_fsnotify_mark *audit_mark, char *op)  in audit_mark_log_rule_change()  argument
126 	struct audit_krule *rule = audit_mark->rule;  in audit_mark_log_rule_change()
138 	audit_log_untrustedstring(ab, audit_mark->path);  in audit_mark_log_rule_change()
144 void audit_remove_mark(struct audit_fsnotify_mark *audit_mark)  in audit_remove_mark()  argument
146 	fsnotify_destroy_mark(&audit_mark->mark, audit_fsnotify_group);  in audit_remove_mark()
147 	fsnotify_put_mark(&audit_mark->mark);  in audit_remove_mark()
157 static void audit_autoremove_mark_rule(struct audit_fsnotify_mark *audit_mark)  in audit_autoremove_mark_rule()  argument
159 	struct audit_krule *rule = audit_mark->rule;  in audit_autoremove_mark_rule()
162 	audit_mark_log_rule_change(audit_mark, "autoremove_rule");  in audit_autoremove_mark_rule()
174 	struct audit_fsnotify_mark *audit_mark;  in audit_mark_handle_event()  local
177 	audit_mark = container_of(inode_mark, struct audit_fsnotify_mark, mark);  in audit_mark_handle_event()
194 		if (audit_compare_dname_path(dname, audit_mark->path, AUDIT_NAME_FULL))  in audit_mark_handle_event()
196 		audit_update_mark(audit_mark, inode);  in audit_mark_handle_event()
198 		audit_autoremove_mark_rule(audit_mark);  in audit_mark_handle_event()