117 	struct audit_entry *entry;  in audit_init_entry()  local
120 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);  in audit_init_entry()
121 	if (unlikely(!entry))  in audit_init_entry()
126 		kfree(entry);  in audit_init_entry()
129 	entry->rule.fields = fields;  in audit_init_entry()
131 	return entry;  in audit_init_entry()
219 static int audit_match_signal(struct audit_entry *entry)  in audit_match_signal()  argument
221 	struct audit_field *arch = entry->rule.arch_f;  in audit_match_signal()
227 					       entry->rule.mask) &&  in audit_match_signal()
229 					       entry->rule.mask));  in audit_match_signal()
235 					       entry->rule.mask));  in audit_match_signal()
238 					       entry->rule.mask));  in audit_match_signal()
249 	struct audit_entry *entry;  in audit_to_entry_common()  local
278 	entry = audit_init_entry(rule->field_count);  in audit_to_entry_common()
279 	if (!entry)  in audit_to_entry_common()
282 	entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND;  in audit_to_entry_common()
283 	entry->rule.listnr = listnr;  in audit_to_entry_common()
284 	entry->rule.action = rule->action;  in audit_to_entry_common()
285 	entry->rule.field_count = rule->field_count;  in audit_to_entry_common()
288 		entry->rule.mask[i] = rule->mask[i];  in audit_to_entry_common()
292 		__u32 *p = &entry->rule.mask[AUDIT_WORD(bit)];  in audit_to_entry_common()
302 				entry->rule.mask[j] |= class[j];  in audit_to_entry_common()
306 	return entry;  in audit_to_entry_common()
333 static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)  in audit_field_valid()  argument
337 		if (entry->rule.listnr != AUDIT_FILTER_TYPE &&  in audit_field_valid()
338 		    entry->rule.listnr != AUDIT_FILTER_USER)  in audit_field_valid()
411 		if (entry->rule.listnr != AUDIT_FILTER_EXIT)  in audit_field_valid()
423 	struct audit_entry *entry;  in audit_data_to_entry()  local
430 	entry = audit_to_entry_common(data);  in audit_data_to_entry()
431 	if (IS_ERR(entry))  in audit_data_to_entry()
436 		struct audit_field *f = &entry->rule.fields[i];  in audit_data_to_entry()
451 			entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;  in audit_data_to_entry()
454 		err = audit_field_valid(entry, f);  in audit_data_to_entry()
480 			entry->rule.arch_f = f;  in audit_data_to_entry()
495 			entry->rule.buflen += f->val;  in audit_data_to_entry()
516 			entry->rule.buflen += f->val;  in audit_data_to_entry()
518 			err = audit_to_watch(&entry->rule, str, f->val, f->op);  in audit_data_to_entry()
528 			entry->rule.buflen += f->val;  in audit_data_to_entry()
530 			err = audit_make_tree(&entry->rule, str, f->op);  in audit_data_to_entry()
536 			err = audit_to_inode(&entry->rule, f);  in audit_data_to_entry()
541 			if (entry->rule.filterkey || f->val > AUDIT_MAX_KEY_LEN)  in audit_data_to_entry()
546 			entry->rule.buflen += f->val;  in audit_data_to_entry()
547 			entry->rule.filterkey = str;  in audit_data_to_entry()
550 			if (entry->rule.exe || f->val > PATH_MAX)  in audit_data_to_entry()
557 			entry->rule.buflen += f->val;  in audit_data_to_entry()
559 			audit_mark = audit_alloc_mark(&entry->rule, str, f->val);  in audit_data_to_entry()
565 			entry->rule.exe = audit_mark;  in audit_data_to_entry()
570 	if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal)  in audit_data_to_entry()
571 		entry->rule.inode_f = NULL;  in audit_data_to_entry()
574 	return entry;  in audit_data_to_entry()
577 	if (entry->rule.tree)  in audit_data_to_entry()
578 		audit_put_tree(entry->rule.tree); /* that's the temporary one */  in audit_data_to_entry()
579 	if (entry->rule.exe)  in audit_data_to_entry()
580 		audit_remove_mark(entry->rule.exe); /* that's the template one */  in audit_data_to_entry()
581 	audit_free_rule(entry);  in audit_data_to_entry()
785 	struct audit_entry *entry;  in audit_dupe_rule()  local
790 	entry = audit_init_entry(fcount);  in audit_dupe_rule()
791 	if (unlikely(!entry))  in audit_dupe_rule()
794 	new = &entry->rule;  in audit_dupe_rule()
847 			audit_free_rule(entry);  in audit_dupe_rule()
857 	return entry;  in audit_dupe_rule()
862 static struct audit_entry *audit_find_rule(struct audit_entry *entry,  in audit_find_rule()  argument
869 	if (entry->rule.inode_f) {  in audit_find_rule()
870 		h = audit_hash_ino(entry->rule.inode_f->val);  in audit_find_rule()
872 	} else if (entry->rule.watch) {  in audit_find_rule()
877 				if (!audit_compare_rule(&entry->rule, &e->rule)) {  in audit_find_rule()
884 		*p = list = &audit_filter_list[entry->rule.listnr];  in audit_find_rule()
888 		if (!audit_compare_rule(&entry->rule, &e->rule)) {  in audit_find_rule()
901 static inline int audit_add_rule(struct audit_entry *entry)  in audit_add_rule()  argument
904 	struct audit_watch *watch = entry->rule.watch;  in audit_add_rule()
905 	struct audit_tree *tree = entry->rule.tree;  in audit_add_rule()
912 	if (entry->rule.listnr == AUDIT_FILTER_USER ||  in audit_add_rule()
913 		entry->rule.listnr == AUDIT_FILTER_TYPE)  in audit_add_rule()
918 	e = audit_find_rule(entry, &list);  in audit_add_rule()
930 		err = audit_add_watch(&entry->rule, &list);  in audit_add_rule()
943 		err = audit_add_tree_rule(&entry->rule);  in audit_add_rule()
950 	entry->rule.prio = ~0ULL;  in audit_add_rule()
951 	if (entry->rule.listnr == AUDIT_FILTER_EXIT) {  in audit_add_rule()
952 		if (entry->rule.flags & AUDIT_FILTER_PREPEND)  in audit_add_rule()
953 			entry->rule.prio = ++prio_high;  in audit_add_rule()
955 			entry->rule.prio = --prio_low;  in audit_add_rule()
958 	if (entry->rule.flags & AUDIT_FILTER_PREPEND) {  in audit_add_rule()
959 		list_add(&entry->rule.list,  in audit_add_rule()
960 			 &audit_rules_list[entry->rule.listnr]);  in audit_add_rule()
961 		list_add_rcu(&entry->list, list);  in audit_add_rule()
962 		entry->rule.flags &= ~AUDIT_FILTER_PREPEND;  in audit_add_rule()
964 		list_add_tail(&entry->rule.list,  in audit_add_rule()
965 			      &audit_rules_list[entry->rule.listnr]);  in audit_add_rule()
966 		list_add_tail_rcu(&entry->list, list);  in audit_add_rule()
972 	if (!audit_match_signal(entry))  in audit_add_rule()
981 int audit_del_rule(struct audit_entry *entry)  in audit_del_rule()  argument
984 	struct audit_tree *tree = entry->rule.tree;  in audit_del_rule()
991 	if (entry->rule.listnr == AUDIT_FILTER_USER ||  in audit_del_rule()
992 		entry->rule.listnr == AUDIT_FILTER_TYPE)  in audit_del_rule()
997 	e = audit_find_rule(entry, &list);  in audit_del_rule()
1016 	if (!audit_match_signal(entry))  in audit_del_rule()
1096 	struct audit_entry *entry;  in audit_rule_change()  local
1098 	entry = audit_data_to_entry(data, datasz);  in audit_rule_change()
1099 	if (IS_ERR(entry))  in audit_rule_change()
1100 		return PTR_ERR(entry);  in audit_rule_change()
1104 		err = audit_add_rule(entry);  in audit_rule_change()
1105 		audit_log_rule_change("add_rule", &entry->rule, !err);  in audit_rule_change()
1108 		err = audit_del_rule(entry);  in audit_rule_change()
1109 		audit_log_rule_change("remove_rule", &entry->rule, !err);  in audit_rule_change()
1117 		if (entry->rule.exe)  in audit_rule_change()
1118 			audit_remove_mark(entry->rule.exe);  in audit_rule_change()
1119 		audit_free_rule(entry);  in audit_rule_change()
1404 	struct audit_entry *entry = container_of(r, struct audit_entry, rule);  in update_lsm_rule()  local
1412 	if (entry->rule.exe)  in update_lsm_rule()
1413 		audit_remove_mark(entry->rule.exe);  in update_lsm_rule()
1421 		list_del_rcu(&entry->list);  in update_lsm_rule()
1426 		list_replace_rcu(&entry->list, &nentry->list);  in update_lsm_rule()
1429 	call_rcu(&entry->rcu, audit_free_rule_rcu);  in update_lsm_rule()