kernel/audit.h

291

extern void audit_remove_mark(struct audit_fsnotify_mark *audit_mark);

kernel/audit_fsnotify.c

100

if (unlikely(!audit_mark)) {

kernel/audit_fsnotify.c

101

audit_mark = ERR_PTR(-ENOMEM);

kernel/audit_fsnotify.c

105

fsnotify_init_mark(&audit_mark->mark, audit_fsnotify_group);

kernel/audit_fsnotify.c

106

audit_mark->mark.mask = AUDIT_FS_EVENTS;

kernel/audit_fsnotify.c

107

audit_mark->path = pathname;

kernel/audit_fsnotify.c

108

audit_mark->rule = krule;

kernel/audit_fsnotify.c

110

audit_update_mark(audit_mark, child);

kernel/audit_fsnotify.c

111

ret = fsnotify_add_inode_mark(&audit_mark->mark, dir, allow_dups);

kernel/audit_fsnotify.c

114

audit_mark->path = NULL;

kernel/audit_fsnotify.c

115

fsnotify_put_mark(&audit_mark->mark);

kernel/audit_fsnotify.c

116

audit_mark = ERR_PTR(ret);

kernel/audit_fsnotify.c

123

return audit_mark;

kernel/audit_fsnotify.c

126

static void audit_mark_log_rule_change(struct audit_fsnotify_mark *audit_mark, char *op)

kernel/audit_fsnotify.c

129

struct audit_krule *rule = audit_mark->rule;

kernel/audit_fsnotify.c

138

audit_log_untrustedstring(ab, audit_mark->path);

kernel/audit_fsnotify.c

144

void audit_remove_mark(struct audit_fsnotify_mark *audit_mark)

kernel/audit_fsnotify.c

146

fsnotify_destroy_mark(&audit_mark->mark, audit_fsnotify_group);

kernel/audit_fsnotify.c

147

fsnotify_put_mark(&audit_mark->mark);

kernel/audit_fsnotify.c

157

static void audit_autoremove_mark_rule(struct audit_fsnotify_mark *audit_mark)

kernel/audit_fsnotify.c

159

struct audit_krule *rule = audit_mark->rule;

kernel/audit_fsnotify.c

162

audit_mark_log_rule_change(audit_mark, "autoremove_rule");

kernel/audit_fsnotify.c

171

struct audit_fsnotify_mark *audit_mark;

kernel/audit_fsnotify.c

173

audit_mark = container_of(inode_mark, struct audit_fsnotify_mark, mark);

kernel/audit_fsnotify.c

179

if (audit_compare_dname_path(dname, audit_mark->path, AUDIT_NAME_FULL))

kernel/audit_fsnotify.c

181

audit_update_mark(audit_mark, inode);

kernel/audit_fsnotify.c

183

audit_autoremove_mark_rule(audit_mark);

kernel/audit_fsnotify.c

41

static void audit_fsnotify_mark_free(struct audit_fsnotify_mark *audit_mark)

kernel/audit_fsnotify.c

43

kfree(audit_mark->path);

kernel/audit_fsnotify.c

44

kfree(audit_mark);

kernel/audit_fsnotify.c

49

struct audit_fsnotify_mark *audit_mark;

kernel/audit_fsnotify.c

51

audit_mark = container_of(mark, struct audit_fsnotify_mark, mark);

kernel/audit_fsnotify.c

52

audit_fsnotify_mark_free(audit_mark);

kernel/audit_fsnotify.c

67

static void audit_update_mark(struct audit_fsnotify_mark *audit_mark,

kernel/audit_fsnotify.c

70

audit_mark->dev = inode ? inode->i_sb->s_dev : AUDIT_DEV_UNSET;

kernel/audit_fsnotify.c

71

audit_mark->ino = inode ? inode->i_ino : AUDIT_INO_UNSET;

kernel/audit_fsnotify.c

77

struct audit_fsnotify_mark *audit_mark;

kernel/audit_fsnotify.c

99

audit_mark = kzalloc_obj(*audit_mark);

kernel/audit_tree.c

170

return audit_mark(mark)->chunk;

kernel/audit_tree.c

175

kmem_cache_free(audit_tree_mark_cachep, audit_mark(mark));

kernel/audit_tree.c

288

audit_mark(mark)->chunk = chunk;

kernel/audit_watch.c

519

struct audit_fsnotify_mark *audit_mark;

kernel/audit_watch.c

526

audit_mark = audit_alloc_mark(new, pathname, strlen(pathname), ctx);

kernel/audit_watch.c

527

if (IS_ERR(audit_mark)) {

kernel/audit_watch.c

529

return PTR_ERR(audit_mark);

kernel/audit_watch.c

531

new->exe = audit_mark;

kernel/auditfilter.c

457

struct audit_fsnotify_mark *audit_mark;

kernel/auditfilter.c

592

audit_mark = audit_alloc_mark(&entry->rule, str, f_val, NULL);

kernel/auditfilter.c

593

if (IS_ERR(audit_mark)) {

kernel/auditfilter.c

595

err = PTR_ERR(audit_mark);

kernel/auditfilter.c

599

entry->rule.exe = audit_mark;