security/audit/audit_bsm_klib.c

58  * Hash table functions for the audit event number to event class mask
63 	au_event_t event;
71 static MALLOC_DEFINE(M_AUDITEVCLASS, "audit_evclass", "Audit event class");
82  * Look up the class for an audit event in the class mapping table.
85 au_event_class(au_event_t event)
92 	evcl = &evclass_hash[event % EVCLASSMAP_HASH_TABLE_SIZE];
95 		if (evc->event == event) {
106  * Insert a event to class mapping. If the event already exists in the
113 au_evclassmap_insert(au_event_t event, au_class_t class)
119 	 * If this event requires auditing a system call then add it to  our
120 	 * audit kernel event mask.  We use audit_kevent_mask to check to see
124 	if (AUE_IS_A_KEVENT(event))
129 	 * Free if there is already a mapping for this event.
134 	evcl = &evclass_hash[event % EVCLASSMAP_HASH_TABLE_SIZE];
136 		if (evc->event == event) {
144 	evc->event = event;
160 	 * Set up the initial event to class mapping for system calls.
180  * Check whether an event is aditable by comparing the mask of classes this
181  * event is part of against the given mask.
184 au_preselect(__unused au_event_t event, au_class_t class, au_mask_t *mask_p,
193 	 * Perform the actual check of the masks against the event.
261  * Convert an open flags specifier into a specific type of open event for
358  * Convert an open flags specifier into a specific type of open_extended event
455  * Convert a MSGCTL command to a specific event.
478  * Convert a SEMCTL command to a specific event.
522  * Convert a command for the auditon() system call to a audit event.