linux-master/kernel/audit_fsnotify.c

41 static void audit_fsnotify_mark_free(struct audit_fsnotify_mark *audit_mark)
43 	kfree(audit_mark->path);
44 	kfree(audit_mark);
49 	struct audit_fsnotify_mark *audit_mark;
51 	audit_mark = container_of(mark, struct audit_fsnotify_mark, mark);
52 	audit_fsnotify_mark_free(audit_mark);
67 static void audit_update_mark(struct audit_fsnotify_mark *audit_mark,
70 	audit_mark->dev = inode ? inode->i_sb->s_dev : AUDIT_DEV_UNSET;
71 	audit_mark->ino = inode ? inode->i_ino : AUDIT_INO_UNSET;
76 	struct audit_fsnotify_mark *audit_mark;
91 	audit_mark = kzalloc(sizeof(*audit_mark), GFP_KERNEL);
92 	if (unlikely(!audit_mark)) {
93 		audit_mark = ERR_PTR(-ENOMEM);
97 	fsnotify_init_mark(&audit_mark->mark, audit_fsnotify_group);
98 	audit_mark->mark.mask = AUDIT_FS_EVENTS;
99 	audit_mark->path = pathname;
100 	audit_update_mark(audit_mark, dentry->d_inode);
101 	audit_mark->rule = krule;
103 	ret = fsnotify_add_inode_mark(&audit_mark->mark, inode, 0);
105 		audit_mark->path = NULL;
106 		fsnotify_put_mark(&audit_mark->mark);
107 		audit_mark = ERR_PTR(ret);
112 	return audit_mark;
115 static void audit_mark_log_rule_change(struct audit_fsnotify_mark *audit_mark, char *op)
118 	struct audit_krule *rule = audit_mark->rule;
127 	audit_log_untrustedstring(ab, audit_mark->path);
133 void audit_remove_mark(struct audit_fsnotify_mark *audit_mark)
135 	fsnotify_destroy_mark(&audit_mark->mark, audit_fsnotify_group);
136 	fsnotify_put_mark(&audit_mark->mark);
146 static void audit_autoremove_mark_rule(struct audit_fsnotify_mark *audit_mark)
148 	struct audit_krule *rule = audit_mark->rule;
151 	audit_mark_log_rule_change(audit_mark, "autoremove_rule");
160 	struct audit_fsnotify_mark *audit_mark;
162 	audit_mark = container_of(inode_mark, struct audit_fsnotify_mark, mark);
168 		if (audit_compare_dname_path(dname, audit_mark->path, AUDIT_NAME_FULL))
170 		audit_update_mark(audit_mark, inode);
172 		audit_autoremove_mark_rule(audit_mark);