Lines Matching refs:rule
456 /* Determine if any context name data matches a rule's watch data */
461 * filtering a task rule at task creation time. This and tsk == current are
465 struct audit_krule *rule,
476 if (ctx && rule->prio <= ctx->prio)
481 for (i = 0; i < rule->field_count; i++) {
482 struct audit_field *f = &rule->fields[i];
500 result = audit_exe_compare(tsk, rule->exe);
634 result = audit_watch_compare(rule->watch,
643 result = match_tree_refs(ctx, rule->tree);
755 if (rule->filterkey) {
757 ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
759 ctx->prio = rule->prio;
761 switch (rule->action) {
783 if (audit_filter_rules(tsk, &e->rule, NULL, NULL,
786 *key = kstrdup(e->rule.filterkey, GFP_ATOMIC);
795 static int audit_in_mask(const struct audit_krule *rule, unsigned long val)
808 return rule->mask[word] & bit;
835 if (audit_in_mask(&e->rule, op) &&
836 audit_filter_rules(tsk, &e->rule, ctx, name,
2311 for (i = 0; i < e->rule.field_count; i++) {
2312 struct audit_field *f = &e->rule.fields[i];
2317 && e->rule.action == AUDIT_NEVER) {
2429 for (i = 0; i < e->rule.field_count; i++) {
2430 struct audit_field *f = &e->rule.fields[i];
2435 && e->rule.action == AUDIT_NEVER) {