51 	int action;  member
78 	{.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
79 	{.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
80 	{.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
81 	{.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
82 	{.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
83 	{.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
84 	{.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
85 	{.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
86 	{.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
88 	{.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}
92 	{.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
94 	{.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
96 	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
98 	{.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
99 	{.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
103 	{.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
105 	{.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
107 	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
109 	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
111 	{.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
112 	{.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
116 	{.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
117 	{.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
118 	{.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
119 	{.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
120 	{.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC},
121 	{.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
122 	{.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
123 	{.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
124 	{.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
125 	{.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
126 	{.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
128 	{.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER},
131 	{.action = APPRAISE, .fowner = GLOBAL_ROOT_UID,
330 	int action = 0, actmask = flags | (flags << 1);  in ima_match_policy()  local
334 		if (!(entry->action & actmask))  in ima_match_policy()
340 		action |= entry->flags & IMA_ACTION_FLAGS;  in ima_match_policy()
342 		action |= entry->action & IMA_DO_MASK;  in ima_match_policy()
343 		if (entry->action & IMA_APPRAISE)  in ima_match_policy()
344 			action |= get_subaction(entry, func);  in ima_match_policy()
346 		if (entry->action & IMA_DO_MASK)  in ima_match_policy()
347 			actmask &= ~(entry->action | entry->action << 1);  in ima_match_policy()
349 			actmask &= ~(entry->action | entry->action >> 1);  in ima_match_policy()
355 	return action;  in ima_match_policy()
370 		if (entry->action & IMA_DO_MASK)  in ima_update_policy_flag()
371 			ima_policy_flag |= entry->action;  in ima_update_policy_flag()
510 	entry->action = UNKNOWN;  in ima_parse_rule()
525 			if (entry->action != UNKNOWN)  in ima_parse_rule()
528 			entry->action = MEASURE;  in ima_parse_rule()
533 			if (entry->action != UNKNOWN)  in ima_parse_rule()
536 			entry->action = DONT_MEASURE;  in ima_parse_rule()
541 			if (entry->action != UNKNOWN)  in ima_parse_rule()
544 			entry->action = APPRAISE;  in ima_parse_rule()
549 			if (entry->action != UNKNOWN)  in ima_parse_rule()
552 			entry->action = DONT_APPRAISE;  in ima_parse_rule()
557 			if (entry->action != UNKNOWN)  in ima_parse_rule()
560 			entry->action = AUDIT;  in ima_parse_rule()
714 			if (entry->action != APPRAISE) {  in ima_parse_rule()
734 	if (!result && (entry->action == UNKNOWN))  in ima_parse_rule()