Lines Matching refs:ab

963 	struct audit_buffer *ab;  in audit_log_pid_context()  local
968 ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID); in audit_log_pid_context()
969 if (!ab) in audit_log_pid_context()
972 audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid, in audit_log_pid_context()
977 audit_log_format(ab, " obj=(none)"); in audit_log_pid_context()
980 audit_log_format(ab, " obj=%s", ctx); in audit_log_pid_context()
984 audit_log_format(ab, " ocomm="); in audit_log_pid_context()
985 audit_log_untrustedstring(ab, comm); in audit_log_pid_context()
986 audit_log_end(ab); in audit_log_pid_context()
1003 struct audit_buffer **ab, in audit_log_single_execve_arg() argument
1085 audit_log_end(*ab); in audit_log_single_execve_arg()
1086 *ab = audit_log_start(context, GFP_KERNEL, AUDIT_EXECVE); in audit_log_single_execve_arg()
1087 if (!*ab) in audit_log_single_execve_arg()
1096 audit_log_format(*ab, " a%d_len=%zu", arg_num, in audit_log_single_execve_arg()
1116 audit_log_format(*ab, " a%d", arg_num); in audit_log_single_execve_arg()
1118 audit_log_format(*ab, "[%d]", i); in audit_log_single_execve_arg()
1119 audit_log_format(*ab, "="); in audit_log_single_execve_arg()
1121 audit_log_n_hex(*ab, buf, to_send); in audit_log_single_execve_arg()
1123 audit_log_string(*ab, buf); in audit_log_single_execve_arg()
1138 struct audit_buffer **ab) in audit_log_execve_info() argument
1147 audit_log_format(*ab, "argc=%d", context->execve.argc); in audit_log_execve_info()
1162 len = audit_log_single_execve_arg(context, ab, i, in audit_log_execve_info()
1173 struct audit_buffer *ab; in show_special() local
1176 ab = audit_log_start(context, GFP_KERNEL, context->type); in show_special()
1177 if (!ab) in show_special()
1183 audit_log_format(ab, "nargs=%d", nargs); in show_special()
1185 audit_log_format(ab, " a%d=%lx", i, in show_special()
1191 audit_log_format(ab, "ouid=%u ogid=%u mode=%#ho", in show_special()
1199 audit_log_format(ab, " osid=%u", osid); in show_special()
1202 audit_log_format(ab, " obj=%s", ctx); in show_special()
1207 audit_log_end(ab); in show_special()
1208 ab = audit_log_start(context, GFP_KERNEL, in show_special()
1210 if (unlikely(!ab)) in show_special()
1212 audit_log_format(ab, in show_special()
1221 audit_log_format(ab, in show_special()
1231 audit_log_format(ab, in show_special()
1241 audit_log_format(ab, "mqdes=%d sigev_signo=%d", in show_special()
1247 audit_log_format(ab, in show_special()
1255 audit_log_format(ab, "pid=%d", context->capset.pid); in show_special()
1256 audit_log_cap(ab, "cap_pi", &context->capset.cap.inheritable); in show_special()
1257 audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted); in show_special()
1258 audit_log_cap(ab, "cap_pe", &context->capset.cap.effective); in show_special()
1261 audit_log_format(ab, "fd=%d flags=0x%x", context->mmap.fd, in show_special()
1265 audit_log_execve_info(context, &ab); in show_special()
1268 audit_log_end(ab); in show_special()
1290 struct audit_buffer *ab; in audit_log_proctitle() local
1292 ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE); in audit_log_proctitle()
1293 if (!ab) in audit_log_proctitle()
1296 audit_log_format(ab, "proctitle="); in audit_log_proctitle()
1320 audit_log_n_untrustedstring(ab, msg, len); in audit_log_proctitle()
1321 audit_log_end(ab); in audit_log_proctitle()
1327 struct audit_buffer *ab; in audit_log_exit() local
1334 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL); in audit_log_exit()
1335 if (!ab) in audit_log_exit()
1337 audit_log_format(ab, "arch=%x syscall=%d", in audit_log_exit()
1340 audit_log_format(ab, " per=%lx", context->personality); in audit_log_exit()
1342 audit_log_format(ab, " success=%s exit=%ld", in audit_log_exit()
1346 audit_log_format(ab, in audit_log_exit()
1354 audit_log_task_info(ab, tsk); in audit_log_exit()
1355 audit_log_key(ab, context->filterkey); in audit_log_exit()
1356 audit_log_end(ab); in audit_log_exit()
1360 ab = audit_log_start(context, GFP_KERNEL, aux->type); in audit_log_exit()
1361 if (!ab) in audit_log_exit()
1368 audit_log_format(ab, "fver=%x", axs->fcap_ver); in audit_log_exit()
1369 audit_log_cap(ab, "fp", &axs->fcap.permitted); in audit_log_exit()
1370 audit_log_cap(ab, "fi", &axs->fcap.inheritable); in audit_log_exit()
1371 audit_log_format(ab, " fe=%d", axs->fcap.fE); in audit_log_exit()
1372 audit_log_cap(ab, "old_pp", &axs->old_pcap.permitted); in audit_log_exit()
1373 audit_log_cap(ab, "old_pi", &axs->old_pcap.inheritable); in audit_log_exit()
1374 audit_log_cap(ab, "old_pe", &axs->old_pcap.effective); in audit_log_exit()
1375 audit_log_cap(ab, "new_pp", &axs->new_pcap.permitted); in audit_log_exit()
1376 audit_log_cap(ab, "new_pi", &axs->new_pcap.inheritable); in audit_log_exit()
1377 audit_log_cap(ab, "new_pe", &axs->new_pcap.effective); in audit_log_exit()
1381 audit_log_end(ab); in audit_log_exit()
1388 ab = audit_log_start(context, GFP_KERNEL, AUDIT_FD_PAIR); in audit_log_exit()
1389 if (ab) { in audit_log_exit()
1390 audit_log_format(ab, "fd0=%d fd1=%d", in audit_log_exit()
1392 audit_log_end(ab); in audit_log_exit()
1397 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SOCKADDR); in audit_log_exit()
1398 if (ab) { in audit_log_exit()
1399 audit_log_format(ab, "saddr="); in audit_log_exit()
1400 audit_log_n_hex(ab, (void *)context->sockaddr, in audit_log_exit()
1402 audit_log_end(ab); in audit_log_exit()
1427 ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD); in audit_log_exit()
1428 if (ab) { in audit_log_exit()
1429 audit_log_d_path(ab, " cwd=", &context->pwd); in audit_log_exit()
1430 audit_log_end(ab); in audit_log_exit()
1444 ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE); in audit_log_exit()
1445 if (ab) in audit_log_exit()
1446 audit_log_end(ab); in audit_log_exit()
1981 struct audit_buffer *ab; in audit_log_set_loginuid() local
1991 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN); in audit_log_set_loginuid()
1992 if (!ab) in audit_log_set_loginuid()
1994 audit_log_format(ab, "pid=%d uid=%u", task_pid_nr(current), uid); in audit_log_set_loginuid()
1995 audit_log_task_context(ab); in audit_log_set_loginuid()
1996 audit_log_format(ab, " old-auid=%u auid=%u old-ses=%u ses=%u res=%d", in audit_log_set_loginuid()
1998 audit_log_end(ab); in audit_log_set_loginuid()
2359 static void audit_log_task(struct audit_buffer *ab) in audit_log_task() argument
2370 audit_log_format(ab, "auid=%u uid=%u gid=%u ses=%u", in audit_log_task()
2375 audit_log_task_context(ab); in audit_log_task()
2376 audit_log_format(ab, " pid=%d comm=", task_pid_nr(current)); in audit_log_task()
2377 audit_log_untrustedstring(ab, get_task_comm(comm, current)); in audit_log_task()
2378 audit_log_d_path_exe(ab, current->mm); in audit_log_task()
2390 struct audit_buffer *ab; in audit_core_dumps() local
2398 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND); in audit_core_dumps()
2399 if (unlikely(!ab)) in audit_core_dumps()
2401 audit_log_task(ab); in audit_core_dumps()
2402 audit_log_format(ab, " sig=%ld", signr); in audit_core_dumps()
2403 audit_log_end(ab); in audit_core_dumps()
2408 struct audit_buffer *ab; in __audit_seccomp() local
2410 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_SECCOMP); in __audit_seccomp()
2411 if (unlikely(!ab)) in __audit_seccomp()
2413 audit_log_task(ab); in __audit_seccomp()
2414 audit_log_format(ab, " sig=%ld arch=%x syscall=%ld compat=%d ip=0x%lx code=0x%x", in __audit_seccomp()
2417 audit_log_end(ab); in __audit_seccomp()