Lines Matching refs:rule
439 struct audit_krule *rule, in audit_filter_rules() argument
451 for (i = 0; i < rule->field_count; i++) { in audit_filter_rules()
452 struct audit_field *f = &rule->fields[i]; in audit_filter_rules()
470 result = audit_exe_compare(tsk, rule->exe); in audit_filter_rules()
598 result = audit_watch_compare(rule->watch, name->ino, name->dev); in audit_filter_rules()
602 result = match_tree_refs(ctx, rule->tree); in audit_filter_rules()
689 if (rule->prio <= ctx->prio) in audit_filter_rules()
691 if (rule->filterkey) { in audit_filter_rules()
693 ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC); in audit_filter_rules()
695 ctx->prio = rule->prio; in audit_filter_rules()
697 switch (rule->action) { in audit_filter_rules()
715 if (audit_filter_rules(tsk, &e->rule, NULL, NULL, in audit_filter_task()
718 *key = kstrdup(e->rule.filterkey, GFP_ATOMIC); in audit_filter_task()
727 static int audit_in_mask(const struct audit_krule *rule, unsigned long val) in audit_in_mask() argument
740 return rule->mask[word] & bit; in audit_in_mask()
761 if (audit_in_mask(&e->rule, ctx->major) && in audit_filter_syscall()
762 audit_filter_rules(tsk, &e->rule, ctx, NULL, in audit_filter_syscall()
790 if (audit_in_mask(&e->rule, ctx->major) && in audit_filter_inode_name()
791 audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) { in audit_filter_inode_name()