Function report

Linux Kernel

v5.5.9

Brick Technologies Co., Ltd

Source Code:kernel\auditfilter.c Create Date:2022-07-28 11:24:32
Last Modify:2020-03-12 14:18:49 Copyright©Brick
home page Tree
Annotation kernel can get tool activityDownload SCCTChinese

Name:Common user-space to kernel rule translation.

Proto:static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule)

Type:struct audit_entry

Parameter:

TypeParameterName
struct audit_rule_data *rule
241  err = -EINVAL
242  listnr = AUDIT_PER_{TASK,CALL}, AUDIT_PREPEND & ~Prepend to front of list
244  Default
245  Go to exit_err
253  Case listnr == Apply rule to user-generated messages
254  Case listnr == Apply rule before record creation
255  Case listnr == Apply rule at __audit_inode_child
258  If Value for the false possibility is greater at compile time(AUDIT_NEVER, AUDIT_POSSIBLE, AUDIT_ALWAYS == Build context if rule matches ) Then
259  pr_err("AUDIT_POSSIBLE is deprecated\n")
260  Go to exit_err
262  If AUDIT_NEVER, AUDIT_POSSIBLE, AUDIT_ALWAYS != Do not build context if rule matches && AUDIT_NEVER, AUDIT_POSSIBLE, AUDIT_ALWAYS != Generate audit record if rule matches Then Go to exit_err
264  If field_count > Rule structure sizes -- if these change, different AUDIT_ADD and* AUDIT_LIST commands must be implemented. Then Go to exit_err
267  err = -ENOMEM
268  entry = Initialize an audit filterlist entry.
269  If Not entry Then Go to exit_err
272  flags = AUDIT_PER_{TASK,CALL}, AUDIT_PREPEND & Prepend to front of list
273  listnr = listnr
274  action = AUDIT_NEVER, AUDIT_POSSIBLE, AUDIT_ALWAYS
275  field_count = field_count
277  When i < AUDIT_BITMASK_SIZE cycle mask[i] = syscall(s) affected [i]
280  When i < AUDIT_SYSCALL_CLASSES cycle
281  bit = AUDIT_BITMASK_SIZE * 32 - i - 1
282  p = mask[AUDIT_WORD(bit)]
285  If Not (p & AUDIT_BIT(bit)) Then Continue
287  p &= ~AUDIT_BIT(bit)
288  class = classes[i]
289  If class Then
291  When j < AUDIT_BITMASK_SIZE cycle mask[j] |= class[j]
296  Return entry
298  exit_err :
299  Return ERR_PTR(err)
Caller
NameDescribe
audit_data_to_entryTranslate struct audit_rule_data to kernel's rule representation.