74 static void audit_free_lsm_field(struct audit_field *f)  in audit_free_lsm_field()  argument
76 	switch (f->type) {  in audit_free_lsm_field()
87 		kfree(f->lsm_str);  in audit_free_lsm_field()
88 		security_audit_rule_free(f->lsm_rule);  in audit_free_lsm_field()
163 				 struct audit_field *f)  in audit_to_inode()  argument
167 	    (f->op != Audit_equal && f->op != Audit_not_equal))  in audit_to_inode()
170 	krule->inode_f = f;  in audit_to_inode()
333 static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)  in audit_field_valid()  argument
335 	switch(f->type) {  in audit_field_valid()
343 	switch(f->type) {  in audit_field_valid()
367 		if (f->op == Audit_bitmask || f->op == Audit_bittest)  in audit_field_valid()
389 		if ((f->val != 0) && (f->val != 1))  in audit_field_valid()
393 		if (f->op != Audit_not_equal && f->op != Audit_equal)  in audit_field_valid()
397 		if (f->val & ~15)  in audit_field_valid()
401 		if (f->val & ~S_IFMT)  in audit_field_valid()
405 		if (f->val > AUDIT_MAX_FIELD_COMPARE)  in audit_field_valid()
409 		if (f->op != Audit_equal)  in audit_field_valid()
436 		struct audit_field *f = &entry->rule.fields[i];  in audit_data_to_entry()  local
440 		f->op = audit_to_op(data->fieldflags[i]);  in audit_data_to_entry()
441 		if (f->op == Audit_bad)  in audit_data_to_entry()
444 		f->type = data->fields[i];  in audit_data_to_entry()
445 		f->val = data->values[i];  in audit_data_to_entry()
448 		if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) {  in audit_data_to_entry()
449 			f->type = AUDIT_LOGINUID_SET;  in audit_data_to_entry()
450 			f->val = 0;  in audit_data_to_entry()
454 		err = audit_field_valid(entry, f);  in audit_data_to_entry()
459 		switch (f->type) {  in audit_data_to_entry()
466 			f->uid = make_kuid(current_user_ns(), f->val);  in audit_data_to_entry()
467 			if (!uid_valid(f->uid))  in audit_data_to_entry()
475 			f->gid = make_kgid(current_user_ns(), f->val);  in audit_data_to_entry()
476 			if (!gid_valid(f->gid))  in audit_data_to_entry()
480 			entry->rule.arch_f = f;  in audit_data_to_entry()
492 			str = audit_unpack_string(&bufp, &remain, f->val);  in audit_data_to_entry()
495 			entry->rule.buflen += f->val;  in audit_data_to_entry()
497 			err = security_audit_rule_init(f->type, f->op, str,  in audit_data_to_entry()
498 						       (void **)&f->lsm_rule);  in audit_data_to_entry()
510 				f->lsm_str = str;  in audit_data_to_entry()
513 			str = audit_unpack_string(&bufp, &remain, f->val);  in audit_data_to_entry()
516 			entry->rule.buflen += f->val;  in audit_data_to_entry()
518 			err = audit_to_watch(&entry->rule, str, f->val, f->op);  in audit_data_to_entry()
525 			str = audit_unpack_string(&bufp, &remain, f->val);  in audit_data_to_entry()
528 			entry->rule.buflen += f->val;  in audit_data_to_entry()
530 			err = audit_make_tree(&entry->rule, str, f->op);  in audit_data_to_entry()
536 			err = audit_to_inode(&entry->rule, f);  in audit_data_to_entry()
541 			if (entry->rule.filterkey || f->val > AUDIT_MAX_KEY_LEN)  in audit_data_to_entry()
543 			str = audit_unpack_string(&bufp, &remain, f->val);  in audit_data_to_entry()
546 			entry->rule.buflen += f->val;  in audit_data_to_entry()
550 			if (entry->rule.exe || f->val > PATH_MAX)  in audit_data_to_entry()
552 			str = audit_unpack_string(&bufp, &remain, f->val);  in audit_data_to_entry()
557 			entry->rule.buflen += f->val;  in audit_data_to_entry()
559 			audit_mark = audit_alloc_mark(&entry->rule, str, f->val);  in audit_data_to_entry()
613 		struct audit_field *f = &krule->fields[i];  in audit_krule_to_data()  local
615 		data->fields[i] = f->type;  in audit_krule_to_data()
616 		data->fieldflags[i] = audit_ops[f->op];  in audit_krule_to_data()
617 		switch(f->type) {  in audit_krule_to_data()
629 				audit_pack_string(&bufp, f->lsm_str);  in audit_krule_to_data()
650 			if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {  in audit_krule_to_data()
657 			data->values[i] = f->val;  in audit_krule_to_data()
1299 		struct audit_field *f = &rule->fields[i];  in audit_filter_user_rules()  local
1304 		switch (f->type) {  in audit_filter_user_rules()
1307 			result = audit_comparator(pid, f->op, f->val);  in audit_filter_user_rules()
1310 			result = audit_uid_comparator(current_uid(), f->op, f->uid);  in audit_filter_user_rules()
1313 			result = audit_gid_comparator(current_gid(), f->op, f->gid);  in audit_filter_user_rules()
1317 						  f->op, f->uid);  in audit_filter_user_rules()
1321 						  f->op, f->val);  in audit_filter_user_rules()
1324 			result = audit_comparator(type, f->op, f->val);  in audit_filter_user_rules()
1331 			if (f->lsm_rule) {  in audit_filter_user_rules()
1334 								   f->type,  in audit_filter_user_rules()
1335 								   f->op,  in audit_filter_user_rules()
1336 								   f->lsm_rule,  in audit_filter_user_rules()
1387 			struct audit_field *f = &e->rule.fields[i];  in audit_filter_type()  local
1388 			if (f->type == AUDIT_MSGTYPE) {  in audit_filter_type()
1389 				result = audit_comparator(type, f->op, f->val);  in audit_filter_type()