linux/kernel/auditfilter.c

153 static inline int audit_to_inode(struct audit_krule *krule,
156 	if ((krule->listnr != AUDIT_FILTER_EXIT &&
157 	     krule->listnr != AUDIT_FILTER_URING_EXIT) ||
158 	    krule->inode_f || krule->watch || krule->tree ||
162 	krule->inode_f = f;
635 static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
641 	data = kmalloc(struct_size(data, buf, krule->buflen), GFP_KERNEL);
646 	data->flags = krule->flags | krule->listnr;
647 	data->action = krule->action;
648 	data->field_count = krule->field_count;
651 		struct audit_field *f = &krule->fields[i];
672 						  audit_watch_path(krule->watch));
677 						  audit_tree_path(krule->tree));
681 				audit_pack_string(&bufp, krule->filterkey);
685 				audit_pack_string(&bufp, audit_mark_path(krule->exe));
688 			if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {
699 		data->mask[i] = krule->mask[i];