Lines Matching full:rule
84 struct audit_krule *erule = &e->rule; in audit_free_rule()
118 entry->rule.fields = fields; in audit_init_entry()
210 struct audit_field *arch = entry->rule.arch_f; in audit_match_signal()
216 entry->rule.mask) && in audit_match_signal()
218 entry->rule.mask)); in audit_match_signal()
224 entry->rule.mask)); in audit_match_signal()
227 entry->rule.mask)); in audit_match_signal()
234 /* Common user-space to kernel rule translation. */
235 static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule) in audit_to_entry_common() argument
242 listnr = rule->flags & ~AUDIT_FILTER_PREPEND; in audit_to_entry_common()
258 if (unlikely(rule->action == AUDIT_POSSIBLE)) { in audit_to_entry_common()
262 if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS) in audit_to_entry_common()
264 if (rule->field_count > AUDIT_MAX_FIELDS) in audit_to_entry_common()
268 entry = audit_init_entry(rule->field_count); in audit_to_entry_common()
272 entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND; in audit_to_entry_common()
273 entry->rule.listnr = listnr; in audit_to_entry_common()
274 entry->rule.action = rule->action; in audit_to_entry_common()
275 entry->rule.field_count = rule->field_count; in audit_to_entry_common()
278 entry->rule.mask[i] = rule->mask[i]; in audit_to_entry_common()
282 __u32 *p = &entry->rule.mask[AUDIT_WORD(bit)]; in audit_to_entry_common()
292 entry->rule.mask[j] |= class[j]; in audit_to_entry_common()
327 if (entry->rule.listnr != AUDIT_FILTER_EXCLUDE && in audit_field_valid()
328 entry->rule.listnr != AUDIT_FILTER_USER) in audit_field_valid()
332 if (entry->rule.listnr != AUDIT_FILTER_FS) in audit_field_valid()
337 switch (entry->rule.listnr) { in audit_field_valid()
440 /* Translate struct audit_rule_data to kernel's rule representation. */
458 struct audit_field *f = &entry->rule.fields[i]; in audit_data_to_entry()
474 entry->rule.pflags |= AUDIT_LOGINUID_LEGACY; in audit_data_to_entry()
504 entry->rule.arch_f = f; in audit_data_to_entry()
521 entry->rule.buflen += f_val; in audit_data_to_entry()
528 pr_warn("audit rule for LSM \'%s\' is invalid\n", in audit_data_to_entry()
540 err = audit_to_watch(&entry->rule, str, f_val, f->op); in audit_data_to_entry()
545 entry->rule.buflen += f_val; in audit_data_to_entry()
553 err = audit_make_tree(&entry->rule, str, f->op); in audit_data_to_entry()
557 entry->rule.buflen += f_val; in audit_data_to_entry()
561 err = audit_to_inode(&entry->rule, f); in audit_data_to_entry()
566 if (entry->rule.filterkey || f_val > AUDIT_MAX_KEY_LEN) in audit_data_to_entry()
573 entry->rule.buflen += f_val; in audit_data_to_entry()
574 entry->rule.filterkey = str; in audit_data_to_entry()
577 if (entry->rule.exe || f_val > PATH_MAX) in audit_data_to_entry()
584 audit_mark = audit_alloc_mark(&entry->rule, str, f_val); in audit_data_to_entry()
590 entry->rule.buflen += f_val; in audit_data_to_entry()
591 entry->rule.exe = audit_mark; in audit_data_to_entry()
599 if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal) in audit_data_to_entry()
600 entry->rule.inode_f = NULL; in audit_data_to_entry()
606 if (entry->rule.tree) in audit_data_to_entry()
607 audit_put_tree(entry->rule.tree); /* that's the temporary one */ in audit_data_to_entry()
608 if (entry->rule.exe) in audit_data_to_entry()
609 audit_remove_mark(entry->rule.exe); /* that's the template one */ in audit_data_to_entry()
625 /* Translate kernel rule representation to struct audit_rule_data. */
797 pr_warn("audit rule for LSM \'%s\' is invalid\n", in audit_dupe_lsm_field()
805 /* Duplicate an audit rule. This will be a deep copy with the exception
808 * rule with the new rule in the filterlist, then free the old rule.
823 new = &entry->rule; in audit_dupe_rule()
838 * since we'd have to have rule gone from the list *and* removed in audit_dupe_rule()
846 * the originals will all be freed when the old rule is freed. */ in audit_dupe_rule()
889 /* Find an existing audit rule.
890 * Caller must hold audit_filter_mutex to prevent stale rule data. */
898 if (entry->rule.inode_f) { in audit_find_rule()
899 h = audit_hash_ino(entry->rule.inode_f->val); in audit_find_rule()
901 } else if (entry->rule.watch) { in audit_find_rule()
906 if (!audit_compare_rule(&entry->rule, &e->rule)) { in audit_find_rule()
913 *p = list = &audit_filter_list[entry->rule.listnr]; in audit_find_rule()
917 if (!audit_compare_rule(&entry->rule, &e->rule)) { in audit_find_rule()
929 /* Add rule to given filterlist if not a duplicate. */
933 struct audit_watch *watch = entry->rule.watch; in audit_add_rule()
934 struct audit_tree *tree = entry->rule.tree; in audit_add_rule()
941 switch(entry->rule.listnr) { in audit_add_rule()
962 err = audit_add_watch(&entry->rule, &list); in audit_add_rule()
975 err = audit_add_tree_rule(&entry->rule); in audit_add_rule()
982 entry->rule.prio = ~0ULL; in audit_add_rule()
983 if (entry->rule.listnr == AUDIT_FILTER_EXIT) { in audit_add_rule()
984 if (entry->rule.flags & AUDIT_FILTER_PREPEND) in audit_add_rule()
985 entry->rule.prio = ++prio_high; in audit_add_rule()
987 entry->rule.prio = --prio_low; in audit_add_rule()
990 if (entry->rule.flags & AUDIT_FILTER_PREPEND) { in audit_add_rule()
991 list_add(&entry->rule.list, in audit_add_rule()
992 &audit_rules_list[entry->rule.listnr]); in audit_add_rule()
994 entry->rule.flags &= ~AUDIT_FILTER_PREPEND; in audit_add_rule()
996 list_add_tail(&entry->rule.list, in audit_add_rule()
997 &audit_rules_list[entry->rule.listnr]); in audit_add_rule()
1012 /* Remove an existing rule from filterlist. */
1016 struct audit_tree *tree = entry->rule.tree; in audit_del_rule()
1023 switch(entry->rule.listnr) { in audit_del_rule()
1038 if (e->rule.watch) in audit_del_rule()
1039 audit_remove_watch_rule(&e->rule); in audit_del_rule()
1041 if (e->rule.tree) in audit_del_rule()
1042 audit_remove_tree_rule(&e->rule); in audit_del_rule()
1044 if (e->rule.exe) in audit_del_rule()
1045 audit_remove_mark_rule(&e->rule); in audit_del_rule()
1056 list_del(&e->rule.list); in audit_del_rule()
1097 /* Log rule additions and removals */
1098 static void audit_log_rule_change(char *action, struct audit_krule *rule, int res) in audit_log_rule_change() argument
1111 audit_log_key(ab, rule->filterkey); in audit_log_rule_change()
1112 audit_log_format(ab, " list=%d res=%d", rule->listnr, res); in audit_log_rule_change()
1134 audit_log_rule_change("add_rule", &entry->rule, !err); in audit_rule_change()
1141 audit_log_rule_change("remove_rule", &entry->rule, !err); in audit_rule_change()
1149 if (entry->rule.exe) in audit_rule_change()
1150 audit_remove_mark(entry->rule.exe); in audit_rule_change()
1329 for (i = 0; i < e->rule.field_count; i++) { in audit_filter()
1330 struct audit_field *f = &e->rule.fields[i]; in audit_filter()
1368 result = audit_exe_compare(current, e->rule.exe); in audit_filter()
1381 if (e->rule.action == AUDIT_NEVER || listtype == AUDIT_FILTER_EXCLUDE) in audit_filter()
1393 struct audit_entry *entry = container_of(r, struct audit_entry, rule); in update_lsm_rule()
1401 if (entry->rule.exe) in update_lsm_rule()
1402 audit_remove_mark(entry->rule.exe); in update_lsm_rule()
1414 list_replace_init(&r->rlist, &nentry->rule.rlist); in update_lsm_rule()
1416 list_replace(&r->list, &nentry->rule.list); in update_lsm_rule()
1425 * specific filter fields. When such a rule is found, it is copied, the
1426 * LSM field is re-initialized, and the old rule is replaced with the
1427 * updated rule. */