security/audit/audit_pipe.c

95  * and optionally expressing per-auid masks.  The following data structure is
96  * the per-auid mask description.  The global state is stored in the audit
100  * usage patterns for per-auid specifications are clear.
161 	 * interest specifications by auid.
271  * Find an audit pipe preselection specification for an auid, if any.
274 audit_pipe_preselect_find(struct audit_pipe *ap, au_id_t auid)
281 		if (app->app_auid == auid)
288  * Query the per-pipe mask for a specific auid.
291 audit_pipe_preselect_get(struct audit_pipe *ap, au_id_t auid,
298 	app = audit_pipe_preselect_find(ap, auid);
309  * Set the per-pipe mask for a specific auid.  Add a new entry if needed;
313 audit_pipe_preselect_set(struct audit_pipe *ap, au_id_t auid, au_mask_t mask)
318 	 * Pessimistically assume that the auid doesn't already have a mask
323 	app = audit_pipe_preselect_find(ap, auid);
327 		app->app_auid = auid;
337  * Delete a per-auid mask on an audit pipe.
340 audit_pipe_preselect_delete(struct audit_pipe *ap, au_id_t auid)
346 	app = audit_pipe_preselect_find(ap, auid);
359  * Delete all per-auid masks on an audit pipe.
389  * - If not, search for a specifically configured auid entry matching the
394 audit_pipe_preselect_check(struct audit_pipe *ap, au_id_t auid,
406 		app = audit_pipe_preselect_find(ap, auid);
408 			if (auid == AU_DEFAUDITID)
431 audit_pipe_preselect(au_id_t auid, au_event_t event, au_class_t class,
443 		if (audit_pipe_preselect_check(ap, auid, event, class, sorf,
507 audit_pipe_submit(au_id_t auid, au_event_t event, au_class_t class, int sorf,
521 		if (audit_pipe_preselect_check(ap, auid, event, class, sorf,
583 	 * Default flags, naflags, and auid-specific preselection settings to
699 	au_id_t auid;
822 		auid = *(au_id_t *)data;
823 		error = audit_pipe_preselect_delete(ap, auid);