Searched refs:krule (Results 1 - 9 of 9) sorted by relevance
/linux-4.4.14/kernel/ |
H A D | audit_watch.c | 54 struct list_head rules; /* anchor for krule->rlist */ 189 int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op) audit_to_watch() argument 197 krule->listnr != AUDIT_FILTER_EXIT || audit_to_watch() 199 krule->inode_f || krule->watch || krule->tree) audit_to_watch() 206 krule->watch = watch; audit_to_watch() 379 static void audit_add_to_parent(struct audit_krule *krule, audit_add_to_parent() argument 382 struct audit_watch *w, *watch = krule->watch; audit_add_to_parent() 393 /* put krule's ref to temporary watch */ audit_add_to_parent() 397 krule->watch = watch = w; audit_add_to_parent() 409 list_add(&krule->rlist, &watch->rules); audit_add_to_parent() 414 int audit_add_watch(struct audit_krule *krule, struct list_head **list) audit_add_watch() argument 416 struct audit_watch *watch = krule->watch; audit_add_watch() 442 audit_add_to_parent(krule, parent); audit_add_watch() 451 void audit_remove_watch_rule(struct audit_krule *krule) audit_remove_watch_rule() argument 453 struct audit_watch *watch = krule->watch; audit_remove_watch_rule() 456 list_del(&krule->rlist); audit_remove_watch_rule()
|
H A D | audit_fsnotify.c | 83 struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pathname, int len) audit_alloc_mark() argument 110 audit_mark->rule = krule; audit_alloc_mark() 150 void audit_remove_mark_rule(struct audit_krule *krule) audit_remove_mark_rule() argument 152 struct audit_fsnotify_mark *mark = krule->exe; audit_remove_mark_rule()
|
H A D | auditfilter.c | 162 static inline int audit_to_inode(struct audit_krule *krule, audit_to_inode() argument 165 if (krule->listnr != AUDIT_FILTER_EXIT || audit_to_inode() 166 krule->inode_f || krule->watch || krule->tree || audit_to_inode() 170 krule->inode_f = f; audit_to_inode() 597 static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) audit_krule_to_data() argument 603 data = kmalloc(sizeof(*data) + krule->buflen, GFP_KERNEL); audit_krule_to_data() 608 data->flags = krule->flags | krule->listnr; audit_krule_to_data() 609 data->action = krule->action; audit_krule_to_data() 610 data->field_count = krule->field_count; audit_krule_to_data() 613 struct audit_field *f = &krule->fields[i]; audit_krule_to_data() 634 audit_watch_path(krule->watch)); audit_krule_to_data() 639 audit_tree_path(krule->tree)); audit_krule_to_data() 643 audit_pack_string(&bufp, krule->filterkey); audit_krule_to_data() 647 audit_pack_string(&bufp, audit_mark_path(krule->exe)); audit_krule_to_data() 650 if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) { audit_krule_to_data() 660 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) data->mask[i] = krule->mask[i]; audit_krule_to_data()
|
H A D | audit.h | 269 extern int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op); 270 extern int audit_add_watch(struct audit_krule *krule, struct list_head **list); 271 extern void audit_remove_watch_rule(struct audit_krule *krule); 275 extern struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pathname, int len); 278 extern void audit_remove_mark_rule(struct audit_krule *krule);
|
/linux-4.4.14/security/selinux/include/ |
H A D | audit.h | 62 int selinux_audit_rule_known(struct audit_krule *krule);
|
/linux-4.4.14/security/ |
H A D | security.c | 1523 int security_audit_rule_known(struct audit_krule *krule) security_audit_rule_known() argument 1525 return call_int_hook(audit_rule_known, 0, krule); security_audit_rule_known()
|
/linux-4.4.14/include/linux/ |
H A D | security.h | 1557 int security_audit_rule_known(struct audit_krule *krule); 1570 static inline int security_audit_rule_known(struct audit_krule *krule) security_audit_rule_known() argument
|
H A D | lsm_hooks.h | 1611 int (*audit_rule_known)(struct audit_krule *krule);
|
/linux-4.4.14/security/smack/ |
H A D | smack_lsm.c | 4425 * @krule: rule of interest, in Audit kernel representation format 4431 static int smack_audit_rule_known(struct audit_krule *krule) smack_audit_rule_known() argument 4436 for (i = 0; i < krule->field_count; i++) { smack_audit_rule_known() 4437 f = &krule->fields[i]; smack_audit_rule_known()
|
Completed in 344 milliseconds