Lines Matching refs:audit
56 #include <linux/audit.h>
71 #include "audit.h"
77 /* Indicates that audit should log the full pathname. */
80 /* no execve audit message should be longer than this (userspace limits) */
83 /* number of audit rules */
165 /* The per-task audit context. */
683 * also not high enough that we already know we have to write an audit
763 * we need to fix up the return code in the audit logs if the actual
860 * audit_alloc - allocate an audit context block for a task
863 * Filter on the task information and allocate a per-task audit context
902 printk(KERN_ERR "audit(:%d): major=%d name_count=%d:"
917 printk(KERN_ERR "audit: freed %d contexts\n", count);
1014 * space in every audit message. In one 7500 byte message we can log up to
1528 * audit_free - free a per-task audit context
1529 * @tsk: task whose audit context block to free
1555 * audit_syscall_entry - fill in an audit record at syscall entry
1563 * Fill in audit context at syscall entry. This only happens if the
1564 * audit context was created when the task was created and the state or
1565 * filters demand the audit context be built. If the state from the
1601 "audit(:%d) pid=%d in syscall=%d;"
1667 * audit_syscall_exit - deallocate audit context after a system call
1671 * Tear down after system call. If the audit context has been marked as
1673 * filtering, or because some other part of the kernel write an audit
1740 printk(KERN_WARNING "out of memory, audit has lost a tree reference\n");
1800 "out of memory, audit has lost a tree reference\n");
1813 * Add a name to the list of audit names for this context.
1845 * If we have stored the name from getname in the audit context,
1890 printk(KERN_DEBUG "audit: name_count maxed, losing inode data: "
1988 * This call updates the audit context with the child's information.
2108 * @task: task whose audit context is being modified
2140 * __audit_mq_open - record audit data for a POSIX MQ open
2162 * __audit_mq_sendrecv - record audit data for a POSIX MQ timed send/receive
2188 * __audit_mq_notify - record audit data for a POSIX MQ notify
2208 * __audit_mq_getsetattr - record audit data for a POSIX MQ get/set attribute
2222 * audit_ipc_obj - record audit data for ipc object
2238 * audit_ipc_set_perm - record audit data for new ipc permissions
2280 * audit_socketcall - record audit data for sys_socketcall
2298 * __audit_fd_pair - record audit data for pipe and socketpair
2311 * audit_sockaddr - record audit data for sys_bind, sys_connect, sys_sendto
2349 * audit_signal_info - record signal info for shutting down audit subsystem
2353 * If the audit subsystem is being terminated, record the task (pid)
2464 * audit system if applicable