Searched refs:krule (Results 1 - 9 of 9) sorted by relevance

/linux-4.4.14/kernel/
H A Daudit_watch.c54 struct list_head rules; /* anchor for krule->rlist */
189 int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op) audit_to_watch() argument
197 krule->listnr != AUDIT_FILTER_EXIT || audit_to_watch()
199 krule->inode_f || krule->watch || krule->tree) audit_to_watch()
206 krule->watch = watch; audit_to_watch()
379 static void audit_add_to_parent(struct audit_krule *krule, audit_add_to_parent() argument
382 struct audit_watch *w, *watch = krule->watch; audit_add_to_parent()
393 /* put krule's ref to temporary watch */ audit_add_to_parent()
397 krule->watch = watch = w; audit_add_to_parent()
409 list_add(&krule->rlist, &watch->rules); audit_add_to_parent()
414 int audit_add_watch(struct audit_krule *krule, struct list_head **list) audit_add_watch() argument
416 struct audit_watch *watch = krule->watch; audit_add_watch()
442 audit_add_to_parent(krule, parent); audit_add_watch()
451 void audit_remove_watch_rule(struct audit_krule *krule) audit_remove_watch_rule() argument
453 struct audit_watch *watch = krule->watch; audit_remove_watch_rule()
456 list_del(&krule->rlist); audit_remove_watch_rule()
H A Daudit_fsnotify.c83 struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pathname, int len) audit_alloc_mark() argument
110 audit_mark->rule = krule; audit_alloc_mark()
150 void audit_remove_mark_rule(struct audit_krule *krule) audit_remove_mark_rule() argument
152 struct audit_fsnotify_mark *mark = krule->exe; audit_remove_mark_rule()
H A Dauditfilter.c162 static inline int audit_to_inode(struct audit_krule *krule, audit_to_inode() argument
165 if (krule->listnr != AUDIT_FILTER_EXIT || audit_to_inode()
166 krule->inode_f || krule->watch || krule->tree || audit_to_inode()
170 krule->inode_f = f; audit_to_inode()
597 static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) audit_krule_to_data() argument
603 data = kmalloc(sizeof(*data) + krule->buflen, GFP_KERNEL); audit_krule_to_data()
608 data->flags = krule->flags | krule->listnr; audit_krule_to_data()
609 data->action = krule->action; audit_krule_to_data()
610 data->field_count = krule->field_count; audit_krule_to_data()
613 struct audit_field *f = &krule->fields[i]; audit_krule_to_data()
634 audit_watch_path(krule->watch)); audit_krule_to_data()
639 audit_tree_path(krule->tree)); audit_krule_to_data()
643 audit_pack_string(&bufp, krule->filterkey); audit_krule_to_data()
647 audit_pack_string(&bufp, audit_mark_path(krule->exe)); audit_krule_to_data()
650 if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) { audit_krule_to_data()
660 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) data->mask[i] = krule->mask[i]; audit_krule_to_data()
H A Daudit.h269 extern int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op);
270 extern int audit_add_watch(struct audit_krule *krule, struct list_head **list);
271 extern void audit_remove_watch_rule(struct audit_krule *krule);
275 extern struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pathname, int len);
278 extern void audit_remove_mark_rule(struct audit_krule *krule);
/linux-4.4.14/security/selinux/include/
H A Daudit.h62 int selinux_audit_rule_known(struct audit_krule *krule);
/linux-4.4.14/security/
H A Dsecurity.c1523 int security_audit_rule_known(struct audit_krule *krule) security_audit_rule_known() argument
1525 return call_int_hook(audit_rule_known, 0, krule); security_audit_rule_known()
/linux-4.4.14/include/linux/
H A Dsecurity.h1557 int security_audit_rule_known(struct audit_krule *krule);
1570 static inline int security_audit_rule_known(struct audit_krule *krule) security_audit_rule_known() argument
H A Dlsm_hooks.h1611 int (*audit_rule_known)(struct audit_krule *krule);
/linux-4.4.14/security/smack/
H A Dsmack_lsm.c4425 * @krule: rule of interest, in Audit kernel representation format
4431 static int smack_audit_rule_known(struct audit_krule *krule) smack_audit_rule_known() argument
4436 for (i = 0; i < krule->field_count; i++) { smack_audit_rule_known()
4437 f = &krule->fields[i]; smack_audit_rule_known()

Completed in 344 milliseconds