Function report

Linux Kernel

v5.5.9

Brick Technologies Co., Ltd

Source Code:kernel\auditfilter.c Create Date:2022-07-28 11:25:18
Last Modify:2020-03-12 14:18:49 Copyright©Brick
home page Tree
Annotation kernel can get tool activityDownload SCCTChinese

Name:Remove an existing rule from filterlist.

Proto:int audit_del_rule(struct audit_entry *entry)

Type:int

Parameter:

TypeParameterName
struct audit_entry *entry
1016  tree = associated watched tree
1018  ret = 0
1031  mutex_lock( & audit_filter_mutex)
1032  e = Find an existing audit rule.* Caller must hold audit_filter_mutex to prevent stale rule data.
1033  If Not e Then
1034  ret = -ENOENT
1035  Go to out
1038  If associated watch Then audit_remove_watch_rule( & rule)
1041  If associated watched tree Then audit_remove_tree_rule( & rule)
1044  If exe Then
1055  list_del_rcu - deletes entry from list without re-initialization*@entry: the element to delete from the list
1056  deletes entry from list
1057  all_rcu() - Queue an RCU callback for invocation after a grace period
1059  out :
1060  mutex_unlock - release the mutex*@lock: the mutex to be released* Unlock a mutex that has been locked by this task previously.* This function must not be used in interrupt context. Unlocking* of a not locked mutex is not allowed.
1062  If tree Then audit_put_tree(tree)
1065  Return ret
Caller
NameDescribe
audit_rule_changeaudit_rule_change - apply all rules to the specified message type*@type: audit message type*@seq: netlink audit message sequence (serial) number*@data: payload data*@datasz: size of payload data
audit_autoremove_mark_rule