Function report

Linux Kernel

v5.5.9

Brick Technologies Co., Ltd

Source Code:kernel\auditfilter.c Create Date:2022-07-28 11:25:03
Last Modify:2020-03-12 14:18:49 Copyright©Brick
home page Tree
Annotation kernel can get tool activityDownload SCCTChinese

Name:Compare two rules in kernel format. Considered success if rules* don't match.

Proto:static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)

Type:int

Parameter:

TypeParameterName
struct audit_krule *a
struct audit_krule *b
700  If flags != flags || pflags != pflags || listnr != listnr || action != action || field_count != field_count Then Return 1
707  When i < field_count cycle
708  If type != type || op != op Then Return 1
713  Case type == security label user
714  Case type == security label role
715  Case type == security label type
716  Case type == security label sensitivity label
717  Case type == security label clearance label
718  Case type == AUDIT_OBJ_USER
719  Case type == AUDIT_OBJ_ROLE
720  Case type == AUDIT_OBJ_TYPE
721  Case type == AUDIT_OBJ_LEV_LOW
722  Case type == AUDIT_OBJ_LEV_HIGH
723  If strcmp(lsm_str, lsm_str) Then Return 1
725  Break
726  Case type == AUDIT_WATCH
727  If strcmp(audit_watch_path( associated watch ), audit_watch_path( associated watch )) Then Return 1
730  Break
731  Case type == AUDIT_DIR
732  If strcmp(ver called ( associated watched tree ), ver called ( associated watched tree )) Then Return 1
735  Break
736  Case type == AUDIT_FILTERKEY
738  If strcmp( ties events to rules , ties events to rules ) Then Return 1
740  Break
741  Case type == AUDIT_EXE
743  If strcmp(audit_mark_path(exe), audit_mark_path(exe)) Then Return 1
746  Break
747  Case type == AUDIT_UID
748  Case type == AUDIT_EUID
749  Case type == AUDIT_SUID
750  Case type == AUDIT_FSUID
751  Case type == AUDIT_LOGINUID
752  Case type == AUDIT_OBJ_UID
753  If Not uid_eq(uid, uid) Then Return 1
755  Break
756  Case type == AUDIT_GID
757  Case type == AUDIT_EGID
758  Case type == AUDIT_SGID
759  Case type == AUDIT_FSGID
760  Case type == AUDIT_OBJ_GID
761  If Not gid_eq(gid, gid) Then Return 1
763  Break
764  Default
765  If val != val Then Return 1
770  When i < AUDIT_BITMASK_SIZE cycle If mask[i] != mask[i] Then
772  Return 1
774  Return 0
Caller
NameDescribe
audit_find_ruleFind an existing audit rule.* Caller must hold audit_filter_mutex to prevent stale rule data.