Function report

Linux Kernel

v5.5.9

Brick Technologies Co., Ltd

Source Code:kernel\auditsc.c Create Date:2022-07-28 11:27:52
Last Modify:2020-03-17 16:31:21 Copyright©Brick
home page Tree
Annotation kernel can get tool activityDownload SCCTChinese

Name:handle_one

Proto:static inline void handle_one(const struct inode *inode)

Type:void

Parameter:

TypeParameterName
const struct inode *inode
1742  If Value is more likely to compile time(!i_fsnotify_marks) Then Return
1744  context = audit_context()
1745  p = trees
1746  count = tree_count
1747  _read_lock() - mark the beginning of an RCU read-side critical section* When synchronize_rcu() is invoked on one CPU while other CPUs* are within RCU read-side critical sections, then the* synchronize_rcu() is guaranteed to block until after all the other
1748  chunk = alled under rcu_read_lock
1749  _read_unlock() - marks the end of an RCU read-side critical section.* In most situations, rcu_read_unlock() is immune from deadlock.* However, in kernels built with CONFIG_RCU_BOOST, rcu_read_unlock()
1750  If Not chunk Then Return
1752  If Value is more likely to compile time(put_tree_ref(context, chunk)) Then Return
1754  If Value for the false possibility is greater at compile time(!grow_tree_refs(context)) Then
1755  pr_warn("out of memory, audit has lost a tree reference\n")
1756  We keep a linked list of fixed-sized (31 pointer) arrays of audit_chunk *;* ->first_trees points to its beginning, ->trees - to the current end of data
1757  audit_put_chunk(chunk)
1758  unroll_tree_refs(context, p, count)
1759  Return
1761  put_tree_ref(context, chunk)
Caller
NameDescribe
__audit_inode_child__audit_inode_child - collect inode info for created/removed objects*@parent: inode of dentry parent*@dentry: dentry being audited*@type: AUDIT_TYPE_* value that we're looking for* For syscalls that create or remove filesystem objects, audit_inode