linux-master/kernel/auditsc.c

380 static int audit_field_compare(struct task_struct *tsk,
397 		return audit_compare_uid(audit_get_loginuid(tsk), name, f, ctx);
409 					    audit_get_loginuid(tsk));
418 		return audit_uid_comparator(audit_get_loginuid(tsk), f->op,
421 		return audit_uid_comparator(audit_get_loginuid(tsk), f->op,
424 		return audit_uid_comparator(audit_get_loginuid(tsk), f->op,
461  * filtering a task rule at task creation time.  This and tsk == current are
462  * the only situations where tsk->cred may be accessed without an rcu read lock.
464 static int audit_filter_rules(struct task_struct *tsk,
479 	cred = rcu_dereference_check(tsk->cred, tsk == current || task_creation);
489 			pid = task_tgid_nr(tsk);
495 					ctx->ppid = task_ppid_nr(tsk);
500 			result = audit_exe_compare(tsk, rule->exe);
543 			sessionid = audit_get_sessionid(tsk);
547 			result = audit_comparator(tsk->personality, f->op, f->val);
649 			result = audit_uid_comparator(audit_get_loginuid(tsk),
653 			result = audit_comparator(audit_loginuid_set(tsk), f->op, f->val);
672 					/* @tsk should always be equal to
675 					 * the new @tsk creds are still a dup
747 			result = audit_field_compare(tsk, cred, f, ctx, name);
776 static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)
783 		if (audit_filter_rules(tsk, &e->rule, NULL, NULL,
813  * @tsk: associated task
819  * Run the udit filters specified in @list against @tsk using @ctx,
825 static int __audit_filter_op(struct task_struct *tsk,
836 		    audit_filter_rules(tsk, &e->rule, ctx, name,
847  * @tsk: associated task
850 static void audit_filter_uring(struct task_struct *tsk,
853 	if (auditd_test_task(tsk))
857 	__audit_filter_op(tsk, ctx, &audit_filter_list[AUDIT_FILTER_URING_EXIT],
867 static void audit_filter_syscall(struct task_struct *tsk,
870 	if (auditd_test_task(tsk))
874 	__audit_filter_op(tsk, ctx, &audit_filter_list[AUDIT_FILTER_EXIT],
883 static int audit_filter_inode_name(struct task_struct *tsk,
890 	return __audit_filter_op(tsk, ctx, list, n, ctx->major);
898 void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx)
902 	if (auditd_test_task(tsk))
908 		if (audit_filter_inode_name(tsk, n, ctx))
1048  * @tsk: task
1055 int audit_alloc(struct task_struct *tsk)
1064 	state = audit_filter_task(tsk, &key);
1066 		clear_task_syscall_work(tsk, SYSCALL_AUDIT);
1078 	audit_set_context(tsk, context);
1079 	set_task_syscall_work(tsk, SYSCALL_AUDIT);
1823  * @tsk: task whose audit context block to free
1827 void __audit_free(struct task_struct *tsk)
1829 	struct audit_context *context = tsk->audit_context;
1839 	 * in the former case tsk == current and in the latter tsk is a
1843 	if (tsk == current && !context->dummy) {
1847 			audit_filter_syscall(tsk, context);
1848 			audit_filter_inodes(tsk, context);
1853 			audit_filter_uring(tsk, context);
1854 			audit_filter_inodes(tsk, context);
1860 	audit_set_context(tsk, NULL);