Function report

Linux Kernel

v5.5.9

Brick Technologies Co., Ltd

Source Code:kernel\auditsc.c Create Date:2022-07-28 11:28:11
Last Modify:2020-03-17 16:31:21 Copyright©Brick
home page Tree
Annotation kernel can get tool activityDownload SCCTChinese

Name:__audit_inode_child - collect inode info for created/removed objects*@parent: inode of dentry parent*@dentry: dentry being audited*@type: AUDIT_TYPE_* value that we're looking for* For syscalls that create or remove filesystem objects, audit_inode

Proto:void __audit_inode_child(struct inode *parent, const struct dentry *dentry, const unsigned char type)

Type:void

Parameter:

TypeParameterName
struct inode *parent
const struct dentry *dentry
const unsigned chartype
2065  context = audit_context()
2066  inode = d_backing_inode - Get upper or lower inode we should be using*@upper: The upper layer* This is the helper that should be used to get at the inode that will be used* if this dentry were to be opened as a file. The inode may be on the upper
2067  dname = d_name
2068  struct audit_names * n, * found_parent = NULL, * found_child = NULL
2070  list = Audit filter lists, defined in [Apply rule at __audit_inode_child ]
2073  If Not 1 if task is in a syscall Then Return
2076  _read_lock() - mark the beginning of an RCU read-side critical section* When synchronize_rcu() is invoked on one CPU while other CPUs* are within RCU read-side critical sections, then the* synchronize_rcu() is guaranteed to block until after all the other
2078  When i < field_count cycle
2079  f = fields[i]
2081  If type == FileSystem Type && audit_comparator(s_magic, op, val) && action == Do not build context if rule matches Then
2085  _read_unlock() - marks the end of an RCU read-side critical section.* In most situations, rcu_read_unlock() is immune from deadlock.* However, in kernels built with CONFIG_RCU_BOOST, rcu_read_unlock()
2086  Return
2090  _read_unlock() - marks the end of an RCU read-side critical section.* In most situations, rcu_read_unlock() is immune from deadlock.* However, in kernels built with CONFIG_RCU_BOOST, rcu_read_unlock()
2092  If inode Then handle_one(inode)
2097  If Not name || cord type != a parent audit record && cord type != we don't know yet Then Continue
2102  If ino == Stat data, not accessed from path walking && dev == s_dev && Not audit_compare_dname_path - compare given dentry name with last component in* given path. Return of 0 indicates a match.*@dname: dentry name that we're comparing*@path: full pathname that we're comparing*@parentlen: length of the parent if known Then
2105  If cord type == we don't know yet Then cord type = a parent audit record
2107  found_parent = n
2108  Break
2115  If Not name || cord type != type && cord type != we don't know yet Then Continue
2119  If Not strcmp(name, pointer to actual string ) || Not audit_compare_dname_path - compare given dentry name with last component in* given path. Return of 0 indicates a match.*@dname: dentry name that we're comparing*@path: full pathname that we're comparing*@parentlen: length of the parent if known Then
2124  If cord type == we don't know yet Then cord type = type
2126  found_child = n
2127  Break
2131  If Not found_parent Then
2133  n = audit_alloc_name(context, a parent audit record )
2134  If Not n Then Return
2136  Copy inode data into an audit_names.
2139  If Not found_child Then
2140  found_child = audit_alloc_name(context, type)
2141  If Not found_child Then Return
2147  If found_parent Then
2148  name = name
2149  umber of chars to log = Indicates that audit should log the full pathname.
2150  refcnt++
2154  If inode Then Copy inode data into an audit_names.
2156  Else ino = AUDIT_INO_UNSET