95 	struct audit_krule *erule = &e->rule;  in audit_free_rule()
129 	entry->rule.fields = fields;  in audit_init_entry()
221 	struct audit_field *arch = entry->rule.arch_f;  in audit_match_signal()
227 					       entry->rule.mask) &&  in audit_match_signal()
229 					       entry->rule.mask));  in audit_match_signal()
235 					       entry->rule.mask));  in audit_match_signal()
238 					       entry->rule.mask));  in audit_match_signal()
246 static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule)  in audit_to_entry_common()  argument
253 	listnr = rule->flags & ~AUDIT_FILTER_PREPEND;  in audit_to_entry_common()
259 		if (rule->action == AUDIT_ALWAYS)  in audit_to_entry_common()
268 	if (unlikely(rule->action == AUDIT_POSSIBLE)) {  in audit_to_entry_common()
272 	if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS)  in audit_to_entry_common()
274 	if (rule->field_count > AUDIT_MAX_FIELDS)  in audit_to_entry_common()
278 	entry = audit_init_entry(rule->field_count);  in audit_to_entry_common()
282 	entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND;  in audit_to_entry_common()
283 	entry->rule.listnr = listnr;  in audit_to_entry_common()
284 	entry->rule.action = rule->action;  in audit_to_entry_common()
285 	entry->rule.field_count = rule->field_count;  in audit_to_entry_common()
288 		entry->rule.mask[i] = rule->mask[i];  in audit_to_entry_common()
292 		__u32 *p = &entry->rule.mask[AUDIT_WORD(bit)];  in audit_to_entry_common()
302 				entry->rule.mask[j] |= class[j];  in audit_to_entry_common()
337 		if (entry->rule.listnr != AUDIT_FILTER_TYPE &&  in audit_field_valid()
338 		    entry->rule.listnr != AUDIT_FILTER_USER)  in audit_field_valid()
411 		if (entry->rule.listnr != AUDIT_FILTER_EXIT)  in audit_field_valid()
436 		struct audit_field *f = &entry->rule.fields[i];  in audit_data_to_entry()
451 			entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;  in audit_data_to_entry()
480 			entry->rule.arch_f = f;  in audit_data_to_entry()
495 			entry->rule.buflen += f->val;  in audit_data_to_entry()
516 			entry->rule.buflen += f->val;  in audit_data_to_entry()
518 			err = audit_to_watch(&entry->rule, str, f->val, f->op);  in audit_data_to_entry()
528 			entry->rule.buflen += f->val;  in audit_data_to_entry()
530 			err = audit_make_tree(&entry->rule, str, f->op);  in audit_data_to_entry()
536 			err = audit_to_inode(&entry->rule, f);  in audit_data_to_entry()
541 			if (entry->rule.filterkey || f->val > AUDIT_MAX_KEY_LEN)  in audit_data_to_entry()
546 			entry->rule.buflen += f->val;  in audit_data_to_entry()
547 			entry->rule.filterkey = str;  in audit_data_to_entry()
550 			if (entry->rule.exe || f->val > PATH_MAX)  in audit_data_to_entry()
557 			entry->rule.buflen += f->val;  in audit_data_to_entry()
559 			audit_mark = audit_alloc_mark(&entry->rule, str, f->val);  in audit_data_to_entry()
565 			entry->rule.exe = audit_mark;  in audit_data_to_entry()
570 	if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal)  in audit_data_to_entry()
571 		entry->rule.inode_f = NULL;  in audit_data_to_entry()
577 	if (entry->rule.tree)  in audit_data_to_entry()
578 		audit_put_tree(entry->rule.tree); /* that's the temporary one */  in audit_data_to_entry()
579 	if (entry->rule.exe)  in audit_data_to_entry()
580 		audit_remove_mark(entry->rule.exe); /* that's the template one */  in audit_data_to_entry()
794 	new = &entry->rule;  in audit_dupe_rule()
869 	if (entry->rule.inode_f) {  in audit_find_rule()
870 		h = audit_hash_ino(entry->rule.inode_f->val);  in audit_find_rule()
872 	} else if (entry->rule.watch) {  in audit_find_rule()
877 				if (!audit_compare_rule(&entry->rule, &e->rule)) {  in audit_find_rule()
884 		*p = list = &audit_filter_list[entry->rule.listnr];  in audit_find_rule()
888 		if (!audit_compare_rule(&entry->rule, &e->rule)) {  in audit_find_rule()
904 	struct audit_watch *watch = entry->rule.watch;  in audit_add_rule()
905 	struct audit_tree *tree = entry->rule.tree;  in audit_add_rule()
912 	if (entry->rule.listnr == AUDIT_FILTER_USER ||  in audit_add_rule()
913 		entry->rule.listnr == AUDIT_FILTER_TYPE)  in audit_add_rule()
930 		err = audit_add_watch(&entry->rule, &list);  in audit_add_rule()
943 		err = audit_add_tree_rule(&entry->rule);  in audit_add_rule()
950 	entry->rule.prio = ~0ULL;  in audit_add_rule()
951 	if (entry->rule.listnr == AUDIT_FILTER_EXIT) {  in audit_add_rule()
952 		if (entry->rule.flags & AUDIT_FILTER_PREPEND)  in audit_add_rule()
953 			entry->rule.prio = ++prio_high;  in audit_add_rule()
955 			entry->rule.prio = --prio_low;  in audit_add_rule()
958 	if (entry->rule.flags & AUDIT_FILTER_PREPEND) {  in audit_add_rule()
959 		list_add(&entry->rule.list,  in audit_add_rule()
960 			 &audit_rules_list[entry->rule.listnr]);  in audit_add_rule()
962 		entry->rule.flags &= ~AUDIT_FILTER_PREPEND;  in audit_add_rule()
964 		list_add_tail(&entry->rule.list,  in audit_add_rule()
965 			      &audit_rules_list[entry->rule.listnr]);  in audit_add_rule()
984 	struct audit_tree *tree = entry->rule.tree;  in audit_del_rule()
991 	if (entry->rule.listnr == AUDIT_FILTER_USER ||  in audit_del_rule()
992 		entry->rule.listnr == AUDIT_FILTER_TYPE)  in audit_del_rule()
1003 	if (e->rule.watch)  in audit_del_rule()
1004 		audit_remove_watch_rule(&e->rule);  in audit_del_rule()
1006 	if (e->rule.tree)  in audit_del_rule()
1007 		audit_remove_tree_rule(&e->rule);  in audit_del_rule()
1009 	if (e->rule.exe)  in audit_del_rule()
1010 		audit_remove_mark_rule(&e->rule);  in audit_del_rule()
1021 	list_del(&e->rule.list);  in audit_del_rule()
1063 static void audit_log_rule_change(char *action, struct audit_krule *rule, int res)  in audit_log_rule_change()  argument
1079 	audit_log_key(ab, rule->filterkey);  in audit_log_rule_change()
1080 	audit_log_format(ab, " list=%d res=%d", rule->listnr, res);  in audit_log_rule_change()
1105 		audit_log_rule_change("add_rule", &entry->rule, !err);  in audit_rule_change()
1109 		audit_log_rule_change("remove_rule", &entry->rule, !err);  in audit_rule_change()
1117 		if (entry->rule.exe)  in audit_rule_change()
1118 			audit_remove_mark(entry->rule.exe);  in audit_rule_change()
1293 static int audit_filter_user_rules(struct audit_krule *rule, int type,  in audit_filter_user_rules()  argument
1298 	for (i = 0; i < rule->field_count; i++) {  in audit_filter_user_rules()
1299 		struct audit_field *f = &rule->fields[i];  in audit_filter_user_rules()
1345 	switch (rule->action) {  in audit_filter_user_rules()
1362 		rc = audit_filter_user_rules(&e->rule, type, &state);  in audit_filter_user()
1386 		for (i = 0; i < e->rule.field_count; i++) {  in audit_filter_type()
1387 			struct audit_field *f = &e->rule.fields[i];  in audit_filter_type()
1404 	struct audit_entry *entry = container_of(r, struct audit_entry, rule);  in update_lsm_rule()
1412 	if (entry->rule.exe)  in update_lsm_rule()
1413 		audit_remove_mark(entry->rule.exe);  in update_lsm_rule()
1425 			list_replace_init(&r->rlist, &nentry->rule.rlist);  in update_lsm_rule()
1427 		list_replace(&r->list, &nentry->rule.list);  in update_lsm_rule()